www.bleepingcomputer.com
Open in
urlscan Pro
104.20.59.209
Public Scan
URL:
https://www.bleepingcomputer.com/forums/t/577460/cwindowssystem32userinitexe-malware-infection/
Submission: On September 07 via api from SG
Submission: On September 07 via api from SG
Form analysis 3 forms found in the DOM
POST https://www.bleepingcomputer.com/forums/index.php?app=core&module=search&do=search&fromMainBar=1
<form action="https://www.bleepingcomputer.com/forums/index.php?app=core&module=search&do=search&fromMainBar=1" method="post" id="search-box">
<fieldset>
<label for="main_search" class="hide">Search</label>
<a href="https://www.bleepingcomputer.com/forums/index.php?app=core&module=search&search_in=forums" title="Advanced Search" accesskey="4" rel="search" id="adv_search" class="right">Advanced</a>
<span id="search_wrap" class="right">
<input type="text" id="main_search" name="search_term" class="" size="17" tabindex="100" placeholder="Search...">
<span class="choice ipbmenu clickable" id="search_options" style="">This topic</span>
<ul id="search_options_menucontent" class="ipbmenu_content ipsPad" style="display: none; position: absolute; z-index: 9999;">
<li class="title" style="z-index: 10000;"><strong style="z-index: 10000;">Search section:</strong></li>
<li class="special" style="z-index: 10000;">
<label for="s_topic" title="This topic" style="z-index: 10000;">
<input type="radio" name="search_app" value="forums:topic:577460" class="input_radio" id="s_topic" checked="checked" style="z-index: 10000;"><strong style="z-index: 10000;">This topic</strong>
</label>
</li>
<li class="app" style="z-index: 10000;"><label for="s_forums" title="Forums" style="z-index: 10000;"><input type="radio" name="search_app" class="input_radio" id="s_forums" value="forums" style="z-index: 10000;">Forums</label></li>
<li class="app" style="z-index: 10000;"><label for="s_members" title="Members" style="z-index: 10000;"><input type="radio" name="search_app" class="input_radio" id="s_members" value="members" style="z-index: 10000;">Members</label></li>
<li class="app" style="z-index: 10000;"><label for="s_core" title="Help Files" style="z-index: 10000;"><input type="radio" name="search_app" class="input_radio" id="s_core" value="core" style="z-index: 10000;">Help Files</label></li>
<li class="app" style="z-index: 10000;">
<label for="s_calendar" title="Calendar" style="z-index: 10000;">
<input type="radio" name="search_app" class="input_radio" id="s_calendar" value="calendar" style="z-index: 10000;">Calendar </label>
</li>
</ul>
<input aria-label="Search the forum" type="submit" class="submit_input clickable" value="">
</span>
</fieldset>
</form>POST https://www.bleepingcomputer.com/forums/index.php?
<form id="modform" method="post" action="https://www.bleepingcomputer.com/forums/index.php?">
<input type="hidden" name="app" value="forums">
<input type="hidden" name="module" value="moderate">
<input type="hidden" name="section" value="moderate">
<input type="hidden" name="do" value="postchoice">
<input type="hidden" name="f" value="22">
<input type="hidden" name="t" value="577460">
<input type="hidden" name="auth_key" value="880ea6a14ea49e853634fbdc5015a024">
<input type="hidden" name="st" value="">
<input type="hidden" name="page" value="">
<input type="hidden" value="" name="selectedpidsJS" id="selectedpidsJS">
<input type="hidden" name="tact" id="tact" value="">
</form>POST https://www.bleepingcomputer.com/forums/index.php?app=core&module=global§ion=login&do=process
<form action="https://www.bleepingcomputer.com/forums/index.php?app=core&module=global&section=login&do=process" method="post" id="login">
<input type="hidden" name="auth_key" value="880ea6a14ea49e853634fbdc5015a024">
<input type="hidden" name="referer" value="https://www.bleepingcomputer.com/forums/t/577460/cwindowssystem32userinitexe-malware-infection/">
<h3>Sign In</h3>
<div class="ipsBox_notice">
<ul class="ipsList_inline">
<li>
<a href="https://www.bleepingcomputer.com/forums/index.php?app=core&module=global&section=login&serviceClick=twitter" class="ipsButton_secondary"><img src="https://www.bleepingcomputer.com/forums/public/style_images/master/loginmethods/twitter.png" alt="Twitter"> Use Twitter</a>
</li>
</ul>
</div>
<br>
<div class="ipsForm ipsForm_horizontal">
<fieldset>
<ul>
<li class="ipsField">
<div class="ipsField_content"> Need an account? <a href="https://www.bleepingcomputer.com/forums/index.php?app=core&module=global&section=register" title="Register now!">Register now!</a>
</div>
</li>
<li class="ipsField ipsField_primary">
<label for="ips_username" class="ipsField_title">Username</label>
<div class="ipsField_content">
<input id="ips_username" type="text" class="input_text" name="ips_username" size="30" tabindex="0">
</div>
</li>
<li class="ipsField ipsField_primary">
<label for="ips_password" class="ipsField_title">Forum Password</label>
<div class="ipsField_content">
<input id="ips_password" type="password" class="input_text" name="ips_password" size="30" tabindex="0"><br>
<a href="https://www.bleepingcomputer.com/forums/index.php?app=core&module=global&section=lostpass" title="Retrieve password">I've forgotten my password</a>
</div>
</li>
<li class="ipsField ipsField_checkbox">
<input type="checkbox" id="inline_remember" checked="checked" name="rememberMe" value="1" class="input_check" tabindex="0">
<div class="ipsField_content">
<label for="inline_remember">
<strong>Remember me</strong><br>
<span class="desc lighter">This is not recommended for shared computers</span>
</label>
</div>
</li>
<li class="ipsField ipsField_checkbox">
<input type="checkbox" id="inline_invisible" name="anonymous" value="1" class="input_check" tabindex="0">
<div class="ipsField_content">
<label for="inline_invisible">
<strong>Sign in anonymously</strong><br>
<span class="desc lighter">Don't add me to the active users list</span>
</label>
</div>
</li>
<li class="ipsPad_top ipsForm_center desc ipsType_smaller">
<a rel="nofollow" href="https://www.bleepingcomputer.com/forums/privacypolicy/">Privacy Policy</a>
</li>
</ul>
</fieldset>
<div class="ipsForm_submit ipsForm_center">
<input type="submit" class="ipsButton" value="Sign In" tabindex="0">
</div>
</div>
</form>Text Content
* Sign In
* Create Account
Search Advanced This topic
* Search section:
* This topic
* Forums
* Members
* Help Files
* Calendar
*
* View New Content
* Forum Rules
* BleepingComputer.com
* Forums
* Members
* Tutorials
* Startup List
* Virus Removal
* Downloads
* Uninstall List
* Welcome Guide
* More
1. BleepingComputer.com
2. → Security
3. → Virus, Trojan, Spyware, and Malware Removal Help
Javascript Disabled Detected
You currently have javascript disabled. Several functions may not work. Please
re-enable javascript to access full functionality.
Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come
together to discuss and learn how to use their computers. Using the site is easy
and fun. As a guest, you can browse and view the various discussions in the
forums, but can not create a new topic or reply to an existing one unless you
are logged in. Other benefits of registering an account are subscribing to
topics and forums, creating a blog, and having no ads shown anywhere on the
site.
Click here to Register a free account now! or read our Welcome Guide to learn
how to use this site.
Latest News: New Chainsaw tool helps IR teams analyze Windows event logs
Featured Deal: Get a complete IT education with this CompTIA training for just
$15
C:\WINDOWS\SYSTEM32\USERINIT.EXE MALWARE INFECTION
Started by User1412 , May 27 2015 02:27 AM
* This topic is locked
12 replies to this topic
#1 USER1412
User1412
*
* Members
* 23 posts
* OFFLINE
* Local time:01:44 PM
Posted 27 May 2015 - 02:27 AM
I'm using laptop with Windows 8.1 Pro. Recently, i ran Malwarebytes to scan and
check my computer for infections and I found this, please find it in
attachments.
There's thing with HKLM\SOFTWARE\MICROSOFT\WINDOWS
NT\CURRENTVERSION\WINLOGON|Userinit,
C:\Windows\system32\userinit.exe,C:\Windows\taskhost.exe /boot, if i remove it,
will it cause damage to my system?
Need help.
ATTACHED FILES
* Malware-scan-27052015.txt 1.81KB 6 downloads
* Back to top
--------------------------------------------------------------------------------
BC ADBOT (LOGIN TO REMOVE)
*
* BleepingComputer.com
*
* Register to remove ads
PLAY Top Articles Video Settings Full Screen About Connatix V128743 Read More
Read More Read More Read More Read More Read More TrickBot gang developer
arrested when trying toleave Korea 1/1 Skip Ad Continue watching after the ad
Visit Advertiser website GO TO PAGE
--------------------------------------------------------------------------------
#2 XXTOFFEEXX
xXToffeeXx
Bleepin' Polar Bear
*
* Malware Response Instructor
* 6,088 posts
* OFFLINE
* Gender:Female
* Location:The Arctic Circle
* Local time:03:44 AM
Posted 27 May 2015 - 05:03 AM
Greetings and to BleepingComputer,
My name is xXToffeeXx, but feel free to call me Toffee if it is easier for you.
I will be helping you with your malware problems.
A few points to cover before we start:
* Do not run any tools without being instructed to as this makes my job much
harder in trying to figure out what you have done.
* Make sure to read my instructions fully before attempting a step.
* If you have problems or questions with any of the steps, feel free to ask me.
I will be happy to answer any questions you have.
* Please follow the topic by clicking on the "Follow this topic" button, and
make sure a tick is in the "receive notifications" and is set to "Instantly".
Any replies should be made in this topic by clicking the "Reply to this
topic" button.
* Important information in my posts will often be in bold, make sure to take
note of these.
* I will attempt to reply as soon as possible, and normally within 24 hours of
your reply. If this is not possible or I have a delay then I will let you
know.
* I will bump a topic after 3 days of no activity, and then will give you
another 2 days to reply before a topic is closed. If you need more time than
this please let me know.
* Let's get going now
==========================
Hi User1412,
You should be able to delete it fine, yes.
Please download Farbar Recovery Scan Tool and save it to your Desktop.
Note: You need to run the version compatible with your system. If you are not
sure which version applies to your system, download both of them and try to run
them. Only one of them will run on your system, that will be the right version.
* Right-click FRST then click "Run as administrator" (XP users: click run after
receipt of Windows Security Warning - Open File).
* When the tool opens, click Yes to disclaimer.
* Press the Scan button.
* When finished, it will produce a log called FRST.txt in the same directory
the tool was run from.
* Please copy and paste the log in your next reply.
Note 2: The first time the tool is run it generates another log (Addition.txt -
also located in the same directory the tool was run from). Please also paste
that, along with the FRST.txt into your next reply.
--------------
To recap, in your next reply I would like to see the following. Make sure to
copy & paste them unless I ask otherwise:
* FRST.txt
* Addition.txt
xXToffeeXx~
~If I am helping you and you have not had a reply from me in two days, please
send me a PM~
ID Ransomware - Identify What Ransomware Encrypted Your Files [Support Topic] -
If we have helped you out and you want to support what we do, you can do so here
~Twitter~ | ~Malware Analyst at Emsisoft~
* Back to top
--------------------------------------------------------------------------------
#3 USER1412
User1412
* Topic Starter
*
* Members
* 23 posts
* OFFLINE
* Local time:01:44 PM
Posted 27 May 2015 - 09:15 AM
Good day Toffee
Here are your requested log:
FRST.txt
Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 27-05-2015
Ran by Duc Hong (administrator) on HONGHOANGPC on 28-05-2015 00:08:58
Running from C:\Users\Duc Hong\Downloads\Programs
Loaded Profiles: Duc Hong (Available Profiles: Duc Hong)
Platform: Windows 8.1 Pro with Media Center (X64) OS Language: English (United
States)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool:
http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file
will not be moved.)
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK
Hotkey\AsLdrSrv.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe
(Avast Software s.r.o.) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device
Support\AppleMobileDeviceService.exe
(Hanwang Technology Co.,Ltd. ) C:\Program Files\ASUS\ASUS
FaceID\HWFaceKeyService.exe
(ASUS Cloud Corporation) C:\Program Files
(x86)\ASUS\WebStorage\2.1.2.301\AsusWSWinService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Microsoft Corporation) C:\Program Files
(x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe
(Microsoft Corporation) C:\Program Files
(x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\GeForce Experience
Service\GfExperienceService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\ibtsiva.exe
(Intel® Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA
Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA
Corporation\NvStreamSrv\nvstreamsvc.exe
(Intel® Corporation) C:\Program Files\Common
Files\Intel\WirelessCommon\RegSrvc.exe
(SoftEther VPN Project at University of Tsukuba, Japan.) C:\Program
Files\SoftEther VPN Client\vpnclient_x64.exe
(VMware, Inc.) C:\Windows\SysWOW64\vmnat.exe
(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe
(VMware, Inc.) C:\Program Files (x86)\VMware\VMware Player\vmware-authd.exe
(VMware, Inc.) C:\Windows\SysWOW64\vmnetdhcp.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft
shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
(Motorola Solutions, Inc.) C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe
(Motorola Solutions, Inc.) C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine
Components\FWService\IntelMeFWService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine
Components\DAL\jhi_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine
Components\LMS\LMS.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK
Hotkey\HControl.exe
(Microsoft) C:\Windows\taskhost.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK
Hotkey\KBFiltr.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\Splendid\ColorUService.exe
(ASUSTek Computer Inc.) C:\Program Files\ASUS\ASUS Console\ASUS Console
Starter.exe
(ASUS) C:\Program Files (x86)\ASUS\Splendid\ACMON.exe
(Microsoft Corporation) C:\Windows\System32\InputMethod\JPN\JpnIME.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK
Media\DMedia.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK
Package\ATKOSD2\ATKOSD2.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update
Core\NvBackend.exe
(AsusTek) C:\Program Files (x86)\ASUS\ASUS Smart
Gesture\AsTPCenter\x64\AsusTPLoader.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(SoftEther VPN Project at University of Tsukuba, Japan.) C:\Program
Files\SoftEther VPN Client\vpnclient_x64.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Tonec Inc.) C:\Program Files (x86)\Internet Download Manager\IDMan.exe
(© 2015 Microsoft Corporation) C:\Users\Duc
Hong\AppData\Local\Microsoft\BingSvc\BingSvc.exe
(Microsoft Corporation) C:\Windows\System32\StikyNot.exe
() C:\Program Files\Rainmeter\Rainmeter.exe
(Internet Download Manager, Tonec Inc.) C:\Program Files (x86)\Internet Download
Manager\IDMIntegrator64.exe
(Tonec Inc.) C:\Program Files (x86)\Internet Download Manager\IEMonitor.exe
(Avast Software s.r.o.) C:\Program Files\AVAST Software\Avast\avastui.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(AsusTek) C:\Program Files (x86)\ASUS\ASUS Smart
Gesture\AsTPCenter\x64\AsusTPHelper.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\ASUS Live
Update\LiveUpdate.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA
Corporation\NvStreamSrv\NvStreamNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA
Corporation\NvStreamSrv\nvstreamsvc.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(AsusTek) C:\Program Files (x86)\ASUS\ASUS Smart
Gesture\AsTPCenter\x64\AsusTPCenter.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to
default or removed. The file will not be moved.)
HKLM\...\Run: [SoftEther VPN Client UI Helper] => C:\Program Files\SoftEther VPN
Client\vpnclient_x64.exe [4374072 2015-01-21] (SoftEther VPN Project at
University of Tsukuba, Japan.)
HKLM\...\Run: [BTMTrayAgent] => rundll32.exe "C:\Program Files
(x86)\Intel\Bluetooth\btmshellex.dll",TrayApp
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update
Core\NvBackend.exe [2685072 2015-05-02] (NVIDIA Corporation)
HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe
C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart
HKLM-x32\...\Run: [ASUSPRP] => C:\Program Files (x86)\ASUS\APRP\APRP.EXE
[1080992 2014-05-17] (ASUSTek Computer Inc.)
HKLM-x32\...\Run: [WebStorage] => C:\Program Files
(x86)\ASUS\WebStorage\2.1.2.301\ASUSWSLoader.exe [63296 2014-02-25] ()
HKLM-x32\...\Run: [ASUS InstantKey] => C:\Program Files (x86)\ASUS\ASUS Instant
Key\Ikey_start.exe [14448 2014-01-29] (ASUS)
HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST
Software\Avast\AvastUI.exe [5515496 2015-05-13] (Avast Software s.r.o.)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common
Files\Java\Java Update\jusched.exe [334896 2015-04-30] (Oracle Corporation)
HKLM\...\Winlogon: [Userinit]
C:\Windows\system32\userinit.exe,C:\Windows\taskhost.exe /boot
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-1926068397-2398490202-140176465-1002\...\Run: [Google Update] =>
C:\Users\Duc Hong\AppData\Local\Google\Update\GoogleUpdate.exe [107848
2015-04-17] (Google Inc.)
HKU\S-1-5-21-1926068397-2398490202-140176465-1002\...\Run: [IDM Helper] =>
C:\Program Files (x86)\Internet Download Manager\IDMGrHlp.exe [513560
2015-02-04] (Tonec Inc.)
HKU\S-1-5-21-1926068397-2398490202-140176465-1002\...\Run: [IDMan] => C:\Program
Files (x86)\Internet Download Manager\IDMan.exe [3903056 2015-05-20] (Tonec
Inc.)
HKU\S-1-5-21-1926068397-2398490202-140176465-1002\...\Run: [BingSvc] =>
C:\Users\Duc Hong\AppData\Local\Microsoft\BingSvc\BingSvc.exe [144008
2015-04-07] (© 2015 Microsoft Corporation)
HKU\S-1-5-21-1926068397-2398490202-140176465-1002\...\Run:
[RESTART_STICKY_NOTES] => C:\Windows\System32\StikyNot.exe [479744 2014-10-29]
(Microsoft Corporation)
HKU\S-1-5-21-1926068397-2398490202-140176465-1002\...\Policies\Explorer:
[NoLowDiskSpaceChecks] 1
HKU\S-1-5-21-1926068397-2398490202-140176465-1002\...\Policies\Explorer:
[LinkResolveIgnoreLinkInfo] 1
HKU\S-1-5-21-1926068397-2398490202-140176465-1002\...\Policies\Explorer:
[NoResolveSearch] 1
HKU\S-1-5-21-1926068397-2398490202-140176465-1002\...\Policies\Explorer:
[NoInternetOpenWith] 1
HKU\S-1-5-21-1926068397-2398490202-140176465-1002\Control
Panel\Desktop\\SCRNSAVE.EXE ->
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\SoftEther
VPN Client Manager Startup.lnk [2015-01-21]
ShortcutTarget: SoftEther VPN Client Manager Startup.lnk -> C:\Program
Files\SoftEther VPN Client\vpncmgr_x64.exe (SoftEther VPN Project at University
of Tsukuba, Japan.)
Startup: C:\Users\Duc Hong\AppData\Roaming\Microsoft\Windows\Start
Menu\Programs\Startup\Rainmeter.lnk [2015-01-07]
ShortcutTarget: Rainmeter.lnk -> C:\Program Files\Rainmeter\Rainmeter.exe ()
ShellIconOverlayIdentifiers: [!AsusWSShellExt_B] ->
{6D4133E5-0742-4ADC-8A8C-9303440F7191} => C:\Program Files (x86)\Common
Files\AWS\2.1.2.301\ASUSWSShellExt64.dll [2013-06-26] (ASUS Cloud Corporation.)
ShellIconOverlayIdentifiers: [!AsusWSShellExt_O] ->
{64174815-8D98-4CE6-8646-4C039977D809} => C:\Program Files (x86)\Common
Files\AWS\2.1.2.301\ASUSWSShellExt64.dll [2013-06-26] (ASUS Cloud Corporation.)
ShellIconOverlayIdentifiers: [!AsusWSShellExt_U] ->
{1C5AB7B1-0B38-4EC4-9093-7FD277E2AF4E} => C:\Program Files (x86)\Common
Files\AWS\2.1.2.301\ASUSWSShellExt64.dll [2013-06-26] (ASUS Cloud Corporation.)
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24}
=> C:\Program Files\AVAST Software\Avast\ashShA64.dll [2015-05-01] (Avast
Software s.r.o.)
ShellIconOverlayIdentifiers: [IDM Shell Extension] ->
{CDC95B92-E27C-4745-A8C5-64A52A78855D} => C:\Program Files (x86)\Internet
Download Manager\IDMShellExt64.dll [2014-04-21] (Tonec Inc.)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be
removed or restored to default.)
HKU\S-1-5-21-1926068397-2398490202-140176465-1002\Software\Microsoft\Internet
Explorer\Main,Start Page =
HKU\S-1-5-21-1926068397-2398490202-140176465-1002\Software\Microsoft\Internet
Explorer\Main,Default_Page_URL = http://asus13.msn.com/?pc=ASJB
HKU\S-1-5-21-1926068397-2398490202-140176465-1002\Software\Microsoft\Internet
Explorer\Main,Start Page Redirect Cache = http://www.msn.com/en-au/?ocid=iehp
SearchScopes: HKU\S-1-5-21-1926068397-2398490202-140176465-1002 -> DefaultScope
{0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-1926068397-2398490202-140176465-1002 ->
{0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO: IDM integration (IDMIEHlprObj Class) ->
{0055C089-8582-441B-A0BF-17B458C2A3A8} -> C:\Program Files (x86)\Internet
Download Manager\IDMIECC64.dll [2015-05-20] (Internet Download Manager, Tonec
Inc.)
BHO: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} ->
C:\Program Files\Java\jre1.8.0_45\bin\ssv.dll [2015-05-27] (Oracle Corporation)
BHO: Skype Click to Call for Internet Explorer ->
{AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files
(x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2014-07-14]
(Microsoft Corporation)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} ->
C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft
Corporation)
BHO: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} ->
C:\Program Files\Java\jre1.8.0_45\bin\jp2ssv.dll [2015-05-27] (Oracle
Corporation)
BHO-x32: ATLAS Toolbar -> {3C6301ED-0F78-4AF2-8150-D9C052361A8E} -> C:\Program
Files (x86)\ATLAS V14\ATLIECP.DLL [2011-07-06] (FUJITSU LIMITED)
BHO-x32: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} ->
C:\Program Files (x86)\Java\jre1.8.0_45\bin\ssv.dll [2015-05-27] (Oracle
Corporation)
BHO-x32: Skype Click to Call for Internet Explorer ->
{AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files
(x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2014-07-14] (Microsoft
Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF}
-> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06]
(Microsoft Corporation)
BHO-x32: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} ->
C:\Program Files (x86)\Java\jre1.8.0_45\bin\jp2ssv.dll [2015-05-27] (Oracle
Corporation)
Toolbar: HKLM-x32 - ATLAS Toolbar - {3C6301ED-0F78-4AF2-8150-D9C052361A8E} -
C:\Program Files (x86)\ATLAS V14\ATLIECP.DLL [2011-07-06] (FUJITSU LIMITED)
Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files
(x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2014-07-14]
(Microsoft Corporation)
Handler-x32: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program
Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2014-07-14]
(Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 172.20.10.1
FireFox:
========
FF ProfilePath: C:\Users\Duc
Hong\AppData\Roaming\Mozilla\Firefox\Profiles\62c9k4xd.default-1422598942125
FF Homepage: www.google.com.au
FF Plugin: @adobe.com/FlashPlayer ->
C:\Windows\system32\Macromed\Flash\NPSWF64_16_0_0_235.dll [2015-01-12] ()
FF Plugin: @java.com/DTPlugin,version=11.45.2 -> C:\Program
Files\Java\jre1.8.0_45\bin\dtplugin\npDeployJava1.dll [2015-05-27] (Oracle
Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.45.2 -> C:\Program
Files\Java\jre1.8.0_45\bin\plugin2\npjp2.dll [2015-05-27] (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft
Silverlight\5.1.40416.0\npctrl.dll [2015-04-16] ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 ->
C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer ->
C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_235.dll [2015-01-12] ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files
(x86)\iTunes\Mozilla Plugins\npitunes.dll [2014-10-30] ()
FF Plugin-x32: @foxitsoftware.com/Foxit PhantomPDF
Plugin,version=1.0,application/pdf -> C:\Program Files (x86)\Foxit
Software\Foxit PhantomPDF\plugins\npFoxitPhantomPDFPlugin.dll [2014-10-20]
(Foxit Corporation)
FF Plugin-x32: @foxitsoftware.com/Foxit PhantomPDF
Plugin,version=1.0,application/vnd.fdf -> C:\Program Files (x86)\Foxit
Software\Foxit PhantomPDF\plugins\npFoxitPhantomPDFPlugin.dll [2014-10-20]
(Foxit Corporation)
FF Plugin-x32: @foxitsoftware.com/Foxit PhantomPDF
Plugin,version=1.0,application/vnd.xdp -> C:\Program Files (x86)\Foxit
Software\Foxit PhantomPDF\plugins\npFoxitPhantomPDFPlugin.dll [2014-10-20]
(Foxit Corporation)
FF Plugin-x32: @foxitsoftware.com/Foxit PhantomPDF
Plugin,version=1.0,application/vnd.xfdf -> C:\Program Files (x86)\Foxit
Software\Foxit PhantomPDF\plugins\npFoxitPhantomPDFPlugin.dll [2014-10-20]
(Foxit Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5 ->
C:\Program Files (x86)\Intel\Intel® Management Engine
Components\IPT\npIntelWebAPIIPT.dll [2013-09-04] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files
(x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIUpdater.dll
[2013-09-04] (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=11.45.2 -> C:\Program Files
(x86)\Java\jre1.8.0_45\bin\dtplugin\npDeployJava1.dll [2015-05-27] (Oracle
Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.45.2 -> C:\Program Files
(x86)\Java\jre1.8.0_45\bin\plugin2\npjp2.dll [2015-05-27] (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files
(x86)\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-15] ( Microsoft
Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 ->
C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 ->
C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files
(x86)\Windows Live\Photo Gallery\NPWLPG.dll [2014-03-31] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files
(x86)\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-05-16] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files
(x86)\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-05-16] (Google Inc.)
FF Plugin HKU\S-1-5-21-1926068397-2398490202-140176465-1002:
@talk.google.com/GoogleTalkPlugin -> C:\Users\Duc
Hong\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll [2015-04-17] (Google)
FF Plugin HKU\S-1-5-21-1926068397-2398490202-140176465-1002:
@talk.google.com/O1DPlugin -> C:\Users\Duc
Hong\AppData\Roaming\Mozilla\plugins\npo1d.dll [2015-04-17] (Google)
FF Plugin HKU\S-1-5-21-1926068397-2398490202-140176465-1002:
@tools.google.com/Google Update;version=3 -> C:\Users\Duc
Hong\AppData\Local\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-05-16]
(Google Inc.)
FF Plugin HKU\S-1-5-21-1926068397-2398490202-140176465-1002:
@tools.google.com/Google Update;version=9 -> C:\Users\Duc
Hong\AppData\Local\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-05-16]
(Google Inc.)
FF Plugin HKU\S-1-5-21-1926068397-2398490202-140176465-1002:
@unity3d.com/UnityPlayer,version=1.0 -> C:\Users\Duc
Hong\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll [2015-05-12] (Unity
Technologies ApS)
FF Plugin ProgramFiles/Appdata: C:\Users\Duc
Hong\AppData\Roaming\mozilla\plugins\npgoogletalk.dll [2015-04-17] (Google)
FF Plugin ProgramFiles/Appdata: C:\Users\Duc
Hong\AppData\Roaming\mozilla\plugins\npo1d.dll [2015-04-17] (Google)
FF Extension: FT DeepDark - C:\Users\Duc
Hong\AppData\Roaming\Mozilla\Firefox\Profiles\62c9k4xd.default-1422598942125\Extensions\{77d2ed30-4cd2-11e0-b8af-0800200c9a66}
[2015-04-15]
FF Extension: Ank Pixiv Tool - C:\Users\Duc
Hong\AppData\Roaming\Mozilla\Firefox\Profiles\62c9k4xd.default-1422598942125\Extensions\ankpixiv@snca.net.xpi
[2015-01-30]
FF Extension: MEGA - C:\Users\Duc
Hong\AppData\Roaming\Mozilla\Firefox\Profiles\62c9k4xd.default-1422598942125\Extensions\firefox@mega.co.nz.xpi
[2015-01-30]
FF Extension: NicoFox - C:\Users\Duc
Hong\AppData\Roaming\Mozilla\Firefox\Profiles\62c9k4xd.default-1422598942125\Extensions\nicofox@littlebtc.xpi
[2015-01-30]
FF Extension: Restart Button - C:\Users\Duc
Hong\AppData\Roaming\Mozilla\Firefox\Profiles\62c9k4xd.default-1422598942125\Extensions\restartbutton@strk.jp.xpi
[2015-01-30]
FF Extension: Stylish - C:\Users\Duc
Hong\AppData\Roaming\Mozilla\Firefox\Profiles\62c9k4xd.default-1422598942125\Extensions\{46551EC9-40F0-4e47-8E18-8E5CF550CFB8}.xpi
[2015-01-30]
FF Extension: Download Status Bar - C:\Users\Duc
Hong\AppData\Roaming\Mozilla\Firefox\Profiles\62c9k4xd.default-1422598942125\Extensions\{6c28e999-e900-4635-a39d-b1ec90ba0c0f}.xpi
[2015-01-30]
FF Extension: Search by Image for Google - C:\Users\Duc
Hong\AppData\Roaming\Mozilla\Firefox\Profiles\62c9k4xd.default-1422598942125\Extensions\{ab4b5718-3998-4a2c-91ae-18a7c2db513e}.xpi
[2015-01-30]
FF Extension: Adblock Plus - C:\Users\Duc
Hong\AppData\Roaming\Mozilla\Firefox\Profiles\62c9k4xd.default-1422598942125\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
[2015-01-30]
FF Extension: Greasemonkey - C:\Users\Duc
Hong\AppData\Roaming\Mozilla\Firefox\Profiles\62c9k4xd.default-1422598942125\Extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}.xpi
[2015-01-30]
FF Extension: YouTube Flash Video Player - C:\Users\Duc
Hong\AppData\Roaming\Mozilla\Firefox\Profiles\62c9k4xd.default-1422598942125\Extensions\{f3bd3dd2-2888-44c5-91a2-2caeb33fb898}.xpi
[2015-05-05]
FF Extension: No Name - C:\Program Files (x86)\Mozilla
Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi
[2015-05-18]
FF HKU\S-1-5-21-1926068397-2398490202-140176465-1002\...\Firefox\Extensions:
[mozilla_cc@internetdownloadmanager.com] - C:\Users\Duc
Hong\AppData\Roaming\IDM\idmmzcc5
FF Extension: IDM CC - C:\Users\Duc Hong\AppData\Roaming\IDM\idmmzcc5
[2015-05-27]
FF HKU\S-1-5-21-1926068397-2398490202-140176465-1002\...\SeaMonkey\Extensions:
[mozilla_cc@internetdownloadmanager.com] - C:\Users\Duc
Hong\AppData\Roaming\IDM\idmmzcc5
Chrome:
=======
CHR Profile: C:\Users\Duc Hong\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Docs) - C:\Users\Duc
Hong\AppData\Local\Google\Chrome\User
Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-01-08]
CHR Extension: (Google Drive) - C:\Users\Duc
Hong\AppData\Local\Google\Chrome\User
Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-01-08]
CHR Extension: (YouTube) - C:\Users\Duc Hong\AppData\Local\Google\Chrome\User
Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-01-08]
CHR Extension: (Bing) - C:\Users\Duc Hong\AppData\Local\Google\Chrome\User
Data\Default\Extensions\bmkckgpgekmanipelfidlhmkfcjicion [2015-05-27]
CHR Extension: (Adblock Plus) - C:\Users\Duc
Hong\AppData\Local\Google\Chrome\User
Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2015-03-25]
CHR Extension: (Google Search) - C:\Users\Duc
Hong\AppData\Local\Google\Chrome\User
Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-01-08]
CHR Extension: (Bookmark Manager) - C:\Users\Duc
Hong\AppData\Local\Google\Chrome\User
Data\Default\Extensions\gmlllbghnfkpflemihljekbapjopfjik [2015-04-24]
CHR Extension: (Chrome Hotword Shared Module) - C:\Users\Duc
Hong\AppData\Local\Google\Chrome\User
Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-03-18]
CHR Extension: (Skype Click to Call) - C:\Users\Duc
Hong\AppData\Local\Google\Chrome\User
Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl [2015-05-27]
CHR Extension: (IDM Integration Module) - C:\Users\Duc
Hong\AppData\Local\Google\Chrome\User
Data\Default\Extensions\ngpampappnmepgilojfohadhhmbhlaek [2015-04-24]
CHR Extension: (Google Wallet) - C:\Users\Duc
Hong\AppData\Local\Google\Chrome\User
Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-01-08]
CHR Extension: (Gmail) - C:\Users\Duc Hong\AppData\Local\Google\Chrome\User
Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-01-08]
CHR HKLM\...\Chrome\Extension: [ngpampappnmepgilojfohadhhmbhlaek] - C:\Program
Files (x86)\Internet Download Manager\IDMGCExt.crx [2015-05-20]
CHR
HKU\S-1-5-21-1926068397-2398490202-140176465-1002\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension:
[bmkckgpgekmanipelfidlhmkfcjicion] -
https://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] -
C:\Program Files (x86)\Skype\Toolbars\ChromeExtension\skype_chrome_extension.crx
[2014-07-14]
CHR HKLM-x32\...\Chrome\Extension: [ngpampappnmepgilojfohadhhmbhlaek] -
C:\Program Files (x86)\Internet Download Manager\IDMGCExt.crx [2015-05-20]
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, it will be removed from the registry.
The file will not be moved unless listed separately.)
R2 ASUS FaceID Service; C:\Program Files\ASUS\ASUS FaceID\HWFaceKeyService.exe
[261648 2013-10-25] (Hanwang Technology Co.,Ltd. )
R2 Asus WebStorage Windows Service; C:\Program Files
(x86)\ASUS\WebStorage\2.1.2.301\AsusWSWinService.exe [71680 2014-02-25] (ASUS
Cloud Corporation) [File not signed]
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [343336
2015-05-01] (Avast Software s.r.o.)
S3 BthHFSrv; C:\Windows\System32\BthHFSrv.dll [324608 2014-10-29] (Microsoft
Corporation)
R2 c2cautoupdatesvc; C:\Program Files
(x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1390176 2014-07-14]
(Microsoft Corporation)
R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe
[1767520 2014-07-14] (Microsoft Corporation)
R2 DiagTrack; C:\Windows\system32\diagtrack.dll [1429504 2015-03-05] (Microsoft
Corporation)
R2 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience
Service\GfExperienceService.exe [1152656 2015-05-02] (NVIDIA Corporation)
R2 iBtSiva; C:\Program Files (x86)\Intel\Bluetooth\ibtsiva.exe [125168
2014-12-04] (Intel Corporation)
R2 Intel® Capability Licensing Service Interface; C:\Program Files\Intel\iCLS
Client\HeciServer.exe [733696 2013-05-12] (Intel® Corporation) [File not signed]
S3 Intel® Capability Licensing Service TCP IP Interface; C:\Program
Files\Intel\iCLS Client\SocketHeciServer.exe [822232 2013-05-12] (Intel®
Corporation)
R2 Intel® ME Service; C:\Program Files (x86)\Intel\Intel® Management Engine
Components\FWService\IntelMeFWService.exe [131544 2013-09-04] (Intel
Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel® Management Engine
Components\DAL\jhi_service.exe [169432 2013-09-04] (Intel Corporation)
S2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe
[1080120 2015-04-14] (Malwarebytes Corporation)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [268192
2014-12-04] ()
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA
Corporation\NetService\NvNetworkService.exe [1884304 2015-05-02] (NVIDIA
Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
[22997648 2015-05-02] (NVIDIA Corporation)
S3 rpcapd; C:\Program Files (x86)\WinPcap\rpcapd.exe [118520 2013-03-01]
(Riverbed Technology, Inc.)
R2 SEVPNCLIENT; C:\Program Files\SoftEther VPN Client\vpnclient_x64.exe [4374072
2015-01-21] (SoftEther VPN Project at University of Tsukuba, Japan.)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [366520 2015-02-04]
(Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2015-02-04]
(Microsoft Corporation)
R2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe
[3820960 2014-12-04] (Intel® Corporation)
S3 AvastVBoxSvc; C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe
[X]
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, it will be removed from the registry.
The file will not be moved unless listed separately.)
R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29168 2015-05-01] ()
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [89944 2015-05-01]
(Avast Software s.r.o.)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93528 2015-05-01] (Avast
Software s.r.o.)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65736 2015-05-01] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1047320 2015-05-01] (Avast
Software s.r.o.)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [442264 2015-05-01] (Avast
Software s.r.o.)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [137288 2015-05-01] (Avast
Software s.r.o.)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [272248 2015-05-01] ()
R3 ATP; C:\Windows\System32\drivers\AsusTP.sys [70928 2014-02-14] (ASUS
Corporation)
S3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [226304 2014-03-18]
(Microsoft Corporation)
S3 btmaux; C:\Windows\system32\DRIVERS\btmaux.sys [141624 2014-10-28] (Motorola
Solutions, Inc.)
R3 btmhsf; C:\Windows\system32\DRIVERS\btmhsf.sys [1448248 2014-11-26] (Motorola
Solutions, Inc.)
S3 DrvAgent64; C:\Windows\SysWOW64\Drivers\DrvAgent64.SYS [13824 2015-05-17]
(Phoenix Technologies) [File not signed]
R1 dtsoftbus01; C:\Windows\System32\drivers\dtsoftbus01.sys [283064 2015-01-08]
(Disc Soft Ltd)
R3 ibtusb; C:\Windows\system32\DRIVERS\ibtusb.sys [230128 2014-12-04] (Intel
Corporation)
R3 kbfiltr; C:\Windows\System32\drivers\kbfiltr.sys [17280 2012-08-06] ( )
S3 ManyCam; C:\Windows\system32\DRIVERS\mcvidrv.sys [49272 2014-12-29] (Visicom
Media Inc.)
S3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-04-14]
(Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [64216 2015-04-14]
(Malwarebytes Corporation)
S3 mcaudrv_simple; C:\Windows\system32\drivers\mcaudrv_x64.sys [35960
2014-12-29] (Visicom Media Inc.)
R3 MEIx64; C:\Windows\system32\DRIVERS\TeeDriverx64.sys [99288 2013-09-04]
(Intel Corporation)
R3 Neo_VPN2; C:\Windows\system32\DRIVERS\Neo_VPN2.sys [28768 2015-01-14]
(SoftEther VPN Project at University of Tsukuba, Japan.)
R3 NETwNb64; C:\Windows\system32\DRIVERS\Netwbw02.sys [3494680 2014-12-08]
(Intel Corporation)
S3 NETwNe64; C:\Windows\system32\DRIVERS\NETwew02.sys [4649440 2013-06-19]
(Intel Corporation)
R2 NPF; C:\Windows\System32\drivers\npf.sys [36600 2013-03-01] (Riverbed
Technology, Inc.)
R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys
[19600 2015-05-02] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\Windows\system32\drivers\nvvad64v.sys [38032
2014-11-22] (NVIDIA Corporation)
R2 plctrl; C:\Program Files\ASUS\P4G\plctrl.sys [14136 2014-02-12] (Windows ®
Win 7 DDK provider)
R1 SeLow; C:\Windows\system32\DRIVERS\SeLow_x64.sys [38368 2015-01-21]
(SoftEther VPN Project at University of Tsukuba, Japan.)
U5 UnlockerDriver5; C:\Program Files\Unlocker\UnlockerDriver5.sys [12352
2010-07-02] ()
R3 vmkbd2; C:\Windows\system32\drivers\VMkbd.sys [33472 2015-02-06] (VMware,
Inc.)
R0 vsock; C:\Windows\System32\drivers\vsock.sys [76480 2015-01-07] (VMware,
Inc.)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2015-02-04]
(Microsoft Corporation)
U0 msahci; system32\drivers\msahci.sys
S2 VBoxAswDrv; \??\C:\Program Files\AVAST Software\Avast\ng\vbox\VBoxAswDrv.sys
[X]
S3 WinRing0_1_2_0; \??\C:\Program Files (x86)\BatteryCare\WinRing0x64.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry.
The file will not be moved unless listed separately.)
==================== One Month Created files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2015-05-28 00:08 - 2015-05-28 00:09 - 00000000 ____D () C:\FRST
2015-05-27 21:59 - 2015-05-27 22:48 - 00057738 _____ ()
C:\Windows\WindowsUpdate.log
2015-05-27 19:03 - 2015-05-27 19:03 - 00097888 _____ (Oracle Corporation)
C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2015-05-27 19:03 - 2015-05-27 19:03 - 00000000 ____D () C:\Program Files
(x86)\Java
2015-05-27 17:25 - 2015-05-27 17:25 - 00001073 _____ () C:\Users\Duc
Hong\Desktop\Notepad++.lnk
2015-05-27 16:52 - 2015-05-27 16:52 - 00002062 _____ () C:\Users\Duc
Hong\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\FileHippo App
Manager.lnk
2015-05-27 16:52 - 2015-05-27 16:52 - 00000000 ____D ()
C:\ProgramData\IsolatedStorage
2015-05-27 16:52 - 2015-05-27 16:52 - 00000000 ____D () C:\Program Files
(x86)\FileHippo.com
2015-05-26 17:00 - 2015-05-26 17:07 - 00010620 _____ () C:\Users\Duc
Hong\Documents\My Movie.wlmp
2015-05-26 16:04 - 2015-05-26 16:04 - 00000000 ____D () C:\Windows\en
2015-05-26 16:03 - 2015-05-26 16:03 - 00002504 _____ ()
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live Messenger.lnk
2015-05-26 16:03 - 2015-05-26 16:03 - 00001476 _____ ()
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live Mail.lnk
2015-05-26 16:03 - 2015-05-26 16:03 - 00001392 _____ ()
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Photo Gallery.lnk
2015-05-26 16:03 - 2015-05-26 16:03 - 00001323 _____ ()
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Movie Maker.lnk
2015-05-26 16:03 - 2015-05-26 16:03 - 00000000 ___RD ()
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live
2015-05-26 16:03 - 2015-05-26 16:03 - 00000000 ____D () C:\Program Files\Windows
Live
2015-05-26 16:03 - 2015-05-26 16:03 - 00000000 ____D () C:\Program Files
(x86)\Microsoft SQL Server Compact Edition
2015-05-26 16:01 - 2015-05-26 16:03 - 00000000 ____D () C:\Program Files
(x86)\Windows Live
2015-05-26 16:01 - 2015-05-26 16:01 - 00003108 _____ ()
C:\Windows\System32\Tasks\Microsoft OneDrive Auto Update
Task-S-1-5-21-1926068397-2398490202-140176465-1002
2015-05-26 16:01 - 2015-05-26 16:01 - 00000000 ___RD () C:\Users\Duc
Hong\OneDrive
2015-05-26 16:00 - 2015-05-26 16:00 - 00000000 ____D () C:\ProgramData\Microsoft
OneDrive
2015-05-26 15:59 - 2015-05-26 16:39 - 00000000 ____D () C:\Users\Duc
Hong\AppData\Local\Windows Live
2015-05-26 15:56 - 2015-05-26 16:56 - 00000000 ____D () C:\Users\Duc
Hong\AppData\Roaming\avidemux
2015-05-26 15:56 - 2015-05-26 15:56 - 00000000 ____D ()
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avidemux (64bits)
2015-05-25 23:37 - 2015-04-16 16:17 - 00325464 _____ (Microsoft Corporation)
C:\Windows\system32\Drivers\USBXHCI.SYS
2015-05-25 23:37 - 2015-04-14 08:37 - 00275968 _____ (Microsoft Corporation)
C:\Windows\system32\authz.dll
2015-05-25 23:37 - 2015-04-14 08:34 - 00180224 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\authz.dll
2015-05-25 23:37 - 2015-04-10 10:40 - 01249280 _____ (Microsoft Corporation)
C:\Windows\system32\UIAutomationCore.dll
2015-05-25 23:37 - 2015-04-10 10:17 - 01018880 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\UIAutomationCore.dll
2015-05-25 23:37 - 2015-04-09 08:41 - 00158720 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\rgb9rast.dll
2015-05-25 23:37 - 2015-04-02 08:42 - 03097600 _____ (Microsoft Corporation)
C:\Windows\system32\msftedit.dll
2015-05-25 23:37 - 2015-04-02 08:30 - 02483712 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\msftedit.dll
2015-05-25 23:37 - 2015-04-01 14:21 - 00337408 _____ (Microsoft Corporation)
C:\Windows\system32\SearchProtocolHost.exe
2015-05-25 23:37 - 2015-04-01 14:18 - 00468480 _____ (Microsoft Corporation)
C:\Windows\system32\mssph.dll
2015-05-25 23:37 - 2015-04-01 14:17 - 00248832 _____ (Microsoft Corporation)
C:\Windows\system32\mssphtb.dll
2015-05-25 23:37 - 2015-04-01 14:08 - 00774144 _____ (Microsoft Corporation)
C:\Windows\system32\mssvp.dll
2015-05-25 23:37 - 2015-04-01 13:46 - 03633664 _____ (Microsoft Corporation)
C:\Windows\system32\tquery.dll
2015-05-25 23:37 - 2015-04-01 13:17 - 02551808 _____ (Microsoft Corporation)
C:\Windows\system32\mssrch.dll
2015-05-25 23:37 - 2015-04-01 13:17 - 00903168 _____ (Microsoft Corporation)
C:\Windows\system32\SearchIndexer.exe
2015-05-25 23:37 - 2015-04-01 12:53 - 00391680 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\mssph.dll
2015-05-25 23:37 - 2015-04-01 12:53 - 00272896 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\SearchProtocolHost.exe
2015-05-25 23:37 - 2015-04-01 12:45 - 02749952 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\tquery.dll
2015-05-25 23:37 - 2015-04-01 12:45 - 00699392 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\mssvp.dll
2015-05-25 23:37 - 2015-04-01 12:14 - 01920000 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\mssrch.dll
2015-05-25 23:37 - 2015-04-01 12:12 - 00710144 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\SearchIndexer.exe
2015-05-25 23:37 - 2015-03-20 13:49 - 00309760 _____ (Microsoft Corporation)
C:\Windows\system32\compstui.dll
2015-05-25 23:37 - 2015-03-20 13:08 - 00477184 _____ (Microsoft Corporation)
C:\Windows\system32\puiobj.dll
2015-05-25 23:37 - 2015-03-20 12:37 - 00367104 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\puiobj.dll
2015-05-25 23:37 - 2015-03-20 12:07 - 01091072 _____ (Microsoft Corporation)
C:\Windows\system32\localspl.dll
2015-05-25 23:37 - 2015-03-02 11:43 - 00222208 _____ (Microsoft Corporation)
C:\Windows\system32\rastapi.dll
2015-05-25 23:37 - 2015-03-02 11:21 - 00207872 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\rastapi.dll
2015-05-25 03:29 - 2015-05-25 03:29 - 00000000 ____D () C:\Users\Duc
Hong\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Ubisoft
2015-05-25 03:29 - 2015-05-25 03:29 - 00000000 ____D () C:\Users\Duc
Hong\AppData\Local\Ubisoft Game Launcher
2015-05-25 03:29 - 2015-05-25 03:29 - 00000000 ____D () C:\Program Files
(x86)\Ubisoft
2015-05-23 15:12 - 2015-05-23 15:12 - 00000000 ____D () C:\Users\Duc
Hong\AppData\Roaming\Aegisub
2015-05-20 23:57 - 2015-05-20 22:55 - 00197616 _____ (Tonec Inc.)
C:\Windows\system32\Drivers\idmwfp.sys
2015-05-20 18:18 - 2015-05-20 18:53 - 00001004 _____ () C:\Users\Duc
Hong\Desktop\Logic and stuffs.java
2015-05-19 04:49 - 2015-05-19 09:21 - 00000000 ____D () C:\Users\Duc
Hong\Documents\Witcher 2
2015-05-19 04:49 - 2015-05-19 04:49 - 00000000 ____D () C:\Users\Duc
Hong\AppData\Local\The Witcher 2
2015-05-19 04:46 - 2015-05-19 04:46 - 00000000 ____D () C:\Users\Duc
Hong\Documents\Rockstar Games
2015-05-19 04:46 - 2015-05-19 04:46 - 00000000 ____D () C:\Users\Duc
Hong\AppData\Local\Rockstar Games
2015-05-19 04:45 - 2015-05-19 04:45 - 00000000 ____D ()
C:\ProgramData\Socialclub
2015-05-18 18:21 - 2015-05-18 18:21 - 00000000 ____D () C:\Program Files
(x86)\Mozilla Firefox
2015-05-18 17:10 - 2015-05-18 17:10 - 00000000 ____D ()
C:\Users\Default\AppData\Local\NVIDIA Corporation
2015-05-18 17:10 - 2015-05-18 17:10 - 00000000 ____D ()
C:\Users\Default\AppData\Local\NVIDIA
2015-05-18 17:10 - 2015-05-18 17:10 - 00000000 ____D () C:\Users\Default
User\AppData\Local\NVIDIA Corporation
2015-05-18 17:10 - 2015-05-18 17:10 - 00000000 ____D () C:\Users\Default
User\AppData\Local\NVIDIA
2015-05-18 05:43 - 2015-05-01 06:35 - 00124112 _____ (Microsoft Corporation)
C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll
2015-05-18 05:43 - 2015-05-01 06:35 - 00102608 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\PresentationCFFRasterizerNative_v0300.dll
2015-05-18 05:36 - 2015-04-10 10:34 - 02256896 _____ (Microsoft Corporation)
C:\Windows\system32\dwmcore.dll
2015-05-18 05:36 - 2015-04-10 10:11 - 01943040 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\dwmcore.dll
2015-05-18 05:35 - 2015-05-01 09:05 - 00429568 _____ (Microsoft Corporation)
C:\Windows\system32\schannel.dll
2015-05-18 05:35 - 2015-05-01 08:48 - 00358912 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\schannel.dll
2015-05-18 05:35 - 2015-04-25 07:32 - 00036864 _____ (Microsoft Corporation)
C:\Windows\system32\UtcResources.dll
2015-05-18 05:35 - 2015-04-22 03:14 - 24971776 _____ (Microsoft Corporation)
C:\Windows\system32\mshtml.dll
2015-05-18 05:35 - 2015-04-22 02:50 - 00584192 _____ (Microsoft Corporation)
C:\Windows\system32\vbscript.dll
2015-05-18 05:35 - 2015-04-22 02:50 - 00417792 _____ (Microsoft Corporation)
C:\Windows\system32\html.iec
2015-05-18 05:35 - 2015-04-22 02:49 - 02885120 _____ (Microsoft Corporation)
C:\Windows\system32\iertutil.dll
2015-05-18 05:35 - 2015-04-22 02:37 - 00633856 _____ (Microsoft Corporation)
C:\Windows\system32\ieui.dll
2015-05-18 05:35 - 2015-04-22 02:35 - 00816640 _____ (Microsoft Corporation)
C:\Windows\system32\jscript.dll
2015-05-18 05:35 - 2015-04-22 02:31 - 06025728 _____ (Microsoft Corporation)
C:\Windows\system32\jscript9.dll
2015-05-18 05:35 - 2015-04-22 02:24 - 19691008 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\mshtml.dll
2015-05-18 05:35 - 2015-04-22 02:13 - 00107520 _____ (Microsoft Corporation)
C:\Windows\system32\inseng.dll
2015-05-18 05:35 - 2015-04-22 02:11 - 00504320 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\vbscript.dll
2015-05-18 05:35 - 2015-04-22 02:09 - 00341504 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\html.iec
2015-05-18 05:35 - 2015-04-22 02:08 - 00092160 _____ (Microsoft Corporation)
C:\Windows\system32\mshtmled.dll
2015-05-18 05:35 - 2015-04-22 02:07 - 00145408 _____ (Microsoft Corporation)
C:\Windows\system32\iepeers.dll
2015-05-18 05:35 - 2015-04-22 02:05 - 00316928 _____ (Microsoft Corporation)
C:\Windows\system32\dxtrans.dll
2015-05-18 05:35 - 2015-04-22 02:04 - 02278400 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\iertutil.dll
2015-05-18 05:35 - 2015-04-22 01:59 - 01032704 _____ (Microsoft Corporation)
C:\Windows\system32\inetcomm.dll
2015-05-18 05:35 - 2015-04-22 01:58 - 00664576 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\jscript.dll
2015-05-18 05:35 - 2015-04-22 01:52 - 00262144 _____ (Microsoft Corporation)
C:\Windows\system32\webcheck.dll
2015-05-18 05:35 - 2015-04-22 01:49 - 00801280 _____ (Microsoft Corporation)
C:\Windows\system32\msfeeds.dll
2015-05-18 05:35 - 2015-04-22 01:49 - 00720384 _____ (Microsoft Corporation)
C:\Windows\system32\ie4uinit.exe
2015-05-18 05:35 - 2015-04-22 01:49 - 00374272 _____ (Microsoft Corporation)
C:\Windows\system32\iedkcs32.dll
2015-05-18 05:35 - 2015-04-22 01:46 - 02125824 _____ (Microsoft Corporation)
C:\Windows\system32\inetcpl.cpl
2015-05-18 05:35 - 2015-04-22 01:40 - 14401536 _____ (Microsoft Corporation)
C:\Windows\system32\ieframe.dll
2015-05-18 05:35 - 2015-04-22 01:38 - 00076288 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\mshtmled.dll
2015-05-18 05:35 - 2015-04-22 01:37 - 00128000 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\iepeers.dll
2015-05-18 05:35 - 2015-04-22 01:36 - 00285696 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\dxtrans.dll
2015-05-18 05:35 - 2015-04-22 01:32 - 00880128 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\inetcomm.dll
2015-05-18 05:35 - 2015-04-22 01:31 - 04305920 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\jscript9.dll
2015-05-18 05:35 - 2015-04-22 01:28 - 00230400 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\webcheck.dll
2015-05-18 05:35 - 2015-04-22 01:27 - 02352128 _____ (Microsoft Corporation)
C:\Windows\system32\wininet.dll
2015-05-18 05:35 - 2015-04-22 01:26 - 00688640 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\msfeeds.dll
2015-05-18 05:35 - 2015-04-22 01:26 - 00327168 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\iedkcs32.dll
2015-05-18 05:35 - 2015-04-22 01:25 - 02052608 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\inetcpl.cpl
2015-05-18 05:35 - 2015-04-22 01:17 - 12828672 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\ieframe.dll
2015-05-18 05:35 - 2015-04-22 01:15 - 01547264 _____ (Microsoft Corporation)
C:\Windows\system32\urlmon.dll
2015-05-18 05:35 - 2015-04-22 01:03 - 00800768 _____ (Microsoft Corporation)
C:\Windows\system32\ieapfltr.dll
2015-05-18 05:35 - 2015-04-22 01:02 - 01882112 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\wininet.dll
2015-05-18 05:35 - 2015-04-22 00:58 - 01310208 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\urlmon.dll
2015-05-18 05:35 - 2015-04-22 00:56 - 00710144 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\ieapfltr.dll
2015-05-18 05:35 - 2015-04-14 08:48 - 04180480 _____ (Microsoft Corporation)
C:\Windows\system32\win32k.sys
2015-05-18 05:35 - 2015-04-10 11:00 - 01996800 _____ (Microsoft Corporation)
C:\Windows\system32\DWrite.dll
2015-05-18 05:35 - 2015-04-10 10:50 - 01387008 _____ (Microsoft Corporation)
C:\Windows\system32\FntCache.dll
2015-05-18 05:35 - 2015-04-10 10:26 - 01560576 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\DWrite.dll
2015-05-18 05:35 - 2015-04-09 08:55 - 00410128 _____ (Microsoft Corporation)
C:\Windows\system32\services.exe
2015-05-18 05:35 - 2015-03-30 15:47 - 00561928 _____ (Microsoft Corporation)
C:\Windows\system32\Drivers\cng.sys
2015-05-18 05:35 - 2015-03-27 13:27 - 00445440 _____ (Microsoft Corporation)
C:\Windows\system32\certcli.dll
2015-05-18 05:35 - 2015-03-27 12:50 - 00324096 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\certcli.dll
2015-05-18 05:35 - 2015-03-27 12:48 - 01441792 _____ (Microsoft Corporation)
C:\Windows\system32\lsasrv.dll
2015-05-18 05:35 - 2015-03-20 11:56 - 00080384 _____ (Microsoft Corporation)
C:\Windows\system32\Drivers\ahcache.sys
2015-05-18 05:35 - 2015-03-13 11:11 - 02162176 _____ (Microsoft Corporation)
C:\Windows\system32\SRH.dll
2015-05-18 05:35 - 2015-03-13 10:39 - 01812992 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\SRH.dll
2015-05-18 05:35 - 2015-03-13 10:29 - 00410017 _____ ()
C:\Windows\system32\ApnDatabase.xml
2015-05-18 05:35 - 2015-03-05 09:09 - 01429504 _____ (Microsoft Corporation)
C:\Windows\system32\diagtrack.dll
2015-05-17 19:44 - 2015-05-17 19:44 - 00000000 ____H () C:\Users\Duc
Hong\Documents\Default.rdp
2015-05-17 02:42 - 2015-05-17 07:57 - 00000000 ____D () C:\Program Files
(x86)\eSupport.com
2015-05-17 02:42 - 2015-05-17 02:42 - 00013824 _____ (Phoenix Technologies)
C:\Windows\SysWOW64\Drivers\DrvAgent64.SYS
2015-05-17 02:42 - 2015-05-17 02:42 - 00000000 ____D () C:\Users\Duc
Hong\AppData\Local\eSupport.com
2015-05-16 22:44 - 2015-05-16 22:44 - 00014480 _____ ()
C:\Windows\system32\Drivers\nvflash.sys
2015-05-16 22:34 - 2015-05-16 22:34 - 00000000 ____D ()
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Oracle VM VirtualBox
2015-05-16 22:34 - 2015-05-13 17:11 - 00922704 _____ (Oracle Corporation)
C:\Windows\system32\Drivers\VBoxDrv.sys
2015-05-16 22:34 - 2015-05-13 17:10 - 00128592 _____ (Oracle Corporation)
C:\Windows\system32\Drivers\VBoxUSBMon.sys
2015-05-13 21:21 - 2015-05-13 21:21 - 00000000 ____D () C:\Users\Duc
Hong\AppData\Roaming\Mediatronic
2015-05-13 21:17 - 2015-05-26 17:27 - 00000000 ____D () C:\Users\Duc
Hong\Desktop\New folder
2015-05-13 17:10 - 2015-05-13 17:10 - 00141440 _____ (Oracle Corporation)
C:\Windows\system32\Drivers\VBoxNetAdp.sys
2015-05-11 18:25 - 2015-05-11 18:25 - 00019851 _____ () C:\Users\Duc
Hong\Desktop\ListOf4V2.java
2015-05-11 17:26 - 2015-05-27 16:20 - 00003474 _____ ()
C:\Windows\System32\Tasks\ASUS Live Update1
2015-05-11 17:26 - 2015-05-11 17:26 - 00003382 _____ ()
C:\Windows\System32\Tasks\Update Checker
2015-05-09 14:32 - 2015-05-09 14:32 - 00000218 _____ () C:\Users\Duc
Hong\AppData\Local\recently-used.xbel
2015-05-09 14:31 - 2015-05-09 14:31 - 00000000 ____D ()
C:\ProgramData\InstallShield
2015-05-09 14:30 - 2015-05-09 14:33 - 00000000 ____D () C:\Users\Duc
Hong\AppData\Roaming\driveridentifier
2015-05-07 20:59 - 2015-05-07 21:00 - 00022659 _____ () C:\Users\Duc
Hong\Desktop\ListofNV.java
2015-05-06 20:19 - 2015-05-06 20:19 - 00012476 _____ () C:\Users\Duc
Hong\Downloads\Smartphone-OS-rundown.odt
2015-05-06 18:14 - 2015-05-06 18:14 - 00000000 ____D () C:\Users\Duc
Hong\Documents\OneNote Notebooks
2015-05-05 06:18 - 2015-05-05 06:18 - 00000000 ____D () C:\Users\Duc
Hong\AppData\Local\ali213GameLauncher
2015-05-04 18:52 - 2015-05-26 16:39 - 00000000 ____D () C:\Users\Duc
Hong\Tracing
2015-05-04 18:47 - 2015-05-21 15:31 - 00000000 ____D () C:\Users\Duc
Hong\AppData\Roaming\Skype
2015-05-04 18:47 - 2015-05-04 18:47 - 00000000 ___RD () C:\Program Files
(x86)\Skype
2015-05-04 18:47 - 2015-05-04 18:47 - 00000000 ____D () C:\Users\Duc
Hong\AppData\Local\Skype
2015-05-04 18:47 - 2015-05-04 18:47 - 00000000 ____D () C:\ProgramData\Skype
2015-05-04 18:47 - 2015-05-04 18:47 - 00000000 ____D ()
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2015-05-04 18:47 - 2015-05-04 18:47 - 00000000 ____D () C:\extensions
2015-05-02 21:29 - 2010-06-02 04:55 - 00527192 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\XAudio2_7.dll
2015-05-02 21:29 - 2010-06-02 04:55 - 00239960 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\xactengine3_7.dll
2015-05-02 21:29 - 2010-06-02 04:55 - 00074072 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\XAPOFX1_5.dll
2015-05-02 21:29 - 2010-05-26 11:41 - 02106216 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\D3DCompiler_43.dll
2015-05-02 21:29 - 2010-05-26 11:41 - 01998168 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\D3DX9_43.dll
2015-05-02 21:29 - 2010-05-26 11:41 - 01868128 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\d3dcsx_43.dll
2015-05-02 21:29 - 2010-05-26 11:41 - 00470880 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\d3dx10_43.dll
2015-05-02 21:29 - 2010-05-26 11:41 - 00248672 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\d3dx11_43.dll
2015-05-02 21:29 - 2010-02-04 10:01 - 00528216 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\XAudio2_6.dll
2015-05-02 21:29 - 2010-02-04 10:01 - 00238936 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\xactengine3_6.dll
2015-05-02 21:29 - 2010-02-04 10:01 - 00074072 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\XAPOFX1_4.dll
2015-05-02 21:29 - 2010-02-04 10:01 - 00022360 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\X3DAudio1_7.dll
2015-05-02 21:29 - 2009-09-04 17:44 - 00515416 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\XAudio2_5.dll
2015-05-02 21:29 - 2009-09-04 17:44 - 00238936 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\xactengine3_5.dll
2015-05-02 21:29 - 2009-09-04 17:29 - 05501792 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\d3dcsx_42.dll
2015-05-02 21:29 - 2009-09-04 17:29 - 01974616 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\D3DCompiler_42.dll
2015-05-02 21:29 - 2009-09-04 17:29 - 01892184 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\D3DX9_42.dll
2015-05-02 21:29 - 2009-09-04 17:29 - 00453456 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\d3dx10_42.dll
2015-05-02 21:29 - 2009-09-04 17:29 - 00235344 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\d3dx11_42.dll
2015-05-02 21:28 - 2009-09-04 17:44 - 00069464 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\XAPOFX1_3.dll
2015-05-02 21:28 - 2009-03-16 14:18 - 00517448 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\XAudio2_4.dll
2015-05-02 21:28 - 2009-03-16 14:18 - 00235352 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\xactengine3_4.dll
2015-05-02 21:28 - 2009-03-16 14:18 - 00022360 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\X3DAudio1_6.dll
2015-05-02 21:28 - 2009-03-09 15:27 - 04178264 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\D3DX9_41.dll
2015-05-02 21:28 - 2009-03-09 15:27 - 01846632 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\D3DCompiler_41.dll
2015-05-02 21:28 - 2009-03-09 15:27 - 00453456 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\d3dx10_41.dll
2015-05-02 21:28 - 2008-10-27 10:04 - 00514384 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\XAudio2_3.dll
2015-05-02 21:28 - 2008-10-27 10:04 - 00235856 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\xactengine3_3.dll
2015-05-02 21:28 - 2008-10-27 10:04 - 00070992 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\XAPOFX1_2.dll
2015-05-02 21:28 - 2008-10-27 10:04 - 00023376 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\X3DAudio1_5.dll
2015-05-02 21:28 - 2008-10-15 06:22 - 04379984 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\D3DX9_40.dll
2015-05-02 21:28 - 2008-10-15 06:22 - 02036576 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\D3DCompiler_40.dll
2015-05-02 21:28 - 2008-10-15 06:22 - 00452440 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\d3dx10_40.dll
2015-05-02 21:28 - 2008-07-31 10:41 - 00238088 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\xactengine3_2.dll
2015-05-02 21:28 - 2008-07-31 10:41 - 00068616 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\XAPOFX1_1.dll
2015-05-02 21:28 - 2008-07-31 10:40 - 00509448 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\XAudio2_2.dll
2015-05-02 21:28 - 2008-07-10 11:01 - 00467984 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\d3dx10_39.dll
2015-05-02 21:28 - 2008-07-10 11:00 - 03851784 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\D3DX9_39.dll
2015-05-02 21:28 - 2008-07-10 11:00 - 01493528 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\D3DCompiler_39.dll
2015-05-02 21:28 - 2008-05-30 14:19 - 00507400 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\XAudio2_1.dll
2015-05-02 21:28 - 2008-05-30 14:18 - 00238088 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\xactengine3_1.dll
2015-05-02 21:28 - 2008-05-30 14:17 - 00065032 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\XAPOFX1_0.dll
2015-05-02 21:28 - 2008-05-30 14:17 - 00025608 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\X3DAudio1_4.dll
2015-05-02 21:28 - 2008-05-30 14:11 - 03850760 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\D3DX9_38.dll
2015-05-02 21:28 - 2008-05-30 14:11 - 01491992 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\D3DCompiler_38.dll
2015-05-02 21:28 - 2008-05-30 14:11 - 00467984 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\d3dx10_38.dll
2015-05-02 21:28 - 2008-03-05 16:03 - 00479752 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\XAudio2_0.dll
2015-05-02 21:28 - 2008-03-05 16:03 - 00238088 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\xactengine3_0.dll
2015-05-02 21:28 - 2008-03-05 16:00 - 00025608 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\X3DAudio1_3.dll
2015-05-02 21:28 - 2008-03-05 15:56 - 03786760 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\D3DX9_37.dll
2015-05-02 21:28 - 2008-03-05 15:56 - 01420824 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\D3DCompiler_37.dll
2015-05-02 21:28 - 2008-02-05 23:07 - 00462864 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\d3dx10_37.dll
2015-05-02 21:28 - 2007-10-22 03:39 - 00267272 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\xactengine2_10.dll
2015-05-02 21:28 - 2007-10-22 03:37 - 00017928 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\X3DAudio1_2.dll
2015-05-02 21:28 - 2007-10-12 15:14 - 03734536 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\d3dx9_36.dll
2015-05-02 21:28 - 2007-10-12 15:14 - 01374232 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\D3DCompiler_36.dll
2015-05-02 21:28 - 2007-10-02 09:56 - 00444776 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\d3dx10_36.dll
2015-05-02 21:28 - 2007-07-20 00:57 - 00267112 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\xactengine2_9.dll
2015-05-02 21:28 - 2007-07-19 18:14 - 03727720 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\d3dx9_35.dll
2015-05-02 21:28 - 2007-07-19 18:14 - 01358192 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\D3DCompiler_35.dll
2015-05-02 21:28 - 2007-07-19 18:14 - 00444776 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\d3dx10_35.dll
2015-05-02 21:28 - 2007-06-20 20:46 - 00266088 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\xactengine2_8.dll
2015-05-02 21:28 - 2007-05-16 16:45 - 03497832 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\d3dx9_34.dll
2015-05-02 21:28 - 2007-05-16 16:45 - 01124720 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\D3DCompiler_34.dll
2015-05-02 21:28 - 2007-05-16 16:45 - 00443752 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\d3dx10_34.dll
2015-05-02 21:28 - 2007-04-04 18:55 - 00261480 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\xactengine2_7.dll
2015-05-02 21:28 - 2007-04-04 18:53 - 00081768 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\xinput1_3.dll
2015-05-02 21:28 - 2007-03-15 16:57 - 00443752 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\d3dx10_33.dll
2015-05-02 21:28 - 2007-03-12 16:42 - 03495784 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\d3dx9_33.dll
2015-05-02 21:28 - 2007-03-12 16:42 - 01123696 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\D3DCompiler_33.dll
2015-05-02 21:28 - 2007-03-05 12:42 - 00015128 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\x3daudio1_1.dll
2015-05-02 21:28 - 2007-01-24 15:27 - 00255848 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\xactengine2_6.dll
2015-05-02 21:28 - 2006-12-08 12:02 - 00251672 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\xactengine2_5.dll
2015-05-02 21:28 - 2006-11-29 13:06 - 03426072 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\d3dx9_32.dll
2015-05-02 21:28 - 2006-11-29 13:06 - 00440080 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\d3dx10.dll
2015-05-02 21:28 - 2006-09-28 16:05 - 02414360 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\d3dx9_31.dll
2015-05-02 21:28 - 2006-09-28 16:05 - 00237848 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\xactengine2_4.dll
2015-05-02 21:28 - 2006-07-28 09:30 - 00236824 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\xactengine2_3.dll
2015-05-02 21:28 - 2006-07-28 09:30 - 00062744 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\xinput1_2.dll
2015-05-02 21:28 - 2006-05-31 07:24 - 00230168 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\xactengine2_2.dll
2015-05-02 21:28 - 2006-03-31 12:40 - 02388176 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\d3dx9_30.dll
2015-05-02 21:28 - 2006-03-31 12:39 - 00229584 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\xactengine2_1.dll
2015-05-02 21:28 - 2006-03-31 12:39 - 00062672 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\xinput1_1.dll
2015-05-02 21:28 - 2006-02-03 08:43 - 02332368 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\d3dx9_29.dll
2015-05-02 21:28 - 2006-02-03 08:42 - 00230096 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\xactengine2_0.dll
2015-05-02 21:28 - 2006-02-03 08:41 - 00014032 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\x3daudio1_0.dll
2015-05-02 21:28 - 2005-12-05 18:09 - 02323664 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\d3dx9_28.dll
2015-05-02 21:28 - 2005-07-22 19:59 - 02319568 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\d3dx9_27.dll
2015-05-02 21:28 - 2005-05-26 15:34 - 02297552 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\d3dx9_26.dll
2015-05-02 21:28 - 2005-03-18 17:19 - 02337488 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\d3dx9_25.dll
2015-05-02 21:28 - 2005-02-05 19:45 - 02222800 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\d3dx9_24.dll
2015-05-01 18:45 - 2015-03-18 03:26 - 00467776 ____C (Microsoft Corporation)
C:\Windows\system32\Drivers\USBHUB3.SYS
2015-05-01 18:45 - 2015-03-09 12:02 - 00057856 ____C (Microsoft Corporation)
C:\Windows\system32\Drivers\bthhfenum.sys
2015-05-01 18:45 - 2015-01-06 13:01 - 00072192 _____ (Microsoft Corporation)
C:\Windows\system32\Drivers\ndproxy.sys
2015-05-01 18:45 - 2015-01-06 12:59 - 00080896 _____ (Microsoft Corporation)
C:\Windows\system32\Drivers\wanarp.sys
2015-05-01 18:45 - 2015-01-06 11:12 - 00185856 _____ (Microsoft Corporation)
C:\Windows\system32\rascfg.dll
2015-05-01 18:45 - 2015-01-06 11:02 - 00164864 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\rascfg.dll
2015-05-01 18:44 - 2015-04-03 10:35 - 00445440 _____ (Microsoft Corporation)
C:\Windows\system32\PhotoMetadataHandler.dll
2015-05-01 18:44 - 2015-04-03 10:14 - 00364544 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\PhotoMetadataHandler.dll
2015-05-01 18:44 - 2015-04-02 08:22 - 02985984 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\dbgeng.dll
2015-05-01 18:44 - 2015-04-02 08:20 - 04417536 _____ (Microsoft Corporation)
C:\Windows\system32\dbgeng.dll
2015-05-01 18:44 - 2015-04-01 13:45 - 01491456 _____ (Microsoft Corporation)
C:\Windows\system32\dbghelp.dll
2015-05-01 18:44 - 2015-04-01 12:31 - 01207296 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\dbghelp.dll
2015-05-01 18:44 - 2015-03-24 07:59 - 07476032 _____ (Microsoft Corporation)
C:\Windows\system32\ntoskrnl.exe
2015-05-01 18:44 - 2015-03-24 07:59 - 01733952 _____ (Microsoft Corporation)
C:\Windows\system32\ntdll.dll
2015-05-01 18:44 - 2015-03-24 07:59 - 00360480 _____ (Microsoft Corporation)
C:\Windows\system32\sechost.dll
2015-05-01 18:44 - 2015-03-24 07:58 - 01498872 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\ntdll.dll
2015-05-01 18:44 - 2015-03-24 07:45 - 00257216 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\sechost.dll
2015-05-01 18:44 - 2015-03-20 14:12 - 00246272 _____ (Microsoft Corporation)
C:\Windows\system32\microsoft-windows-system-events.dll
2015-05-01 18:44 - 2015-03-20 14:10 - 00285184 _____ (Microsoft Corporation)
C:\Windows\system32\wow64.dll
2015-05-01 18:44 - 2015-03-20 14:10 - 00013312 _____ (Microsoft Corporation)
C:\Windows\system32\wow64cpu.dll
2015-05-01 18:44 - 2015-03-20 13:17 - 00411648 _____ (Microsoft Corporation)
C:\Windows\system32\tracerpt.exe
2015-05-01 18:44 - 2015-03-20 12:41 - 00369152 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\tracerpt.exe
2015-05-01 18:44 - 2015-03-20 12:40 - 00950784 _____ (Microsoft Corporation)
C:\Windows\system32\tdh.dll
2015-05-01 18:44 - 2015-03-20 12:16 - 00749568 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\tdh.dll
2015-05-01 18:44 - 2015-03-13 12:58 - 00259072 _____ (Microsoft Corporation)
C:\Windows\system32\pku2u.dll
2015-05-01 18:44 - 2015-03-13 12:37 - 00208896 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\pku2u.dll
2015-05-01 18:44 - 2015-03-06 12:47 - 01696256 _____ (Microsoft Corporation)
C:\Windows\system32\wevtsvc.dll
2015-05-01 18:44 - 2015-03-04 11:32 - 00172544 _____ (Microsoft Corporation)
C:\Windows\system32\Windows.UI.Input.Inking.dll
2015-05-01 18:44 - 2015-03-04 11:12 - 00141824 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\Windows.UI.Input.Inking.dll
2015-05-01 18:44 - 2015-01-30 10:53 - 02819584 _____ (Microsoft Corporation)
C:\Windows\system32\SettingsHandlers.dll
2015-05-01 18:44 - 2014-11-18 06:17 - 00672984 _____ (Microsoft Corporation)
C:\Windows\system32\MDMAgent.exe
2015-05-01 18:44 - 2014-11-18 06:17 - 00273240 _____ (Microsoft Corporation)
C:\Windows\system32\SystemSettingsAdminFlows.exe
2015-05-01 18:44 - 2014-11-14 16:58 - 00116736 _____ (Microsoft Corporation)
C:\Windows\system32\SystemSettingsDatabase.dll
2015-05-01 18:44 - 2014-11-14 16:54 - 00463872 _____ (Microsoft Corporation)
C:\Windows\system32\SystemSettings.Handlers.dll
2015-05-01 18:44 - 2014-11-14 16:46 - 02171904 _____ (Microsoft Corporation)
C:\Windows\system32\SystemSettingsAdminFlowUI.dll
2015-05-01 18:43 - 2015-03-11 11:49 - 00024576 _____ (Microsoft Corporation)
C:\Windows\system32\sdbinst.exe
2015-05-01 18:43 - 2015-03-11 11:09 - 00021504 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\sdbinst.exe
2015-05-01 18:42 - 2015-03-13 14:03 - 00239424 ____C (Microsoft Corporation)
C:\Windows\system32\Drivers\sdbus.sys
2015-05-01 18:42 - 2015-03-13 14:03 - 00154432 ____C (Microsoft Corporation)
C:\Windows\system32\Drivers\dumpsd.sys
2015-05-01 18:42 - 2015-03-06 13:08 - 02067968 _____ (Microsoft Corporation)
C:\Windows\system32\wpdshext.dll
2015-05-01 18:42 - 2015-03-06 12:43 - 01969664 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\wpdshext.dll
2015-05-01 18:42 - 2015-03-04 20:25 - 00377152 _____ (Microsoft Corporation)
C:\Windows\system32\Drivers\clfs.sys
2015-05-01 18:42 - 2015-03-04 13:04 - 00075264 _____ (Microsoft Corporation)
C:\Windows\system32\clfsw32.dll
2015-05-01 18:42 - 2015-03-04 12:19 - 00058880 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\clfsw32.dll
2015-05-01 18:42 - 2015-02-24 18:32 - 00991552 _____ (Microsoft Corporation)
C:\Windows\system32\Drivers\http.sys
2015-05-01 18:39 - 2015-02-18 09:19 - 00186368 _____ (Microsoft Corporation)
C:\Windows\system32\dpapisrv.dll
2015-05-01 18:20 - 2015-03-13 12:02 - 00316416 _____ (Microsoft Corporation)
C:\Windows\system32\Drivers\udfs.sys
2015-05-01 16:28 - 2015-05-01 16:28 - 00364472 _____ (Avast Software s.r.o.)
C:\Windows\system32\aswBoot.exe
2015-05-01 16:28 - 2015-05-01 16:28 - 00043112 _____ (Avast Software s.r.o.)
C:\Windows\avastSS.scr
2015-04-30 23:17 - 2015-02-06 17:40 - 00066752 _____ (VMware, Inc.)
C:\Windows\system32\Drivers\vmx86.sys
2015-04-30 23:16 - 2015-02-06 17:39 - 00033472 _____ (VMware, Inc.)
C:\Windows\system32\Drivers\VMkbd.sys
2015-04-30 23:15 - 2015-02-06 17:40 - 00438464 _____ (VMware, Inc.)
C:\Windows\SysWOW64\vmnat.exe
2015-04-30 23:15 - 2015-02-06 17:40 - 00359104 _____ (VMware, Inc.)
C:\Windows\SysWOW64\vmnetdhcp.exe
2015-04-30 23:15 - 2015-02-06 17:40 - 00026816 _____ (VMware, Inc.)
C:\Windows\system32\Drivers\vmnetuserif.sys
2015-04-30 23:15 - 2015-02-06 17:39 - 00931008 _____ (VMware, Inc.)
C:\Windows\system32\vnetlib64.dll
2015-04-30 17:21 - 2015-04-30 17:21 - 00003939 _____ () C:\Users\Duc
Hong\Desktop\bubblesortsolution.java
2015-04-28 07:24 - 2015-04-28 07:24 - 00000000 ____D () C:\Users\Duc
Hong\AppData\Roaming\NVIDIA
==================== One Month Modified files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2015-05-28 00:00 - 2013-08-23 01:36 - 00000000 ____D () C:\Windows\system32\sru
2015-05-27 23:42 - 2015-02-17 22:33 - 00002908 _____ ()
C:\Windows\System32\Tasks\AutoKMS
2015-05-27 23:42 - 2015-01-08 07:43 - 00000298 _____ ()
C:\Windows\Tasks\AutoKMS.job
2015-05-27 23:21 - 2015-04-17 17:11 - 00000944 _____ ()
C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1926068397-2398490202-140176465-1002UA.job
2015-05-27 20:28 - 2015-04-20 17:38 - 00003598 _____ ()
C:\Windows\System32\Tasks\Optimize Start Menu Cache
Files-S-1-5-21-1926068397-2398490202-140176465-1002
2015-05-27 20:09 - 2015-01-08 18:53 - 00000000 ____D () C:\Users\Duc
Hong\Desktop\Tools
2015-05-27 19:04 - 2015-01-08 23:41 - 00000000 ____D () C:\ProgramData\Oracle
2015-05-27 19:01 - 2015-04-02 16:59 - 00000000 ____D () C:\Program Files\Java
2015-05-27 19:00 - 2015-04-02 17:02 - 00111016 _____ (Oracle Corporation)
C:\Windows\system32\WindowsAccessBridge-64.dll
2015-05-27 17:25 - 2015-01-08 01:11 - 00000000 ____D () C:\Program Files
(x86)\Notepad++
2015-05-27 17:19 - 2015-04-12 05:06 - 00000000 ____D () C:\Users\Duc
Hong\Desktop\Docs
2015-05-27 17:05 - 2015-01-18 16:16 - 00136408 _____ (Malwarebytes Corporation)
C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-05-27 17:04 - 2015-01-18 16:16 - 00000000 ____D ()
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2015-05-27 17:04 - 2015-01-18 16:16 - 00000000 ____D () C:\Program Files
(x86)\Malwarebytes Anti-Malware
2015-05-27 17:01 - 2015-01-08 16:58 - 00000000 ____D () C:\Program
Files\Defraggler
2015-05-27 16:53 - 2015-01-18 12:20 - 00000000 ____D () C:\Users\Duc
Hong\AppData\Roaming\TeamViewer
2015-05-27 16:53 - 2015-01-08 07:25 - 00000000 ____D () C:\Users\Duc
Hong\AppData\Roaming\DAEMON Tools Lite
2015-05-27 16:53 - 2015-01-08 06:43 - 00000000 ____D () C:\Users\Duc
Hong\AppData\Roaming\uTorrent
2015-05-27 16:53 - 2015-01-07 21:35 - 00000000 ____D () C:\Users\Duc
Hong\AppData\Roaming\IDM
2015-05-27 16:52 - 2015-01-07 20:39 - 00000000 ____D () C:\Program
Files\CCleaner
2015-05-27 05:51 - 2015-01-07 21:35 - 00000000 ____D () C:\Users\Duc
Hong\AppData\Roaming\DMCache
2015-05-27 05:49 - 2015-01-07 20:14 - 00000074 _____ () C:\Users\Duc
Hong\AppData\Roaming\sp_data.sys
2015-05-27 05:47 - 2015-01-08 16:51 - 00000926 _____ ()
C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-05-27 03:21 - 2015-04-17 17:11 - 00000892 _____ ()
C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1926068397-2398490202-140176465-1002Core.job
2015-05-26 18:12 - 2014-03-18 20:03 - 00885780 _____ ()
C:\Windows\system32\PerfStringBackup.INI
2015-05-26 16:01 - 2015-01-07 20:13 - 00000000 ____D () C:\Users\Duc Hong
2015-05-25 23:42 - 2015-03-04 16:42 - 00000000 ____D () C:\ProgramData\VMware
2015-05-25 23:42 - 2015-01-14 15:54 - 00000000 ____D () C:\Program
Files\SoftEther VPN Client
2015-05-25 23:41 - 2013-08-23 00:45 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-05-25 23:40 - 2013-08-23 01:36 - 00000000 ___RD () C:\Windows\ToastData
2015-05-25 23:38 - 2013-08-23 01:20 - 00000000 ____D () C:\Windows\CbsTemp
2015-05-25 23:11 - 2015-01-07 21:35 - 00000000 ____D () C:\Program Files
(x86)\Internet Download Manager
2015-05-25 18:22 - 2015-03-16 17:17 - 00000000 ____D () C:\Users\Duc
Hong\Desktop\Bluej
2015-05-25 03:35 - 2015-04-12 15:20 - 00000000 ____D () C:\ProgramData\Orbit
2015-05-23 05:11 - 2015-01-07 21:36 - 00000000 ____D () C:\Users\Duc
Hong\Downloads\Video
2015-05-21 19:58 - 2015-02-22 16:22 - 00000000 ____D () C:\Users\Duc
Hong\AppData\Roaming\CodeBlocks
2015-05-20 20:47 - 2015-01-14 13:01 - 00000000 ____D () C:\Users\Duc
Hong\.VirtualBox
2015-05-19 19:09 - 2015-01-30 16:22 - 00000187 _____ () C:\Windows\wininit.ini
2015-05-19 18:03 - 2013-08-23 01:36 - 00000000 ____D () C:\Windows\rescache
2015-05-18 05:48 - 2015-01-23 14:11 - 00481120 _____ ()
C:\Windows\system32\FNTCACHE.DAT
2015-05-18 05:47 - 2015-01-07 23:38 - 00000000 ____D () C:\Program
Files\Microsoft Silverlight
2015-05-18 05:47 - 2015-01-07 23:38 - 00000000 ____D () C:\Program Files
(x86)\Microsoft Silverlight
2015-05-18 05:45 - 2015-01-08 07:28 - 00000000 ____D () C:\ProgramData\Microsoft
Help
2015-05-18 05:44 - 2015-04-05 04:10 - 00000039 _____ () C:\Windows\vbaddin.ini
2015-05-18 05:43 - 2015-01-08 08:40 - 00000000 ____D () C:\Windows\system32\MRT
2015-05-18 05:39 - 2015-01-08 08:40 - 140425016 _____ (Microsoft Corporation)
C:\Windows\system32\MRT.exe
2015-05-18 05:39 - 2013-08-22 23:25 - 00262144 ___SH ()
C:\Windows\system32\config\ELAM
2015-05-18 05:38 - 2015-04-14 22:32 - 00000000 ___SD () C:\Windows\SysWOW64\GWX
2015-05-18 05:38 - 2015-04-14 22:32 - 00000000 ___SD () C:\Windows\system32\GWX
2015-05-18 05:38 - 2015-01-07 23:38 - 00000000 ____D ()
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2015-05-18 05:36 - 2014-03-18 19:45 - 00000000 ____D () C:\Program Files\Windows
Journal
2015-05-17 20:00 - 2015-01-08 07:10 - 00000000 ____D () C:\Users\Duc
Hong\AppData\Local\Unity
2015-05-17 19:17 - 2014-07-12 08:56 - 00000000 ____D () C:\ProgramData\Package
Cache
2015-05-16 22:32 - 2015-03-04 16:45 - 00000000 ____D () C:\Users\Duc
Hong\AppData\Roaming\VMware
2015-05-16 22:32 - 2015-03-04 16:45 - 00000000 ____D () C:\Users\Duc
Hong\AppData\Local\VMware
2015-05-16 05:42 - 2013-08-22 23:25 - 00262144 ___SH ()
C:\Windows\system32\config\BBI
2015-05-16 03:16 - 2015-04-17 17:11 - 00003900 _____ ()
C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1926068397-2398490202-140176465-1002UA
2015-05-16 03:16 - 2015-04-17 17:11 - 00003520 _____ ()
C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1926068397-2398490202-140176465-1002Core
2015-05-16 03:12 - 2015-01-08 16:51 - 00003902 _____ ()
C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2015-05-16 03:12 - 2015-01-08 16:51 - 00003666 _____ ()
C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2015-05-16 03:12 - 2015-01-08 16:51 - 00000930 _____ ()
C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-05-13 21:07 - 2015-01-19 23:50 - 00000000 ____D () C:\Users\Duc
Hong\AppData\Roaming\HandBrake
2015-05-13 17:10 - 2015-03-02 14:18 - 00204264 _____ (Oracle Corporation)
C:\Windows\system32\VBoxNetFltNobj.dll
2015-05-13 17:10 - 2015-03-02 14:18 - 00156360 _____ (Oracle Corporation)
C:\Windows\system32\Drivers\VBoxNetFlt.sys
2015-05-12 17:42 - 2015-02-11 16:03 - 00000000 ____D () C:\Users\Duc
Hong\Desktop\IMG
2015-05-12 14:06 - 2013-08-23 01:36 - 00000000 ____D () C:\Windows\system32\NDF
2015-05-11 17:26 - 2014-05-17 06:03 - 00000000 ____D ()
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ASUS
2015-05-11 17:26 - 2014-05-17 06:02 - 00000000 ____D () C:\Program Files
(x86)\ASUS
2015-05-11 01:18 - 2015-01-07 20:13 - 00000000 ____D () C:\Users\Duc
Hong\AppData\Local\Packages
2015-05-11 01:18 - 2013-08-23 01:36 - 00000000 ____D () C:\Windows\AppReadiness
2015-05-09 14:32 - 2015-04-08 21:25 - 00000000 ____D () C:\Users\Duc
Hong\.bluefish
2015-05-09 14:31 - 2014-07-12 08:47 - 00000000 ___HD () C:\Program Files
(x86)\InstallShield Installation Information
2015-05-08 20:54 - 2015-01-22 16:51 - 00000000 ____D () C:\Users\Duc
Hong\AppData\Roaming\iFunbox_UserCache
2015-05-06 03:59 - 2015-02-16 18:53 - 00792568 _____ (Adobe Systems
Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-05-06 03:59 - 2015-02-16 18:53 - 00178168 _____ (Adobe Systems
Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-05-05 06:44 - 2015-01-07 23:31 - 00000000 ____D ()
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Steam
2015-05-05 06:23 - 2015-01-08 19:56 - 00000000 ____D () C:\Users\Duc
Hong\Documents\my games
2015-05-02 02:51 - 2015-04-26 23:22 - 01316184 _____ (NVIDIA Corporation)
C:\Windows\SysWOW64\nvspcap.dll
2015-05-02 02:51 - 2015-04-26 23:22 - 01316000 _____ (NVIDIA Corporation)
C:\Windows\SysWOW64\nvspbridge.dll
2015-05-02 02:50 - 2015-04-26 23:22 - 01756424 _____ (NVIDIA Corporation)
C:\Windows\system32\nvspbridge64.dll
2015-05-02 02:50 - 2015-04-26 23:22 - 01570672 _____ (NVIDIA Corporation)
C:\Windows\system32\nvspcap64.dll
2015-05-01 18:55 - 2013-08-23 01:36 - 00000000 ___RD ()
C:\Windows\ImmersiveControlPanel
2015-05-01 18:55 - 2013-08-22 23:36 - 00000000 ____D ()
C:\Windows\system32\AdvancedInstallers
2015-05-01 18:45 - 2013-08-22 23:25 - 00000199 _____ () C:\Windows\win.ini
2015-05-01 16:28 - 2015-01-07 21:13 - 00003924 _____ ()
C:\Windows\System32\Tasks\avast! Emergency Update
2015-05-01 16:28 - 2015-01-07 21:12 - 01047320 _____ (Avast Software s.r.o.)
C:\Windows\system32\Drivers\aswSnx.sys
2015-05-01 16:28 - 2015-01-07 21:12 - 00442264 _____ (Avast Software s.r.o.)
C:\Windows\system32\Drivers\aswSP.sys
2015-05-01 16:28 - 2015-01-07 21:12 - 00272248 _____ ()
C:\Windows\system32\Drivers\aswVmm.sys
2015-05-01 16:28 - 2015-01-07 21:12 - 00137288 _____ (Avast Software s.r.o.)
C:\Windows\system32\Drivers\aswStm.sys
2015-05-01 16:28 - 2015-01-07 21:12 - 00093528 _____ (Avast Software s.r.o.)
C:\Windows\system32\Drivers\aswRdr2.sys
2015-05-01 16:28 - 2015-01-07 21:12 - 00089944 _____ (Avast Software s.r.o.)
C:\Windows\system32\Drivers\aswMonFlt.sys
2015-05-01 16:28 - 2015-01-07 21:12 - 00065736 _____ ()
C:\Windows\system32\Drivers\aswRvrt.sys
2015-05-01 16:28 - 2015-01-07 21:12 - 00029168 _____ ()
C:\Windows\system32\Drivers\aswHwid.sys
==================== Files in the root of some directories =======
2015-01-23 17:37 - 2015-01-23 17:37 - 0000021 _____ () C:\Users\Duc
Hong\AppData\Roaming\my_intel.sys
2015-01-07 20:14 - 2015-05-27 05:49 - 0000074 _____ () C:\Users\Duc
Hong\AppData\Roaming\sp_data.sys
2015-01-07 21:37 - 2015-01-07 21:37 - 0000002 ____H () C:\Users\Duc
Hong\AppData\Roaming\win.dat
2015-05-09 14:32 - 2015-05-09 14:32 - 0000218 _____ () C:\Users\Duc
Hong\AppData\Local\recently-used.xbel
2015-01-22 00:28 - 2015-01-28 16:59 - 0007618 _____ () C:\Users\Duc
Hong\AppData\Local\Resmon.ResmonCfg
2014-07-12 08:51 - 2014-07-12 08:51 - 0000000 ____H ()
C:\ProgramData\DP45977C.lfl
2015-03-26 23:11 - 2015-03-26 23:11 - 0000040 _____ () C:\ProgramData\ra3.ini
2014-05-17 06:02 - 2012-09-07 21:40 - 0000256 _____ ()
C:\ProgramData\SetStretch.cmd
2014-05-17 06:02 - 2009-07-22 20:04 - 0024576 _____ ()
C:\ProgramData\SetStretch.exe
2014-05-17 06:02 - 2012-09-07 21:37 - 0000103 _____ ()
C:\ProgramData\SetStretch.VBS
Files to move or delete:
====================
C:\ProgramData\SetStretch.exe
C:\ProgramData\SetStretch.VBS
Some files in TEMP:
====================
C:\Users\Duc Hong\AppData\Local\Temp\npp.6.7.8.2.Installer.exe
C:\Users\Duc Hong\AppData\Local\Temp\xmlUpdater.exe
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2015-05-26 22:51
==================== End of log ============================
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 27-05-2015
Ran by Duc Hong at 2015-05-28 00:09:28
Running from C:\Users\Duc Hong\Downloads\Programs
Boot Mode: Normal
==========================================================
==================== Accounts: =============================
Administrator (S-1-5-21-1926068397-2398490202-140176465-500 - Administrator -
Disabled)
Duc Hong (S-1-5-21-1926068397-2398490202-140176465-1002 - Administrator -
Enabled) => C:\Users\Duc Hong
Guest (S-1-5-21-1926068397-2398490202-140176465-501 - Limited - Disabled)
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Windows Defender (Disabled - Up to date)
{D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AV: avast! Antivirus (Enabled - Up to date)
{17AD7D40-BA12-9C46-7131-94903A54AD8B}
AS: Windows Defender (Disabled - Up to date)
{D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: avast! Antivirus (Enabled - Up to date)
{ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to
unhide them. The adware programs should be uninstalled manually.)
µTorrent (HKLM-x32\...\uTorrent) (Version: 3.2.3.28705 - BitTorrent Inc.)
7-Zip 9.38 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0938-000001000000})
(Version: 9.38.00.0 - Igor Pavlov)
Adobe Flash Player 16 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version:
16.0.0.235 - Adobe Systems Incorporated)
Apple Application Support (32-bit)
(HKLM-x32\...\{2FE00055-C4F3-4F7A-AEDD-E198D54CF12F}) (Version: 3.1.1 - Apple
Inc.)
Apple Mobile Device Support (HKLM\...\{19DED56B-657D-41DA-9EB0-7C20DDF6A613})
(Version: 8.1.0.18 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE})
(Version: 2.1.3.127 - Apple Inc.)
ASUS Console (HKLM\...\{6D989E08-8143-4AB8-B0A8-5B836235CAA4}) (Version: 1.0.5 -
ASUS)
Asus FaceID (HKLM-x32\...\{C4071085-DDF0-403F-90F9-27582FC22C9B}) (Version:
7.7.6.1 - ASUS)
ASUS Instant Key (HKLM-x32\...\{D97A1B80-131F-4692-9543-E652956D8B99}) (Version:
1.1.7 - ASUS)
ASUS Live Update (HKLM-x32\...\{FA540E67-095C-4A1B-97BA-4D547DEC9AF4}) (Version:
3.3.4 - ASUS)
ASUS Power4Gear Hybrid (HKLM\...\{9B6239BF-4E85-4590-8D72-51E30DB1A9AA})
(Version: 3.0.8 - ASUS)
ASUS Smart Gesture (HKLM-x32\...\{4D3286A6-F6AB-498A-82A4-E4F040529F3D})
(Version: 2.2.10 - ASUS)
ASUS Splendid Video Enhancement Technology
(HKLM-x32\...\{0969AF05-4FF6-4C00-9406-43599238DE0D}) (Version: 2.01.0021 -
ASUS)
ATK Package (HKLM-x32\...\{AB5C933E-5C7D-4D30-B314-9C83A49B94BE}) (Version:
1.0.0031 - ASUS)
ATLAS Translation Standard V14.0 Trial Version
(HKLM-x32\...\{6652750B-AA69-49B7-9D09-C0A28B6FFC9F}) (Version: 14.00.2000 -
FUJITSU LIMITED)
Auslogics DiskDefrag (HKLM-x32\...\{DF6A13C0-77DF-41FE-BD05-6D5201EB0CE7}_is1)
(Version: 5.4.0.0 - Auslogics Labs Pty Ltd)
Avast Free Antivirus (HKLM-x32\...\Avast) (Version: 10.2.2218 - AVAST Software)
Avidemux 2.6 - 64bits (HKLM-x32\...\Avidemux 2.6 - 64bits (64-bit)) (Version:
2.6.9.00 - )
BatteryBar (remove only) (HKLM\...\BatteryBar) (Version: - )
Bluefish 2.2.7 (HKLM-x32\...\Bluefish) (Version: 2.2.7 - The Bluefish
Developers)
BlueJ (HKLM-x32\...\{7D66971C-652B-4065-A6B1-B3EE313C254B}) (Version: 3.1.4 -
BlueJ Team)
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 -
Apple Inc.)
CCleaner (HKLM\...\CCleaner) (Version: 5.06 - Piriform)
CodeBlocks (HKU\S-1-5-21-1926068397-2398490202-140176465-1002\...\CodeBlocks)
(Version: 13.12 - The Code::Blocks Team)
Color Cop 5.4.3 (HKLM-x32\...\Color Cop_is1) (Version: - Jay Prall)
Command & Conquer™ Red Alert™ 3
(HKLM\...\{296D8550-CB06-48E4-9A8B-E5034FB64715}) (Version: 1.0.1.0 - Electronic
Arts)
Command & Conquer™ Red Alert™ 3
(HKLM-x32\...\{296D8550-CB06-48E4-9A8B-E5034FB64715}) (Version: 1.0.1.0 -
Electronic Arts)
Counter-Strike: Global Offensive (HKLM-x32\...\Steam App 730) (Version: -
Valve)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
DAEMON Tools Lite (HKLM-x32\...\DAEMON Tools Lite) (Version: 4.49.1.0356 - Disc
Soft Ltd)
Defraggler (HKLM\...\Defraggler) (Version: 2.19 - Piriform)
Everything 1.3.4.686 (x64) (HKLM\...\Everything) (Version: - )
Explorer Suite IV (HKLM\...\Explorer Suite_is1) (Version: - )
FarCry 4 (HKLM-x32\...\Uplay Install 420) (Version: - Ubisoft)
FileHippo App Manager (HKLM-x32\...\FileHippo.com) (Version: - FileHippo.com)
Foxit PhantomPDF Business (HKLM-x32\...\{8A601904-4113-40FE-9DCC-7A38CE1A8032})
(Version: 7.0.6.1126 - Foxit Software Inc.)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 43.0.2357.81 - Google Inc.)
Google Talk Plugin (HKLM-x32\...\{CA3DD97D-1FD7-37A7-BD5C-FC4430C8B8E6})
(Version: 5.41.2.0 - Google)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.27.5 - Google Inc.) Hidden
HandBrake 0.10.1 (HKLM-x32\...\HandBrake) (Version: 0.10.1 - )
HD Tune Pro 5.50 (HKLM-x32\...\HD Tune Pro_is1) (Version: - EFD Software)
Intel® Driver Update Utility 2.0 (x32 Version: 2.0.0.29 - Intel) Hidden
Intel® Management Engine Components
(HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 9.5.14.1724 -
Intel Corporation)
Intel® Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA})
(Version: 10.18.10.3355 - Intel Corporation)
Intel® Wireless Bluetooth®(patch version 17.1.1449.356)
(HKLM\...\{302600C1-6BDF-4FD1-1411-148929CC1385}) (Version: 17.1.1411.0506 -
Intel Corporation)
Intel® Driver Update Utility
(HKLM-x32\...\{8409c4f7-2340-4933-a304-5d37db4fb48b}) (Version: 2.0.0.29 -
Intel)
Intel® PROSet/Wireless Software
(HKLM-x32\...\{a9888f41-68ae-43df-bd7d-d93405a44106}) (Version: 17.13.11 - Intel
Corporation)
Internet Download Manager (HKLM-x32\...\Internet Download Manager) (Version: -
Tonec Inc.)
IrfanView (remove only) (HKLM-x32\...\IrfanView) (Version: 4.38 - Irfan Skiljan)
iTunes (HKLM\...\{2EA80E9F-C811-41BB-ABAC-F270B4B39BC6}) (Version: 12.1.0.71 -
Apple Inc.)
Java 8 Update 45 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86418045F0})
(Version: 8.0.450 - Oracle Corporation)
Java 8 Update 45 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218045F0}) (Version:
8.0.450 - Oracle Corporation)
Java SE Development Kit 8 Update 40 (64-bit)
(HKLM\...\{64A3A4F4-B792-11D6-A78A-00B0D0180400}) (Version: 8.0.400.26 - Oracle
Corporation)
Junk Mail filter update (x32 Version: 16.4.3528.0331 - Microsoft Corporation)
Hidden
K-Lite Codec Pack 11.0.8 Full (HKLM-x32\...\KLiteCodecPack_is1) (Version: 11.0.8
- )
Malwarebytes Anti-Malware version 2.1.6.1022 (HKLM-x32\...\Malwarebytes
Anti-Malware_is1) (Version: 2.1.6.1022 - Malwarebytes Corporation)
MediaCoder x64 0.8.34.5716 (HKLM\...\MediaCoder x64) (Version: 0.8.34.5716 -
Mediatronic)
Microsoft ASP.NET MVC 4 Runtime
(HKLM-x32\...\{3FE312D5-B862-40CE-8E4E-A6D8ABF62736}) (Version: 4.0.40804.0 -
Microsoft Corporation)
Microsoft Office Professional Plus 2010 (HKLM\...\Office14.PROPLUS) (Version:
14.0.7015.1000 - Microsoft Corporation)
Microsoft OneDrive
(HKU\S-1-5-21-1926068397-2398490202-140176465-1002\...\OneDriveSetup.exe)
(Version: 17.0.4035.0328 - Microsoft Corporation)
Microsoft Outlook Hotmail Connector 64-bit
(HKLM\...\{95140000-007A-0409-1000-0000000FF1CE}) (Version: 14.0.5118.5000 -
Microsoft Corporation)
Microsoft Outlook Social Connector Provider for Windows Live Messenger 64-bit
(HKLM\...\{95140000-007D-0409-1000-0000000FF1CE}) (Version: 14.0.5120.5000 -
Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00})
(Version: 5.1.40416.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU]
(HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 -
Microsoft Corporation)
Microsoft Visio Professional 2010 (HKLM\...\Office14.VISIOR) (Version:
14.0.7015.1000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable
(HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 -
Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
(HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 -
Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148
(HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 -
Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
(HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 -
Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
(HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 -
Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
(HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 -
Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
(HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 -
Microsoft Corporation)
Microsoft Visual C++ 2010 Redistributable - x64 10.0.40219
(HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 -
Microsoft Corporation)
Microsoft Visual C++ 2010 Redistributable - x86 10.0.40219
(HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 -
Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030
(HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 -
Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030
(HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 -
Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005
(HKLM-x32\...\{ce085a78-074e-4823-8dc1-8a721b94b76d}) (Version: 12.0.21005.1 -
Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft
Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 -
Microsoft Corporation)
Movie Maker (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Mozilla Firefox 37.0.1 (x86 en-US) (HKLM-x32\...\Mozilla Firefox 37.0.1 (x86
en-US)) (Version: 37.0.1 - Mozilla)
Mozilla Firefox 38.0.1 (x86 en-US)
(HKU\S-1-5-21-1926068397-2398490202-140176465-1002\...\Mozilla Firefox 38.0.1
(x86 en-US)) (Version: 38.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version:
36.0.3 - Mozilla)
MyDefrag v4.3.1 (HKLM\...\MyDefrag v4.3.1_is1) (Version: 4.0.0.0 - J.C. Kessels)
NEKOPARA vol.1
(HKU\S-1-5-21-1926068397-2398490202-140176465-1002\...\{64DC04AF-BD7C-4CF4-9CA4-938953224328})
(Version: - NEKO WORKs)
Notepad++ (HKLM-x32\...\Notepad++) (Version: 6.7.8.2 - Notepad++ Team)
NVIDIA GeForce Experience 2.4.3.22
(HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version:
2.4.3.22 - NVIDIA Corporation)
NVIDIA Graphics Driver 350.05
(HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version:
350.05 - NVIDIA Corporation)
NVIDIA PhysX System Software 9.15.0324
(HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version:
9.15.0324 - NVIDIA Corporation)
Oracle VM VirtualBox 4.3.28 (HKLM\...\{E8BB81BC-E67C-4750-84EE-128DA5A7ADA5})
(Version: 4.3.28 - Oracle Corporation)
Potplayer (HKLM-x32\...\PotPlayer) (Version: - Daum Kakao Corp.)
Rainmeter (HKLM-x32\...\Rainmeter) (Version: 3.2.1 r2386 - )
Realtek Card Reader (HKLM-x32\...\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A})
(Version: 6.2.9200.39048 - Realtek Semiconductor Corp.)
Realtek Ethernet Controller Driver
(HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 8.20.815.2013 -
Realtek)
Revo Uninstaller Pro 3.0.2 (HKLM\...\{67579783-0FB7-4F7B-B881-E5BE47C9DBE0}_is1)
(Version: 3.0.2 - VS Revo Group, Ltd.)
RW-Everything v1.6.5.9 (HKLM\...\RW-Everything_is1) (Version: - )
Service Pack 2 for Microsoft Office 2010 (KB2687455) 64-Bit Edition
(HKLM\...\{90140000-0011-0000-1000-0000000FF1CE}_Office14.PROPLUS_{A3364707-2F53-4C83-8F68-C9877A9080C7})
(Version: - Microsoft)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 64-Bit Edition
(HKLM\...\{91140000-0057-0000-1000-0000000FF1CE}_Office14.VISIOR_{3C578F10-F74F-4655-B2A6-9F88A6C415E8})
(Version: - Microsoft)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 64-Bit Edition (Version: -
Microsoft) Hidden
SHIELD Streaming (Version: 4.1.1000 - NVIDIA Corporation) Hidden
SHIELD Wireless Controller Driver (Version: 2.4.3.22 - NVIDIA Corporation)
Hidden
Sid Meier's Civilization V (HKLM-x32\...\Steam App 8930) (Version: - 2K Games,
Inc.)
Skype Click to Call (HKLM-x32\...\{6D1221A9-17BF-4EC0-81F2-27D30EC30701})
(Version: 7.3.16540.9015 - Microsoft Corporation)
Skype™ 7.4 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version:
7.4.102 - Skype Technologies S.A.)
SoftEther VPN Client (HKLM\...\softether_sevpnclient) (Version: 4.12.9514 -
SoftEther VPN Project)
Speccy (HKLM\...\Speccy) (Version: 1.28 - Piriform)
Spotify (HKU\S-1-5-21-1926068397-2398490202-140176465-1002\...\Spotify)
(Version: 1.0.3.101.gbfa97dfe - Spotify AB)
Steam (HKLM-x32\...\Steam) (Version: 2.10.91.91 - Valve Corporation)
Synei System Utilities (HKLM-x32\...\{BFDC3B26-7DB0-43D3-BC84-7E9649C157EA}_is1)
(Version: 2.25 - Synei)
System Requirements Lab (HKLM-x32\...\{0F659036-14C7-4622-9505-35A0DC93526A})
(Version: 6.1.3.0 - Husdawg, LLC)
Team Fortress 2 (HKLM-x32\...\Steam App 440) (Version: - Valve)
TeraCopy 2.3 (HKLM\...\TeraCopy_is1) (Version: - Code Sector)
The Elder Scrolls V: Skyrim (HKLM-x32\...\Steam App 72850) (Version: - Bethesda
Game Studios)
The Witcher 2: Assassins of Kings Enhanced Edition (HKLM-x32\...\Steam App
20920) (Version: - CD PROJEKT RED)
Unity Web Player
(HKU\S-1-5-21-1926068397-2398490202-140176465-1002\...\UnityWebPlayer) (Version:
5.0.2f1 - Unity Technologies ApS)
Unlocker 1.9.2 (HKLM\...\Unlocker) (Version: 1.9.2 - Cedrick Collomb)
Update for Japanese Microsoft IME Postal Code Dictionary
(HKLM-x32\...\{15015752-9990-4516-A2B1-93823281FB8E}) (Version: 15.0.1759 -
Microsoft Corporation)
Update for Japanese Microsoft IME Standard Dictionary
(HKLM-x32\...\{7DB71278-9AD7-4480-AB08-8649C5010B17}) (Version: 15.0.1215 -
Microsoft Corporation)
Update for Japanese Microsoft IME Standard Extended Dictionary
(HKLM-x32\...\{78CE66A9-85AF-4BD8-8FB7-35B5F3846C00}) (Version: 15.0.1215 -
Microsoft Corporation)
Uplay (HKLM-x32\...\Uplay) (Version: 4.8 - Ubisoft)
VMware Player (HKLM-x32\...\VMware_Player) (Version: 7.1.0 - VMware, Inc)
VMware Player (Version: 7.1.0 - VMware, Inc.) Hidden
Warframe (HKLM-x32\...\Steam App 230410) (Version: - Digital Extremes)
WebStorage (HKLM-x32\...\WebStorage) (Version: 2.1.2.301 - ASUS Cloud
Corporation)
Windows Driver Package - ASUS (ATP) Mouse (01/07/2014 1.0.0.197)
(HKLM\...\2BEE838DC3D664A0CAB23AEA0332BB3877ED0685) (Version: 01/07/2014
1.0.0.197 - ASUS)
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3528.0331 -
Microsoft Corporation)
WinFlash (HKLM-x32\...\{8F21291E-0444-4B1D-B9F9-4370A73E346D}) (Version: 2.42.0
- ASUS)
WinPcap 4.1.3 (HKLM-x32\...\WinPcapInst) (Version: 4.1.0.2980 - Riverbed
Technology, Inc.)
WinRAR 5.20 (64-bit) (HKLM\...\WinRAR archiver) (Version: 5.20.0 - win.rar GmbH)
Wireshark 1.12.5 (64-bit) (HKLM-x32\...\Wireshark) (Version: 1.12.5 - The
Wireshark developer community, http://www.wireshark.org)
==================== Custom CLSID (Whitelisted): ==========================
(If an entry is included in the fixlist, it will be removed from the registry.
The file will not be moved unless listed separately.)
CustomCLSID:
HKU\S-1-5-21-1926068397-2398490202-140176465-1002_Classes\CLSID\{1423F872-3F7F-4E57-B621-8B1A9D49B448}\InprocServer32
-> C:\Users\Duc Hong\AppData\Local\Google\Update\1.3.27.5\psuser_64.dll (Google
Inc.)
CustomCLSID:
HKU\S-1-5-21-1926068397-2398490202-140176465-1002_Classes\CLSID\{E8CF3E55-F919-49D9-ABC0-948E6CB34B9F}\InprocServer32
-> C:\Users\Duc Hong\AppData\Local\Google\Update\1.3.27.5\psuser_64.dll (Google
Inc.)
CustomCLSID:
HKU\S-1-5-21-1926068397-2398490202-140176465-1002_Classes\CLSID\{F8071786-1FD0-4A66-81A1-3CBE29274458}\InprocServer32
-> C:\Users\Duc
Hong\AppData\Local\Microsoft\SkyDrive\17.0.4035.0328\amd64\FileSyncApi64.dll
(Microsoft Corporation)
==================== Restore Points =========================
26-05-2015 15:59:24 Windows Live Essentials
26-05-2015 16:01:59 WLSetup
==================== Hosts content: ===============================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2013-08-22 23:25 - 2015-02-11 01:00 - 00000793 ____A
C:\Windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (Whitelisted) =============
(If an entry is included in the fixlist, it will be removed from the registry.
The file will not be moved unless listed separately.)
Task: {0672CE47-9AF2-49B5-BA4A-D987C76AF085} -
System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1926068397-2398490202-140176465-1002UA
=> C:\Users\Duc Hong\AppData\Local\Google\Update\GoogleUpdate.exe [2015-04-17]
(Google Inc.)
Task: {0B01FB0E-B462-46B8-816C-2444A6441DB3} - System32\Tasks\ASUS Smart Gesture
Launcher => C:\Program Files (x86)\ASUS\ASUS Smart
Gesture\AsTPCenter\x64\AsusTPLauncher.exe [2014-02-14] (AsusTek)
Task: {1BAF89D5-B76F-48CA-B114-034B69480F29} - System32\Tasks\ASUS Splendid
ColorU => C:\Program Files (x86)\ASUS\Splendid\ColorUService.exe [2013-10-08]
(ASUSTeK Computer Inc.)
Task: {1EB54610-9F30-42C5-93C1-9B6CBD358D7E} - System32\Tasks\RTKCPL =>
C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [2014-05-20] (Realtek
Semiconductor)
Task: {31E03131-2908-43E9-AE6D-CD1AC82DAD2F} - System32\Tasks\ASUS Console =>
C:\Program Files\ASUS\ASUS Console\ASUS Console Starter.exe [2014-02-07]
(ASUSTek Computer Inc.)
Task: {4E3FDD62-EABC-414B-8FBD-DBA444C5CA8A} -
System32\Tasks\Microsoft\Windows\Setup\gwx\refreshgwxconfig =>
C:\Windows\system32\GWX\GWXConfigManager.exe [2015-05-06] (Microsoft
Corporation)
Task: {760AE585-4971-4AD2-AFC4-DEA14F01B495} -
System32\Tasks\Microsoft\Windows\Setup\gwx\launchtrayprocess =>
C:\Windows\system32\GWX\GWX.exe [2015-05-06] (Microsoft Corporation)
Task: {766E80C1-FFF8-4F47-8FC3-4E533BAE0AC1} - System32\Tasks\Update Checker =>
C:\Program Files (x86)\ASUS\ASUS Live Update\UpdateChecker.exe [2015-02-12] ()
Task: {82F04444-7113-4278-B8C4-51A59E6C29E4} - System32\Tasks\RtHDVBg =>
C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [2014-05-13] (Realtek
Semiconductor)
Task: {9D746130-D7A9-4BB8-8E96-05093DEF9977} -
System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1926068397-2398490202-140176465-1002Core
=> C:\Users\Duc Hong\AppData\Local\Google\Update\GoogleUpdate.exe [2015-04-17]
(Google Inc.)
Task: {A508D830-687E-41AA-AF60-8916D26EAEBF} - System32\Tasks\CCleanerSkipUAC =>
C:\Program Files\CCleaner\CCleaner.exe [2015-05-09] (Piriform Ltd)
Task: {B0F0CAF5-E8BC-45C2-B67C-9C12294AF136} - System32\Tasks\AutoKMS =>
C:\Windows\AutoKMS\AutoKMS.exe [2015-01-08] ()
Task: {B905D56A-7E45-4939-90F9-416CB290E620} - System32\Tasks\AsusVibeSchedule
=> C:\Program Files (x86)\Asus\AsusVibe\AsusVibeLauncher.exe
Task: {BFBCA901-B92C-49C8-A07C-57F94EC4BD4A} - System32\Tasks\ASUS Live Update1
=> C:\Program Files (x86)\ASUS\ASUS Live Update\LiveUpdate.exe [2015-03-23]
(ASUSTeK Computer Inc.)
Task: {CB4E97FF-DC08-4AE9-B101-6EC041501D17} -
System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB =>
C:\Windows\system32\MRT.exe [2015-05-18] (Microsoft Corporation)
Task: {CE71F3E1-DE1E-4B42-A816-09F806D6EAFE} - System32\Tasks\Microsoft OneDrive
Auto Update Task-S-1-5-21-1926068397-2398490202-140176465-1002 =>
%localappdata%\Microsoft\SkyDrive\SkyDrive.exe
Task: {D54DEED3-1E09-43DD-A0D7-2534D4F95BFB} -
System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files
(x86)\Google\Update\GoogleUpdate.exe [2015-01-08] (Google Inc.)
Task: {EA345886-3FBF-4930-8FE1-DEAE05BA0372} - System32\Tasks\ASUS Splendid
ACMON => C:\Program Files (x86)\ASUS\Splendid\ACMON.exe [2013-10-08] (ASUS)
Task: {F6441995-B4CF-4A06-BBE6-5BE2EE55D8EA} - System32\Tasks\avast! Emergency
Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2015-05-01]
(Avast Software s.r.o.)
Task: {F87A5893-944C-45F8-AF4F-42245D864FF7} -
System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files
(x86)\Google\Update\GoogleUpdate.exe [2015-01-08] (Google Inc.)
Task: C:\Windows\Tasks\AutoKMS.job => C:\Windows\AutoKMS\AutoKMS.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files
(x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files
(x86)\Google\Update\GoogleUpdate.exe
Task:
C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1926068397-2398490202-140176465-1002Core.job
=> C:\Users\Duc Hong\AppData\Local\Google\Update\GoogleUpdate.exe
Task:
C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1926068397-2398490202-140176465-1002UA.job
=> C:\Users\Duc Hong\AppData\Local\Google\Update\GoogleUpdate.exe
==================== Loaded Modules (Whitelisted) ==============
2015-02-20 08:01 - 2015-02-20 08:01 - 00022528 _____ ()
C:\Windows\System32\us001lm.dll
2014-07-12 09:01 - 2013-08-27 09:29 - 00755728 _____ ()
C:\Windows\SYSTEM32\sqlite3.dll
2015-04-26 23:21 - 2015-04-02 17:19 - 00117392 _____ () C:\Program Files\NVIDIA
Corporation\Display\NvSmartMax64.dll
2013-09-04 23:17 - 2013-09-04 23:17 - 04300456 _____ () C:\Program Files\Common
Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF
2010-10-20 14:23 - 2010-10-20 14:23 - 08801632 _____ () C:\Program
Files\Microsoft Office\Office14\1033\GrooveIntlResource.dll
2015-03-24 23:28 - 2015-03-24 23:28 - 00036544 _____ () C:\Program
Files\Rainmeter\Rainmeter.exe
2015-03-24 23:28 - 2015-03-24 23:28 - 00775872 _____ () C:\Program
Files\Rainmeter\Rainmeter.dll
2015-03-24 23:28 - 2015-03-24 23:28 - 00022528 _____ () C:\Program
Files\Rainmeter\Plugins\InputText.dll
2015-03-24 23:27 - 2015-03-24 23:27 - 00011776 _____ () C:\Program
Files\Rainmeter\Plugins\PowerPlugin.DLL
2015-03-24 23:27 - 2015-03-24 23:27 - 00022016 _____ () C:\Program
Files\Rainmeter\Plugins\WifiStatus.DLL
2015-03-24 23:27 - 2015-03-24 23:27 - 00020992 _____ () C:\Program
Files\Rainmeter\Plugins\SysInfo.DLL
2015-03-24 23:27 - 2015-03-24 23:27 - 00058368 _____ () C:\Program
Files\Rainmeter\Plugins\WebParser.DLL
2015-03-24 23:27 - 2015-03-24 23:27 - 00023040 _____ () C:\Program
Files\Rainmeter\Plugins\Win7AudioPlugin.DLL
2010-07-15 14:44 - 2010-07-15 14:44 - 00020032 _____ () C:\Program
Files\Unlocker\UnlockerCOM.dll
2015-04-16 06:13 - 2015-04-16 06:13 - 00222720 _____ () C:\Program Files
(x86)\Notepad++\NppShell_06.dll
2015-05-01 16:28 - 2015-05-01 16:28 - 00104400 _____ () C:\Program Files\AVAST
Software\Avast\log.dll
2015-05-01 16:28 - 2015-05-01 16:28 - 00081728 _____ () C:\Program Files\AVAST
Software\Avast\JsonRpcServer.dll
2015-05-26 23:07 - 2015-05-26 23:07 - 02948096 _____ () C:\Program Files\AVAST
Software\Avast\defs\15052600\algo.dll
2015-01-20 21:35 - 2015-01-20 21:35 - 00073544 _____ () C:\Program Files
(x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2015-01-20 21:35 - 2015-01-20 21:35 - 01044776 _____ () C:\Program Files
(x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2015-02-06 17:40 - 2015-02-06 17:40 - 01301696 _____ () C:\Program Files
(x86)\VMware\VMware Player\libxml2.dll
2014-07-12 08:47 - 2013-09-04 09:52 - 01242584 _____ () C:\Program Files
(x86)\Intel\Intel® Management Engine Components\LMS\ACE.dll
2013-09-10 11:23 - 2013-09-10 11:23 - 00162816 _____ () C:\Program Files
(x86)\ASUS\Splendid\CCTAdjust.dll
2013-10-09 13:41 - 2013-10-09 13:41 - 00037968 _____ () C:\Program Files
(x86)\ASUS\Splendid\DetectDisplayDC.dll
2015-04-26 23:22 - 2015-05-02 02:52 - 00011920 _____ () C:\Program Files
(x86)\NVIDIA Corporation\Update Core\detoured.dll
2015-03-20 15:31 - 2015-03-20 15:31 - 40540672 _____ () C:\Program Files\AVAST
Software\Avast\libcef.dll
2013-04-27 10:24 - 2013-04-27 10:24 - 00071680 _____ () C:\Program Files
(x86)\ASUS\ASUS Live Update\checkmetro.dll
==================== Alternate Data Streams (Whitelisted) =========
(If an entry is included in the fixlist, only the ADS will be removed.)
==================== Safe Mode (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry.
The "AlternateShell" will be restored.)
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcpltsvc => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcpltsvc => ""=""
==================== EXE Association (Whitelisted) ===============
(If an entry is included in the fixlist, the registry item will be restored to
default or removed.)
==================== Internet Explorer trusted/restricted ===============
(If an entry is included in the fixlist, it will be removed from the registry.)
==================== Other Areas ============================
(Currently there is no automatic fix for this section.)
HKU\S-1-5-21-1926068397-2398490202-140176465-1002\Control
Panel\Desktop\\Wallpaper -> C:\Users\Duc
Hong\AppData\Roaming\IrfanView\IrfanView_Wallpaper.bmp
DNS Servers: 192.168.1.1
==================== MSCONFIG/TASK MANAGER disabled items ==
(Currently there is no automatic fix for this section.)
HKLM\...\StartupApproved\StartupFolder: => "SoftEther VPN Client Manager
Startup.lnk"
HKLM\...\StartupApproved\Run: => "ShadowPlay"
HKLM\...\StartupApproved\Run32: => "ASUSPRP"
HKLM\...\StartupApproved\Run32: => "WebStorage"
HKU\S-1-5-21-1926068397-2398490202-140176465-1002\...\StartupApproved\Run: =>
"FlashPlayerUpdate"
HKU\S-1-5-21-1926068397-2398490202-140176465-1002\...\StartupApproved\Run: =>
"Google Update"
HKU\S-1-5-21-1926068397-2398490202-140176465-1002\...\StartupApproved\Run: =>
"DevidAgent"
==================== FirewallRules (Whitelisted) ===============
(If an entry is included in the fixlist, it will be removed from the registry.
The file will not be moved unless listed separately.)
FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139
FirewallRules: [Daum PotPlayer(PotPlayerMini.exe)] => (Allow) C:\Program Files
(x86)\DAUM\PotPlayer\PotPlayerMini.exe
FirewallRules: [{6AD7A4C1-520C-4938-83E9-8C3D4AF4470B}] => (Allow) C:\Program
Files (x86)\DAUM\PotPlayer\PotPlayerMini.exe
FirewallRules: [TCP Query
User{B408D18C-6D03-4CC8-9E8F-41FF22643530}C:\windows\microsoft.net\framework\v2.0.50727\vbc.exe]
=> (Allow) C:\windows\microsoft.net\framework\v2.0.50727\vbc.exe
FirewallRules: [UDP Query
User{A1BDE586-1E5F-4E70-83A1-C3724D86FBEA}C:\windows\microsoft.net\framework\v2.0.50727\vbc.exe]
=> (Allow) C:\windows\microsoft.net\framework\v2.0.50727\vbc.exe
FirewallRules: [{46831999-F626-41E8-A1AB-F3130E61A535}] => (Allow)
E:\Temp\Steam\Steam.exe
FirewallRules: [{24C0EBEB-6AAB-4281-B843-FC830B4FEB52}] => (Allow)
E:\Temp\Steam\Steam.exe
FirewallRules: [{AED3302F-B17D-4701-9390-ED277A47C947}] => (Allow)
E:\Temp\Steam\steamapps\common\Skyrim\SkyrimLauncher.exe
FirewallRules: [{259FAB07-4841-4498-8702-1C73EE758BF7}] => (Allow)
E:\Temp\Steam\steamapps\common\Skyrim\SkyrimLauncher.exe
FirewallRules: [{F2D50447-ADCB-4ACF-A732-83AA56A4E7A9}] => (Allow) C:\Program
Files\SoftEther VPN Client\vpnclient_x64.exe
FirewallRules: [{332E3FF6-209A-48A4-A6EC-7423A11D35B6}] => (Allow) C:\Program
Files\SoftEther VPN Client\vpncmgr.exe
FirewallRules: [{8284D947-F7E8-4B89-A26F-A0AD5FD80F82}] => (Allow) C:\Program
Files\SoftEther VPN Client\vpncmd_x64.exe
FirewallRules: [{A44E3BA8-FD16-4235-9303-E17CA8FF8D6D}] => (Allow) C:\Program
Files\SoftEther VPN Client\vpncmgr_x64.exe
FirewallRules: [{5647D39A-F124-4953-ACEC-254F04260C4D}] => (Allow) C:\Program
Files\SoftEther VPN Client\vpnclient.exe
FirewallRules: [{BB5EAF98-68DC-4481-BDA2-0F92653D1BE9}] => (Allow) C:\Program
Files\SoftEther VPN Client\vpncmd.exe
FirewallRules: [SPPSVC-In-TCP] => (Allow) %SystemRoot%\system32\sppextcomobj.exe
FirewallRules: [SPPSVC-In-TCP-NoScope] => (Allow)
%SystemRoot%\system32\sppextcomobj.exe
FirewallRules: [{2BFDCA10-D873-4098-A023-AF8A8D52659D}] => (Allow) C:\Users\Duc
Hong\AppData\Roaming\Spotify\spotify.exe
FirewallRules: [{95AFAF81-213D-48BB-9D2E-9FC489C69485}] => (Allow) C:\Users\Duc
Hong\AppData\Roaming\Spotify\spotify.exe
FirewallRules: [{E419D7CD-9FEB-40AD-8036-CEF8EE2A3E58}] => (Allow) C:\Program
Files (x86)\uTorrent\uTorrent.exe
FirewallRules: [{7EB67D77-8A9B-425E-8A9D-556828BD9F2A}] => (Allow) C:\Program
Files (x86)\uTorrent\uTorrent.exe
FirewallRules: [{E7314D54-19FD-4376-952A-C283F866565A}] => (Allow)
E:\Temp\Steam\steamapps\common\Team Fortress 2\hl2.exe
FirewallRules: [{A9537D58-5E28-443C-9DF3-773B75BE8B9C}] => (Allow)
E:\Temp\Steam\steamapps\common\Team Fortress 2\hl2.exe
FirewallRules: [{5405FDE4-13D9-46A4-BA72-2C3D637A820A}] => (Allow)
E:\Temp\Steam\steamapps\common\Sid Meier's Civilization V\Launcher.exe
FirewallRules: [{4D112B3C-965E-4D2B-8A4C-A3BC7790EB24}] => (Allow)
E:\Temp\Steam\steamapps\common\Sid Meier's Civilization V\Launcher.exe
FirewallRules: [{57563CA2-4C58-4DB6-A9D8-63CCEE8D3D58}] => (Allow) C:\Program
Files\Intel\WiFi\bin\PanDhcpDns.exe
FirewallRules: [{EECB906E-0A72-4349-ABC2-51F722808688}] => (Allow) C:\Program
Files (x86)\VMware\VMware Player\vmware-authd.exe
FirewallRules: [{E113D9E6-3F09-4DFD-9AE0-63C1DDFBFF5F}] => (Allow) C:\Program
Files (x86)\VMware\VMware Player\vmware-authd.exe
FirewallRules: [TCP Query User{D2BD56E1-FECA-4760-BFF6-7B483CFCD029}C:\program
files (x86)\mozilla firefox\firefox.exe] => (Allow) C:\program files
(x86)\mozilla firefox\firefox.exe
FirewallRules: [UDP Query User{31909EE8-B773-4D7F-8A9B-F43C433277C1}C:\program
files (x86)\mozilla firefox\firefox.exe] => (Allow) C:\program files
(x86)\mozilla firefox\firefox.exe
FirewallRules: [{D584DDB2-8E7C-45B2-828F-ACE4C55E5EEF}] => (Allow) C:\Program
Files\Bonjour\mDNSResponder.exe
FirewallRules: [{0E7DD122-51EE-4061-BA2E-AC6519ACC2AD}] => (Allow) C:\Program
Files\Bonjour\mDNSResponder.exe
FirewallRules: [{55B30F08-3CE8-40C4-A149-EC7C5462450F}] => (Allow) C:\Program
Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{6A093041-DBDC-47C2-A540-CFBC73668DB9}] => (Allow) C:\Program
Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{2E92677B-4DF7-48B8-A955-03BC56D592A8}] => (Allow) C:\Program
Files (x86)\iTunes\iTunes.exe
FirewallRules: [{C61C7218-4C30-48CF-A3C2-6D208730DCEE}] => (Allow) C:\Users\Duc
Hong\AppData\Roaming\Spotify\spotify.exe
FirewallRules: [{0CB55171-3C48-4165-B73A-D3D703E0BF74}] => (Allow) C:\Users\Duc
Hong\AppData\Roaming\Spotify\spotify.exe
FirewallRules: [{62290C84-E203-48CD-96FE-25F287B35C58}] => (Allow) C:\Program
Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{CF008ED2-2D02-4F90-9DE1-AF2683AC3A75}] => (Allow) C:\Program
Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{4A2F08C8-3C2D-4E62-AB32-9E6F21033E5D}] => (Allow)
E:\Temp\Steam\steamapps\common\Counter-Strike Global Offensive\csgo.exe
FirewallRules: [{5A10E92E-14BC-4EA2-87C5-DFA76406A1B6}] => (Allow)
E:\Temp\Steam\steamapps\common\Counter-Strike Global Offensive\csgo.exe
FirewallRules: [{450E7EC7-2C50-4F23-96AB-7ECDB5C88FFC}] => (Allow) C:\Program
Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
FirewallRules: [{32706039-9609-4992-BEEB-8ED8864C4607}] => (Allow) C:\Program
Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
FirewallRules: [{F739246A-3A2D-4765-808B-7BB1F4458A55}] => (Allow) C:\Program
Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe
FirewallRules: [{B1667E06-E235-41E6-B974-A2480A44B3EA}] => (Allow) C:\Program
Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe
FirewallRules: [{C902004C-0182-4F8A-92B3-90CDD0848EEE}] => (Allow) C:\Program
Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{CA9C0864-93C5-4403-A96A-481A312E25AB}] => (Allow) C:\Program
Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{FB800EB4-BE51-4D8C-8E4F-CFC1270DB18B}] => (Allow)
E:\Temp\Steam\steamapps\common\Warframe\Tools\Launcher.exe
FirewallRules: [{C72A1B67-D93C-43AC-BE28-B0ACE3FE8839}] => (Allow)
E:\Temp\Steam\steamapps\common\Warframe\Tools\Launcher.exe
FirewallRules: [TCP Query User{EB9F9A8C-6653-487F-B17B-9F501F2579C1}C:\program
files (x86)\skype\phone\skype.exe] => (Allow) C:\program files
(x86)\skype\phone\skype.exe
FirewallRules: [UDP Query User{56B69EA0-F89E-4E3A-86A9-17B0A681F65D}C:\program
files (x86)\skype\phone\skype.exe] => (Allow) C:\program files
(x86)\skype\phone\skype.exe
FirewallRules: [{8D865167-D700-4BE4-9F4A-CA556B393C38}] => (Allow)
E:\Temp\Steam\steamapps\common\the witcher 2\Launcher.exe
FirewallRules: [{E0ABD53F-A995-438C-9AF4-7F12976B664F}] => (Allow)
E:\Temp\Steam\steamapps\common\the witcher 2\Launcher.exe
FirewallRules: [{70336664-A8F7-4643-8DE1-888C970ADC52}] => (Allow)
E:\Temp\Test\FarCry 4\bin\FarCry4.exe
FirewallRules: [{72959202-F7E2-4BC0-9E68-D9CE43FA28F0}] => (Allow)
E:\Temp\Test\FarCry 4\bin\FarCry4.exe
FirewallRules: [{A5616C7D-29F6-4A47-BCBB-F7E60F43C9E9}] => (Allow)
E:\Temp\Test\FarCry 4\bin\IGE_WPF64.exe
FirewallRules: [{5A969598-A826-47D0-ADB8-1F16B5161795}] => (Allow)
E:\Temp\Test\FarCry 4\bin\IGE_WPF64.exe
FirewallRules: [{6B564610-4D4B-4514-8E99-BA30320C8C45}] => (Allow) C:\Program
Files (x86)\Google\Chrome\Application\chrome.exe
FirewallRules: [{8275C44B-588A-44A8-AA31-5CA246C843D7}] => (Allow) C:\Users\Duc
Hong\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe
FirewallRules: [{341B590C-72BE-41C1-8D3B-81B7B97F31C4}] => (Allow) C:\Program
Files (x86)\Windows Live\Contacts\wlcomm.exe
FirewallRules: [{9C62EFEB-4763-4789-983E-C443E1323C56}] => (Allow) LPort=2869
FirewallRules: [{A0BBA649-A813-4E72-B461-002ADF599BB2}] => (Allow) LPort=1900
FirewallRules: [{7A1895A9-2842-4905-B03D-7FE4C9AE9DF0}] => (Allow) C:\Program
Files (x86)\Windows Live\Messenger\msnmsgr.exe
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (05/27/2015 08:28:22 PM) (Source: NvStreamSvc) (EventID: 2001) (User: )
Description: NvStreamSvcFailed continue stopping. [5]
Error: (05/27/2015 07:04:24 PM) (Source: NvStreamSvc) (EventID: 2001) (User: )
Description: NvStreamSvcFailed continue stopping. [6]
Error: (05/27/2015 06:55:22 PM) (Source: NvStreamSvc) (EventID: 2001) (User: )
Description: NvStreamSvcFailed continue stopping. [0]
Error: (05/27/2015 05:01:26 PM) (Source: Application Error) (EventID: 1000)
(User: )
Description: Faulting application name: defraggler64.exe, version: 2.18.0.945,
time stamp: 0x534528ea
Faulting module name: dbghelp.dll_unloaded, version: 6.3.9600.17787, time stamp:
0x551b69ca
Exception code: 0xc0000005
Fault offset: 0x0000000000113a70
Faulting process id: 0x1714
Faulting application start time: 0xdefraggler64.exe0
Faulting application path: defraggler64.exe1
Faulting module path: defraggler64.exe2
Report Id: defraggler64.exe3
Faulting package full name: defraggler64.exe4
Faulting package-relative application ID: defraggler64.exe5
Error: (05/27/2015 04:17:57 PM) (Source: NvStreamSvc) (EventID: 2001) (User: )
Description: NvStreamSvcFailed continue stopping. [0]
Error: (05/27/2015 05:48:26 AM) (Source: NvStreamSvc) (EventID: 2001) (User: )
Description: NvStreamSvcFailed continue stopping. [0]
Error: (05/26/2015 08:22:37 PM) (Source: NvStreamSvc) (EventID: 2001) (User: )
Description: NvStreamSvcFailed continue stopping. [5]
Error: (05/26/2015 08:03:08 PM) (Source: NvStreamSvc) (EventID: 2001) (User: )
Description: NvStreamSvcFailed continue stopping. [6]
Error: (05/26/2015 07:40:12 PM) (Source: NvStreamSvc) (EventID: 2001) (User: )
Description: NvStreamSvcFailed continue stopping. [6]
Error: (05/26/2015 06:35:40 PM) (Source: VSS) (EventID: 8193) (User: )
Description: Volume Shadow Copy Service error: Unexpected error calling routine
CoCreateInstance. hr = 0x80040154, Class not registered
.
Operation:
Instantiating VSS server
System errors:
=============
Error: (05/28/2015 00:07:30 AM) (Source: DCOM) (EventID: 10010) (User:
HongHoangPC)
Description: {1B1F472E-3221-4826-97DB-2C2324D389AE}
Error: (05/28/2015 00:07:00 AM) (Source: DCOM) (EventID: 10010) (User:
HongHoangPC)
Description: {BF6C1E47-86EC-4194-9CE5-13C15DCB2001}
Error: (05/28/2015 00:01:25 AM) (Source: DCOM) (EventID: 10010) (User:
HongHoangPC)
Description: {1B1F472E-3221-4826-97DB-2C2324D389AE}
Error: (05/28/2015 00:00:46 AM) (Source: DCOM) (EventID: 10010) (User:
HongHoangPC)
Description: {BF6C1E47-86EC-4194-9CE5-13C15DCB2001}
Error: (05/27/2015 11:56:16 PM) (Source: DCOM) (EventID: 10010) (User:
HongHoangPC)
Description: {1B1F472E-3221-4826-97DB-2C2324D389AE}
Error: (05/27/2015 11:55:37 PM) (Source: DCOM) (EventID: 10010) (User:
HongHoangPC)
Description: {BF6C1E47-86EC-4194-9CE5-13C15DCB2001}
Error: (05/27/2015 11:48:16 PM) (Source: DCOM) (EventID: 10010) (User:
HongHoangPC)
Description: {1B1F472E-3221-4826-97DB-2C2324D389AE}
Error: (05/27/2015 11:47:36 PM) (Source: DCOM) (EventID: 10010) (User:
HongHoangPC)
Description: {BF6C1E47-86EC-4194-9CE5-13C15DCB2001}
Error: (05/27/2015 11:10:25 PM) (Source: DCOM) (EventID: 10010) (User:
HongHoangPC)
Description: {1B1F472E-3221-4826-97DB-2C2324D389AE}
Error: (05/27/2015 11:09:44 PM) (Source: DCOM) (EventID: 10010) (User:
HongHoangPC)
Description: {BF6C1E47-86EC-4194-9CE5-13C15DCB2001}
Microsoft Office:
=========================
Error: (05/27/2015 08:28:22 PM) (Source: NvStreamSvc) (EventID: 2001) (User: )
Description: NvStreamSvcFailed continue stopping. [5]
Error: (05/27/2015 07:04:24 PM) (Source: NvStreamSvc) (EventID: 2001) (User: )
Description: NvStreamSvcFailed continue stopping. [6]
Error: (05/27/2015 06:55:22 PM) (Source: NvStreamSvc) (EventID: 2001) (User: )
Description: NvStreamSvcFailed continue stopping. [0]
Error: (05/27/2015 05:01:26 PM) (Source: Application Error) (EventID: 1000)
(User: )
Description:
defraggler64.exe2.18.0.945534528eadbghelp.dll_unloaded6.3.9600.17787551b69cac00000050000000000113a70171401d0984af3376023C:\Program
Files\Defraggler\defraggler64.exedbghelp.dll30e64e57-043e-11e5-82d4-7824afb1d22b
Error: (05/27/2015 04:17:57 PM) (Source: NvStreamSvc) (EventID: 2001) (User: )
Description: NvStreamSvcFailed continue stopping. [0]
Error: (05/27/2015 05:48:26 AM) (Source: NvStreamSvc) (EventID: 2001) (User: )
Description: NvStreamSvcFailed continue stopping. [0]
Error: (05/26/2015 08:22:37 PM) (Source: NvStreamSvc) (EventID: 2001) (User: )
Description: NvStreamSvcFailed continue stopping. [5]
Error: (05/26/2015 08:03:08 PM) (Source: NvStreamSvc) (EventID: 2001) (User: )
Description: NvStreamSvcFailed continue stopping. [6]
Error: (05/26/2015 07:40:12 PM) (Source: NvStreamSvc) (EventID: 2001) (User: )
Description: NvStreamSvcFailed continue stopping. [6]
Error: (05/26/2015 06:35:40 PM) (Source: VSS) (EventID: 8193) (User: )
Description: CoCreateInstance0x80040154, Class not registered
Operation:
Instantiating VSS server
CodeIntegrity Errors:
===================================
Date: 2015-05-17 02:43:02.789
Description: Windows is unable to verify the image integrity of the file
\Device\HarddiskVolume4\Windows\SysWOW64\drivers\DrvAgent64.SYS because file
hash could not be found on the system. A recent hardware or software change
might have installed a file that is signed incorrectly or damaged, or that might
be malicious software from an unknown source.
Date: 2015-05-17 02:43:02.723
Description: Windows is unable to verify the image integrity of the file
\Device\HarddiskVolume4\Windows\SysWOW64\drivers\DrvAgent64.SYS because file
hash could not be found on the system. A recent hardware or software change
might have installed a file that is signed incorrectly or damaged, or that might
be malicious software from an unknown source.
Date: 2015-05-17 02:43:02.658
Description: Windows is unable to verify the image integrity of the file
\Device\HarddiskVolume4\Windows\SysWOW64\drivers\DrvAgent64.SYS because file
hash could not be found on the system. A recent hardware or software change
might have installed a file that is signed incorrectly or damaged, or that might
be malicious software from an unknown source.
Date: 2015-05-17 02:43:02.595
Description: Windows is unable to verify the image integrity of the file
\Device\HarddiskVolume4\Windows\SysWOW64\drivers\DrvAgent64.SYS because file
hash could not be found on the system. A recent hardware or software change
might have installed a file that is signed incorrectly or damaged, or that might
be malicious software from an unknown source.
Date: 2015-05-17 02:43:02.527
Description: Windows is unable to verify the image integrity of the file
\Device\HarddiskVolume4\Windows\SysWOW64\drivers\DrvAgent64.SYS because file
hash could not be found on the system. A recent hardware or software change
might have installed a file that is signed incorrectly or damaged, or that might
be malicious software from an unknown source.
Date: 2015-05-17 02:43:02.462
Description: Windows is unable to verify the image integrity of the file
\Device\HarddiskVolume4\Windows\SysWOW64\drivers\DrvAgent64.SYS because file
hash could not be found on the system. A recent hardware or software change
might have installed a file that is signed incorrectly or damaged, or that might
be malicious software from an unknown source.
Date: 2015-05-17 02:43:02.397
Description: Windows is unable to verify the image integrity of the file
\Device\HarddiskVolume4\Windows\SysWOW64\drivers\DrvAgent64.SYS because file
hash could not be found on the system. A recent hardware or software change
might have installed a file that is signed incorrectly or damaged, or that might
be malicious software from an unknown source.
Date: 2015-05-17 02:43:02.333
Description: Windows is unable to verify the image integrity of the file
\Device\HarddiskVolume4\Windows\SysWOW64\drivers\DrvAgent64.SYS because file
hash could not be found on the system. A recent hardware or software change
might have installed a file that is signed incorrectly or damaged, or that might
be malicious software from an unknown source.
Date: 2015-05-17 02:42:58.259
Description: Windows is unable to verify the image integrity of the file
\Device\HarddiskVolume4\Windows\SysWOW64\drivers\DrvAgent64.SYS because file
hash could not be found on the system. A recent hardware or software change
might have installed a file that is signed incorrectly or damaged, or that might
be malicious software from an unknown source.
Date: 2015-05-17 02:42:58.195
Description: Windows is unable to verify the image integrity of the file
\Device\HarddiskVolume4\Windows\SysWOW64\drivers\DrvAgent64.SYS because file
hash could not be found on the system. A recent hardware or software change
might have installed a file that is signed incorrectly or damaged, or that might
be malicious software from an unknown source.
==================== Memory info ===========================
Processor: Intel® Core™ i7-4710HQ CPU @ 2.50GHz
Percentage of memory in use: 28%
Total physical RAM: 8075.06 MB
Available physical RAM: 5808.31 MB
Total Pagefile: 8587.06 MB
Available Pagefile: 6043.32 MB
Total Virtual: 131072 MB
Available Virtual: 131071.78 MB
==================== Drives ================================
Drive c: (OS) (Fixed) (Total:72.6 GB) (Free:22.92 GB) NTFS ==>[System with boot
components (obtained from reading drive)]
Drive d: (DucHong) (Fixed) (Total:418.9 GB) (Free:298.56 GB) NTFS
Drive e: (Miscellaneous) (Fixed) (Total:300 GB) (Free:80.84 GB) NTFS
Drive f: (Misc.2) (Fixed) (Total:118.9 GB) (Free:96.35 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (Size: 931.5 GB) (Disk ID: EE7E28CB)
Partition: GPT Partition Type.
==================== End of log ============================
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 27-05-2015
Ran by Duc Hong at 2015-05-28 00:09:28
Running from C:\Users\Duc Hong\Downloads\Programs
Boot Mode: Normal
==========================================================
==================== Accounts: =============================
Administrator (S-1-5-21-1926068397-2398490202-140176465-500 - Administrator -
Disabled)
Duc Hong (S-1-5-21-1926068397-2398490202-140176465-1002 - Administrator -
Enabled) => C:\Users\Duc Hong
Guest (S-1-5-21-1926068397-2398490202-140176465-501 - Limited - Disabled)
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Windows Defender (Disabled - Up to date)
{D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AV: avast! Antivirus (Enabled - Up to date)
{17AD7D40-BA12-9C46-7131-94903A54AD8B}
AS: Windows Defender (Disabled - Up to date)
{D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: avast! Antivirus (Enabled - Up to date)
{ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to
unhide them. The adware programs should be uninstalled manually.)
µTorrent (HKLM-x32\...\uTorrent) (Version: 3.2.3.28705 - BitTorrent Inc.)
7-Zip 9.38 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0938-000001000000})
(Version: 9.38.00.0 - Igor Pavlov)
Adobe Flash Player 16 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version:
16.0.0.235 - Adobe Systems Incorporated)
Apple Application Support (32-bit)
(HKLM-x32\...\{2FE00055-C4F3-4F7A-AEDD-E198D54CF12F}) (Version: 3.1.1 - Apple
Inc.)
Apple Mobile Device Support (HKLM\...\{19DED56B-657D-41DA-9EB0-7C20DDF6A613})
(Version: 8.1.0.18 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE})
(Version: 2.1.3.127 - Apple Inc.)
ASUS Console (HKLM\...\{6D989E08-8143-4AB8-B0A8-5B836235CAA4}) (Version: 1.0.5 -
ASUS)
Asus FaceID (HKLM-x32\...\{C4071085-DDF0-403F-90F9-27582FC22C9B}) (Version:
7.7.6.1 - ASUS)
ASUS Instant Key (HKLM-x32\...\{D97A1B80-131F-4692-9543-E652956D8B99}) (Version:
1.1.7 - ASUS)
ASUS Live Update (HKLM-x32\...\{FA540E67-095C-4A1B-97BA-4D547DEC9AF4}) (Version:
3.3.4 - ASUS)
ASUS Power4Gear Hybrid (HKLM\...\{9B6239BF-4E85-4590-8D72-51E30DB1A9AA})
(Version: 3.0.8 - ASUS)
ASUS Smart Gesture (HKLM-x32\...\{4D3286A6-F6AB-498A-82A4-E4F040529F3D})
(Version: 2.2.10 - ASUS)
ASUS Splendid Video Enhancement Technology
(HKLM-x32\...\{0969AF05-4FF6-4C00-9406-43599238DE0D}) (Version: 2.01.0021 -
ASUS)
ATK Package (HKLM-x32\...\{AB5C933E-5C7D-4D30-B314-9C83A49B94BE}) (Version:
1.0.0031 - ASUS)
ATLAS Translation Standard V14.0 Trial Version
(HKLM-x32\...\{6652750B-AA69-49B7-9D09-C0A28B6FFC9F}) (Version: 14.00.2000 -
FUJITSU LIMITED)
Auslogics DiskDefrag (HKLM-x32\...\{DF6A13C0-77DF-41FE-BD05-6D5201EB0CE7}_is1)
(Version: 5.4.0.0 - Auslogics Labs Pty Ltd)
Avast Free Antivirus (HKLM-x32\...\Avast) (Version: 10.2.2218 - AVAST Software)
Avidemux 2.6 - 64bits (HKLM-x32\...\Avidemux 2.6 - 64bits (64-bit)) (Version:
2.6.9.00 - )
BatteryBar (remove only) (HKLM\...\BatteryBar) (Version: - )
Bluefish 2.2.7 (HKLM-x32\...\Bluefish) (Version: 2.2.7 - The Bluefish
Developers)
BlueJ (HKLM-x32\...\{7D66971C-652B-4065-A6B1-B3EE313C254B}) (Version: 3.1.4 -
BlueJ Team)
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 -
Apple Inc.)
CCleaner (HKLM\...\CCleaner) (Version: 5.06 - Piriform)
CodeBlocks (HKU\S-1-5-21-1926068397-2398490202-140176465-1002\...\CodeBlocks)
(Version: 13.12 - The Code::Blocks Team)
Color Cop 5.4.3 (HKLM-x32\...\Color Cop_is1) (Version: - Jay Prall)
Command & Conquer™ Red Alert™ 3
(HKLM\...\{296D8550-CB06-48E4-9A8B-E5034FB64715}) (Version: 1.0.1.0 - Electronic
Arts)
Command & Conquer™ Red Alert™ 3
(HKLM-x32\...\{296D8550-CB06-48E4-9A8B-E5034FB64715}) (Version: 1.0.1.0 -
Electronic Arts)
Counter-Strike: Global Offensive (HKLM-x32\...\Steam App 730) (Version: -
Valve)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
DAEMON Tools Lite (HKLM-x32\...\DAEMON Tools Lite) (Version: 4.49.1.0356 - Disc
Soft Ltd)
Defraggler (HKLM\...\Defraggler) (Version: 2.19 - Piriform)
Everything 1.3.4.686 (x64) (HKLM\...\Everything) (Version: - )
Explorer Suite IV (HKLM\...\Explorer Suite_is1) (Version: - )
FarCry 4 (HKLM-x32\...\Uplay Install 420) (Version: - Ubisoft)
FileHippo App Manager (HKLM-x32\...\FileHippo.com) (Version: - FileHippo.com)
Foxit PhantomPDF Business (HKLM-x32\...\{8A601904-4113-40FE-9DCC-7A38CE1A8032})
(Version: 7.0.6.1126 - Foxit Software Inc.)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 43.0.2357.81 - Google Inc.)
Google Talk Plugin (HKLM-x32\...\{CA3DD97D-1FD7-37A7-BD5C-FC4430C8B8E6})
(Version: 5.41.2.0 - Google)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.27.5 - Google Inc.) Hidden
HandBrake 0.10.1 (HKLM-x32\...\HandBrake) (Version: 0.10.1 - )
HD Tune Pro 5.50 (HKLM-x32\...\HD Tune Pro_is1) (Version: - EFD Software)
Intel® Driver Update Utility 2.0 (x32 Version: 2.0.0.29 - Intel) Hidden
Intel® Management Engine Components
(HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 9.5.14.1724 -
Intel Corporation)
Intel® Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA})
(Version: 10.18.10.3355 - Intel Corporation)
Intel® Wireless Bluetooth®(patch version 17.1.1449.356)
(HKLM\...\{302600C1-6BDF-4FD1-1411-148929CC1385}) (Version: 17.1.1411.0506 -
Intel Corporation)
Intel® Driver Update Utility
(HKLM-x32\...\{8409c4f7-2340-4933-a304-5d37db4fb48b}) (Version: 2.0.0.29 -
Intel)
Intel® PROSet/Wireless Software
(HKLM-x32\...\{a9888f41-68ae-43df-bd7d-d93405a44106}) (Version: 17.13.11 - Intel
Corporation)
Internet Download Manager (HKLM-x32\...\Internet Download Manager) (Version: -
Tonec Inc.)
IrfanView (remove only) (HKLM-x32\...\IrfanView) (Version: 4.38 - Irfan Skiljan)
iTunes (HKLM\...\{2EA80E9F-C811-41BB-ABAC-F270B4B39BC6}) (Version: 12.1.0.71 -
Apple Inc.)
Java 8 Update 45 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86418045F0})
(Version: 8.0.450 - Oracle Corporation)
Java 8 Update 45 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218045F0}) (Version:
8.0.450 - Oracle Corporation)
Java SE Development Kit 8 Update 40 (64-bit)
(HKLM\...\{64A3A4F4-B792-11D6-A78A-00B0D0180400}) (Version: 8.0.400.26 - Oracle
Corporation)
Junk Mail filter update (x32 Version: 16.4.3528.0331 - Microsoft Corporation)
Hidden
K-Lite Codec Pack 11.0.8 Full (HKLM-x32\...\KLiteCodecPack_is1) (Version: 11.0.8
- )
Malwarebytes Anti-Malware version 2.1.6.1022 (HKLM-x32\...\Malwarebytes
Anti-Malware_is1) (Version: 2.1.6.1022 - Malwarebytes Corporation)
MediaCoder x64 0.8.34.5716 (HKLM\...\MediaCoder x64) (Version: 0.8.34.5716 -
Mediatronic)
Microsoft ASP.NET MVC 4 Runtime
(HKLM-x32\...\{3FE312D5-B862-40CE-8E4E-A6D8ABF62736}) (Version: 4.0.40804.0 -
Microsoft Corporation)
Microsoft Office Professional Plus 2010 (HKLM\...\Office14.PROPLUS) (Version:
14.0.7015.1000 - Microsoft Corporation)
Microsoft OneDrive
(HKU\S-1-5-21-1926068397-2398490202-140176465-1002\...\OneDriveSetup.exe)
(Version: 17.0.4035.0328 - Microsoft Corporation)
Microsoft Outlook Hotmail Connector 64-bit
(HKLM\...\{95140000-007A-0409-1000-0000000FF1CE}) (Version: 14.0.5118.5000 -
Microsoft Corporation)
Microsoft Outlook Social Connector Provider for Windows Live Messenger 64-bit
(HKLM\...\{95140000-007D-0409-1000-0000000FF1CE}) (Version: 14.0.5120.5000 -
Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00})
(Version: 5.1.40416.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU]
(HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 -
Microsoft Corporation)
Microsoft Visio Professional 2010 (HKLM\...\Office14.VISIOR) (Version:
14.0.7015.1000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable
(HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 -
Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
(HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 -
Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148
(HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 -
Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
(HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 -
Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
(HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 -
Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
(HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 -
Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
(HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 -
Microsoft Corporation)
Microsoft Visual C++ 2010 Redistributable - x64 10.0.40219
(HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 -
Microsoft Corporation)
Microsoft Visual C++ 2010 Redistributable - x86 10.0.40219
(HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 -
Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030
(HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 -
Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030
(HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 -
Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005
(HKLM-x32\...\{ce085a78-074e-4823-8dc1-8a721b94b76d}) (Version: 12.0.21005.1 -
Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft
Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 -
Microsoft Corporation)
Movie Maker (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Mozilla Firefox 37.0.1 (x86 en-US) (HKLM-x32\...\Mozilla Firefox 37.0.1 (x86
en-US)) (Version: 37.0.1 - Mozilla)
Mozilla Firefox 38.0.1 (x86 en-US)
(HKU\S-1-5-21-1926068397-2398490202-140176465-1002\...\Mozilla Firefox 38.0.1
(x86 en-US)) (Version: 38.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version:
36.0.3 - Mozilla)
MyDefrag v4.3.1 (HKLM\...\MyDefrag v4.3.1_is1) (Version: 4.0.0.0 - J.C. Kessels)
NEKOPARA vol.1
(HKU\S-1-5-21-1926068397-2398490202-140176465-1002\...\{64DC04AF-BD7C-4CF4-9CA4-938953224328})
(Version: - NEKO WORKs)
Notepad++ (HKLM-x32\...\Notepad++) (Version: 6.7.8.2 - Notepad++ Team)
NVIDIA GeForce Experience 2.4.3.22
(HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version:
2.4.3.22 - NVIDIA Corporation)
NVIDIA Graphics Driver 350.05
(HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version:
350.05 - NVIDIA Corporation)
NVIDIA PhysX System Software 9.15.0324
(HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version:
9.15.0324 - NVIDIA Corporation)
Oracle VM VirtualBox 4.3.28 (HKLM\...\{E8BB81BC-E67C-4750-84EE-128DA5A7ADA5})
(Version: 4.3.28 - Oracle Corporation)
Potplayer (HKLM-x32\...\PotPlayer) (Version: - Daum Kakao Corp.)
Rainmeter (HKLM-x32\...\Rainmeter) (Version: 3.2.1 r2386 - )
Realtek Card Reader (HKLM-x32\...\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A})
(Version: 6.2.9200.39048 - Realtek Semiconductor Corp.)
Realtek Ethernet Controller Driver
(HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 8.20.815.2013 -
Realtek)
Revo Uninstaller Pro 3.0.2 (HKLM\...\{67579783-0FB7-4F7B-B881-E5BE47C9DBE0}_is1)
(Version: 3.0.2 - VS Revo Group, Ltd.)
RW-Everything v1.6.5.9 (HKLM\...\RW-Everything_is1) (Version: - )
Service Pack 2 for Microsoft Office 2010 (KB2687455) 64-Bit Edition
(HKLM\...\{90140000-0011-0000-1000-0000000FF1CE}_Office14.PROPLUS_{A3364707-2F53-4C83-8F68-C9877A9080C7})
(Version: - Microsoft)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 64-Bit Edition
(HKLM\...\{91140000-0057-0000-1000-0000000FF1CE}_Office14.VISIOR_{3C578F10-F74F-4655-B2A6-9F88A6C415E8})
(Version: - Microsoft)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 64-Bit Edition (Version: -
Microsoft) Hidden
SHIELD Streaming (Version: 4.1.1000 - NVIDIA Corporation) Hidden
SHIELD Wireless Controller Driver (Version: 2.4.3.22 - NVIDIA Corporation)
Hidden
Sid Meier's Civilization V (HKLM-x32\...\Steam App 8930) (Version: - 2K Games,
Inc.)
Skype Click to Call (HKLM-x32\...\{6D1221A9-17BF-4EC0-81F2-27D30EC30701})
(Version: 7.3.16540.9015 - Microsoft Corporation)
Skype™ 7.4 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version:
7.4.102 - Skype Technologies S.A.)
SoftEther VPN Client (HKLM\...\softether_sevpnclient) (Version: 4.12.9514 -
SoftEther VPN Project)
Speccy (HKLM\...\Speccy) (Version: 1.28 - Piriform)
Spotify (HKU\S-1-5-21-1926068397-2398490202-140176465-1002\...\Spotify)
(Version: 1.0.3.101.gbfa97dfe - Spotify AB)
Steam (HKLM-x32\...\Steam) (Version: 2.10.91.91 - Valve Corporation)
Synei System Utilities (HKLM-x32\...\{BFDC3B26-7DB0-43D3-BC84-7E9649C157EA}_is1)
(Version: 2.25 - Synei)
System Requirements Lab (HKLM-x32\...\{0F659036-14C7-4622-9505-35A0DC93526A})
(Version: 6.1.3.0 - Husdawg, LLC)
Team Fortress 2 (HKLM-x32\...\Steam App 440) (Version: - Valve)
TeraCopy 2.3 (HKLM\...\TeraCopy_is1) (Version: - Code Sector)
The Elder Scrolls V: Skyrim (HKLM-x32\...\Steam App 72850) (Version: - Bethesda
Game Studios)
The Witcher 2: Assassins of Kings Enhanced Edition (HKLM-x32\...\Steam App
20920) (Version: - CD PROJEKT RED)
Unity Web Player
(HKU\S-1-5-21-1926068397-2398490202-140176465-1002\...\UnityWebPlayer) (Version:
5.0.2f1 - Unity Technologies ApS)
Unlocker 1.9.2 (HKLM\...\Unlocker) (Version: 1.9.2 - Cedrick Collomb)
Update for Japanese Microsoft IME Postal Code Dictionary
(HKLM-x32\...\{15015752-9990-4516-A2B1-93823281FB8E}) (Version: 15.0.1759 -
Microsoft Corporation)
Update for Japanese Microsoft IME Standard Dictionary
(HKLM-x32\...\{7DB71278-9AD7-4480-AB08-8649C5010B17}) (Version: 15.0.1215 -
Microsoft Corporation)
Update for Japanese Microsoft IME Standard Extended Dictionary
(HKLM-x32\...\{78CE66A9-85AF-4BD8-8FB7-35B5F3846C00}) (Version: 15.0.1215 -
Microsoft Corporation)
Uplay (HKLM-x32\...\Uplay) (Version: 4.8 - Ubisoft)
VMware Player (HKLM-x32\...\VMware_Player) (Version: 7.1.0 - VMware, Inc)
VMware Player (Version: 7.1.0 - VMware, Inc.) Hidden
Warframe (HKLM-x32\...\Steam App 230410) (Version: - Digital Extremes)
WebStorage (HKLM-x32\...\WebStorage) (Version: 2.1.2.301 - ASUS Cloud
Corporation)
Windows Driver Package - ASUS (ATP) Mouse (01/07/2014 1.0.0.197)
(HKLM\...\2BEE838DC3D664A0CAB23AEA0332BB3877ED0685) (Version: 01/07/2014
1.0.0.197 - ASUS)
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3528.0331 -
Microsoft Corporation)
WinFlash (HKLM-x32\...\{8F21291E-0444-4B1D-B9F9-4370A73E346D}) (Version: 2.42.0
- ASUS)
WinPcap 4.1.3 (HKLM-x32\...\WinPcapInst) (Version: 4.1.0.2980 - Riverbed
Technology, Inc.)
WinRAR 5.20 (64-bit) (HKLM\...\WinRAR archiver) (Version: 5.20.0 - win.rar GmbH)
Wireshark 1.12.5 (64-bit) (HKLM-x32\...\Wireshark) (Version: 1.12.5 - The
Wireshark developer community, http://www.wireshark.org)
==================== Custom CLSID (Whitelisted): ==========================
(If an entry is included in the fixlist, it will be removed from the registry.
The file will not be moved unless listed separately.)
CustomCLSID:
HKU\S-1-5-21-1926068397-2398490202-140176465-1002_Classes\CLSID\{1423F872-3F7F-4E57-B621-8B1A9D49B448}\InprocServer32
-> C:\Users\Duc Hong\AppData\Local\Google\Update\1.3.27.5\psuser_64.dll (Google
Inc.)
CustomCLSID:
HKU\S-1-5-21-1926068397-2398490202-140176465-1002_Classes\CLSID\{E8CF3E55-F919-49D9-ABC0-948E6CB34B9F}\InprocServer32
-> C:\Users\Duc Hong\AppData\Local\Google\Update\1.3.27.5\psuser_64.dll (Google
Inc.)
CustomCLSID:
HKU\S-1-5-21-1926068397-2398490202-140176465-1002_Classes\CLSID\{F8071786-1FD0-4A66-81A1-3CBE29274458}\InprocServer32
-> C:\Users\Duc
Hong\AppData\Local\Microsoft\SkyDrive\17.0.4035.0328\amd64\FileSyncApi64.dll
(Microsoft Corporation)
==================== Restore Points =========================
26-05-2015 15:59:24 Windows Live Essentials
26-05-2015 16:01:59 WLSetup
==================== Hosts content: ===============================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2013-08-22 23:25 - 2015-02-11 01:00 - 00000793 ____A
C:\Windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (Whitelisted) =============
(If an entry is included in the fixlist, it will be removed from the registry.
The file will not be moved unless listed separately.)
Task: {0672CE47-9AF2-49B5-BA4A-D987C76AF085} -
System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1926068397-2398490202-140176465-1002UA
=> C:\Users\Duc Hong\AppData\Local\Google\Update\GoogleUpdate.exe [2015-04-17]
(Google Inc.)
Task: {0B01FB0E-B462-46B8-816C-2444A6441DB3} - System32\Tasks\ASUS Smart Gesture
Launcher => C:\Program Files (x86)\ASUS\ASUS Smart
Gesture\AsTPCenter\x64\AsusTPLauncher.exe [2014-02-14] (AsusTek)
Task: {1BAF89D5-B76F-48CA-B114-034B69480F29} - System32\Tasks\ASUS Splendid
ColorU => C:\Program Files (x86)\ASUS\Splendid\ColorUService.exe [2013-10-08]
(ASUSTeK Computer Inc.)
Task: {1EB54610-9F30-42C5-93C1-9B6CBD358D7E} - System32\Tasks\RTKCPL =>
C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [2014-05-20] (Realtek
Semiconductor)
Task: {31E03131-2908-43E9-AE6D-CD1AC82DAD2F} - System32\Tasks\ASUS Console =>
C:\Program Files\ASUS\ASUS Console\ASUS Console Starter.exe [2014-02-07]
(ASUSTek Computer Inc.)
Task: {4E3FDD62-EABC-414B-8FBD-DBA444C5CA8A} -
System32\Tasks\Microsoft\Windows\Setup\gwx\refreshgwxconfig =>
C:\Windows\system32\GWX\GWXConfigManager.exe [2015-05-06] (Microsoft
Corporation)
Task: {760AE585-4971-4AD2-AFC4-DEA14F01B495} -
System32\Tasks\Microsoft\Windows\Setup\gwx\launchtrayprocess =>
C:\Windows\system32\GWX\GWX.exe [2015-05-06] (Microsoft Corporation)
Task: {766E80C1-FFF8-4F47-8FC3-4E533BAE0AC1} - System32\Tasks\Update Checker =>
C:\Program Files (x86)\ASUS\ASUS Live Update\UpdateChecker.exe [2015-02-12] ()
Task: {82F04444-7113-4278-B8C4-51A59E6C29E4} - System32\Tasks\RtHDVBg =>
C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [2014-05-13] (Realtek
Semiconductor)
Task: {9D746130-D7A9-4BB8-8E96-05093DEF9977} -
System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1926068397-2398490202-140176465-1002Core
=> C:\Users\Duc Hong\AppData\Local\Google\Update\GoogleUpdate.exe [2015-04-17]
(Google Inc.)
Task: {A508D830-687E-41AA-AF60-8916D26EAEBF} - System32\Tasks\CCleanerSkipUAC =>
C:\Program Files\CCleaner\CCleaner.exe [2015-05-09] (Piriform Ltd)
Task: {B0F0CAF5-E8BC-45C2-B67C-9C12294AF136} - System32\Tasks\AutoKMS =>
C:\Windows\AutoKMS\AutoKMS.exe [2015-01-08] ()
Task: {B905D56A-7E45-4939-90F9-416CB290E620} - System32\Tasks\AsusVibeSchedule
=> C:\Program Files (x86)\Asus\AsusVibe\AsusVibeLauncher.exe
Task: {BFBCA901-B92C-49C8-A07C-57F94EC4BD4A} - System32\Tasks\ASUS Live Update1
=> C:\Program Files (x86)\ASUS\ASUS Live Update\LiveUpdate.exe [2015-03-23]
(ASUSTeK Computer Inc.)
Task: {CB4E97FF-DC08-4AE9-B101-6EC041501D17} -
System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB =>
C:\Windows\system32\MRT.exe [2015-05-18] (Microsoft Corporation)
Task: {CE71F3E1-DE1E-4B42-A816-09F806D6EAFE} - System32\Tasks\Microsoft OneDrive
Auto Update Task-S-1-5-21-1926068397-2398490202-140176465-1002 =>
%localappdata%\Microsoft\SkyDrive\SkyDrive.exe
Task: {D54DEED3-1E09-43DD-A0D7-2534D4F95BFB} -
System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files
(x86)\Google\Update\GoogleUpdate.exe [2015-01-08] (Google Inc.)
Task: {EA345886-3FBF-4930-8FE1-DEAE05BA0372} - System32\Tasks\ASUS Splendid
ACMON => C:\Program Files (x86)\ASUS\Splendid\ACMON.exe [2013-10-08] (ASUS)
Task: {F6441995-B4CF-4A06-BBE6-5BE2EE55D8EA} - System32\Tasks\avast! Emergency
Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2015-05-01]
(Avast Software s.r.o.)
Task: {F87A5893-944C-45F8-AF4F-42245D864FF7} -
System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files
(x86)\Google\Update\GoogleUpdate.exe [2015-01-08] (Google Inc.)
Task: C:\Windows\Tasks\AutoKMS.job => C:\Windows\AutoKMS\AutoKMS.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files
(x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files
(x86)\Google\Update\GoogleUpdate.exe
Task:
C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1926068397-2398490202-140176465-1002Core.job
=> C:\Users\Duc Hong\AppData\Local\Google\Update\GoogleUpdate.exe
Task:
C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1926068397-2398490202-140176465-1002UA.job
=> C:\Users\Duc Hong\AppData\Local\Google\Update\GoogleUpdate.exe
==================== Loaded Modules (Whitelisted) ==============
2015-02-20 08:01 - 2015-02-20 08:01 - 00022528 _____ ()
C:\Windows\System32\us001lm.dll
2014-07-12 09:01 - 2013-08-27 09:29 - 00755728 _____ ()
C:\Windows\SYSTEM32\sqlite3.dll
2015-04-26 23:21 - 2015-04-02 17:19 - 00117392 _____ () C:\Program Files\NVIDIA
Corporation\Display\NvSmartMax64.dll
2013-09-04 23:17 - 2013-09-04 23:17 - 04300456 _____ () C:\Program Files\Common
Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF
2010-10-20 14:23 - 2010-10-20 14:23 - 08801632 _____ () C:\Program
Files\Microsoft Office\Office14\1033\GrooveIntlResource.dll
2015-03-24 23:28 - 2015-03-24 23:28 - 00036544 _____ () C:\Program
Files\Rainmeter\Rainmeter.exe
2015-03-24 23:28 - 2015-03-24 23:28 - 00775872 _____ () C:\Program
Files\Rainmeter\Rainmeter.dll
2015-03-24 23:28 - 2015-03-24 23:28 - 00022528 _____ () C:\Program
Files\Rainmeter\Plugins\InputText.dll
2015-03-24 23:27 - 2015-03-24 23:27 - 00011776 _____ () C:\Program
Files\Rainmeter\Plugins\PowerPlugin.DLL
2015-03-24 23:27 - 2015-03-24 23:27 - 00022016 _____ () C:\Program
Files\Rainmeter\Plugins\WifiStatus.DLL
2015-03-24 23:27 - 2015-03-24 23:27 - 00020992 _____ () C:\Program
Files\Rainmeter\Plugins\SysInfo.DLL
2015-03-24 23:27 - 2015-03-24 23:27 - 00058368 _____ () C:\Program
Files\Rainmeter\Plugins\WebParser.DLL
2015-03-24 23:27 - 2015-03-24 23:27 - 00023040 _____ () C:\Program
Files\Rainmeter\Plugins\Win7AudioPlugin.DLL
2010-07-15 14:44 - 2010-07-15 14:44 - 00020032 _____ () C:\Program
Files\Unlocker\UnlockerCOM.dll
2015-04-16 06:13 - 2015-04-16 06:13 - 00222720 _____ () C:\Program Files
(x86)\Notepad++\NppShell_06.dll
2015-05-01 16:28 - 2015-05-01 16:28 - 00104400 _____ () C:\Program Files\AVAST
Software\Avast\log.dll
2015-05-01 16:28 - 2015-05-01 16:28 - 00081728 _____ () C:\Program Files\AVAST
Software\Avast\JsonRpcServer.dll
2015-05-26 23:07 - 2015-05-26 23:07 - 02948096 _____ () C:\Program Files\AVAST
Software\Avast\defs\15052600\algo.dll
2015-01-20 21:35 - 2015-01-20 21:35 - 00073544 _____ () C:\Program Files
(x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2015-01-20 21:35 - 2015-01-20 21:35 - 01044776 _____ () C:\Program Files
(x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2015-02-06 17:40 - 2015-02-06 17:40 - 01301696 _____ () C:\Program Files
(x86)\VMware\VMware Player\libxml2.dll
2014-07-12 08:47 - 2013-09-04 09:52 - 01242584 _____ () C:\Program Files
(x86)\Intel\Intel® Management Engine Components\LMS\ACE.dll
2013-09-10 11:23 - 2013-09-10 11:23 - 00162816 _____ () C:\Program Files
(x86)\ASUS\Splendid\CCTAdjust.dll
2013-10-09 13:41 - 2013-10-09 13:41 - 00037968 _____ () C:\Program Files
(x86)\ASUS\Splendid\DetectDisplayDC.dll
2015-04-26 23:22 - 2015-05-02 02:52 - 00011920 _____ () C:\Program Files
(x86)\NVIDIA Corporation\Update Core\detoured.dll
2015-03-20 15:31 - 2015-03-20 15:31 - 40540672 _____ () C:\Program Files\AVAST
Software\Avast\libcef.dll
2013-04-27 10:24 - 2013-04-27 10:24 - 00071680 _____ () C:\Program Files
(x86)\ASUS\ASUS Live Update\checkmetro.dll
==================== Alternate Data Streams (Whitelisted) =========
(If an entry is included in the fixlist, only the ADS will be removed.)
==================== Safe Mode (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry.
The "AlternateShell" will be restored.)
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcpltsvc => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcpltsvc => ""=""
==================== EXE Association (Whitelisted) ===============
(If an entry is included in the fixlist, the registry item will be restored to
default or removed.)
==================== Internet Explorer trusted/restricted ===============
(If an entry is included in the fixlist, it will be removed from the registry.)
==================== Other Areas ============================
(Currently there is no automatic fix for this section.)
HKU\S-1-5-21-1926068397-2398490202-140176465-1002\Control
Panel\Desktop\\Wallpaper -> C:\Users\Duc
Hong\AppData\Roaming\IrfanView\IrfanView_Wallpaper.bmp
DNS Servers: 192.168.1.1
==================== MSCONFIG/TASK MANAGER disabled items ==
(Currently there is no automatic fix for this section.)
HKLM\...\StartupApproved\StartupFolder: => "SoftEther VPN Client Manager
Startup.lnk"
HKLM\...\StartupApproved\Run: => "ShadowPlay"
HKLM\...\StartupApproved\Run32: => "ASUSPRP"
HKLM\...\StartupApproved\Run32: => "WebStorage"
HKU\S-1-5-21-1926068397-2398490202-140176465-1002\...\StartupApproved\Run: =>
"FlashPlayerUpdate"
HKU\S-1-5-21-1926068397-2398490202-140176465-1002\...\StartupApproved\Run: =>
"Google Update"
HKU\S-1-5-21-1926068397-2398490202-140176465-1002\...\StartupApproved\Run: =>
"DevidAgent"
==================== FirewallRules (Whitelisted) ===============
(If an entry is included in the fixlist, it will be removed from the registry.
The file will not be moved unless listed separately.)
FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139
FirewallRules: [Daum PotPlayer(PotPlayerMini.exe)] => (Allow) C:\Program Files
(x86)\DAUM\PotPlayer\PotPlayerMini.exe
FirewallRules: [{6AD7A4C1-520C-4938-83E9-8C3D4AF4470B}] => (Allow) C:\Program
Files (x86)\DAUM\PotPlayer\PotPlayerMini.exe
FirewallRules: [TCP Query
User{B408D18C-6D03-4CC8-9E8F-41FF22643530}C:\windows\microsoft.net\framework\v2.0.50727\vbc.exe]
=> (Allow) C:\windows\microsoft.net\framework\v2.0.50727\vbc.exe
FirewallRules: [UDP Query
User{A1BDE586-1E5F-4E70-83A1-C3724D86FBEA}C:\windows\microsoft.net\framework\v2.0.50727\vbc.exe]
=> (Allow) C:\windows\microsoft.net\framework\v2.0.50727\vbc.exe
FirewallRules: [{46831999-F626-41E8-A1AB-F3130E61A535}] => (Allow)
E:\Temp\Steam\Steam.exe
FirewallRules: [{24C0EBEB-6AAB-4281-B843-FC830B4FEB52}] => (Allow)
E:\Temp\Steam\Steam.exe
FirewallRules: [{AED3302F-B17D-4701-9390-ED277A47C947}] => (Allow)
E:\Temp\Steam\steamapps\common\Skyrim\SkyrimLauncher.exe
FirewallRules: [{259FAB07-4841-4498-8702-1C73EE758BF7}] => (Allow)
E:\Temp\Steam\steamapps\common\Skyrim\SkyrimLauncher.exe
FirewallRules: [{F2D50447-ADCB-4ACF-A732-83AA56A4E7A9}] => (Allow) C:\Program
Files\SoftEther VPN Client\vpnclient_x64.exe
FirewallRules: [{332E3FF6-209A-48A4-A6EC-7423A11D35B6}] => (Allow) C:\Program
Files\SoftEther VPN Client\vpncmgr.exe
FirewallRules: [{8284D947-F7E8-4B89-A26F-A0AD5FD80F82}] => (Allow) C:\Program
Files\SoftEther VPN Client\vpncmd_x64.exe
FirewallRules: [{A44E3BA8-FD16-4235-9303-E17CA8FF8D6D}] => (Allow) C:\Program
Files\SoftEther VPN Client\vpncmgr_x64.exe
FirewallRules: [{5647D39A-F124-4953-ACEC-254F04260C4D}] => (Allow) C:\Program
Files\SoftEther VPN Client\vpnclient.exe
FirewallRules: [{BB5EAF98-68DC-4481-BDA2-0F92653D1BE9}] => (Allow) C:\Program
Files\SoftEther VPN Client\vpncmd.exe
FirewallRules: [SPPSVC-In-TCP] => (Allow) %SystemRoot%\system32\sppextcomobj.exe
FirewallRules: [SPPSVC-In-TCP-NoScope] => (Allow)
%SystemRoot%\system32\sppextcomobj.exe
FirewallRules: [{2BFDCA10-D873-4098-A023-AF8A8D52659D}] => (Allow) C:\Users\Duc
Hong\AppData\Roaming\Spotify\spotify.exe
FirewallRules: [{95AFAF81-213D-48BB-9D2E-9FC489C69485}] => (Allow) C:\Users\Duc
Hong\AppData\Roaming\Spotify\spotify.exe
FirewallRules: [{E419D7CD-9FEB-40AD-8036-CEF8EE2A3E58}] => (Allow) C:\Program
Files (x86)\uTorrent\uTorrent.exe
FirewallRules: [{7EB67D77-8A9B-425E-8A9D-556828BD9F2A}] => (Allow) C:\Program
Files (x86)\uTorrent\uTorrent.exe
FirewallRules: [{E7314D54-19FD-4376-952A-C283F866565A}] => (Allow)
E:\Temp\Steam\steamapps\common\Team Fortress 2\hl2.exe
FirewallRules: [{A9537D58-5E28-443C-9DF3-773B75BE8B9C}] => (Allow)
E:\Temp\Steam\steamapps\common\Team Fortress 2\hl2.exe
FirewallRules: [{5405FDE4-13D9-46A4-BA72-2C3D637A820A}] => (Allow)
E:\Temp\Steam\steamapps\common\Sid Meier's Civilization V\Launcher.exe
FirewallRules: [{4D112B3C-965E-4D2B-8A4C-A3BC7790EB24}] => (Allow)
E:\Temp\Steam\steamapps\common\Sid Meier's Civilization V\Launcher.exe
FirewallRules: [{57563CA2-4C58-4DB6-A9D8-63CCEE8D3D58}] => (Allow) C:\Program
Files\Intel\WiFi\bin\PanDhcpDns.exe
FirewallRules: [{EECB906E-0A72-4349-ABC2-51F722808688}] => (Allow) C:\Program
Files (x86)\VMware\VMware Player\vmware-authd.exe
FirewallRules: [{E113D9E6-3F09-4DFD-9AE0-63C1DDFBFF5F}] => (Allow) C:\Program
Files (x86)\VMware\VMware Player\vmware-authd.exe
FirewallRules: [TCP Query User{D2BD56E1-FECA-4760-BFF6-7B483CFCD029}C:\program
files (x86)\mozilla firefox\firefox.exe] => (Allow) C:\program files
(x86)\mozilla firefox\firefox.exe
FirewallRules: [UDP Query User{31909EE8-B773-4D7F-8A9B-F43C433277C1}C:\program
files (x86)\mozilla firefox\firefox.exe] => (Allow) C:\program files
(x86)\mozilla firefox\firefox.exe
FirewallRules: [{D584DDB2-8E7C-45B2-828F-ACE4C55E5EEF}] => (Allow) C:\Program
Files\Bonjour\mDNSResponder.exe
FirewallRules: [{0E7DD122-51EE-4061-BA2E-AC6519ACC2AD}] => (Allow) C:\Program
Files\Bonjour\mDNSResponder.exe
FirewallRules: [{55B30F08-3CE8-40C4-A149-EC7C5462450F}] => (Allow) C:\Program
Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{6A093041-DBDC-47C2-A540-CFBC73668DB9}] => (Allow) C:\Program
Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{2E92677B-4DF7-48B8-A955-03BC56D592A8}] => (Allow) C:\Program
Files (x86)\iTunes\iTunes.exe
FirewallRules: [{C61C7218-4C30-48CF-A3C2-6D208730DCEE}] => (Allow) C:\Users\Duc
Hong\AppData\Roaming\Spotify\spotify.exe
FirewallRules: [{0CB55171-3C48-4165-B73A-D3D703E0BF74}] => (Allow) C:\Users\Duc
Hong\AppData\Roaming\Spotify\spotify.exe
FirewallRules: [{62290C84-E203-48CD-96FE-25F287B35C58}] => (Allow) C:\Program
Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{CF008ED2-2D02-4F90-9DE1-AF2683AC3A75}] => (Allow) C:\Program
Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{4A2F08C8-3C2D-4E62-AB32-9E6F21033E5D}] => (Allow)
E:\Temp\Steam\steamapps\common\Counter-Strike Global Offensive\csgo.exe
FirewallRules: [{5A10E92E-14BC-4EA2-87C5-DFA76406A1B6}] => (Allow)
E:\Temp\Steam\steamapps\common\Counter-Strike Global Offensive\csgo.exe
FirewallRules: [{450E7EC7-2C50-4F23-96AB-7ECDB5C88FFC}] => (Allow) C:\Program
Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
FirewallRules: [{32706039-9609-4992-BEEB-8ED8864C4607}] => (Allow) C:\Program
Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
FirewallRules: [{F739246A-3A2D-4765-808B-7BB1F4458A55}] => (Allow) C:\Program
Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe
FirewallRules: [{B1667E06-E235-41E6-B974-A2480A44B3EA}] => (Allow) C:\Program
Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe
FirewallRules: [{C902004C-0182-4F8A-92B3-90CDD0848EEE}] => (Allow) C:\Program
Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{CA9C0864-93C5-4403-A96A-481A312E25AB}] => (Allow) C:\Program
Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{FB800EB4-BE51-4D8C-8E4F-CFC1270DB18B}] => (Allow)
E:\Temp\Steam\steamapps\common\Warframe\Tools\Launcher.exe
FirewallRules: [{C72A1B67-D93C-43AC-BE28-B0ACE3FE8839}] => (Allow)
E:\Temp\Steam\steamapps\common\Warframe\Tools\Launcher.exe
FirewallRules: [TCP Query User{EB9F9A8C-6653-487F-B17B-9F501F2579C1}C:\program
files (x86)\skype\phone\skype.exe] => (Allow) C:\program files
(x86)\skype\phone\skype.exe
FirewallRules: [UDP Query User{56B69EA0-F89E-4E3A-86A9-17B0A681F65D}C:\program
files (x86)\skype\phone\skype.exe] => (Allow) C:\program files
(x86)\skype\phone\skype.exe
FirewallRules: [{8D865167-D700-4BE4-9F4A-CA556B393C38}] => (Allow)
E:\Temp\Steam\steamapps\common\the witcher 2\Launcher.exe
FirewallRules: [{E0ABD53F-A995-438C-9AF4-7F12976B664F}] => (Allow)
E:\Temp\Steam\steamapps\common\the witcher 2\Launcher.exe
FirewallRules: [{70336664-A8F7-4643-8DE1-888C970ADC52}] => (Allow)
E:\Temp\Test\FarCry 4\bin\FarCry4.exe
FirewallRules: [{72959202-F7E2-4BC0-9E68-D9CE43FA28F0}] => (Allow)
E:\Temp\Test\FarCry 4\bin\FarCry4.exe
FirewallRules: [{A5616C7D-29F6-4A47-BCBB-F7E60F43C9E9}] => (Allow)
E:\Temp\Test\FarCry 4\bin\IGE_WPF64.exe
FirewallRules: [{5A969598-A826-47D0-ADB8-1F16B5161795}] => (Allow)
E:\Temp\Test\FarCry 4\bin\IGE_WPF64.exe
FirewallRules: [{6B564610-4D4B-4514-8E99-BA30320C8C45}] => (Allow) C:\Program
Files (x86)\Google\Chrome\Application\chrome.exe
FirewallRules: [{8275C44B-588A-44A8-AA31-5CA246C843D7}] => (Allow) C:\Users\Duc
Hong\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe
FirewallRules: [{341B590C-72BE-41C1-8D3B-81B7B97F31C4}] => (Allow) C:\Program
Files (x86)\Windows Live\Contacts\wlcomm.exe
FirewallRules: [{9C62EFEB-4763-4789-983E-C443E1323C56}] => (Allow) LPort=2869
FirewallRules: [{A0BBA649-A813-4E72-B461-002ADF599BB2}] => (Allow) LPort=1900
FirewallRules: [{7A1895A9-2842-4905-B03D-7FE4C9AE9DF0}] => (Allow) C:\Program
Files (x86)\Windows Live\Messenger\msnmsgr.exe
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (05/27/2015 08:28:22 PM) (Source: NvStreamSvc) (EventID: 2001) (User: )
Description: NvStreamSvcFailed continue stopping. [5]
Error: (05/27/2015 07:04:24 PM) (Source: NvStreamSvc) (EventID: 2001) (User: )
Description: NvStreamSvcFailed continue stopping. [6]
Error: (05/27/2015 06:55:22 PM) (Source: NvStreamSvc) (EventID: 2001) (User: )
Description: NvStreamSvcFailed continue stopping. [0]
Error: (05/27/2015 05:01:26 PM) (Source: Application Error) (EventID: 1000)
(User: )
Description: Faulting application name: defraggler64.exe, version: 2.18.0.945,
time stamp: 0x534528ea
Faulting module name: dbghelp.dll_unloaded, version: 6.3.9600.17787, time stamp:
0x551b69ca
Exception code: 0xc0000005
Fault offset: 0x0000000000113a70
Faulting process id: 0x1714
Faulting application start time: 0xdefraggler64.exe0
Faulting application path: defraggler64.exe1
Faulting module path: defraggler64.exe2
Report Id: defraggler64.exe3
Faulting package full name: defraggler64.exe4
Faulting package-relative application ID: defraggler64.exe5
Error: (05/27/2015 04:17:57 PM) (Source: NvStreamSvc) (EventID: 2001) (User: )
Description: NvStreamSvcFailed continue stopping. [0]
Error: (05/27/2015 05:48:26 AM) (Source: NvStreamSvc) (EventID: 2001) (User: )
Description: NvStreamSvcFailed continue stopping. [0]
Error: (05/26/2015 08:22:37 PM) (Source: NvStreamSvc) (EventID: 2001) (User: )
Description: NvStreamSvcFailed continue stopping. [5]
Error: (05/26/2015 08:03:08 PM) (Source: NvStreamSvc) (EventID: 2001) (User: )
Description: NvStreamSvcFailed continue stopping. [6]
Error: (05/26/2015 07:40:12 PM) (Source: NvStreamSvc) (EventID: 2001) (User: )
Description: NvStreamSvcFailed continue stopping. [6]
Error: (05/26/2015 06:35:40 PM) (Source: VSS) (EventID: 8193) (User: )
Description: Volume Shadow Copy Service error: Unexpected error calling routine
CoCreateInstance. hr = 0x80040154, Class not registered
.
Operation:
Instantiating VSS server
System errors:
=============
Error: (05/28/2015 00:07:30 AM) (Source: DCOM) (EventID: 10010) (User:
HongHoangPC)
Description: {1B1F472E-3221-4826-97DB-2C2324D389AE}
Error: (05/28/2015 00:07:00 AM) (Source: DCOM) (EventID: 10010) (User:
HongHoangPC)
Description: {BF6C1E47-86EC-4194-9CE5-13C15DCB2001}
Error: (05/28/2015 00:01:25 AM) (Source: DCOM) (EventID: 10010) (User:
HongHoangPC)
Description: {1B1F472E-3221-4826-97DB-2C2324D389AE}
Error: (05/28/2015 00:00:46 AM) (Source: DCOM) (EventID: 10010) (User:
HongHoangPC)
Description: {BF6C1E47-86EC-4194-9CE5-13C15DCB2001}
Error: (05/27/2015 11:56:16 PM) (Source: DCOM) (EventID: 10010) (User:
HongHoangPC)
Description: {1B1F472E-3221-4826-97DB-2C2324D389AE}
Error: (05/27/2015 11:55:37 PM) (Source: DCOM) (EventID: 10010) (User:
HongHoangPC)
Description: {BF6C1E47-86EC-4194-9CE5-13C15DCB2001}
Error: (05/27/2015 11:48:16 PM) (Source: DCOM) (EventID: 10010) (User:
HongHoangPC)
Description: {1B1F472E-3221-4826-97DB-2C2324D389AE}
Error: (05/27/2015 11:47:36 PM) (Source: DCOM) (EventID: 10010) (User:
HongHoangPC)
Description: {BF6C1E47-86EC-4194-9CE5-13C15DCB2001}
Error: (05/27/2015 11:10:25 PM) (Source: DCOM) (EventID: 10010) (User:
HongHoangPC)
Description: {1B1F472E-3221-4826-97DB-2C2324D389AE}
Error: (05/27/2015 11:09:44 PM) (Source: DCOM) (EventID: 10010) (User:
HongHoangPC)
Description: {BF6C1E47-86EC-4194-9CE5-13C15DCB2001}
Microsoft Office:
=========================
Error: (05/27/2015 08:28:22 PM) (Source: NvStreamSvc) (EventID: 2001) (User: )
Description: NvStreamSvcFailed continue stopping. [5]
Error: (05/27/2015 07:04:24 PM) (Source: NvStreamSvc) (EventID: 2001) (User: )
Description: NvStreamSvcFailed continue stopping. [6]
Error: (05/27/2015 06:55:22 PM) (Source: NvStreamSvc) (EventID: 2001) (User: )
Description: NvStreamSvcFailed continue stopping. [0]
Error: (05/27/2015 05:01:26 PM) (Source: Application Error) (EventID: 1000)
(User: )
Description:
defraggler64.exe2.18.0.945534528eadbghelp.dll_unloaded6.3.9600.17787551b69cac00000050000000000113a70171401d0984af3376023C:\Program
Files\Defraggler\defraggler64.exedbghelp.dll30e64e57-043e-11e5-82d4-7824afb1d22b
Error: (05/27/2015 04:17:57 PM) (Source: NvStreamSvc) (EventID: 2001) (User: )
Description: NvStreamSvcFailed continue stopping. [0]
Error: (05/27/2015 05:48:26 AM) (Source: NvStreamSvc) (EventID: 2001) (User: )
Description: NvStreamSvcFailed continue stopping. [0]
Error: (05/26/2015 08:22:37 PM) (Source: NvStreamSvc) (EventID: 2001) (User: )
Description: NvStreamSvcFailed continue stopping. [5]
Error: (05/26/2015 08:03:08 PM) (Source: NvStreamSvc) (EventID: 2001) (User: )
Description: NvStreamSvcFailed continue stopping. [6]
Error: (05/26/2015 07:40:12 PM) (Source: NvStreamSvc) (EventID: 2001) (User: )
Description: NvStreamSvcFailed continue stopping. [6]
Error: (05/26/2015 06:35:40 PM) (Source: VSS) (EventID: 8193) (User: )
Description: CoCreateInstance0x80040154, Class not registered
Operation:
Instantiating VSS server
CodeIntegrity Errors:
===================================
Date: 2015-05-17 02:43:02.789
Description: Windows is unable to verify the image integrity of the file
\Device\HarddiskVolume4\Windows\SysWOW64\drivers\DrvAgent64.SYS because file
hash could not be found on the system. A recent hardware or software change
might have installed a file that is signed incorrectly or damaged, or that might
be malicious software from an unknown source.
Date: 2015-05-17 02:43:02.723
Description: Windows is unable to verify the image integrity of the file
\Device\HarddiskVolume4\Windows\SysWOW64\drivers\DrvAgent64.SYS because file
hash could not be found on the system. A recent hardware or software change
might have installed a file that is signed incorrectly or damaged, or that might
be malicious software from an unknown source.
Date: 2015-05-17 02:43:02.658
Description: Windows is unable to verify the image integrity of the file
\Device\HarddiskVolume4\Windows\SysWOW64\drivers\DrvAgent64.SYS because file
hash could not be found on the system. A recent hardware or software change
might have installed a file that is signed incorrectly or damaged, or that might
be malicious software from an unknown source.
Date: 2015-05-17 02:43:02.595
Description: Windows is unable to verify the image integrity of the file
\Device\HarddiskVolume4\Windows\SysWOW64\drivers\DrvAgent64.SYS because file
hash could not be found on the system. A recent hardware or software change
might have installed a file that is signed incorrectly or damaged, or that might
be malicious software from an unknown source.
Date: 2015-05-17 02:43:02.527
Description: Windows is unable to verify the image integrity of the file
\Device\HarddiskVolume4\Windows\SysWOW64\drivers\DrvAgent64.SYS because file
hash could not be found on the system. A recent hardware or software change
might have installed a file that is signed incorrectly or damaged, or that might
be malicious software from an unknown source.
Date: 2015-05-17 02:43:02.462
Description: Windows is unable to verify the image integrity of the file
\Device\HarddiskVolume4\Windows\SysWOW64\drivers\DrvAgent64.SYS because file
hash could not be found on the system. A recent hardware or software change
might have installed a file that is signed incorrectly or damaged, or that might
be malicious software from an unknown source.
Date: 2015-05-17 02:43:02.397
Description: Windows is unable to verify the image integrity of the file
\Device\HarddiskVolume4\Windows\SysWOW64\drivers\DrvAgent64.SYS because file
hash could not be found on the system. A recent hardware or software change
might have installed a file that is signed incorrectly or damaged, or that might
be malicious software from an unknown source.
Date: 2015-05-17 02:43:02.333
Description: Windows is unable to verify the image integrity of the file
\Device\HarddiskVolume4\Windows\SysWOW64\drivers\DrvAgent64.SYS because file
hash could not be found on the system. A recent hardware or software change
might have installed a file that is signed incorrectly or damaged, or that might
be malicious software from an unknown source.
Date: 2015-05-17 02:42:58.259
Description: Windows is unable to verify the image integrity of the file
\Device\HarddiskVolume4\Windows\SysWOW64\drivers\DrvAgent64.SYS because file
hash could not be found on the system. A recent hardware or software change
might have installed a file that is signed incorrectly or damaged, or that might
be malicious software from an unknown source.
Date: 2015-05-17 02:42:58.195
Description: Windows is unable to verify the image integrity of the file
\Device\HarddiskVolume4\Windows\SysWOW64\drivers\DrvAgent64.SYS because file
hash could not be found on the system. A recent hardware or software change
might have installed a file that is signed incorrectly or damaged, or that might
be malicious software from an unknown source.
==================== Memory info ===========================
Processor: Intel® Core™ i7-4710HQ CPU @ 2.50GHz
Percentage of memory in use: 28%
Total physical RAM: 8075.06 MB
Available physical RAM: 5808.31 MB
Total Pagefile: 8587.06 MB
Available Pagefile: 6043.32 MB
Total Virtual: 131072 MB
Available Virtual: 131071.78 MB
==================== Drives ================================
Drive c: (OS) (Fixed) (Total:72.6 GB) (Free:22.92 GB) NTFS ==>[System with boot
components (obtained from reading drive)]
Drive d: (DucHong) (Fixed) (Total:418.9 GB) (Free:298.56 GB) NTFS
Drive e: (Miscellaneous) (Fixed) (Total:300 GB) (Free:80.84 GB) NTFS
Drive f: (Misc.2) (Fixed) (Total:118.9 GB) (Free:96.35 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (Size: 931.5 GB) (Disk ID: EE7E28CB)
Partition: GPT Partition Type.
==================== End of log ============================
I also attached them below.
ATTACHED FILES
* Addition.txt 43.23KB 1 downloads
* FRST.txt 73.9KB 0 downloads
Edited by xXToffeeXx, 27 May 2015 - 02:06 PM.
* Back to top
--------------------------------------------------------------------------------
#4 XXTOFFEEXX
xXToffeeXx
Bleepin' Polar Bear
*
* Malware Response Instructor
* 6,088 posts
* OFFLINE
* Gender:Female
* Location:The Arctic Circle
* Local time:03:44 AM
Posted 27 May 2015 - 02:19 PM
Hi User1412,
We need to run a fix with FRST:
* Press the windows key + r on your keyboard at the same time. Type in notepad
and press Enter.
* Copy and paste the script below in the notepad document:
HKLM\...\Winlogon: [Userinit] C:\Windows\system32\userinit.exe,C:\Windows\taskhost.exe /boot
C:\Windows\taskhost.exe
HKU\S-1-5-21-1926068397-2398490202-140176465-1002\Software\Microsoft\Internet Explorer\Main,Start Page =
SearchScopes: HKU\S-1-5-21-1926068397-2398490202-140176465-1002 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-1926068397-2398490202-140176465-1002 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
* Save the file to your desktop and name it as fixlist.txt
Note: It's important that both files, FRST.exe/FRST64.exe and fixlist.txt are in
the same location or the fix will not work
NOTICE: This script was written specifically for this user, for use on that
particular machine. Running this on another machine may cause damage to your
operating system
* Run FRST.exe/FRST64.exe and press the Fix button just once and wait
* If for some reason the tool needs a restart, please make sure you let the
system restart normally, then let the tool complete its run
* When finished, FRST will generate a log (Fixlog.txt) in the same location the
tool was run.
* Please copy and paste the log in your next reply.
xXToffeeXx~
~If I am helping you and you have not had a reply from me in two days, please
send me a PM~
ID Ransomware - Identify What Ransomware Encrypted Your Files [Support Topic] -
If we have helped you out and you want to support what we do, you can do so here
~Twitter~ | ~Malware Analyst at Emsisoft~
* Back to top
--------------------------------------------------------------------------------
#5 USER1412
User1412
* Topic Starter
*
* Members
* 23 posts
* OFFLINE
* Local time:01:44 PM
Posted 27 May 2015 - 03:57 PM
Here you are:
Fix result of Farbar Recovery Scan Tool (x64) Version: 27-05-2015
Ran by Duc Hong at 2015-05-28 06:55:51 Run:1
Running from C:\Users\Duc Hong\Desktop
Loaded Profiles: Duc Hong (Available Profiles: Duc Hong)
Boot Mode: Normal
==============================================
fixlist content:
*****************
HKLM\...\Winlogon: [Userinit]
C:\Windows\system32\userinit.exe,C:\Windows\taskhost.exe /boot
C:\Windows\taskhost.exe
HKU\S-1-5-21-1926068397-2398490202-140176465-1002\Software\Microsoft\Internet
Explorer\Main,Start Page =
SearchScopes: HKU\S-1-5-21-1926068397-2398490202-140176465-1002 -> DefaultScope
{0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-1926068397-2398490202-140176465-1002 ->
{0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
*****************
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\\Userinit => value
restored successfully
C:\Windows\taskhost.exe => Moved successfully.
HKU\S-1-5-21-1926068397-2398490202-140176465-1002\Software\Microsoft\Internet
Explorer\Main\\Start Page => value restored successfully
HKU\S-1-5-21-1926068397-2398490202-140176465-1002\SOFTWARE\Microsoft\Internet
Explorer\SearchScopes\\DefaultScope => value Removed successfully
"HKU\S-1-5-21-1926068397-2398490202-140176465-1002\SOFTWARE\Microsoft\Internet
Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}" => key Removed
successfully
HKCR\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} => key not found.
==== End of Fixlog 06:55:52 ====
* Back to top
--------------------------------------------------------------------------------
#6 XXTOFFEEXX
xXToffeeXx
Bleepin' Polar Bear
*
* Malware Response Instructor
* 6,088 posts
* OFFLINE
* Gender:Female
* Location:The Arctic Circle
* Local time:03:44 AM
Posted 28 May 2015 - 10:14 AM
Hi User1412,
Download Emsisoft Emergency Kit and save it to your desktop. Double click on
EmsisoftEmergencyKit.exe to extract its contents and create a shortcut on the
desktop. Leave all settings as they are and click Accept & Extract. A folder
named EEK will be created in the root of the drive (usually c:\). .
* After extraction an Emsisoft Emergency Kit window will open. Under "Run
Directly:" click Emergency Kit Scanner.
* When asked to run an online update, click Yes.
* When the update is finished, click the Back to Security Status link in the
left corner. On the main screen click the Scan Now button.
* Select the Full Scan option and click the SCAN button.
* When the scan is finished click the Quarantine selected objects button. Note,
this option is only available if malicious objects were detected during the
scan.
* Click the View Report button and in the Reports window double-click on the
most recent log. Note, logs are named as follows: a2scan_<date>-<time>.txt.
* Copy/paste the report contents in your next reply.
--------------
This scan can take a long time, so it is best done overnight or when you do not
need the computer
I'd like us to scan your machine with ESET OnlineScan
* Hold down Control and click on this link to open ESET OnlineScan in a new
window.
* Click the button.
* For alternate browsers only: (Microsoft Internet Explorer users can skip
these steps)
* Click on esetsmartinstaller_enu.exe to download the ESET Smart Installer.
Save it to your desktop.
* Double click on the icon on your desktop.
* Check "YES, I accept the Terms of Use."
* Click the Start button.
* Accept any security warnings from your browser.
* Under scan settings, check "Scan Archives" and "Remove found threats"
* Click Advanced settings and select the following:
* Scan potentially unwanted applications
* Scan for potentially unsafe applications
* Enable Anti-Stealth technology
* ESET will then download updates for itself, install itself, and begin
scanning your computer. Please be patient as this can take some time.
* When the scan completes, click List Threats
* Click Export, and save the file to your desktop using a unique name, such as
ESETScan. Include the contents of this report in your next reply.
* Click the Back button.
* Click the Finish button.
--------------
To recap, in your next reply I would like to see the following. Make sure to
copy & paste them unless I ask otherwise:
* Emsisoft log
* ESET log
xXToffeeXx~
~If I am helping you and you have not had a reply from me in two days, please
send me a PM~
ID Ransomware - Identify What Ransomware Encrypted Your Files [Support Topic] -
If we have helped you out and you want to support what we do, you can do so here
~Twitter~ | ~Malware Analyst at Emsisoft~
* Back to top
--------------------------------------------------------------------------------
#7 USER1412
User1412
* Topic Starter
*
* Members
* 23 posts
* OFFLINE
* Local time:01:44 PM
Posted 29 May 2015 - 06:04 AM
ESET:
C:\Documents and Settings\Duc Hong\Downloads\Programs\ccsetup506.exe Win32/Bundled.Toolbar.Google.D potentially unsafe application
C:\Documents and Settings\Duc Hong\Downloads\Programs\dfsetup219.exe Win32/Bundled.Toolbar.Google.D potentially unsafe application
C:\Documents and Settings\Duc Hong\Downloads\Programs\spsetup128.exe Win32/Bundled.Toolbar.Google.D potentially unsafe application
C:\Users\Duc Hong\Downloads\Programs\spsetup128.exe Win32/Bundled.Toolbar.Google.D potentially unsafe application
E:\file from mediafire\IDM files\mailpv\mailpv.exe Win32/PSWTool.MailPassView.E potentially unsafe application
E:\file from mediafire\IDM files\Wondershare.Video.Converter.Ultimate.6.x.Patch-XenoCoder\wondershare.video.converter.ultimate.6.x-patch.exe a variant of Win32/HackTool.Patcher.AD potentially unsafe application
E:\Software\Compressed\[Celestia]VnSharing_Diskeeper.2011.Pro.Premier.v15.0.951\Diskeeper.2011.Pro.Premier.v15.0.951.Incl.Patch.And.Keymaker-AGAiN\Keygen.exe a variant of Win32/Keygen.AF potentially unsafe application
E:\Software\Programs\ccsetup506.exe Win32/Bundled.Toolbar.Google.D potentially unsafe application
E:\Software\Programs\dfsetup219.exe Win32/Bundled.Toolbar.Google.D potentially unsafe application
E:\Software\Programs\FoxitReader510.1021_enu_Setup.exe a variant of Win32/Bundled.Toolbar.Ask potentially unsafe application
E:\Software\Programs\light_image_resizer4_setup_4.2.0.0_bunndle.exe a variant of Win32/Bunndle potentially unsafe application
E:\Software\Programs\rcsetup151.exe Win32/Bundled.Toolbar.Google.D potentially unsafe application
E:\Software\Programs 2\CrystalDiskInfo5_4_2-en.exe Win32/OpenCandy potentially unsafe application
E:\Software\Programs 2\driverfusionsetup.exe Win32/OpenCandy potentially unsafe application
E:\Software\Programs 2\DTLite4491-0356.exe Win32/DownWare.L potentially unwanted application
E:\Software\Programs 2\FFCoder_v1.3.0.3_Setup_Full.exe Win32/PrcView potentially unsafe application
E:\Software\Programs 2\FFSetup300.exe a variant of Win32/Hao123.A potentially unwanted application
E:\Software\Programs 2\FreemakeVideoConverter_4.0.4.3.exe Win32/OpenCandy potentially unsafe application
E:\Software\Programs 2\MediaCoder-0.8.20.5380.exe Win32/OpenCandy potentially unsafe application
E:\Software\Programs 2\networx_setup.exe a variant of Win32/NetFilter.A potentially unsafe application
E:\Software\Programs 2\SetupImgBurn_2.5.8.0.exe Win32/OpenCandy potentially unsafe application
E:\Software\Programs 2\SIWPortable_2011.10.29.paf.exe a variant of Win32/RemoteAdmin.RemoteExec.AA potentially unsafe application
E:\Software\Programs 2\spsetup120.exe Win32/Bundled.Toolbar.Google.E potentially unsafe application
E:\Software\Programs 2\Unlocker1.9.2.exe Win32/DownWare.L potentially unwanted application
E:\Software\Programs 2\visionssetup.exe a variant of Win32/Toolbar.Conduit.AI potentially unwanted application
E:\Software\Test\SevenQFInstall.exe Win32/DownWare.W potentially unwanted application
E:\Software\Test\System Utilities\3DP_Chip_v1208.exe Win32/OpenCandy potentially unsafe application
E:\Software\Test\System Utilities\ASC\asc-setup.exe a variant of Win32/Toolbar.Widgi.B potentially unwanted application
E:\Software\Test\Wondershare\Wondershare Video Converter Ultimate 6.x-patch\wondershare.video.converter.ultimate.6.x-patch.exe a variant of Win32/HackTool.Patcher.AD potentially unsafe application
E:\Software\Test\[Celestia]VnSharing_Diskeeper.2011.Pro.Premier.v15.0.951\Diskeeper.2011.Pro.Premier.v15.0.951.Incl.Patch.And.Keymaker-AGAiN\Keygen.exe a variant of Win32/Keygen.AF potentially unsafe application
E:\Software\Tools\Mipony-Installer.exe Win32/InstallCore.HQ potentially unwanted application
E:\Software\Utilities\3DP_Chip_v1408.exe a variant of Win32/OpenCandy.C potentially unsafe application
E:\Temp\BKUP\backup from usb 8g\disk-defrag-setup.exe a variant of Win32/Toolbar.Widgi.N potentially unwanted application
E:\Temp\BKUP\bkup\Old Firefox Data 2\dy5tzm1j.default-1371212508919\prefs.js JS/SecurityDisabler.A.Gen potentially unwanted application
Emsisoft:
Emsisoft Emergency Kit - Version 9.0
Last update: 29-May-15 3:02:56 PM
User account: HongHoangPC\Duc Hong
Scan settings:
Scan type: Full Scan
Objects: Rootkits, Memory, Traces, C:\, D:\, E:\, F:\
Detect PUPs: Off
Scan archives: On
ADS Scan: On
File extension filter: Off
Advanced caching: On
Direct disk access: Off
Scan start: 29-May-15 3:26:00 PM
C:\FRST\Quarantine\C\Windows\taskhost.exe.xBAD detected: Trojan.GenericKD.1841162 (B)
C:\Users\Duc Hong\Downloads\Programs\Steam Unchained__9273_il588.exe detected: Gen:Variant.Adware.Strictor.83379 (B)
E:\file from mediafire\IDM files\VSO-ConvertXtoDVD-5.2.0.5-Final-Multilingual.rar -> vso.convertxtodvd.5.x-patch.exe detected: Gen:Trojan.Heur.FU.euW@a0Q59To (B)
E:\Software\Compressed\[Cattleya][VnSharing.net] Trillian Astra 5.0.0.34.rar -> [Cattleya][VnSharing.net] Trillian Astra 5.0.0.34\patch.exe detected: Backdoor.Generic.580467 (B)
E:\Software\Compressed\[vnsharing.net]Perfect Resize 7.0.6 Professional Edition.rar -> [vnsharing.net]Perfect Resize 7.0.6 Professional Edition\keygen\KeyGen.exe detected: Trojan.Generic.KD.118597 (B)
E:\Software\Compressed\[VnSharing.net]RAR Repair Tool 4.0.1.rar -> RAR Repair Tool 4.0.1 Incl.Serial\Rar Repair Tool 4.0.1.exe detected: Win32.Polip.A (B)
E:\Software\Compressed\ConvertXtoDVD5\convertxtodvd.5.x.patch.v2.8-Cerberus.exe detected: Dropped:Trojan.Generic.14524712 (B)
E:\Software\Compressed\ConvertXtoDVD5\convertxtodvd.5.x.patch.v2.8-Cerberus.rar -> convertxtodvd.5.x.patch.v2.8-Cerberus.exe detected: Dropped:Trojan.Generic.14524712 (B)
E:\Software\Compressed\ConvertXtoDVD5\VSO ConvertxtoDVD 5.x.Patch.zip -> vso.convertxtodvd.5.x-patch.exe detected: Gen:Trojan.Heur.FU.euW@a0Q59To (B)
E:\Software\Compressed\ConvertXtoDVD5\vso.convertxtodvd.5.x-patch.exe detected: Gen:Trojan.Heur.FU.euW@a0Q59To (B)
E:\Software\Compressed\InternetDownloadManager\[shoptinhoc.com]IDM All version patch by z0mbie.rar -> [shoptinhoc.com]IDM All version patch by z0mbie\IDM All version patch by z0mbie.exe detected: Trojan.Generic.7567038 (B)
E:\Software\Compressed\InternetDownloadManager\[shoptinhoc.com]IDM All version patch by z0mbie\IDM All version patch by z0mbie.exe detected: Trojan.Generic.7567038 (B)
E:\Software\Compressed\xplr2.P.v2.2.0.1.rar -> ZABKAT.xplorer2.Pro.v2.2.0.1.x64.Multilingual.Incl.Keymaker-ZWT.rar -> ZABKAT.xplorer2.Pro.v2.2.0.1.x64.Multilingual.Incl.Keymaker-ZWT\zm614xvk.zip -> zwt.rar -> keygen.exe detected: Trojan.Generic.7518365 (B)
E:\Software\Compressed\xplr2.P.v2.2.0.1.rar -> ZABKAT.xplorer2.Pro.v2.2.0.1.Multilingual.Incl.Keymaker-ZWT.rar -> ZABKAT.xplorer2.Pro.v2.2.0.1.Multilingual.Incl.Keymaker-ZWT\z2qc26le.zip -> zwt.rar -> keygen.exe detected: Trojan.Generic.7518365 (B)
E:\Software\Test\System Utilities\ASC\Advanced.SystemCare.PRO.v6.0.8.170.Patch.Only-OCJ.7z -> Patch.exe detected: Gen:Variant.Kazy.345 (B)
E:\Software\Test\System Utilities\ASC\djkute151092_Patch.Only-OCJ.7z -> Patch.exe detected: Gen:Variant.Kazy.345 (B)
E:\Software\Test\System Utilities\ASC\Patch.exe detected: Gen:Variant.Kazy.345 (B)
E:\Software\Test\System Utilities\Driver Reviver\reviversoft-patch.exe detected: Gen:Trojan.Heur.FU.euW@aS5BYTm (B)
E:\Software\Test\System Utilities\Driver Reviver\reviversoft-patch.rar -> reviversoft-patch.exe detected: Gen:Trojan.Heur.FU.euW@aS5BYTm (B)
E:\Software\Test\Xilisoft\Keygen\Keygen.exe detected: HackTool.Win32.Keygen (A)
E:\Software\Test\Xilisoft\Xilisoft DVD Ripper Platinum 7.x patch&keygen\Lz0.rar -> Lz0\Keygen.exe detected: Gen:Variant.Kazy.2529 (B)
E:\Software\Test\Xilisoft\Xilisoft DVD Ripper Platinum 7.x patch&keygen\Lz0\Keygen.exe detected: Gen:Variant.Kazy.2529 (B)
E:\Software\Test\Xilisoft\Xilisoft DVD Ripper Platinum 7.x patch&keygen\Xilisoft.ImTOO.4Media.Multipatch.v0.5-BBB.zip -> Patch.exe detected: Gen:Variant.Minggy.2 (B)
E:\Software\Test\Xilisoft\Xilisoft Multi Keygen 18 in 1 (2012)_qg128_CiN1TeAm.biZ.exe detected: Trojan.Generic.8220808 (B)
E:\Software\Test\Xilisoft\Xilisoft Patcher All Products 2012_Patch_cin1\Xilisoft Patcher All Products 2012_Patch_cin1.exe detected: Backdoor.Generic.826044 (B)
E:\Software\Test\Xilisoft\Xilisoft_Video_Converter_Ultimate-7.5.0.20120822.rar -> xilisoft.video.converter.ultimate-SND.rar -> xilisoft.video.converter.ultimate.exe detected: Gen:Trojan.Heur.VP2.jmKfaa6nIZji (B)
E:\Software\Tools\PE explorer full\ABRE ESTO\crack\keygen.exe detected: Trojan.Generic.7582513 (B)
Scanned 488956
Found 27
Scan end: 29-May-15 5:11:49 PM
Scan time: 1:45:49
E:\Software\Tools\PE explorer full\ABRE ESTO\crack\keygen.exe Quarantined Trojan.Generic.7582513 (B)
E:\Software\Test\Xilisoft\Xilisoft_Video_Converter_Ultimate-7.5.0.20120822.rar Quarantined Gen:Trojan.Heur.VP2.jmKfaa6nIZji (B)
E:\Software\Test\Xilisoft\Xilisoft Patcher All Products 2012_Patch_cin1\Xilisoft Patcher All Products 2012_Patch_cin1.exe Quarantined Backdoor.Generic.826044 (B)
E:\Software\Test\Xilisoft\Xilisoft Multi Keygen 18 in 1 (2012)_qg128_CiN1TeAm.biZ.exe Quarantined Trojan.Generic.8220808 (B)
E:\Software\Test\Xilisoft\Xilisoft DVD Ripper Platinum 7.x patch&keygen\Xilisoft.ImTOO.4Media.Multipatch.v0.5-BBB.zip Quarantined Gen:Variant.Minggy.2 (B)
E:\Software\Test\Xilisoft\Xilisoft DVD Ripper Platinum 7.x patch&keygen\Lz0\Keygen.exe Quarantined Gen:Variant.Kazy.2529 (B)
E:\Software\Test\Xilisoft\Xilisoft DVD Ripper Platinum 7.x patch&keygen\Lz0.rar Quarantined Gen:Variant.Kazy.2529 (B)
E:\Software\Test\Xilisoft\Keygen\Keygen.exe Quarantined HackTool.Win32.Keygen (A)
E:\Software\Test\System Utilities\Driver Reviver\reviversoft-patch.rar Quarantined Gen:Trojan.Heur.FU.euW@aS5BYTm (B)
E:\Software\Test\System Utilities\Driver Reviver\reviversoft-patch.exe Quarantined Gen:Trojan.Heur.FU.euW@aS5BYTm (B)
E:\Software\Test\System Utilities\ASC\Patch.exe Quarantined Gen:Variant.Kazy.345 (B)
E:\Software\Test\System Utilities\ASC\djkute151092_Patch.Only-OCJ.7z Quarantined Gen:Variant.Kazy.345 (B)
E:\Software\Test\System Utilities\ASC\Advanced.SystemCare.PRO.v6.0.8.170.Patch.Only-OCJ.7z Quarantined Gen:Variant.Kazy.345 (B)
E:\Software\Compressed\xplr2.P.v2.2.0.1.rar Quarantined Trojan.Generic.7518365 (B)
E:\Software\Compressed\InternetDownloadManager\[shoptinhoc.com]IDM All version patch by z0mbie\IDM All version patch by z0mbie.exe Quarantined Trojan.Generic.7567038 (B)
E:\Software\Compressed\InternetDownloadManager\[shoptinhoc.com]IDM All version patch by z0mbie.rar Quarantined Trojan.Generic.7567038 (B)
E:\Software\Compressed\ConvertXtoDVD5\vso.convertxtodvd.5.x-patch.exe Quarantined Gen:Trojan.Heur.FU.euW@a0Q59To (B)
E:\Software\Compressed\ConvertXtoDVD5\VSO ConvertxtoDVD 5.x.Patch.zip Quarantined Gen:Trojan.Heur.FU.euW@a0Q59To (B)
E:\Software\Compressed\ConvertXtoDVD5\convertxtodvd.5.x.patch.v2.8-Cerberus.rar Quarantined Dropped:Trojan.Generic.14524712 (B)
E:\Software\Compressed\ConvertXtoDVD5\convertxtodvd.5.x.patch.v2.8-Cerberus.exe Quarantined Dropped:Trojan.Generic.14524712 (B)
E:\Software\Compressed\[VnSharing.net]RAR Repair Tool 4.0.1.rar Quarantined Win32.Polip.A (B)
E:\Software\Compressed\[vnsharing.net]Perfect Resize 7.0.6 Professional Edition.rar Quarantined Trojan.Generic.KD.118597 (B)
E:\Software\Compressed\[Cattleya][VnSharing.net] Trillian Astra 5.0.0.34.rar Quarantined Backdoor.Generic.580467 (B)
E:\file from mediafire\IDM files\VSO-ConvertXtoDVD-5.2.0.5-Final-Multilingual.rar Quarantined Gen:Trojan.Heur.FU.euW@a0Q59To (B)
C:\Users\Duc Hong\Downloads\Programs\Steam Unchained__9273_il588.exe Quarantined Gen:Variant.Adware.Strictor.83379 (B)
C:\FRST\Quarantine\C\Windows\taskhost.exe.xBAD Quarantined Trojan.GenericKD.1841162 (B)
Quarantined 26
Edited by User1412, 29 May 2015 - 06:06 AM.
* Back to top
--------------------------------------------------------------------------------
#8 XXTOFFEEXX
xXToffeeXx
Bleepin' Polar Bear
*
* Malware Response Instructor
* 6,088 posts
* OFFLINE
* Gender:Female
* Location:The Arctic Circle
* Local time:03:44 AM
Posted 29 May 2015 - 02:24 PM
Hi User1412,
A lot of your cracks seem to be malicious, this is probably where your infection
came from.
I see a number of lines in your log which are related to cracks, torrents
and keygens. I shall provide this warning:
The practice of using keygens, hacking tools, cracking tools, warez, torrents or
any pirated software is not only considered illegal activity, but it is a
serious security risk which can turn a computer into a virus honeypot or zombie.
When you use these kind of programs, be forewarned that some of the worst types
of malware infections can be contracted and spread by
visiting crack, keygen, warez and other pirated software sites. In many cases,
those sites are infested with a smörgåsbord of malware and an increasing source
of system infection. Those who attempt to get software for free can end up with
a computer system so badly damaged that recovery is not possible, and it cannot
be repaired. When that happens there is nothing you can do
besides reformatting and reinstalling the OS.
If you want to read on then the full post is here.
--------------
Please re-run FRST from the desktop (like you did before) and press the scan
button. It will produce a FRST.txt log located on the desktop. Please copy and
paste the log into your next reply.
xXToffeeXx~
~If I am helping you and you have not had a reply from me in two days, please
send me a PM~
ID Ransomware - Identify What Ransomware Encrypted Your Files [Support Topic] -
If we have helped you out and you want to support what we do, you can do so here
~Twitter~ | ~Malware Analyst at Emsisoft~
* Back to top
--------------------------------------------------------------------------------
#9 USER1412
User1412
* Topic Starter
*
* Members
* 23 posts
* OFFLINE
* Local time:01:44 PM
Posted 30 May 2015 - 02:24 AM
I used to do some exploits with software and read them from online materials so
there's lots of cracks and keygens there ;b
Here's the log:
Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 27-05-2015
Ran by Duc Hong (administrator) on HONGHOANGPC on 30-05-2015 17:19:05
Running from C:\Users\Duc Hong\Desktop\FRST
Loaded Profiles: Duc Hong (Available Profiles: Duc Hong)
Platform: Windows 8.1 Pro with Media Center (X64) OS Language: English (United
States)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool:
http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file
will not be moved.)
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK
Hotkey\AsLdrSrv.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe
(Avast Software s.r.o.) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device
Support\AppleMobileDeviceService.exe
(Hanwang Technology Co.,Ltd. ) C:\Program Files\ASUS\ASUS
FaceID\HWFaceKeyService.exe
(ASUS Cloud Corporation) C:\Program Files
(x86)\ASUS\WebStorage\2.1.2.301\AsusWSWinService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Microsoft Corporation) C:\Program Files
(x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe
(Microsoft Corporation) C:\Program Files
(x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\GeForce Experience
Service\GfExperienceService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\ibtsiva.exe
(Intel® Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA
Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA
Corporation\NvStreamSrv\nvstreamsvc.exe
(Intel® Corporation) C:\Program Files\Common
Files\Intel\WirelessCommon\RegSrvc.exe
(SoftEther VPN Project at University of Tsukuba, Japan.) C:\Program
Files\SoftEther VPN Client\vpnclient_x64.exe
(VMware, Inc.) C:\Windows\SysWOW64\vmnat.exe
(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe
(VMware, Inc.) C:\Program Files (x86)\VMware\VMware Player\vmware-authd.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA
Corporation\NvStreamSrv\NvStreamNetworkService.exe
(VMware, Inc.) C:\Windows\SysWOW64\vmnetdhcp.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft
shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
(Motorola Solutions, Inc.) C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe
(Motorola Solutions, Inc.) C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine
Components\FWService\IntelMeFWService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine
Components\DAL\jhi_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine
Components\LMS\LMS.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK
Hotkey\HControl.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA
Corporation\NvStreamSrv\nvstreamsvc.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\Splendid\ColorUService.exe
(ASUSTek Computer Inc.) C:\Program Files\ASUS\ASUS Console\ASUS Console
Starter.exe
(ASUS) C:\Program Files (x86)\ASUS\Splendid\ACMON.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK
Hotkey\KBFiltr.exe
(Microsoft Corporation) C:\Windows\System32\InputMethod\JPN\JpnIME.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK
Media\DMedia.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK
Package\ATKOSD2\ATKOSD2.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update
Core\NvBackend.exe
(AsusTek) C:\Program Files (x86)\ASUS\ASUS Smart
Gesture\AsTPCenter\x64\AsusTPLoader.exe
(AsusTek) C:\Program Files (x86)\ASUS\ASUS Smart
Gesture\AsTPCenter\x64\AsusTPCenter.exe
(AsusTek) C:\Program Files (x86)\ASUS\ASUS Smart
Gesture\AsTPCenter\x64\AsusTPHelper.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Tonec Inc.) C:\Program Files (x86)\Internet Download Manager\IDMan.exe
(Microsoft Corporation) C:\Windows\System32\StikyNot.exe
(Internet Download Manager, Tonec Inc.) C:\Program Files (x86)\Internet Download
Manager\IDMIntegrator64.exe
(Tonec Inc.) C:\Program Files (x86)\Internet Download Manager\IEMonitor.exe
() C:\Program Files\Rainmeter\Rainmeter.exe
(Avast Software s.r.o.) C:\Program Files\AVAST Software\Avast\avastui.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java
Update\jusched.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
(Microsoft Corporation) C:\Windows\splwow64.exe
(Foxit Software Inc.) C:\Program Files (x86)\Foxit Software\Foxit
PhantomPDF\FoxitPhantomPDF.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(MPC-HC Team) C:\Program Files (x86)\K-Lite Codec Pack\MPC-HC\mpc-hc.exe
(Google) C:\Users\Duc Hong\AppData\Local\Google\Google Talk
Plugin\googletalkplugin.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to
default or removed. The file will not be moved.)
HKLM\...\Run: [SoftEther VPN Client UI Helper] => C:\Program Files\SoftEther VPN
Client\vpnclient_x64.exe [4374072 2015-01-21] (SoftEther VPN Project at
University of Tsukuba, Japan.)
HKLM\...\Run: [BTMTrayAgent] => rundll32.exe "C:\Program Files
(x86)\Intel\Bluetooth\btmshellex.dll",TrayApp
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update
Core\NvBackend.exe [2685072 2015-05-02] (NVIDIA Corporation)
HKLM-x32\...\Run: [ASUSPRP] => C:\Program Files (x86)\ASUS\APRP\APRP.EXE
[1080992 2014-05-17] (ASUSTek Computer Inc.)
HKLM-x32\...\Run: [ASUS InstantKey] => C:\Program Files (x86)\ASUS\ASUS Instant
Key\Ikey_start.exe [14448 2014-01-29] (ASUS)
HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST
Software\Avast\AvastUI.exe [5515496 2015-05-13] (Avast Software s.r.o.)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common
Files\Java\Java Update\jusched.exe [334896 2015-04-30] (Oracle Corporation)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-1926068397-2398490202-140176465-1002\...\Run: [Google Update] =>
C:\Users\Duc Hong\AppData\Local\Google\Update\GoogleUpdate.exe [107848
2015-04-17] (Google Inc.)
HKU\S-1-5-21-1926068397-2398490202-140176465-1002\...\Run: [IDM Helper] =>
C:\Program Files (x86)\Internet Download Manager\IDMGrHlp.exe [513560
2015-02-04] (Tonec Inc.)
HKU\S-1-5-21-1926068397-2398490202-140176465-1002\...\Run: [IDMan] => C:\Program
Files (x86)\Internet Download Manager\IDMan.exe [3903056 2015-05-20] (Tonec
Inc.)
HKU\S-1-5-21-1926068397-2398490202-140176465-1002\...\Run: [BingSvc] =>
C:\Users\Duc Hong\AppData\Local\Microsoft\BingSvc\BingSvc.exe [144008
2015-04-07] (© 2015 Microsoft Corporation)
HKU\S-1-5-21-1926068397-2398490202-140176465-1002\...\Run:
[RESTART_STICKY_NOTES] => C:\Windows\System32\StikyNot.exe [479744 2014-10-29]
(Microsoft Corporation)
HKU\S-1-5-21-1926068397-2398490202-140176465-1002\...\Policies\Explorer:
[NoLowDiskSpaceChecks] 1
HKU\S-1-5-21-1926068397-2398490202-140176465-1002\...\Policies\Explorer:
[LinkResolveIgnoreLinkInfo] 1
HKU\S-1-5-21-1926068397-2398490202-140176465-1002\...\Policies\Explorer:
[NoResolveSearch] 1
HKU\S-1-5-21-1926068397-2398490202-140176465-1002\...\Policies\Explorer:
[NoInternetOpenWith] 1
HKU\S-1-5-21-1926068397-2398490202-140176465-1002\Control
Panel\Desktop\\SCRNSAVE.EXE ->
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\SoftEther
VPN Client Manager Startup.lnk [2015-01-21]
ShortcutTarget: SoftEther VPN Client Manager Startup.lnk -> C:\Program
Files\SoftEther VPN Client\vpncmgr_x64.exe (SoftEther VPN Project at University
of Tsukuba, Japan.)
Startup: C:\Users\Duc Hong\AppData\Roaming\Microsoft\Windows\Start
Menu\Programs\Startup\Rainmeter.lnk [2015-01-07]
ShortcutTarget: Rainmeter.lnk -> C:\Program Files\Rainmeter\Rainmeter.exe ()
ShellIconOverlayIdentifiers: [!AsusWSShellExt_B] ->
{6D4133E5-0742-4ADC-8A8C-9303440F7191} => C:\Program Files (x86)\Common
Files\AWS\2.1.2.301\ASUSWSShellExt64.dll [2013-06-26] (ASUS Cloud Corporation.)
ShellIconOverlayIdentifiers: [!AsusWSShellExt_O] ->
{64174815-8D98-4CE6-8646-4C039977D809} => C:\Program Files (x86)\Common
Files\AWS\2.1.2.301\ASUSWSShellExt64.dll [2013-06-26] (ASUS Cloud Corporation.)
ShellIconOverlayIdentifiers: [!AsusWSShellExt_U] ->
{1C5AB7B1-0B38-4EC4-9093-7FD277E2AF4E} => C:\Program Files (x86)\Common
Files\AWS\2.1.2.301\ASUSWSShellExt64.dll [2013-06-26] (ASUS Cloud Corporation.)
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24}
=> C:\Program Files\AVAST Software\Avast\ashShA64.dll [2015-05-01] (Avast
Software s.r.o.)
ShellIconOverlayIdentifiers: [IDM Shell Extension] ->
{CDC95B92-E27C-4745-A8C5-64A52A78855D} => C:\Program Files (x86)\Internet
Download Manager\IDMShellExt64.dll [2014-04-21] (Tonec Inc.)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be
removed or restored to default.)
HKU\S-1-5-21-1926068397-2398490202-140176465-1002\Software\Microsoft\Internet
Explorer\Main,Default_Page_URL = http://asus13.msn.com/?pc=ASJB
HKU\S-1-5-21-1926068397-2398490202-140176465-1002\Software\Microsoft\Internet
Explorer\Main,Start Page Redirect Cache = http://www.msn.com/en-au/?ocid=iehp
BHO: IDM integration (IDMIEHlprObj Class) ->
{0055C089-8582-441B-A0BF-17B458C2A3A8} -> C:\Program Files (x86)\Internet
Download Manager\IDMIECC64.dll [2015-05-20] (Internet Download Manager, Tonec
Inc.)
BHO: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} ->
C:\Program Files\Java\jre1.8.0_45\bin\ssv.dll [2015-05-27] (Oracle Corporation)
BHO: Skype Click to Call for Internet Explorer ->
{AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files
(x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2014-07-14]
(Microsoft Corporation)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} ->
C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft
Corporation)
BHO: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} ->
C:\Program Files\Java\jre1.8.0_45\bin\jp2ssv.dll [2015-05-27] (Oracle
Corporation)
BHO-x32: ATLAS Toolbar -> {3C6301ED-0F78-4AF2-8150-D9C052361A8E} -> C:\Program
Files (x86)\ATLAS V14\ATLIECP.DLL [2011-07-06] (FUJITSU LIMITED)
BHO-x32: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} ->
C:\Program Files (x86)\Java\jre1.8.0_45\bin\ssv.dll [2015-05-27] (Oracle
Corporation)
BHO-x32: Skype Click to Call for Internet Explorer ->
{AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files
(x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2014-07-14] (Microsoft
Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF}
-> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06]
(Microsoft Corporation)
BHO-x32: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} ->
C:\Program Files (x86)\Java\jre1.8.0_45\bin\jp2ssv.dll [2015-05-27] (Oracle
Corporation)
Toolbar: HKLM-x32 - ATLAS Toolbar - {3C6301ED-0F78-4AF2-8150-D9C052361A8E} -
C:\Program Files (x86)\ATLAS V14\ATLIECP.DLL [2011-07-06] (FUJITSU LIMITED)
Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files
(x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2014-07-14]
(Microsoft Corporation)
Handler-x32: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program
Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2014-07-14]
(Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
FireFox:
========
FF ProfilePath: C:\Users\Duc
Hong\AppData\Roaming\Mozilla\Firefox\Profiles\62c9k4xd.default-1422598942125
FF Homepage: www.google.com.au
FF Plugin: @adobe.com/FlashPlayer ->
C:\Windows\system32\Macromed\Flash\NPSWF64_16_0_0_235.dll [2015-01-12] ()
FF Plugin: @java.com/DTPlugin,version=11.45.2 -> C:\Program
Files\Java\jre1.8.0_45\bin\dtplugin\npDeployJava1.dll [2015-05-27] (Oracle
Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.45.2 -> C:\Program
Files\Java\jre1.8.0_45\bin\plugin2\npjp2.dll [2015-05-27] (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft
Silverlight\5.1.40416.0\npctrl.dll [2015-04-16] ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 ->
C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer ->
C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_235.dll [2015-01-12] ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files
(x86)\iTunes\Mozilla Plugins\npitunes.dll [2014-10-30] ()
FF Plugin-x32: @foxitsoftware.com/Foxit PhantomPDF
Plugin,version=1.0,application/pdf -> C:\Program Files (x86)\Foxit
Software\Foxit PhantomPDF\plugins\npFoxitPhantomPDFPlugin.dll [2014-10-20]
(Foxit Corporation)
FF Plugin-x32: @foxitsoftware.com/Foxit PhantomPDF
Plugin,version=1.0,application/vnd.fdf -> C:\Program Files (x86)\Foxit
Software\Foxit PhantomPDF\plugins\npFoxitPhantomPDFPlugin.dll [2014-10-20]
(Foxit Corporation)
FF Plugin-x32: @foxitsoftware.com/Foxit PhantomPDF
Plugin,version=1.0,application/vnd.xdp -> C:\Program Files (x86)\Foxit
Software\Foxit PhantomPDF\plugins\npFoxitPhantomPDFPlugin.dll [2014-10-20]
(Foxit Corporation)
FF Plugin-x32: @foxitsoftware.com/Foxit PhantomPDF
Plugin,version=1.0,application/vnd.xfdf -> C:\Program Files (x86)\Foxit
Software\Foxit PhantomPDF\plugins\npFoxitPhantomPDFPlugin.dll [2014-10-20]
(Foxit Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5 ->
C:\Program Files (x86)\Intel\Intel® Management Engine
Components\IPT\npIntelWebAPIIPT.dll [2013-09-04] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files
(x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIUpdater.dll
[2013-09-04] (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=11.45.2 -> C:\Program Files
(x86)\Java\jre1.8.0_45\bin\dtplugin\npDeployJava1.dll [2015-05-27] (Oracle
Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.45.2 -> C:\Program Files
(x86)\Java\jre1.8.0_45\bin\plugin2\npjp2.dll [2015-05-27] (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files
(x86)\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-15] ( Microsoft
Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 ->
C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 ->
C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files
(x86)\Windows Live\Photo Gallery\NPWLPG.dll [2014-03-31] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files
(x86)\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-05-16] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files
(x86)\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-05-16] (Google Inc.)
FF Plugin HKU\S-1-5-21-1926068397-2398490202-140176465-1002:
@talk.google.com/GoogleTalkPlugin -> C:\Users\Duc
Hong\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll [2015-04-17] (Google)
FF Plugin HKU\S-1-5-21-1926068397-2398490202-140176465-1002:
@talk.google.com/O1DPlugin -> C:\Users\Duc
Hong\AppData\Roaming\Mozilla\plugins\npo1d.dll [2015-04-17] (Google)
FF Plugin HKU\S-1-5-21-1926068397-2398490202-140176465-1002:
@tools.google.com/Google Update;version=3 -> C:\Users\Duc
Hong\AppData\Local\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-05-16]
(Google Inc.)
FF Plugin HKU\S-1-5-21-1926068397-2398490202-140176465-1002:
@tools.google.com/Google Update;version=9 -> C:\Users\Duc
Hong\AppData\Local\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-05-16]
(Google Inc.)
FF Plugin HKU\S-1-5-21-1926068397-2398490202-140176465-1002:
@unity3d.com/UnityPlayer,version=1.0 -> C:\Users\Duc
Hong\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll [2015-05-12] (Unity
Technologies ApS)
FF Plugin ProgramFiles/Appdata: C:\Users\Duc
Hong\AppData\Roaming\mozilla\plugins\npgoogletalk.dll [2015-04-17] (Google)
FF Plugin ProgramFiles/Appdata: C:\Users\Duc
Hong\AppData\Roaming\mozilla\plugins\npo1d.dll [2015-04-17] (Google)
FF Extension: FT DeepDark - C:\Users\Duc
Hong\AppData\Roaming\Mozilla\Firefox\Profiles\62c9k4xd.default-1422598942125\Extensions\{77d2ed30-4cd2-11e0-b8af-0800200c9a66}
[2015-04-15]
FF Extension: Ank Pixiv Tool - C:\Users\Duc
Hong\AppData\Roaming\Mozilla\Firefox\Profiles\62c9k4xd.default-1422598942125\Extensions\ankpixiv@snca.net.xpi
[2015-01-30]
FF Extension: MEGA - C:\Users\Duc
Hong\AppData\Roaming\Mozilla\Firefox\Profiles\62c9k4xd.default-1422598942125\Extensions\firefox@mega.co.nz.xpi
[2015-01-30]
FF Extension: NicoFox - C:\Users\Duc
Hong\AppData\Roaming\Mozilla\Firefox\Profiles\62c9k4xd.default-1422598942125\Extensions\nicofox@littlebtc.xpi
[2015-01-30]
FF Extension: Restart Button - C:\Users\Duc
Hong\AppData\Roaming\Mozilla\Firefox\Profiles\62c9k4xd.default-1422598942125\Extensions\restartbutton@strk.jp.xpi
[2015-01-30]
FF Extension: Download Status Bar - C:\Users\Duc
Hong\AppData\Roaming\Mozilla\Firefox\Profiles\62c9k4xd.default-1422598942125\Extensions\{6c28e999-e900-4635-a39d-b1ec90ba0c0f}.xpi
[2015-01-30]
FF Extension: Search by Image for Google - C:\Users\Duc
Hong\AppData\Roaming\Mozilla\Firefox\Profiles\62c9k4xd.default-1422598942125\Extensions\{ab4b5718-3998-4a2c-91ae-18a7c2db513e}.xpi
[2015-01-30]
FF Extension: Adblock Plus - C:\Users\Duc
Hong\AppData\Roaming\Mozilla\Firefox\Profiles\62c9k4xd.default-1422598942125\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
[2015-01-30]
FF Extension: Greasemonkey - C:\Users\Duc
Hong\AppData\Roaming\Mozilla\Firefox\Profiles\62c9k4xd.default-1422598942125\Extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}.xpi
[2015-01-30]
FF Extension: No Name - C:\Program Files (x86)\Mozilla
Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi
[2015-05-18]
FF HKU\S-1-5-21-1926068397-2398490202-140176465-1002\...\Firefox\Extensions:
[mozilla_cc@internetdownloadmanager.com] - C:\Users\Duc
Hong\AppData\Roaming\IDM\idmmzcc5
FF Extension: IDM CC - C:\Users\Duc Hong\AppData\Roaming\IDM\idmmzcc5
[2015-05-30]
FF HKU\S-1-5-21-1926068397-2398490202-140176465-1002\...\SeaMonkey\Extensions:
[mozilla_cc@internetdownloadmanager.com] - C:\Users\Duc
Hong\AppData\Roaming\IDM\idmmzcc5
Chrome:
=======
CHR Profile: C:\Users\Duc Hong\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Docs) - C:\Users\Duc
Hong\AppData\Local\Google\Chrome\User
Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-01-08]
CHR Extension: (Google Drive) - C:\Users\Duc
Hong\AppData\Local\Google\Chrome\User
Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-01-08]
CHR Extension: (YouTube) - C:\Users\Duc Hong\AppData\Local\Google\Chrome\User
Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-01-08]
CHR Extension: (Bing) - C:\Users\Duc Hong\AppData\Local\Google\Chrome\User
Data\Default\Extensions\bmkckgpgekmanipelfidlhmkfcjicion [2015-05-27]
CHR Extension: (Adblock Plus) - C:\Users\Duc
Hong\AppData\Local\Google\Chrome\User
Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2015-03-25]
CHR Extension: (Google Search) - C:\Users\Duc
Hong\AppData\Local\Google\Chrome\User
Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-01-08]
CHR Extension: (Bookmark Manager) - C:\Users\Duc
Hong\AppData\Local\Google\Chrome\User
Data\Default\Extensions\gmlllbghnfkpflemihljekbapjopfjik [2015-04-24]
CHR Extension: (Chrome Hotword Shared Module) - C:\Users\Duc
Hong\AppData\Local\Google\Chrome\User
Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-03-18]
CHR Extension: (Skype Click to Call) - C:\Users\Duc
Hong\AppData\Local\Google\Chrome\User
Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl [2015-05-27]
CHR Extension: (IDM Integration Module) - C:\Users\Duc
Hong\AppData\Local\Google\Chrome\User
Data\Default\Extensions\ngpampappnmepgilojfohadhhmbhlaek [2015-04-24]
CHR Extension: (Google Wallet) - C:\Users\Duc
Hong\AppData\Local\Google\Chrome\User
Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-01-08]
CHR Extension: (Gmail) - C:\Users\Duc Hong\AppData\Local\Google\Chrome\User
Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-01-08]
CHR HKLM\...\Chrome\Extension: [ngpampappnmepgilojfohadhhmbhlaek] - C:\Program
Files (x86)\Internet Download Manager\IDMGCExt.crx [2015-05-20]
CHR
HKU\S-1-5-21-1926068397-2398490202-140176465-1002\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension:
[bmkckgpgekmanipelfidlhmkfcjicion] -
https://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] -
C:\Program Files (x86)\Skype\Toolbars\ChromeExtension\skype_chrome_extension.crx
[2014-07-14]
CHR HKLM-x32\...\Chrome\Extension: [ngpampappnmepgilojfohadhhmbhlaek] -
C:\Program Files (x86)\Internet Download Manager\IDMGCExt.crx [2015-05-20]
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, it will be removed from the registry.
The file will not be moved unless listed separately.)
R2 ASUS FaceID Service; C:\Program Files\ASUS\ASUS FaceID\HWFaceKeyService.exe
[261648 2013-10-25] (Hanwang Technology Co.,Ltd. )
R2 Asus WebStorage Windows Service; C:\Program Files
(x86)\ASUS\WebStorage\2.1.2.301\AsusWSWinService.exe [71680 2014-02-25] (ASUS
Cloud Corporation) [File not signed]
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [343336
2015-05-01] (Avast Software s.r.o.)
S3 BthHFSrv; C:\Windows\System32\BthHFSrv.dll [324608 2014-10-29] (Microsoft
Corporation)
R2 c2cautoupdatesvc; C:\Program Files
(x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1390176 2014-07-14]
(Microsoft Corporation)
R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe
[1767520 2014-07-14] (Microsoft Corporation)
R2 DiagTrack; C:\Windows\system32\diagtrack.dll [1429504 2015-03-05] (Microsoft
Corporation)
R2 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience
Service\GfExperienceService.exe [1152656 2015-05-02] (NVIDIA Corporation)
R2 iBtSiva; C:\Program Files (x86)\Intel\Bluetooth\ibtsiva.exe [125168
2014-12-04] (Intel Corporation)
R2 Intel® Capability Licensing Service Interface; C:\Program Files\Intel\iCLS
Client\HeciServer.exe [733696 2013-05-12] (Intel® Corporation) [File not signed]
S3 Intel® Capability Licensing Service TCP IP Interface; C:\Program
Files\Intel\iCLS Client\SocketHeciServer.exe [822232 2013-05-12] (Intel®
Corporation)
R2 Intel® ME Service; C:\Program Files (x86)\Intel\Intel® Management Engine
Components\FWService\IntelMeFWService.exe [131544 2013-09-04] (Intel
Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel® Management Engine
Components\DAL\jhi_service.exe [169432 2013-09-04] (Intel Corporation)
S2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe
[1080120 2015-04-14] (Malwarebytes Corporation)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [268192
2014-12-04] ()
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA
Corporation\NetService\NvNetworkService.exe [1884304 2015-05-02] (NVIDIA
Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
[22997648 2015-05-02] (NVIDIA Corporation)
S3 rpcapd; C:\Program Files (x86)\WinPcap\rpcapd.exe [118520 2013-03-01]
(Riverbed Technology, Inc.)
R2 SEVPNCLIENT; C:\Program Files\SoftEther VPN Client\vpnclient_x64.exe [4374072
2015-01-21] (SoftEther VPN Project at University of Tsukuba, Japan.)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [366520 2015-02-04]
(Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2015-02-04]
(Microsoft Corporation)
R2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe
[3820960 2014-12-04] (Intel® Corporation)
S3 AvastVBoxSvc; C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe
[X]
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, it will be removed from the registry.
The file will not be moved unless listed separately.)
R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29168 2015-05-01] ()
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [89944 2015-05-01]
(Avast Software s.r.o.)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93528 2015-05-01] (Avast
Software s.r.o.)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65736 2015-05-01] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1047320 2015-05-01] (Avast
Software s.r.o.)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [442264 2015-05-01] (Avast
Software s.r.o.)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [137288 2015-05-01] (Avast
Software s.r.o.)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [272248 2015-05-01] ()
R3 ATP; C:\Windows\System32\drivers\AsusTP.sys [70928 2014-02-14] (ASUS
Corporation)
S3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [226304 2014-03-18]
(Microsoft Corporation)
S3 btmaux; C:\Windows\system32\DRIVERS\btmaux.sys [141624 2014-10-28] (Motorola
Solutions, Inc.)
R3 btmhsf; C:\Windows\system32\DRIVERS\btmhsf.sys [1448248 2014-11-26] (Motorola
Solutions, Inc.)
S3 cleanhlp; C:\EEK\bin\cleanhlp64.sys [57024 2015-05-29] (Emsisoft GmbH)
S3 DrvAgent64; C:\Windows\SysWOW64\Drivers\DrvAgent64.SYS [13824 2015-05-17]
(Phoenix Technologies) [File not signed]
R1 dtsoftbus01; C:\Windows\System32\drivers\dtsoftbus01.sys [283064 2015-01-08]
(Disc Soft Ltd)
R3 ibtusb; C:\Windows\system32\DRIVERS\ibtusb.sys [230128 2014-12-04] (Intel
Corporation)
R3 kbfiltr; C:\Windows\System32\drivers\kbfiltr.sys [17280 2012-08-06] ( )
S3 ManyCam; C:\Windows\system32\DRIVERS\mcvidrv.sys [49272 2014-12-29] (Visicom
Media Inc.)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-04-14]
(Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [64216 2015-04-14]
(Malwarebytes Corporation)
S3 mcaudrv_simple; C:\Windows\system32\drivers\mcaudrv_x64.sys [35960
2014-12-29] (Visicom Media Inc.)
R3 MEIx64; C:\Windows\system32\DRIVERS\TeeDriverx64.sys [99288 2013-09-04]
(Intel Corporation)
R3 Neo_VPN2; C:\Windows\system32\DRIVERS\Neo_VPN2.sys [28768 2015-01-14]
(SoftEther VPN Project at University of Tsukuba, Japan.)
R3 NETwNb64; C:\Windows\system32\DRIVERS\Netwbw02.sys [3494680 2014-12-08]
(Intel Corporation)
S3 NETwNe64; C:\Windows\system32\DRIVERS\NETwew02.sys [4649440 2013-06-19]
(Intel Corporation)
R2 NPF; C:\Windows\System32\drivers\npf.sys [36600 2013-03-01] (Riverbed
Technology, Inc.)
R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys
[19600 2015-05-02] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\Windows\system32\drivers\nvvad64v.sys [38032
2014-11-22] (NVIDIA Corporation)
R2 plctrl; C:\Program Files\ASUS\P4G\plctrl.sys [14136 2014-02-12] (Windows ®
Win 7 DDK provider)
R1 SeLow; C:\Windows\system32\DRIVERS\SeLow_x64.sys [38368 2015-01-21]
(SoftEther VPN Project at University of Tsukuba, Japan.)
U5 UnlockerDriver5; C:\Program Files\Unlocker\UnlockerDriver5.sys [12352
2010-07-02] ()
R3 vmkbd2; C:\Windows\system32\drivers\VMkbd.sys [33472 2015-02-06] (VMware,
Inc.)
R0 vsock; C:\Windows\System32\drivers\vsock.sys [76480 2015-01-07] (VMware,
Inc.)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2015-02-04]
(Microsoft Corporation)
U0 msahci; system32\drivers\msahci.sys
S2 VBoxAswDrv; \??\C:\Program Files\AVAST Software\Avast\ng\vbox\VBoxAswDrv.sys
[X]
S3 WinRing0_1_2_0; \??\C:\Program Files (x86)\BatteryCare\WinRing0x64.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry.
The file will not be moved unless listed separately.)
==================== One Month Created files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2015-05-30 14:16 - 2015-05-30 14:49 - 00092773 _____ ()
C:\Windows\WindowsUpdate.log
2015-05-30 14:15 - 2015-05-30 14:16 - 00000348 _____ () C:\Windows\setupact.log
2015-05-30 14:15 - 2015-05-30 14:15 - 00000354 _____ () C:\Windows\PFRO.log
2015-05-30 14:15 - 2015-05-30 14:15 - 00000000 _____ () C:\Windows\setuperr.log
2015-05-29 17:17 - 2015-05-29 17:17 - 00000000 ____D () C:\Program Files
(x86)\ESET
2015-05-29 14:59 - 2015-05-29 15:01 - 00000000 ____D () C:\EEK
2015-05-28 07:02 - 2015-05-30 14:16 - 00002908 _____ ()
C:\Windows\System32\Tasks\AutoKMS
2015-05-28 06:58 - 2015-05-30 17:19 - 00000000 ____D () C:\Users\Duc
Hong\Desktop\FRST
2015-05-28 01:11 - 2015-05-29 23:10 - 00000000 ____D () C:\Program Files
(x86)\Secunia
2015-05-28 00:08 - 2015-05-30 17:19 - 00000000 ____D () C:\FRST
2015-05-27 19:03 - 2015-05-27 19:03 - 00097888 _____ (Oracle Corporation)
C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2015-05-27 19:03 - 2015-05-27 19:03 - 00000000 ____D () C:\Program Files
(x86)\Java
2015-05-27 17:25 - 2015-05-27 17:25 - 00001073 _____ () C:\Users\Duc
Hong\Desktop\Notepad++.lnk
2015-05-27 16:52 - 2015-05-27 16:52 - 00002062 _____ () C:\Users\Duc
Hong\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\FileHippo App
Manager.lnk
2015-05-27 16:52 - 2015-05-27 16:52 - 00000000 ____D ()
C:\ProgramData\IsolatedStorage
2015-05-27 16:52 - 2015-05-27 16:52 - 00000000 ____D () C:\Program Files
(x86)\FileHippo.com
2015-05-26 17:00 - 2015-05-26 17:07 - 00010620 _____ () C:\Users\Duc
Hong\Documents\My Movie.wlmp
2015-05-26 16:04 - 2015-05-26 16:04 - 00000000 ____D () C:\Windows\en
2015-05-26 16:03 - 2015-05-26 16:03 - 00002504 _____ ()
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live Messenger.lnk
2015-05-26 16:03 - 2015-05-26 16:03 - 00001476 _____ ()
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live Mail.lnk
2015-05-26 16:03 - 2015-05-26 16:03 - 00001392 _____ ()
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Photo Gallery.lnk
2015-05-26 16:03 - 2015-05-26 16:03 - 00001323 _____ ()
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Movie Maker.lnk
2015-05-26 16:03 - 2015-05-26 16:03 - 00000000 ___RD ()
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live
2015-05-26 16:03 - 2015-05-26 16:03 - 00000000 ____D () C:\Program Files\Windows
Live
2015-05-26 16:03 - 2015-05-26 16:03 - 00000000 ____D () C:\Program Files
(x86)\Microsoft SQL Server Compact Edition
2015-05-26 16:01 - 2015-05-26 16:03 - 00000000 ____D () C:\Program Files
(x86)\Windows Live
2015-05-26 16:01 - 2015-05-26 16:01 - 00003108 _____ ()
C:\Windows\System32\Tasks\Microsoft OneDrive Auto Update
Task-S-1-5-21-1926068397-2398490202-140176465-1002
2015-05-26 16:01 - 2015-05-26 16:01 - 00000000 ___RD () C:\Users\Duc
Hong\OneDrive
2015-05-26 16:00 - 2015-05-26 16:00 - 00000000 ____D () C:\ProgramData\Microsoft
OneDrive
2015-05-26 15:59 - 2015-05-26 16:56 - 00000000 ____D () C:\Users\Duc
Hong\AppData\Local\Windows Live
2015-05-26 15:56 - 2015-05-26 16:56 - 00000000 ____D () C:\Users\Duc
Hong\AppData\Roaming\avidemux
2015-05-26 15:56 - 2015-05-26 15:56 - 00000000 ____D ()
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avidemux (64bits)
2015-05-25 23:37 - 2015-04-16 16:17 - 00325464 _____ (Microsoft Corporation)
C:\Windows\system32\Drivers\USBXHCI.SYS
2015-05-25 23:37 - 2015-04-14 08:37 - 00275968 _____ (Microsoft Corporation)
C:\Windows\system32\authz.dll
2015-05-25 23:37 - 2015-04-14 08:34 - 00180224 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\authz.dll
2015-05-25 23:37 - 2015-04-10 10:40 - 01249280 _____ (Microsoft Corporation)
C:\Windows\system32\UIAutomationCore.dll
2015-05-25 23:37 - 2015-04-10 10:17 - 01018880 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\UIAutomationCore.dll
2015-05-25 23:37 - 2015-04-09 08:41 - 00158720 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\rgb9rast.dll
2015-05-25 23:37 - 2015-04-02 08:42 - 03097600 _____ (Microsoft Corporation)
C:\Windows\system32\msftedit.dll
2015-05-25 23:37 - 2015-04-02 08:30 - 02483712 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\msftedit.dll
2015-05-25 23:37 - 2015-04-01 14:21 - 00337408 _____ (Microsoft Corporation)
C:\Windows\system32\SearchProtocolHost.exe
2015-05-25 23:37 - 2015-04-01 14:18 - 00468480 _____ (Microsoft Corporation)
C:\Windows\system32\mssph.dll
2015-05-25 23:37 - 2015-04-01 14:17 - 00248832 _____ (Microsoft Corporation)
C:\Windows\system32\mssphtb.dll
2015-05-25 23:37 - 2015-04-01 14:08 - 00774144 _____ (Microsoft Corporation)
C:\Windows\system32\mssvp.dll
2015-05-25 23:37 - 2015-04-01 13:46 - 03633664 _____ (Microsoft Corporation)
C:\Windows\system32\tquery.dll
2015-05-25 23:37 - 2015-04-01 13:17 - 02551808 _____ (Microsoft Corporation)
C:\Windows\system32\mssrch.dll
2015-05-25 23:37 - 2015-04-01 13:17 - 00903168 _____ (Microsoft Corporation)
C:\Windows\system32\SearchIndexer.exe
2015-05-25 23:37 - 2015-04-01 12:53 - 00391680 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\mssph.dll
2015-05-25 23:37 - 2015-04-01 12:53 - 00272896 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\SearchProtocolHost.exe
2015-05-25 23:37 - 2015-04-01 12:45 - 02749952 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\tquery.dll
2015-05-25 23:37 - 2015-04-01 12:45 - 00699392 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\mssvp.dll
2015-05-25 23:37 - 2015-04-01 12:14 - 01920000 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\mssrch.dll
2015-05-25 23:37 - 2015-04-01 12:12 - 00710144 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\SearchIndexer.exe
2015-05-25 23:37 - 2015-03-20 13:49 - 00309760 _____ (Microsoft Corporation)
C:\Windows\system32\compstui.dll
2015-05-25 23:37 - 2015-03-20 13:08 - 00477184 _____ (Microsoft Corporation)
C:\Windows\system32\puiobj.dll
2015-05-25 23:37 - 2015-03-20 12:37 - 00367104 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\puiobj.dll
2015-05-25 23:37 - 2015-03-20 12:07 - 01091072 _____ (Microsoft Corporation)
C:\Windows\system32\localspl.dll
2015-05-25 23:37 - 2015-03-02 11:43 - 00222208 _____ (Microsoft Corporation)
C:\Windows\system32\rastapi.dll
2015-05-25 23:37 - 2015-03-02 11:21 - 00207872 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\rastapi.dll
2015-05-25 03:29 - 2015-05-25 03:29 - 00000000 ____D () C:\Users\Duc
Hong\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Ubisoft
2015-05-25 03:29 - 2015-05-25 03:29 - 00000000 ____D () C:\Users\Duc
Hong\AppData\Local\Ubisoft Game Launcher
2015-05-25 03:29 - 2015-05-25 03:29 - 00000000 ____D () C:\Program Files
(x86)\Ubisoft
2015-05-23 15:12 - 2015-05-23 15:12 - 00000000 ____D () C:\Users\Duc
Hong\AppData\Roaming\Aegisub
2015-05-20 23:57 - 2015-05-20 22:55 - 00197616 _____ (Tonec Inc.)
C:\Windows\system32\Drivers\idmwfp.sys
2015-05-20 18:18 - 2015-05-20 18:53 - 00001004 _____ () C:\Users\Duc
Hong\Desktop\Logic and stuffs.java
2015-05-19 04:49 - 2015-05-19 09:21 - 00000000 ____D () C:\Users\Duc
Hong\Documents\Witcher 2
2015-05-19 04:49 - 2015-05-19 04:49 - 00000000 ____D () C:\Users\Duc
Hong\AppData\Local\The Witcher 2
2015-05-19 04:46 - 2015-05-19 04:46 - 00000000 ____D () C:\Users\Duc
Hong\Documents\Rockstar Games
2015-05-19 04:46 - 2015-05-19 04:46 - 00000000 ____D () C:\Users\Duc
Hong\AppData\Local\Rockstar Games
2015-05-19 04:45 - 2015-05-19 04:45 - 00000000 ____D ()
C:\ProgramData\Socialclub
2015-05-18 18:21 - 2015-05-18 18:21 - 00000000 ____D () C:\Program Files
(x86)\Mozilla Firefox
2015-05-18 17:10 - 2015-05-18 17:10 - 00000000 ____D ()
C:\Users\Default\AppData\Local\NVIDIA Corporation
2015-05-18 17:10 - 2015-05-18 17:10 - 00000000 ____D ()
C:\Users\Default\AppData\Local\NVIDIA
2015-05-18 17:10 - 2015-05-18 17:10 - 00000000 ____D () C:\Users\Default
User\AppData\Local\NVIDIA Corporation
2015-05-18 17:10 - 2015-05-18 17:10 - 00000000 ____D () C:\Users\Default
User\AppData\Local\NVIDIA
2015-05-18 05:43 - 2015-05-01 06:35 - 00124112 _____ (Microsoft Corporation)
C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll
2015-05-18 05:43 - 2015-05-01 06:35 - 00102608 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\PresentationCFFRasterizerNative_v0300.dll
2015-05-18 05:36 - 2015-04-10 10:34 - 02256896 _____ (Microsoft Corporation)
C:\Windows\system32\dwmcore.dll
2015-05-18 05:36 - 2015-04-10 10:11 - 01943040 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\dwmcore.dll
2015-05-18 05:35 - 2015-05-01 09:05 - 00429568 _____ (Microsoft Corporation)
C:\Windows\system32\schannel.dll
2015-05-18 05:35 - 2015-05-01 08:48 - 00358912 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\schannel.dll
2015-05-18 05:35 - 2015-04-25 07:32 - 00036864 _____ (Microsoft Corporation)
C:\Windows\system32\UtcResources.dll
2015-05-18 05:35 - 2015-04-22 03:14 - 24971776 _____ (Microsoft Corporation)
C:\Windows\system32\mshtml.dll
2015-05-18 05:35 - 2015-04-22 02:50 - 00584192 _____ (Microsoft Corporation)
C:\Windows\system32\vbscript.dll
2015-05-18 05:35 - 2015-04-22 02:50 - 00417792 _____ (Microsoft Corporation)
C:\Windows\system32\html.iec
2015-05-18 05:35 - 2015-04-22 02:49 - 02885120 _____ (Microsoft Corporation)
C:\Windows\system32\iertutil.dll
2015-05-18 05:35 - 2015-04-22 02:37 - 00633856 _____ (Microsoft Corporation)
C:\Windows\system32\ieui.dll
2015-05-18 05:35 - 2015-04-22 02:35 - 00816640 _____ (Microsoft Corporation)
C:\Windows\system32\jscript.dll
2015-05-18 05:35 - 2015-04-22 02:31 - 06025728 _____ (Microsoft Corporation)
C:\Windows\system32\jscript9.dll
2015-05-18 05:35 - 2015-04-22 02:24 - 19691008 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\mshtml.dll
2015-05-18 05:35 - 2015-04-22 02:13 - 00107520 _____ (Microsoft Corporation)
C:\Windows\system32\inseng.dll
2015-05-18 05:35 - 2015-04-22 02:11 - 00504320 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\vbscript.dll
2015-05-18 05:35 - 2015-04-22 02:09 - 00341504 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\html.iec
2015-05-18 05:35 - 2015-04-22 02:08 - 00092160 _____ (Microsoft Corporation)
C:\Windows\system32\mshtmled.dll
2015-05-18 05:35 - 2015-04-22 02:07 - 00145408 _____ (Microsoft Corporation)
C:\Windows\system32\iepeers.dll
2015-05-18 05:35 - 2015-04-22 02:05 - 00316928 _____ (Microsoft Corporation)
C:\Windows\system32\dxtrans.dll
2015-05-18 05:35 - 2015-04-22 02:04 - 02278400 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\iertutil.dll
2015-05-18 05:35 - 2015-04-22 01:59 - 01032704 _____ (Microsoft Corporation)
C:\Windows\system32\inetcomm.dll
2015-05-18 05:35 - 2015-04-22 01:58 - 00664576 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\jscript.dll
2015-05-18 05:35 - 2015-04-22 01:52 - 00262144 _____ (Microsoft Corporation)
C:\Windows\system32\webcheck.dll
2015-05-18 05:35 - 2015-04-22 01:49 - 00801280 _____ (Microsoft Corporation)
C:\Windows\system32\msfeeds.dll
2015-05-18 05:35 - 2015-04-22 01:49 - 00720384 _____ (Microsoft Corporation)
C:\Windows\system32\ie4uinit.exe
2015-05-18 05:35 - 2015-04-22 01:49 - 00374272 _____ (Microsoft Corporation)
C:\Windows\system32\iedkcs32.dll
2015-05-18 05:35 - 2015-04-22 01:46 - 02125824 _____ (Microsoft Corporation)
C:\Windows\system32\inetcpl.cpl
2015-05-18 05:35 - 2015-04-22 01:40 - 14401536 _____ (Microsoft Corporation)
C:\Windows\system32\ieframe.dll
2015-05-18 05:35 - 2015-04-22 01:38 - 00076288 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\mshtmled.dll
2015-05-18 05:35 - 2015-04-22 01:37 - 00128000 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\iepeers.dll
2015-05-18 05:35 - 2015-04-22 01:36 - 00285696 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\dxtrans.dll
2015-05-18 05:35 - 2015-04-22 01:32 - 00880128 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\inetcomm.dll
2015-05-18 05:35 - 2015-04-22 01:31 - 04305920 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\jscript9.dll
2015-05-18 05:35 - 2015-04-22 01:28 - 00230400 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\webcheck.dll
2015-05-18 05:35 - 2015-04-22 01:27 - 02352128 _____ (Microsoft Corporation)
C:\Windows\system32\wininet.dll
2015-05-18 05:35 - 2015-04-22 01:26 - 00688640 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\msfeeds.dll
2015-05-18 05:35 - 2015-04-22 01:26 - 00327168 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\iedkcs32.dll
2015-05-18 05:35 - 2015-04-22 01:25 - 02052608 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\inetcpl.cpl
2015-05-18 05:35 - 2015-04-22 01:17 - 12828672 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\ieframe.dll
2015-05-18 05:35 - 2015-04-22 01:15 - 01547264 _____ (Microsoft Corporation)
C:\Windows\system32\urlmon.dll
2015-05-18 05:35 - 2015-04-22 01:03 - 00800768 _____ (Microsoft Corporation)
C:\Windows\system32\ieapfltr.dll
2015-05-18 05:35 - 2015-04-22 01:02 - 01882112 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\wininet.dll
2015-05-18 05:35 - 2015-04-22 00:58 - 01310208 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\urlmon.dll
2015-05-18 05:35 - 2015-04-22 00:56 - 00710144 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\ieapfltr.dll
2015-05-18 05:35 - 2015-04-14 08:48 - 04180480 _____ (Microsoft Corporation)
C:\Windows\system32\win32k.sys
2015-05-18 05:35 - 2015-04-10 11:00 - 01996800 _____ (Microsoft Corporation)
C:\Windows\system32\DWrite.dll
2015-05-18 05:35 - 2015-04-10 10:50 - 01387008 _____ (Microsoft Corporation)
C:\Windows\system32\FntCache.dll
2015-05-18 05:35 - 2015-04-10 10:26 - 01560576 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\DWrite.dll
2015-05-18 05:35 - 2015-04-09 08:55 - 00410128 _____ (Microsoft Corporation)
C:\Windows\system32\services.exe
2015-05-18 05:35 - 2015-03-30 15:47 - 00561928 _____ (Microsoft Corporation)
C:\Windows\system32\Drivers\cng.sys
2015-05-18 05:35 - 2015-03-27 13:27 - 00445440 _____ (Microsoft Corporation)
C:\Windows\system32\certcli.dll
2015-05-18 05:35 - 2015-03-27 12:50 - 00324096 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\certcli.dll
2015-05-18 05:35 - 2015-03-27 12:48 - 01441792 _____ (Microsoft Corporation)
C:\Windows\system32\lsasrv.dll
2015-05-18 05:35 - 2015-03-20 11:56 - 00080384 _____ (Microsoft Corporation)
C:\Windows\system32\Drivers\ahcache.sys
2015-05-18 05:35 - 2015-03-13 11:11 - 02162176 _____ (Microsoft Corporation)
C:\Windows\system32\SRH.dll
2015-05-18 05:35 - 2015-03-13 10:39 - 01812992 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\SRH.dll
2015-05-18 05:35 - 2015-03-13 10:29 - 00410017 _____ ()
C:\Windows\system32\ApnDatabase.xml
2015-05-18 05:35 - 2015-03-05 09:09 - 01429504 _____ (Microsoft Corporation)
C:\Windows\system32\diagtrack.dll
2015-05-17 19:44 - 2015-05-17 19:44 - 00000000 ____H () C:\Users\Duc
Hong\Documents\Default.rdp
2015-05-17 02:42 - 2015-05-17 07:57 - 00000000 ____D () C:\Program Files
(x86)\eSupport.com
2015-05-17 02:42 - 2015-05-17 02:42 - 00013824 _____ (Phoenix Technologies)
C:\Windows\SysWOW64\Drivers\DrvAgent64.SYS
2015-05-17 02:42 - 2015-05-17 02:42 - 00000000 ____D () C:\Users\Duc
Hong\AppData\Local\eSupport.com
2015-05-16 22:44 - 2015-05-16 22:44 - 00014480 _____ ()
C:\Windows\system32\Drivers\nvflash.sys
2015-05-16 22:34 - 2015-05-16 22:34 - 00000000 ____D ()
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Oracle VM VirtualBox
2015-05-16 22:34 - 2015-05-13 17:11 - 00922704 _____ (Oracle Corporation)
C:\Windows\system32\Drivers\VBoxDrv.sys
2015-05-16 22:34 - 2015-05-13 17:10 - 00128592 _____ (Oracle Corporation)
C:\Windows\system32\Drivers\VBoxUSBMon.sys
2015-05-13 21:21 - 2015-05-13 21:21 - 00000000 ____D () C:\Users\Duc
Hong\AppData\Roaming\Mediatronic
2015-05-13 21:17 - 2015-05-26 17:27 - 00000000 ____D () C:\Users\Duc
Hong\Desktop\New folder
2015-05-13 17:10 - 2015-05-13 17:10 - 00141440 _____ (Oracle Corporation)
C:\Windows\system32\Drivers\VBoxNetAdp.sys
2015-05-11 18:25 - 2015-05-11 18:25 - 00019851 _____ () C:\Users\Duc
Hong\Desktop\ListOf4V2.java
2015-05-11 17:26 - 2015-05-29 14:18 - 00003474 _____ ()
C:\Windows\System32\Tasks\ASUS Live Update1
2015-05-11 17:26 - 2015-05-11 17:26 - 00003382 _____ ()
C:\Windows\System32\Tasks\Update Checker
2015-05-09 14:32 - 2015-05-09 14:32 - 00000218 _____ () C:\Users\Duc
Hong\AppData\Local\recently-used.xbel
2015-05-09 14:31 - 2015-05-09 14:31 - 00000000 ____D ()
C:\ProgramData\InstallShield
2015-05-09 14:30 - 2015-05-09 14:33 - 00000000 ____D () C:\Users\Duc
Hong\AppData\Roaming\driveridentifier
2015-05-07 20:59 - 2015-05-07 21:00 - 00022659 _____ () C:\Users\Duc
Hong\Desktop\ListofNV.java
2015-05-06 20:19 - 2015-05-06 20:19 - 00012476 _____ () C:\Users\Duc
Hong\Downloads\Smartphone-OS-rundown.odt
2015-05-06 18:14 - 2015-05-06 18:14 - 00000000 ____D () C:\Users\Duc
Hong\Documents\OneNote Notebooks
2015-05-05 06:18 - 2015-05-05 06:18 - 00000000 ____D () C:\Users\Duc
Hong\AppData\Local\ali213GameLauncher
2015-05-04 18:52 - 2015-05-26 16:39 - 00000000 ____D () C:\Users\Duc
Hong\Tracing
2015-05-04 18:47 - 2015-05-29 16:10 - 00000000 ____D () C:\Users\Duc
Hong\AppData\Roaming\Skype
2015-05-04 18:47 - 2015-05-04 18:47 - 00000000 ___RD () C:\Program Files
(x86)\Skype
2015-05-04 18:47 - 2015-05-04 18:47 - 00000000 ____D () C:\Users\Duc
Hong\AppData\Local\Skype
2015-05-04 18:47 - 2015-05-04 18:47 - 00000000 ____D () C:\ProgramData\Skype
2015-05-04 18:47 - 2015-05-04 18:47 - 00000000 ____D ()
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2015-05-04 18:47 - 2015-05-04 18:47 - 00000000 ____D () C:\extensions
2015-05-02 21:29 - 2010-06-02 04:55 - 00527192 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\XAudio2_7.dll
2015-05-02 21:29 - 2010-06-02 04:55 - 00239960 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\xactengine3_7.dll
2015-05-02 21:29 - 2010-06-02 04:55 - 00074072 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\XAPOFX1_5.dll
2015-05-02 21:29 - 2010-05-26 11:41 - 02106216 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\D3DCompiler_43.dll
2015-05-02 21:29 - 2010-05-26 11:41 - 01998168 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\D3DX9_43.dll
2015-05-02 21:29 - 2010-05-26 11:41 - 01868128 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\d3dcsx_43.dll
2015-05-02 21:29 - 2010-05-26 11:41 - 00470880 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\d3dx10_43.dll
2015-05-02 21:29 - 2010-05-26 11:41 - 00248672 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\d3dx11_43.dll
2015-05-02 21:29 - 2010-02-04 10:01 - 00528216 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\XAudio2_6.dll
2015-05-02 21:29 - 2010-02-04 10:01 - 00238936 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\xactengine3_6.dll
2015-05-02 21:29 - 2010-02-04 10:01 - 00074072 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\XAPOFX1_4.dll
2015-05-02 21:29 - 2010-02-04 10:01 - 00022360 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\X3DAudio1_7.dll
2015-05-02 21:29 - 2009-09-04 17:44 - 00515416 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\XAudio2_5.dll
2015-05-02 21:29 - 2009-09-04 17:44 - 00238936 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\xactengine3_5.dll
2015-05-02 21:29 - 2009-09-04 17:29 - 05501792 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\d3dcsx_42.dll
2015-05-02 21:29 - 2009-09-04 17:29 - 01974616 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\D3DCompiler_42.dll
2015-05-02 21:29 - 2009-09-04 17:29 - 01892184 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\D3DX9_42.dll
2015-05-02 21:29 - 2009-09-04 17:29 - 00453456 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\d3dx10_42.dll
2015-05-02 21:29 - 2009-09-04 17:29 - 00235344 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\d3dx11_42.dll
2015-05-02 21:28 - 2009-09-04 17:44 - 00069464 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\XAPOFX1_3.dll
2015-05-02 21:28 - 2009-03-16 14:18 - 00517448 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\XAudio2_4.dll
2015-05-02 21:28 - 2009-03-16 14:18 - 00235352 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\xactengine3_4.dll
2015-05-02 21:28 - 2009-03-16 14:18 - 00022360 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\X3DAudio1_6.dll
2015-05-02 21:28 - 2009-03-09 15:27 - 04178264 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\D3DX9_41.dll
2015-05-02 21:28 - 2009-03-09 15:27 - 01846632 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\D3DCompiler_41.dll
2015-05-02 21:28 - 2009-03-09 15:27 - 00453456 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\d3dx10_41.dll
2015-05-02 21:28 - 2008-10-27 10:04 - 00514384 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\XAudio2_3.dll
2015-05-02 21:28 - 2008-10-27 10:04 - 00235856 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\xactengine3_3.dll
2015-05-02 21:28 - 2008-10-27 10:04 - 00070992 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\XAPOFX1_2.dll
2015-05-02 21:28 - 2008-10-27 10:04 - 00023376 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\X3DAudio1_5.dll
2015-05-02 21:28 - 2008-10-15 06:22 - 04379984 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\D3DX9_40.dll
2015-05-02 21:28 - 2008-10-15 06:22 - 02036576 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\D3DCompiler_40.dll
2015-05-02 21:28 - 2008-10-15 06:22 - 00452440 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\d3dx10_40.dll
2015-05-02 21:28 - 2008-07-31 10:41 - 00238088 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\xactengine3_2.dll
2015-05-02 21:28 - 2008-07-31 10:41 - 00068616 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\XAPOFX1_1.dll
2015-05-02 21:28 - 2008-07-31 10:40 - 00509448 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\XAudio2_2.dll
2015-05-02 21:28 - 2008-07-10 11:01 - 00467984 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\d3dx10_39.dll
2015-05-02 21:28 - 2008-07-10 11:00 - 03851784 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\D3DX9_39.dll
2015-05-02 21:28 - 2008-07-10 11:00 - 01493528 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\D3DCompiler_39.dll
2015-05-02 21:28 - 2008-05-30 14:19 - 00507400 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\XAudio2_1.dll
2015-05-02 21:28 - 2008-05-30 14:18 - 00238088 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\xactengine3_1.dll
2015-05-02 21:28 - 2008-05-30 14:17 - 00065032 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\XAPOFX1_0.dll
2015-05-02 21:28 - 2008-05-30 14:17 - 00025608 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\X3DAudio1_4.dll
2015-05-02 21:28 - 2008-05-30 14:11 - 03850760 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\D3DX9_38.dll
2015-05-02 21:28 - 2008-05-30 14:11 - 01491992 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\D3DCompiler_38.dll
2015-05-02 21:28 - 2008-05-30 14:11 - 00467984 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\d3dx10_38.dll
2015-05-02 21:28 - 2008-03-05 16:03 - 00479752 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\XAudio2_0.dll
2015-05-02 21:28 - 2008-03-05 16:03 - 00238088 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\xactengine3_0.dll
2015-05-02 21:28 - 2008-03-05 16:00 - 00025608 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\X3DAudio1_3.dll
2015-05-02 21:28 - 2008-03-05 15:56 - 03786760 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\D3DX9_37.dll
2015-05-02 21:28 - 2008-03-05 15:56 - 01420824 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\D3DCompiler_37.dll
2015-05-02 21:28 - 2008-02-05 23:07 - 00462864 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\d3dx10_37.dll
2015-05-02 21:28 - 2007-10-22 03:39 - 00267272 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\xactengine2_10.dll
2015-05-02 21:28 - 2007-10-22 03:37 - 00017928 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\X3DAudio1_2.dll
2015-05-02 21:28 - 2007-10-12 15:14 - 03734536 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\d3dx9_36.dll
2015-05-02 21:28 - 2007-10-12 15:14 - 01374232 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\D3DCompiler_36.dll
2015-05-02 21:28 - 2007-10-02 09:56 - 00444776 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\d3dx10_36.dll
2015-05-02 21:28 - 2007-07-20 00:57 - 00267112 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\xactengine2_9.dll
2015-05-02 21:28 - 2007-07-19 18:14 - 03727720 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\d3dx9_35.dll
2015-05-02 21:28 - 2007-07-19 18:14 - 01358192 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\D3DCompiler_35.dll
2015-05-02 21:28 - 2007-07-19 18:14 - 00444776 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\d3dx10_35.dll
2015-05-02 21:28 - 2007-06-20 20:46 - 00266088 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\xactengine2_8.dll
2015-05-02 21:28 - 2007-05-16 16:45 - 03497832 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\d3dx9_34.dll
2015-05-02 21:28 - 2007-05-16 16:45 - 01124720 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\D3DCompiler_34.dll
2015-05-02 21:28 - 2007-05-16 16:45 - 00443752 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\d3dx10_34.dll
2015-05-02 21:28 - 2007-04-04 18:55 - 00261480 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\xactengine2_7.dll
2015-05-02 21:28 - 2007-04-04 18:53 - 00081768 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\xinput1_3.dll
2015-05-02 21:28 - 2007-03-15 16:57 - 00443752 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\d3dx10_33.dll
2015-05-02 21:28 - 2007-03-12 16:42 - 03495784 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\d3dx9_33.dll
2015-05-02 21:28 - 2007-03-12 16:42 - 01123696 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\D3DCompiler_33.dll
2015-05-02 21:28 - 2007-03-05 12:42 - 00015128 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\x3daudio1_1.dll
2015-05-02 21:28 - 2007-01-24 15:27 - 00255848 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\xactengine2_6.dll
2015-05-02 21:28 - 2006-12-08 12:02 - 00251672 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\xactengine2_5.dll
2015-05-02 21:28 - 2006-11-29 13:06 - 03426072 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\d3dx9_32.dll
2015-05-02 21:28 - 2006-11-29 13:06 - 00440080 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\d3dx10.dll
2015-05-02 21:28 - 2006-09-28 16:05 - 02414360 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\d3dx9_31.dll
2015-05-02 21:28 - 2006-09-28 16:05 - 00237848 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\xactengine2_4.dll
2015-05-02 21:28 - 2006-07-28 09:30 - 00236824 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\xactengine2_3.dll
2015-05-02 21:28 - 2006-07-28 09:30 - 00062744 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\xinput1_2.dll
2015-05-02 21:28 - 2006-05-31 07:24 - 00230168 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\xactengine2_2.dll
2015-05-02 21:28 - 2006-03-31 12:40 - 02388176 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\d3dx9_30.dll
2015-05-02 21:28 - 2006-03-31 12:39 - 00229584 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\xactengine2_1.dll
2015-05-02 21:28 - 2006-03-31 12:39 - 00062672 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\xinput1_1.dll
2015-05-02 21:28 - 2006-02-03 08:43 - 02332368 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\d3dx9_29.dll
2015-05-02 21:28 - 2006-02-03 08:42 - 00230096 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\xactengine2_0.dll
2015-05-02 21:28 - 2006-02-03 08:41 - 00014032 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\x3daudio1_0.dll
2015-05-02 21:28 - 2005-12-05 18:09 - 02323664 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\d3dx9_28.dll
2015-05-02 21:28 - 2005-07-22 19:59 - 02319568 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\d3dx9_27.dll
2015-05-02 21:28 - 2005-05-26 15:34 - 02297552 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\d3dx9_26.dll
2015-05-02 21:28 - 2005-03-18 17:19 - 02337488 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\d3dx9_25.dll
2015-05-02 21:28 - 2005-02-05 19:45 - 02222800 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\d3dx9_24.dll
2015-05-01 18:45 - 2015-03-18 03:26 - 00467776 ____C (Microsoft Corporation)
C:\Windows\system32\Drivers\USBHUB3.SYS
2015-05-01 18:45 - 2015-03-09 12:02 - 00057856 ____C (Microsoft Corporation)
C:\Windows\system32\Drivers\bthhfenum.sys
2015-05-01 18:45 - 2015-01-06 13:01 - 00072192 _____ (Microsoft Corporation)
C:\Windows\system32\Drivers\ndproxy.sys
2015-05-01 18:45 - 2015-01-06 12:59 - 00080896 _____ (Microsoft Corporation)
C:\Windows\system32\Drivers\wanarp.sys
2015-05-01 18:45 - 2015-01-06 11:12 - 00185856 _____ (Microsoft Corporation)
C:\Windows\system32\rascfg.dll
2015-05-01 18:45 - 2015-01-06 11:02 - 00164864 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\rascfg.dll
2015-05-01 18:44 - 2015-04-03 10:35 - 00445440 _____ (Microsoft Corporation)
C:\Windows\system32\PhotoMetadataHandler.dll
2015-05-01 18:44 - 2015-04-03 10:14 - 00364544 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\PhotoMetadataHandler.dll
2015-05-01 18:44 - 2015-04-02 08:22 - 02985984 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\dbgeng.dll
2015-05-01 18:44 - 2015-04-02 08:20 - 04417536 _____ (Microsoft Corporation)
C:\Windows\system32\dbgeng.dll
2015-05-01 18:44 - 2015-04-01 13:45 - 01491456 _____ (Microsoft Corporation)
C:\Windows\system32\dbghelp.dll
2015-05-01 18:44 - 2015-04-01 12:31 - 01207296 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\dbghelp.dll
2015-05-01 18:44 - 2015-03-24 07:59 - 07476032 _____ (Microsoft Corporation)
C:\Windows\system32\ntoskrnl.exe
2015-05-01 18:44 - 2015-03-24 07:59 - 01733952 _____ (Microsoft Corporation)
C:\Windows\system32\ntdll.dll
2015-05-01 18:44 - 2015-03-24 07:59 - 00360480 _____ (Microsoft Corporation)
C:\Windows\system32\sechost.dll
2015-05-01 18:44 - 2015-03-24 07:58 - 01498872 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\ntdll.dll
2015-05-01 18:44 - 2015-03-24 07:45 - 00257216 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\sechost.dll
2015-05-01 18:44 - 2015-03-20 14:12 - 00246272 _____ (Microsoft Corporation)
C:\Windows\system32\microsoft-windows-system-events.dll
2015-05-01 18:44 - 2015-03-20 14:10 - 00285184 _____ (Microsoft Corporation)
C:\Windows\system32\wow64.dll
2015-05-01 18:44 - 2015-03-20 14:10 - 00013312 _____ (Microsoft Corporation)
C:\Windows\system32\wow64cpu.dll
2015-05-01 18:44 - 2015-03-20 13:17 - 00411648 _____ (Microsoft Corporation)
C:\Windows\system32\tracerpt.exe
2015-05-01 18:44 - 2015-03-20 12:41 - 00369152 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\tracerpt.exe
2015-05-01 18:44 - 2015-03-20 12:40 - 00950784 _____ (Microsoft Corporation)
C:\Windows\system32\tdh.dll
2015-05-01 18:44 - 2015-03-20 12:16 - 00749568 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\tdh.dll
2015-05-01 18:44 - 2015-03-13 12:58 - 00259072 _____ (Microsoft Corporation)
C:\Windows\system32\pku2u.dll
2015-05-01 18:44 - 2015-03-13 12:37 - 00208896 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\pku2u.dll
2015-05-01 18:44 - 2015-03-06 12:47 - 01696256 _____ (Microsoft Corporation)
C:\Windows\system32\wevtsvc.dll
2015-05-01 18:44 - 2015-03-04 11:32 - 00172544 _____ (Microsoft Corporation)
C:\Windows\system32\Windows.UI.Input.Inking.dll
2015-05-01 18:44 - 2015-03-04 11:12 - 00141824 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\Windows.UI.Input.Inking.dll
2015-05-01 18:44 - 2015-01-30 10:53 - 02819584 _____ (Microsoft Corporation)
C:\Windows\system32\SettingsHandlers.dll
2015-05-01 18:44 - 2014-11-18 06:17 - 00672984 _____ (Microsoft Corporation)
C:\Windows\system32\MDMAgent.exe
2015-05-01 18:44 - 2014-11-18 06:17 - 00273240 _____ (Microsoft Corporation)
C:\Windows\system32\SystemSettingsAdminFlows.exe
2015-05-01 18:44 - 2014-11-14 16:58 - 00116736 _____ (Microsoft Corporation)
C:\Windows\system32\SystemSettingsDatabase.dll
2015-05-01 18:44 - 2014-11-14 16:54 - 00463872 _____ (Microsoft Corporation)
C:\Windows\system32\SystemSettings.Handlers.dll
2015-05-01 18:44 - 2014-11-14 16:46 - 02171904 _____ (Microsoft Corporation)
C:\Windows\system32\SystemSettingsAdminFlowUI.dll
2015-05-01 18:43 - 2015-03-11 11:49 - 00024576 _____ (Microsoft Corporation)
C:\Windows\system32\sdbinst.exe
2015-05-01 18:43 - 2015-03-11 11:09 - 00021504 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\sdbinst.exe
2015-05-01 18:42 - 2015-03-13 14:03 - 00239424 ____C (Microsoft Corporation)
C:\Windows\system32\Drivers\sdbus.sys
2015-05-01 18:42 - 2015-03-13 14:03 - 00154432 ____C (Microsoft Corporation)
C:\Windows\system32\Drivers\dumpsd.sys
2015-05-01 18:42 - 2015-03-06 13:08 - 02067968 _____ (Microsoft Corporation)
C:\Windows\system32\wpdshext.dll
2015-05-01 18:42 - 2015-03-06 12:43 - 01969664 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\wpdshext.dll
2015-05-01 18:42 - 2015-03-04 20:25 - 00377152 _____ (Microsoft Corporation)
C:\Windows\system32\Drivers\clfs.sys
2015-05-01 18:42 - 2015-03-04 13:04 - 00075264 _____ (Microsoft Corporation)
C:\Windows\system32\clfsw32.dll
2015-05-01 18:42 - 2015-03-04 12:19 - 00058880 _____ (Microsoft Corporation)
C:\Windows\SysWOW64\clfsw32.dll
2015-05-01 18:42 - 2015-02-24 18:32 - 00991552 _____ (Microsoft Corporation)
C:\Windows\system32\Drivers\http.sys
2015-05-01 18:39 - 2015-02-18 09:19 - 00186368 _____ (Microsoft Corporation)
C:\Windows\system32\dpapisrv.dll
2015-05-01 18:20 - 2015-03-13 12:02 - 00316416 _____ (Microsoft Corporation)
C:\Windows\system32\Drivers\udfs.sys
2015-05-01 16:28 - 2015-05-01 16:28 - 00364472 _____ (Avast Software s.r.o.)
C:\Windows\system32\aswBoot.exe
2015-05-01 16:28 - 2015-05-01 16:28 - 00043112 _____ (Avast Software s.r.o.)
C:\Windows\avastSS.scr
2015-04-30 23:17 - 2015-02-06 17:40 - 00066752 _____ (VMware, Inc.)
C:\Windows\system32\Drivers\vmx86.sys
2015-04-30 23:16 - 2015-02-06 17:39 - 00033472 _____ (VMware, Inc.)
C:\Windows\system32\Drivers\VMkbd.sys
2015-04-30 23:15 - 2015-02-06 17:40 - 00438464 _____ (VMware, Inc.)
C:\Windows\SysWOW64\vmnat.exe
2015-04-30 23:15 - 2015-02-06 17:40 - 00359104 _____ (VMware, Inc.)
C:\Windows\SysWOW64\vmnetdhcp.exe
2015-04-30 23:15 - 2015-02-06 17:40 - 00026816 _____ (VMware, Inc.)
C:\Windows\system32\Drivers\vmnetuserif.sys
2015-04-30 23:15 - 2015-02-06 17:39 - 00931008 _____ (VMware, Inc.)
C:\Windows\system32\vnetlib64.dll
2015-04-30 17:21 - 2015-04-30 17:21 - 00003939 _____ () C:\Users\Duc
Hong\Desktop\bubblesortsolution.java
==================== One Month Modified files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2015-05-30 17:00 - 2013-08-23 01:36 - 00000000 ____D () C:\Windows\system32\sru
2015-05-30 16:21 - 2015-04-17 17:11 - 00000944 _____ ()
C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1926068397-2398490202-140176465-1002UA.job
2015-05-30 14:26 - 2015-04-20 17:38 - 00003598 _____ ()
C:\Windows\System32\Tasks\Optimize Start Menu Cache
Files-S-1-5-21-1926068397-2398490202-140176465-1002
2015-05-30 14:22 - 2015-01-07 20:14 - 00000074 _____ () C:\Users\Duc
Hong\AppData\Roaming\sp_data.sys
2015-05-30 14:21 - 2015-01-08 16:51 - 00000926 _____ ()
C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-05-30 14:16 - 2015-03-04 16:42 - 00000000 ____D () C:\ProgramData\VMware
2015-05-30 14:16 - 2015-01-14 15:54 - 00000000 ____D () C:\Program
Files\SoftEther VPN Client
2015-05-30 14:16 - 2015-01-08 07:43 - 00000298 _____ ()
C:\Windows\Tasks\AutoKMS.job
2015-05-30 14:15 - 2013-08-23 00:45 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-05-30 06:10 - 2015-01-07 21:35 - 00000000 ____D () C:\Users\Duc
Hong\AppData\Roaming\DMCache
2015-05-30 03:23 - 2015-01-07 21:35 - 00000000 ____D () C:\Users\Duc
Hong\AppData\Roaming\IDM
2015-05-30 03:21 - 2015-04-17 17:11 - 00000892 _____ ()
C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1926068397-2398490202-140176465-1002Core.job
2015-05-29 22:29 - 2015-01-08 18:53 - 00000000 ____D () C:\Users\Duc
Hong\Desktop\Tools
2015-05-29 20:59 - 2015-04-12 05:06 - 00000000 ____D () C:\Users\Duc
Hong\Desktop\Docs
2015-05-28 22:25 - 2015-01-14 13:01 - 00000000 ____D () C:\Users\Duc
Hong\.VirtualBox
2015-05-28 21:34 - 2015-01-07 21:36 - 00000000 ____D () C:\Users\Duc
Hong\Downloads\Video
2015-05-28 17:58 - 2013-08-23 01:36 - 00000000 ____D () C:\Windows\addins
2015-05-28 07:17 - 2015-01-07 21:35 - 00000000 ____D () C:\Program Files
(x86)\Internet Download Manager
2015-05-28 07:03 - 2015-01-18 16:16 - 00136408 _____ (Malwarebytes Corporation)
C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-05-27 19:04 - 2015-01-08 23:41 - 00000000 ____D () C:\ProgramData\Oracle
2015-05-27 19:01 - 2015-04-02 16:59 - 00000000 ____D () C:\Program Files\Java
2015-05-27 19:00 - 2015-04-02 17:02 - 00111016 _____ (Oracle Corporation)
C:\Windows\system32\WindowsAccessBridge-64.dll
2015-05-27 17:25 - 2015-01-08 01:11 - 00000000 ____D () C:\Program Files
(x86)\Notepad++
2015-05-27 17:04 - 2015-01-18 16:16 - 00000000 ____D ()
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2015-05-27 17:04 - 2015-01-18 16:16 - 00000000 ____D () C:\Program Files
(x86)\Malwarebytes Anti-Malware
2015-05-27 17:01 - 2015-01-08 16:58 - 00000000 ____D () C:\Program
Files\Defraggler
2015-05-27 16:53 - 2015-01-18 12:20 - 00000000 ____D () C:\Users\Duc
Hong\AppData\Roaming\TeamViewer
2015-05-27 16:53 - 2015-01-08 07:25 - 00000000 ____D () C:\Users\Duc
Hong\AppData\Roaming\DAEMON Tools Lite
2015-05-27 16:53 - 2015-01-08 06:43 - 00000000 ____D () C:\Users\Duc
Hong\AppData\Roaming\uTorrent
2015-05-27 16:52 - 2015-01-07 20:39 - 00000000 ____D () C:\Program
Files\CCleaner
2015-05-26 18:12 - 2014-03-18 20:03 - 00885780 _____ ()
C:\Windows\system32\PerfStringBackup.INI
2015-05-26 16:01 - 2015-01-07 20:13 - 00000000 ____D () C:\Users\Duc Hong
2015-05-25 23:40 - 2013-08-23 01:36 - 00000000 ___RD () C:\Windows\ToastData
2015-05-25 23:38 - 2013-08-23 01:20 - 00000000 ____D () C:\Windows\CbsTemp
2015-05-25 18:22 - 2015-03-16 17:17 - 00000000 ____D () C:\Users\Duc
Hong\Desktop\Bluej
2015-05-25 03:35 - 2015-04-12 15:20 - 00000000 ____D () C:\ProgramData\Orbit
2015-05-21 19:58 - 2015-02-22 16:22 - 00000000 ____D () C:\Users\Duc
Hong\AppData\Roaming\CodeBlocks
2015-05-19 19:09 - 2015-01-30 16:22 - 00000187 _____ () C:\Windows\wininit.ini
2015-05-19 18:03 - 2013-08-23 01:36 - 00000000 ____D () C:\Windows\rescache
2015-05-18 05:48 - 2015-01-23 14:11 - 00481120 _____ ()
C:\Windows\system32\FNTCACHE.DAT
2015-05-18 05:47 - 2015-01-07 23:38 - 00000000 ____D () C:\Program
Files\Microsoft Silverlight
2015-05-18 05:47 - 2015-01-07 23:38 - 00000000 ____D () C:\Program Files
(x86)\Microsoft Silverlight
2015-05-18 05:45 - 2015-01-08 07:28 - 00000000 ____D () C:\ProgramData\Microsoft
Help
2015-05-18 05:44 - 2015-04-05 04:10 - 00000039 _____ () C:\Windows\vbaddin.ini
2015-05-18 05:43 - 2015-01-08 08:40 - 00000000 ____D () C:\Windows\system32\MRT
2015-05-18 05:39 - 2015-01-08 08:40 - 140425016 _____ (Microsoft Corporation)
C:\Windows\system32\MRT.exe
2015-05-18 05:39 - 2013-08-22 23:25 - 00262144 ___SH ()
C:\Windows\system32\config\ELAM
2015-05-18 05:38 - 2015-04-14 22:32 - 00000000 ___SD () C:\Windows\SysWOW64\GWX
2015-05-18 05:38 - 2015-04-14 22:32 - 00000000 ___SD () C:\Windows\system32\GWX
2015-05-18 05:38 - 2015-01-07 23:38 - 00000000 ____D ()
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2015-05-18 05:36 - 2014-03-18 19:45 - 00000000 ____D () C:\Program Files\Windows
Journal
2015-05-17 20:00 - 2015-01-08 07:10 - 00000000 ____D () C:\Users\Duc
Hong\AppData\Local\Unity
2015-05-17 19:17 - 2014-07-12 08:56 - 00000000 ____D () C:\ProgramData\Package
Cache
2015-05-16 22:32 - 2015-03-04 16:45 - 00000000 ____D () C:\Users\Duc
Hong\AppData\Roaming\VMware
2015-05-16 22:32 - 2015-03-04 16:45 - 00000000 ____D () C:\Users\Duc
Hong\AppData\Local\VMware
2015-05-16 05:42 - 2013-08-22 23:25 - 00262144 ___SH ()
C:\Windows\system32\config\BBI
2015-05-16 03:16 - 2015-04-17 17:11 - 00003900 _____ ()
C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1926068397-2398490202-140176465-1002UA
2015-05-16 03:16 - 2015-04-17 17:11 - 00003520 _____ ()
C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1926068397-2398490202-140176465-1002Core
2015-05-16 03:12 - 2015-01-08 16:51 - 00003902 _____ ()
C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2015-05-16 03:12 - 2015-01-08 16:51 - 00003666 _____ ()
C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2015-05-16 03:12 - 2015-01-08 16:51 - 00000930 _____ ()
C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-05-13 21:07 - 2015-01-19 23:50 - 00000000 ____D () C:\Users\Duc
Hong\AppData\Roaming\HandBrake
2015-05-13 17:10 - 2015-03-02 14:18 - 00204264 _____ (Oracle Corporation)
C:\Windows\system32\VBoxNetFltNobj.dll
2015-05-13 17:10 - 2015-03-02 14:18 - 00156360 _____ (Oracle Corporation)
C:\Windows\system32\Drivers\VBoxNetFlt.sys
2015-05-12 17:42 - 2015-02-11 16:03 - 00000000 ____D () C:\Users\Duc
Hong\Desktop\IMG
2015-05-12 14:06 - 2013-08-23 01:36 - 00000000 ____D () C:\Windows\system32\NDF
2015-05-11 17:26 - 2014-05-17 06:03 - 00000000 ____D ()
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ASUS
2015-05-11 17:26 - 2014-05-17 06:02 - 00000000 ____D () C:\Program Files
(x86)\ASUS
2015-05-11 01:18 - 2015-01-07 20:13 - 00000000 ____D () C:\Users\Duc
Hong\AppData\Local\Packages
2015-05-11 01:18 - 2013-08-23 01:36 - 00000000 ____D () C:\Windows\AppReadiness
2015-05-09 14:32 - 2015-04-08 21:25 - 00000000 ____D () C:\Users\Duc
Hong\.bluefish
2015-05-09 14:31 - 2014-07-12 08:47 - 00000000 ___HD () C:\Program Files
(x86)\InstallShield Installation Information
2015-05-08 20:54 - 2015-01-22 16:51 - 00000000 ____D () C:\Users\Duc
Hong\AppData\Roaming\iFunbox_UserCache
2015-05-06 03:59 - 2015-02-16 18:53 - 00792568 _____ (Adobe Systems
Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-05-06 03:59 - 2015-02-16 18:53 - 00178168 _____ (Adobe Systems
Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-05-05 06:44 - 2015-01-07 23:31 - 00000000 ____D ()
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Steam
2015-05-05 06:23 - 2015-01-08 19:56 - 00000000 ____D () C:\Users\Duc
Hong\Documents\my games
2015-05-02 02:51 - 2015-04-26 23:22 - 01316184 _____ (NVIDIA Corporation)
C:\Windows\SysWOW64\nvspcap.dll
2015-05-02 02:51 - 2015-04-26 23:22 - 01316000 _____ (NVIDIA Corporation)
C:\Windows\SysWOW64\nvspbridge.dll
2015-05-02 02:50 - 2015-04-26 23:22 - 01756424 _____ (NVIDIA Corporation)
C:\Windows\system32\nvspbridge64.dll
2015-05-02 02:50 - 2015-04-26 23:22 - 01570672 _____ (NVIDIA Corporation)
C:\Windows\system32\nvspcap64.dll
2015-05-01 18:55 - 2013-08-23 01:36 - 00000000 ___RD ()
C:\Windows\ImmersiveControlPanel
2015-05-01 18:55 - 2013-08-22 23:36 - 00000000 ____D ()
C:\Windows\system32\AdvancedInstallers
2015-05-01 18:45 - 2013-08-22 23:25 - 00000199 _____ () C:\Windows\win.ini
2015-05-01 16:28 - 2015-01-07 21:13 - 00003924 _____ ()
C:\Windows\System32\Tasks\avast! Emergency Update
2015-05-01 16:28 - 2015-01-07 21:12 - 01047320 _____ (Avast Software s.r.o.)
C:\Windows\system32\Drivers\aswSnx.sys
2015-05-01 16:28 - 2015-01-07 21:12 - 00442264 _____ (Avast Software s.r.o.)
C:\Windows\system32\Drivers\aswSP.sys
2015-05-01 16:28 - 2015-01-07 21:12 - 00272248 _____ ()
C:\Windows\system32\Drivers\aswVmm.sys
2015-05-01 16:28 - 2015-01-07 21:12 - 00137288 _____ (Avast Software s.r.o.)
C:\Windows\system32\Drivers\aswStm.sys
2015-05-01 16:28 - 2015-01-07 21:12 - 00093528 _____ (Avast Software s.r.o.)
C:\Windows\system32\Drivers\aswRdr2.sys
2015-05-01 16:28 - 2015-01-07 21:12 - 00089944 _____ (Avast Software s.r.o.)
C:\Windows\system32\Drivers\aswMonFlt.sys
2015-05-01 16:28 - 2015-01-07 21:12 - 00065736 _____ ()
C:\Windows\system32\Drivers\aswRvrt.sys
2015-05-01 16:28 - 2015-01-07 21:12 - 00029168 _____ ()
C:\Windows\system32\Drivers\aswHwid.sys
==================== Files in the root of some directories =======
2015-01-23 17:37 - 2015-01-23 17:37 - 0000021 _____ () C:\Users\Duc
Hong\AppData\Roaming\my_intel.sys
2015-01-07 20:14 - 2015-05-30 14:22 - 0000074 _____ () C:\Users\Duc
Hong\AppData\Roaming\sp_data.sys
2015-01-07 21:37 - 2015-01-07 21:37 - 0000002 ____H () C:\Users\Duc
Hong\AppData\Roaming\win.dat
2015-05-09 14:32 - 2015-05-09 14:32 - 0000218 _____ () C:\Users\Duc
Hong\AppData\Local\recently-used.xbel
2015-01-22 00:28 - 2015-01-28 16:59 - 0007618 _____ () C:\Users\Duc
Hong\AppData\Local\Resmon.ResmonCfg
2014-07-12 08:51 - 2014-07-12 08:51 - 0000000 ____H ()
C:\ProgramData\DP45977C.lfl
2015-03-26 23:11 - 2015-03-26 23:11 - 0000040 _____ () C:\ProgramData\ra3.ini
2014-05-17 06:02 - 2012-09-07 21:40 - 0000256 _____ ()
C:\ProgramData\SetStretch.cmd
2014-05-17 06:02 - 2009-07-22 20:04 - 0024576 _____ ()
C:\ProgramData\SetStretch.exe
2014-05-17 06:02 - 2012-09-07 21:37 - 0000103 _____ ()
C:\ProgramData\SetStretch.VBS
Files to move or delete:
====================
C:\ProgramData\SetStretch.exe
C:\ProgramData\SetStretch.VBS
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2015-05-26 22:51
==================== End of log ============================
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 27-05-2015
Ran by Duc Hong at 2015-05-30 17:19:55
Running from C:\Users\Duc Hong\Desktop\FRST
Boot Mode: Normal
==========================================================
==================== Accounts: =============================
Administrator (S-1-5-21-1926068397-2398490202-140176465-500 - Administrator -
Disabled)
Duc Hong (S-1-5-21-1926068397-2398490202-140176465-1002 - Administrator -
Enabled) => C:\Users\Duc Hong
Guest (S-1-5-21-1926068397-2398490202-140176465-501 - Limited - Disabled)
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Windows Defender (Disabled - Up to date)
{D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AV: avast! Antivirus (Enabled - Up to date)
{17AD7D40-BA12-9C46-7131-94903A54AD8B}
AS: Windows Defender (Disabled - Up to date)
{D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: avast! Antivirus (Enabled - Up to date)
{ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to
unhide them. The adware programs should be uninstalled manually.)
µTorrent (HKLM-x32\...\uTorrent) (Version: 3.2.3.28705 - BitTorrent Inc.)
7-Zip 9.38 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0938-000001000000})
(Version: 9.38.00.0 - Igor Pavlov)
Adobe Flash Player 16 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version:
16.0.0.235 - Adobe Systems Incorporated)
Apple Application Support (32-bit)
(HKLM-x32\...\{2FE00055-C4F3-4F7A-AEDD-E198D54CF12F}) (Version: 3.1.1 - Apple
Inc.)
Apple Mobile Device Support (HKLM\...\{19DED56B-657D-41DA-9EB0-7C20DDF6A613})
(Version: 8.1.0.18 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE})
(Version: 2.1.3.127 - Apple Inc.)
ASUS Console (HKLM\...\{6D989E08-8143-4AB8-B0A8-5B836235CAA4}) (Version: 1.0.5 -
ASUS)
Asus FaceID (HKLM-x32\...\{C4071085-DDF0-403F-90F9-27582FC22C9B}) (Version:
7.7.6.1 - ASUS)
ASUS Instant Key (HKLM-x32\...\{D97A1B80-131F-4692-9543-E652956D8B99}) (Version:
1.1.7 - ASUS)
ASUS Live Update (HKLM-x32\...\{FA540E67-095C-4A1B-97BA-4D547DEC9AF4}) (Version:
3.3.4 - ASUS)
ASUS Power4Gear Hybrid (HKLM\...\{9B6239BF-4E85-4590-8D72-51E30DB1A9AA})
(Version: 3.0.8 - ASUS)
ASUS Smart Gesture (HKLM-x32\...\{4D3286A6-F6AB-498A-82A4-E4F040529F3D})
(Version: 2.2.10 - ASUS)
ASUS Splendid Video Enhancement Technology
(HKLM-x32\...\{0969AF05-4FF6-4C00-9406-43599238DE0D}) (Version: 2.01.0021 -
ASUS)
ATK Package (HKLM-x32\...\{AB5C933E-5C7D-4D30-B314-9C83A49B94BE}) (Version:
1.0.0031 - ASUS)
ATLAS Translation Standard V14.0 Trial Version
(HKLM-x32\...\{6652750B-AA69-49B7-9D09-C0A28B6FFC9F}) (Version: 14.00.2000 -
FUJITSU LIMITED)
Auslogics DiskDefrag (HKLM-x32\...\{DF6A13C0-77DF-41FE-BD05-6D5201EB0CE7}_is1)
(Version: 5.4.0.0 - Auslogics Labs Pty Ltd)
Avast Free Antivirus (HKLM-x32\...\Avast) (Version: 10.2.2218 - AVAST Software)
Avidemux 2.6 - 64bits (HKLM-x32\...\Avidemux 2.6 - 64bits (64-bit)) (Version:
2.6.9.00 - )
BatteryBar (remove only) (HKLM\...\BatteryBar) (Version: - )
Bluefish 2.2.7 (HKLM-x32\...\Bluefish) (Version: 2.2.7 - The Bluefish
Developers)
BlueJ (HKLM-x32\...\{7D66971C-652B-4065-A6B1-B3EE313C254B}) (Version: 3.1.4 -
BlueJ Team)
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 -
Apple Inc.)
CCleaner (HKLM\...\CCleaner) (Version: 5.06 - Piriform)
CodeBlocks (HKU\S-1-5-21-1926068397-2398490202-140176465-1002\...\CodeBlocks)
(Version: 13.12 - The Code::Blocks Team)
Color Cop 5.4.3 (HKLM-x32\...\Color Cop_is1) (Version: - Jay Prall)
Command & Conquer™ Red Alert™ 3
(HKLM\...\{296D8550-CB06-48E4-9A8B-E5034FB64715}) (Version: 1.0.1.0 - Electronic
Arts)
Command & Conquer™ Red Alert™ 3
(HKLM-x32\...\{296D8550-CB06-48E4-9A8B-E5034FB64715}) (Version: 1.0.1.0 -
Electronic Arts)
Counter-Strike: Global Offensive (HKLM-x32\...\Steam App 730) (Version: -
Valve)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
DAEMON Tools Lite (HKLM-x32\...\DAEMON Tools Lite) (Version: 4.49.1.0356 - Disc
Soft Ltd)
Defraggler (HKLM\...\Defraggler) (Version: 2.19 - Piriform)
ESET Online Scanner v3 (HKLM-x32\...\ESET Online Scanner) (Version: - )
Everything 1.3.4.686 (x64) (HKLM\...\Everything) (Version: - )
Explorer Suite IV (HKLM\...\Explorer Suite_is1) (Version: - )
FarCry 4 (HKLM-x32\...\Uplay Install 420) (Version: - Ubisoft)
FileHippo App Manager (HKLM-x32\...\FileHippo.com) (Version: - FileHippo.com)
Foxit PhantomPDF Business (HKLM-x32\...\{8A601904-4113-40FE-9DCC-7A38CE1A8032})
(Version: 7.0.6.1126 - Foxit Software Inc.)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 43.0.2357.81 - Google Inc.)
Google Talk Plugin (HKLM-x32\...\{CA3DD97D-1FD7-37A7-BD5C-FC4430C8B8E6})
(Version: 5.41.2.0 - Google)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.27.5 - Google Inc.) Hidden
HandBrake 0.10.1 (HKLM-x32\...\HandBrake) (Version: 0.10.1 - )
HD Tune Pro 5.50 (HKLM-x32\...\HD Tune Pro_is1) (Version: - EFD Software)
Intel® Driver Update Utility 2.0 (x32 Version: 2.0.0.29 - Intel) Hidden
Intel® Management Engine Components
(HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 9.5.14.1724 -
Intel Corporation)
Intel® Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA})
(Version: 10.18.10.3355 - Intel Corporation)
Intel® Wireless Bluetooth®(patch version 17.1.1449.356)
(HKLM\...\{302600C1-6BDF-4FD1-1411-148929CC1385}) (Version: 17.1.1411.0506 -
Intel Corporation)
Intel® Driver Update Utility
(HKLM-x32\...\{8409c4f7-2340-4933-a304-5d37db4fb48b}) (Version: 2.0.0.29 -
Intel)
Intel® PROSet/Wireless Software
(HKLM-x32\...\{a9888f41-68ae-43df-bd7d-d93405a44106}) (Version: 17.13.11 - Intel
Corporation)
Internet Download Manager (HKLM-x32\...\Internet Download Manager) (Version: -
Tonec Inc.)
IrfanView (remove only) (HKLM-x32\...\IrfanView) (Version: 4.38 - Irfan Skiljan)
iTunes (HKLM\...\{2EA80E9F-C811-41BB-ABAC-F270B4B39BC6}) (Version: 12.1.0.71 -
Apple Inc.)
Java 8 Update 45 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86418045F0})
(Version: 8.0.450 - Oracle Corporation)
Java 8 Update 45 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218045F0}) (Version:
8.0.450 - Oracle Corporation)
Java SE Development Kit 8 Update 40 (64-bit)
(HKLM\...\{64A3A4F4-B792-11D6-A78A-00B0D0180400}) (Version: 8.0.400.26 - Oracle
Corporation)
Junk Mail filter update (x32 Version: 16.4.3528.0331 - Microsoft Corporation)
Hidden
K-Lite Codec Pack 11.0.8 Full (HKLM-x32\...\KLiteCodecPack_is1) (Version: 11.0.8
- )
Malwarebytes Anti-Malware version 2.1.6.1022 (HKLM-x32\...\Malwarebytes
Anti-Malware_is1) (Version: 2.1.6.1022 - Malwarebytes Corporation)
MediaCoder x64 0.8.34.5716 (HKLM\...\MediaCoder x64) (Version: 0.8.34.5716 -
Mediatronic)
Microsoft ASP.NET MVC 4 Runtime
(HKLM-x32\...\{3FE312D5-B862-40CE-8E4E-A6D8ABF62736}) (Version: 4.0.40804.0 -
Microsoft Corporation)
Microsoft Office Professional Plus 2010 (HKLM\...\Office14.PROPLUS) (Version:
14.0.7015.1000 - Microsoft Corporation)
Microsoft OneDrive
(HKU\S-1-5-21-1926068397-2398490202-140176465-1002\...\OneDriveSetup.exe)
(Version: 17.0.4035.0328 - Microsoft Corporation)
Microsoft Outlook Hotmail Connector 64-bit
(HKLM\...\{95140000-007A-0409-1000-0000000FF1CE}) (Version: 14.0.5118.5000 -
Microsoft Corporation)
Microsoft Outlook Social Connector Provider for Windows Live Messenger 64-bit
(HKLM\...\{95140000-007D-0409-1000-0000000FF1CE}) (Version: 14.0.5120.5000 -
Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00})
(Version: 5.1.40416.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU]
(HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 -
Microsoft Corporation)
Microsoft Visio Professional 2010 (HKLM\...\Office14.VISIOR) (Version:
14.0.7015.1000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable
(HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 -
Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
(HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 -
Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148
(HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 -
Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
(HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 -
Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
(HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 -
Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
(HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 -
Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
(HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 -
Microsoft Corporation)
Microsoft Visual C++ 2010 Redistributable - x64 10.0.40219
(HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 -
Microsoft Corporation)
Microsoft Visual C++ 2010 Redistributable - x86 10.0.40219
(HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 -
Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030
(HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 -
Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030
(HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 -
Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005
(HKLM-x32\...\{ce085a78-074e-4823-8dc1-8a721b94b76d}) (Version: 12.0.21005.1 -
Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft
Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 -
Microsoft Corporation)
Movie Maker (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Mozilla Firefox 37.0.1 (x86 en-US) (HKLM-x32\...\Mozilla Firefox 37.0.1 (x86
en-US)) (Version: 37.0.1 - Mozilla)
Mozilla Firefox 38.0.1 (x86 en-US)
(HKU\S-1-5-21-1926068397-2398490202-140176465-1002\...\Mozilla Firefox 38.0.1
(x86 en-US)) (Version: 38.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version:
36.0.3 - Mozilla)
MyDefrag v4.3.1 (HKLM\...\MyDefrag v4.3.1_is1) (Version: 4.0.0.0 - J.C. Kessels)
NEKOPARA vol.1
(HKU\S-1-5-21-1926068397-2398490202-140176465-1002\...\{64DC04AF-BD7C-4CF4-9CA4-938953224328})
(Version: - NEKO WORKs)
Notepad++ (HKLM-x32\...\Notepad++) (Version: 6.7.8.2 - Notepad++ Team)
NVIDIA GeForce Experience 2.4.3.22
(HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version:
2.4.3.22 - NVIDIA Corporation)
NVIDIA Graphics Driver 350.05
(HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version:
350.05 - NVIDIA Corporation)
NVIDIA PhysX System Software 9.15.0324
(HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version:
9.15.0324 - NVIDIA Corporation)
Oracle VM VirtualBox 4.3.28 (HKLM\...\{E8BB81BC-E67C-4750-84EE-128DA5A7ADA5})
(Version: 4.3.28 - Oracle Corporation)
Potplayer (HKLM-x32\...\PotPlayer) (Version: - Daum Kakao Corp.)
Rainmeter (HKLM-x32\...\Rainmeter) (Version: 3.2.1 r2386 - )
Realtek Card Reader (HKLM-x32\...\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A})
(Version: 6.2.9200.39048 - Realtek Semiconductor Corp.)
Realtek Ethernet Controller Driver
(HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 8.20.815.2013 -
Realtek)
Revo Uninstaller Pro 3.0.2 (HKLM\...\{67579783-0FB7-4F7B-B881-E5BE47C9DBE0}_is1)
(Version: 3.0.2 - VS Revo Group, Ltd.)
RW-Everything v1.6.5.9 (HKLM\...\RW-Everything_is1) (Version: - )
Service Pack 2 for Microsoft Office 2010 (KB2687455) 64-Bit Edition
(HKLM\...\{90140000-0011-0000-1000-0000000FF1CE}_Office14.PROPLUS_{A3364707-2F53-4C83-8F68-C9877A9080C7})
(Version: - Microsoft)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 64-Bit Edition
(HKLM\...\{91140000-0057-0000-1000-0000000FF1CE}_Office14.VISIOR_{3C578F10-F74F-4655-B2A6-9F88A6C415E8})
(Version: - Microsoft)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 64-Bit Edition (Version: -
Microsoft) Hidden
SHIELD Streaming (Version: 4.1.1000 - NVIDIA Corporation) Hidden
SHIELD Wireless Controller Driver (Version: 2.4.3.22 - NVIDIA Corporation)
Hidden
Sid Meier's Civilization V (HKLM-x32\...\Steam App 8930) (Version: - 2K Games,
Inc.)
Skype Click to Call (HKLM-x32\...\{6D1221A9-17BF-4EC0-81F2-27D30EC30701})
(Version: 7.3.16540.9015 - Microsoft Corporation)
Skype™ 7.5 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version:
7.5.101 - Skype Technologies S.A.)
SoftEther VPN Client (HKLM\...\softether_sevpnclient) (Version: 4.12.9514 -
SoftEther VPN Project)
Speccy (HKLM\...\Speccy) (Version: 1.28 - Piriform)
Spotify (HKU\S-1-5-21-1926068397-2398490202-140176465-1002\...\Spotify)
(Version: 1.0.3.101.gbfa97dfe - Spotify AB)
Steam (HKLM-x32\...\Steam) (Version: 2.10.91.91 - Valve Corporation)
Synei System Utilities (HKLM-x32\...\{BFDC3B26-7DB0-43D3-BC84-7E9649C157EA}_is1)
(Version: 2.25 - Synei)
System Requirements Lab (HKLM-x32\...\{0F659036-14C7-4622-9505-35A0DC93526A})
(Version: 6.1.3.0 - Husdawg, LLC)
Team Fortress 2 (HKLM-x32\...\Steam App 440) (Version: - Valve)
TeraCopy 2.3 (HKLM\...\TeraCopy_is1) (Version: - Code Sector)
The Elder Scrolls V: Skyrim (HKLM-x32\...\Steam App 72850) (Version: - Bethesda
Game Studios)
The Witcher 2: Assassins of Kings Enhanced Edition (HKLM-x32\...\Steam App
20920) (Version: - CD PROJEKT RED)
Unity Web Player
(HKU\S-1-5-21-1926068397-2398490202-140176465-1002\...\UnityWebPlayer) (Version:
5.0.2f1 - Unity Technologies ApS)
Unlocker 1.9.2 (HKLM\...\Unlocker) (Version: 1.9.2 - Cedrick Collomb)
Update for Japanese Microsoft IME Postal Code Dictionary
(HKLM-x32\...\{15015752-9990-4516-A2B1-93823281FB8E}) (Version: 15.0.1759 -
Microsoft Corporation)
Update for Japanese Microsoft IME Standard Dictionary
(HKLM-x32\...\{7DB71278-9AD7-4480-AB08-8649C5010B17}) (Version: 15.0.1215 -
Microsoft Corporation)
Update for Japanese Microsoft IME Standard Extended Dictionary
(HKLM-x32\...\{78CE66A9-85AF-4BD8-8FB7-35B5F3846C00}) (Version: 15.0.1215 -
Microsoft Corporation)
Uplay (HKLM-x32\...\Uplay) (Version: 4.8 - Ubisoft)
VMware Player (HKLM-x32\...\VMware_Player) (Version: 7.1.0 - VMware, Inc)
VMware Player (Version: 7.1.0 - VMware, Inc.) Hidden
Warframe (HKLM-x32\...\Steam App 230410) (Version: - Digital Extremes)
WebStorage (HKLM-x32\...\WebStorage) (Version: 2.1.2.301 - ASUS Cloud
Corporation)
Windows Driver Package - ASUS (ATP) Mouse (01/07/2014 1.0.0.197)
(HKLM\...\2BEE838DC3D664A0CAB23AEA0332BB3877ED0685) (Version: 01/07/2014
1.0.0.197 - ASUS)
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3528.0331 -
Microsoft Corporation)
WinFlash (HKLM-x32\...\{8F21291E-0444-4B1D-B9F9-4370A73E346D}) (Version: 2.42.0
- ASUS)
WinPcap 4.1.3 (HKLM-x32\...\WinPcapInst) (Version: 4.1.0.2980 - Riverbed
Technology, Inc.)
WinRAR 5.20 (64-bit) (HKLM\...\WinRAR archiver) (Version: 5.20.0 - win.rar GmbH)
Wireshark 1.12.5 (64-bit) (HKLM-x32\...\Wireshark) (Version: 1.12.5 - The
Wireshark developer community, http://www.wireshark.org)
==================== Custom CLSID (Whitelisted): ==========================
(If an entry is included in the fixlist, it will be removed from the registry.
The file will not be moved unless listed separately.)
CustomCLSID:
HKU\S-1-5-21-1926068397-2398490202-140176465-1002_Classes\CLSID\{1423F872-3F7F-4E57-B621-8B1A9D49B448}\InprocServer32
-> C:\Users\Duc Hong\AppData\Local\Google\Update\1.3.27.5\psuser_64.dll (Google
Inc.)
CustomCLSID:
HKU\S-1-5-21-1926068397-2398490202-140176465-1002_Classes\CLSID\{E8CF3E55-F919-49D9-ABC0-948E6CB34B9F}\InprocServer32
-> C:\Users\Duc Hong\AppData\Local\Google\Update\1.3.27.5\psuser_64.dll (Google
Inc.)
CustomCLSID:
HKU\S-1-5-21-1926068397-2398490202-140176465-1002_Classes\CLSID\{F8071786-1FD0-4A66-81A1-3CBE29274458}\InprocServer32
-> C:\Users\Duc
Hong\AppData\Local\Microsoft\SkyDrive\17.0.4035.0328\amd64\FileSyncApi64.dll
(Microsoft Corporation)
==================== Restore Points =========================
==================== Hosts content: ===============================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2013-08-22 23:25 - 2015-02-11 01:00 - 00000793 ____A
C:\Windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (Whitelisted) =============
(If an entry is included in the fixlist, it will be removed from the registry.
The file will not be moved unless listed separately.)
Task: {0672CE47-9AF2-49B5-BA4A-D987C76AF085} -
System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1926068397-2398490202-140176465-1002UA
=> C:\Users\Duc Hong\AppData\Local\Google\Update\GoogleUpdate.exe [2015-04-17]
(Google Inc.)
Task: {0B01FB0E-B462-46B8-816C-2444A6441DB3} - System32\Tasks\ASUS Smart Gesture
Launcher => C:\Program Files (x86)\ASUS\ASUS Smart
Gesture\AsTPCenter\x64\AsusTPLauncher.exe [2014-02-14] (AsusTek)
Task: {1BAF89D5-B76F-48CA-B114-034B69480F29} - System32\Tasks\ASUS Splendid
ColorU => C:\Program Files (x86)\ASUS\Splendid\ColorUService.exe [2013-10-08]
(ASUSTeK Computer Inc.)
Task: {1EB54610-9F30-42C5-93C1-9B6CBD358D7E} - System32\Tasks\RTKCPL =>
C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [2014-05-20] (Realtek
Semiconductor)
Task: {31E03131-2908-43E9-AE6D-CD1AC82DAD2F} - System32\Tasks\ASUS Console =>
C:\Program Files\ASUS\ASUS Console\ASUS Console Starter.exe [2014-02-07]
(ASUSTek Computer Inc.)
Task: {4E3FDD62-EABC-414B-8FBD-DBA444C5CA8A} -
System32\Tasks\Microsoft\Windows\Setup\gwx\refreshgwxconfig =>
C:\Windows\system32\GWX\GWXConfigManager.exe [2015-05-06] (Microsoft
Corporation)
Task: {760AE585-4971-4AD2-AFC4-DEA14F01B495} -
System32\Tasks\Microsoft\Windows\Setup\gwx\launchtrayprocess =>
C:\Windows\system32\GWX\GWX.exe [2015-05-06] (Microsoft Corporation)
Task: {766E80C1-FFF8-4F47-8FC3-4E533BAE0AC1} - System32\Tasks\Update Checker =>
C:\Program Files (x86)\ASUS\ASUS Live Update\UpdateChecker.exe [2015-02-12] ()
Task: {82F04444-7113-4278-B8C4-51A59E6C29E4} - System32\Tasks\RtHDVBg =>
C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [2014-05-13] (Realtek
Semiconductor)
Task: {9D746130-D7A9-4BB8-8E96-05093DEF9977} -
System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1926068397-2398490202-140176465-1002Core
=> C:\Users\Duc Hong\AppData\Local\Google\Update\GoogleUpdate.exe [2015-04-17]
(Google Inc.)
Task: {A508D830-687E-41AA-AF60-8916D26EAEBF} - System32\Tasks\CCleanerSkipUAC =>
C:\Program Files\CCleaner\CCleaner.exe [2015-05-09] (Piriform Ltd)
Task: {B15A7A20-383B-47EB-A029-E30292516E17} - System32\Tasks\ASUS Live Update1
=> C:\Program Files (x86)\ASUS\ASUS Live Update\LiveUpdate.exe [2015-03-23]
(ASUSTeK Computer Inc.)
Task: {B905D56A-7E45-4939-90F9-416CB290E620} - System32\Tasks\AsusVibeSchedule
=> C:\Program Files (x86)\Asus\AsusVibe\AsusVibeLauncher.exe
Task: {CB4E97FF-DC08-4AE9-B101-6EC041501D17} -
System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB =>
C:\Windows\system32\MRT.exe [2015-05-18] (Microsoft Corporation)
Task: {CE71F3E1-DE1E-4B42-A816-09F806D6EAFE} - System32\Tasks\Microsoft OneDrive
Auto Update Task-S-1-5-21-1926068397-2398490202-140176465-1002 =>
%localappdata%\Microsoft\SkyDrive\SkyDrive.exe
Task: {D54DEED3-1E09-43DD-A0D7-2534D4F95BFB} -
System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files
(x86)\Google\Update\GoogleUpdate.exe [2015-01-08] (Google Inc.)
Task: {EA345886-3FBF-4930-8FE1-DEAE05BA0372} - System32\Tasks\ASUS Splendid
ACMON => C:\Program Files (x86)\ASUS\Splendid\ACMON.exe [2013-10-08] (ASUS)
Task: {F160855D-2EAD-405F-A8EF-A15DF3A90A7E} - System32\Tasks\AutoKMS =>
C:\Windows\AutoKMS\AutoKMS.exe [2015-01-08] ()
Task: {F6441995-B4CF-4A06-BBE6-5BE2EE55D8EA} - System32\Tasks\avast! Emergency
Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2015-05-01]
(Avast Software s.r.o.)
Task: {F87A5893-944C-45F8-AF4F-42245D864FF7} -
System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files
(x86)\Google\Update\GoogleUpdate.exe [2015-01-08] (Google Inc.)
Task: C:\Windows\Tasks\AutoKMS.job => C:\Windows\AutoKMS\AutoKMS.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files
(x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files
(x86)\Google\Update\GoogleUpdate.exe
Task:
C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1926068397-2398490202-140176465-1002Core.job
=> C:\Users\Duc Hong\AppData\Local\Google\Update\GoogleUpdate.exe
Task:
C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1926068397-2398490202-140176465-1002UA.job
=> C:\Users\Duc Hong\AppData\Local\Google\Update\GoogleUpdate.exe
==================== Loaded Modules (Whitelisted) ==============
2015-04-26 23:21 - 2015-04-02 17:19 - 00117392 _____ () C:\Program Files\NVIDIA
Corporation\Display\NvSmartMax64.dll
2015-02-20 08:01 - 2015-02-20 08:01 - 00022528 _____ ()
C:\Windows\System32\us001lm.dll
2014-07-12 09:01 - 2013-08-27 09:29 - 00755728 _____ ()
C:\Windows\SYSTEM32\sqlite3.dll
2013-09-04 23:17 - 2013-09-04 23:17 - 04300456 _____ () C:\Program Files\Common
Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF
2010-10-20 14:23 - 2010-10-20 14:23 - 08801632 _____ () C:\Program
Files\Microsoft Office\Office14\1033\GrooveIntlResource.dll
2010-07-15 14:44 - 2010-07-15 14:44 - 00020032 _____ () C:\Program
Files\Unlocker\UnlockerCOM.dll
2015-04-16 06:13 - 2015-04-16 06:13 - 00222720 _____ () C:\Program Files
(x86)\Notepad++\NppShell_06.dll
2015-03-24 23:28 - 2015-03-24 23:28 - 00036544 _____ () C:\Program
Files\Rainmeter\Rainmeter.exe
2015-03-24 23:28 - 2015-03-24 23:28 - 00775872 _____ () C:\Program
Files\Rainmeter\Rainmeter.dll
2015-03-24 23:28 - 2015-03-24 23:28 - 00022528 _____ () C:\Program
Files\Rainmeter\Plugins\InputText.dll
2015-03-24 23:27 - 2015-03-24 23:27 - 00011776 _____ () C:\Program
Files\Rainmeter\Plugins\PowerPlugin.DLL
2015-03-24 23:27 - 2015-03-24 23:27 - 00022016 _____ () C:\Program
Files\Rainmeter\Plugins\WifiStatus.DLL
2015-03-24 23:27 - 2015-03-24 23:27 - 00020992 _____ () C:\Program
Files\Rainmeter\Plugins\SysInfo.DLL
2015-03-24 23:27 - 2015-03-24 23:27 - 00058368 _____ () C:\Program
Files\Rainmeter\Plugins\WebParser.DLL
2015-03-24 23:27 - 2015-03-24 23:27 - 00023040 _____ () C:\Program
Files\Rainmeter\Plugins\Win7AudioPlugin.DLL
2013-09-04 23:17 - 2013-09-04 23:17 - 04300456 _____ () C:\Program Files\Common
Files\Microsoft Shared\office14\Cultures\office.odf
2015-02-20 08:01 - 2015-02-20 08:01 - 01603584 _____ ()
C:\Windows\system32\spool\DRIVERS\x64\3\us001du.dll
2015-05-01 16:28 - 2015-05-01 16:28 - 00104400 _____ () C:\Program Files\AVAST
Software\Avast\log.dll
2015-05-01 16:28 - 2015-05-01 16:28 - 00081728 _____ () C:\Program Files\AVAST
Software\Avast\JsonRpcServer.dll
2015-05-30 14:30 - 2015-05-30 14:30 - 02950656 _____ () C:\Program Files\AVAST
Software\Avast\defs\15052901\algo.dll
2015-01-20 21:35 - 2015-01-20 21:35 - 00073544 _____ () C:\Program Files
(x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2015-01-20 21:35 - 2015-01-20 21:35 - 01044776 _____ () C:\Program Files
(x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2015-02-06 17:40 - 2015-02-06 17:40 - 01301696 _____ () C:\Program Files
(x86)\VMware\VMware Player\libxml2.dll
2014-07-12 08:47 - 2013-09-04 09:52 - 01242584 _____ () C:\Program Files
(x86)\Intel\Intel® Management Engine Components\LMS\ACE.dll
2013-09-10 11:23 - 2013-09-10 11:23 - 00162816 _____ () C:\Program Files
(x86)\ASUS\Splendid\CCTAdjust.dll
2013-10-09 13:41 - 2013-10-09 13:41 - 00037968 _____ () C:\Program Files
(x86)\ASUS\Splendid\DetectDisplayDC.dll
2015-04-26 23:22 - 2015-05-02 02:52 - 00011920 _____ () C:\Program Files
(x86)\NVIDIA Corporation\Update Core\detoured.dll
2015-03-20 15:31 - 2015-03-20 15:31 - 40540672 _____ () C:\Program Files\AVAST
Software\Avast\libcef.dll
2013-09-04 23:14 - 2013-09-04 23:14 - 04300456 _____ () C:\Program Files
(x86)\Common Files\Microsoft Shared\OFFICE14\Cultures\OFFICE.ODF
2010-10-20 14:45 - 2010-10-20 14:45 - 08801120 _____ () C:\Program Files
(x86)\Microsoft Office\Office14\1033\GrooveIntlResource.dll
2015-04-09 05:33 - 2015-03-31 04:00 - 00236544 _____ () C:\Program Files
(x86)\K-Lite Codec Pack\Filters\LAV\libbluray.dll
2015-04-09 05:33 - 2015-03-25 04:00 - 03502080 _____ () C:\Program Files
(x86)\K-Lite Codec Pack\Filters\ffdshow\ffdshow.ax
2015-04-09 05:33 - 2015-03-25 04:00 - 04015616 _____ () C:\Program Files
(x86)\K-Lite Codec Pack\Filters\ffdshow\ffmpeg.dll
==================== Alternate Data Streams (Whitelisted) =========
(If an entry is included in the fixlist, only the ADS will be removed.)
==================== Safe Mode (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry.
The "AlternateShell" will be restored.)
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\CleanHlp => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\CleanHlp.sys =>
""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcpltsvc => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\CleanHlp => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\CleanHlp.sys =>
""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcpltsvc => ""=""
==================== EXE Association (Whitelisted) ===============
(If an entry is included in the fixlist, the registry item will be restored to
default or removed.)
==================== Internet Explorer trusted/restricted ===============
(If an entry is included in the fixlist, it will be removed from the registry.)
==================== Other Areas ============================
(Currently there is no automatic fix for this section.)
HKU\S-1-5-21-1926068397-2398490202-140176465-1002\Control
Panel\Desktop\\Wallpaper -> C:\Users\Duc
Hong\AppData\Roaming\IrfanView\IrfanView_Wallpaper.bmp
DNS Servers: 192.168.1.1
==================== MSCONFIG/TASK MANAGER disabled items ==
(Currently there is no automatic fix for this section.)
HKLM\...\StartupApproved\StartupFolder: => "SoftEther VPN Client Manager
Startup.lnk"
HKLM\...\StartupApproved\Run: => "SoftEther VPN Client UI Helper"
HKLM\...\StartupApproved\Run32: => "ASUSPRP"
HKU\S-1-5-21-1926068397-2398490202-140176465-1002\...\StartupApproved\Run: =>
"FlashPlayerUpdate"
HKU\S-1-5-21-1926068397-2398490202-140176465-1002\...\StartupApproved\Run: =>
"Google Update"
HKU\S-1-5-21-1926068397-2398490202-140176465-1002\...\StartupApproved\Run: =>
"DevidAgent"
HKU\S-1-5-21-1926068397-2398490202-140176465-1002\...\StartupApproved\Run: =>
"BingSvc"
==================== FirewallRules (Whitelisted) ===============
(If an entry is included in the fixlist, it will be removed from the registry.
The file will not be moved unless listed separately.)
FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139
FirewallRules: [Daum PotPlayer(PotPlayerMini.exe)] => (Allow) C:\Program Files
(x86)\DAUM\PotPlayer\PotPlayerMini.exe
FirewallRules: [{6AD7A4C1-520C-4938-83E9-8C3D4AF4470B}] => (Allow) C:\Program
Files (x86)\DAUM\PotPlayer\PotPlayerMini.exe
FirewallRules: [TCP Query
User{B408D18C-6D03-4CC8-9E8F-41FF22643530}C:\windows\microsoft.net\framework\v2.0.50727\vbc.exe]
=> (Allow) C:\windows\microsoft.net\framework\v2.0.50727\vbc.exe
FirewallRules: [UDP Query
User{A1BDE586-1E5F-4E70-83A1-C3724D86FBEA}C:\windows\microsoft.net\framework\v2.0.50727\vbc.exe]
=> (Allow) C:\windows\microsoft.net\framework\v2.0.50727\vbc.exe
FirewallRules: [{46831999-F626-41E8-A1AB-F3130E61A535}] => (Allow)
E:\Temp\Steam\Steam.exe
FirewallRules: [{24C0EBEB-6AAB-4281-B843-FC830B4FEB52}] => (Allow)
E:\Temp\Steam\Steam.exe
FirewallRules: [{AED3302F-B17D-4701-9390-ED277A47C947}] => (Allow)
E:\Temp\Steam\steamapps\common\Skyrim\SkyrimLauncher.exe
FirewallRules: [{259FAB07-4841-4498-8702-1C73EE758BF7}] => (Allow)
E:\Temp\Steam\steamapps\common\Skyrim\SkyrimLauncher.exe
FirewallRules: [{F2D50447-ADCB-4ACF-A732-83AA56A4E7A9}] => (Allow) C:\Program
Files\SoftEther VPN Client\vpnclient_x64.exe
FirewallRules: [{332E3FF6-209A-48A4-A6EC-7423A11D35B6}] => (Allow) C:\Program
Files\SoftEther VPN Client\vpncmgr.exe
FirewallRules: [{8284D947-F7E8-4B89-A26F-A0AD5FD80F82}] => (Allow) C:\Program
Files\SoftEther VPN Client\vpncmd_x64.exe
FirewallRules: [{A44E3BA8-FD16-4235-9303-E17CA8FF8D6D}] => (Allow) C:\Program
Files\SoftEther VPN Client\vpncmgr_x64.exe
FirewallRules: [{5647D39A-F124-4953-ACEC-254F04260C4D}] => (Allow) C:\Program
Files\SoftEther VPN Client\vpnclient.exe
FirewallRules: [{BB5EAF98-68DC-4481-BDA2-0F92653D1BE9}] => (Allow) C:\Program
Files\SoftEther VPN Client\vpncmd.exe
FirewallRules: [SPPSVC-In-TCP] => (Allow) %SystemRoot%\system32\sppextcomobj.exe
FirewallRules: [SPPSVC-In-TCP-NoScope] => (Allow)
%SystemRoot%\system32\sppextcomobj.exe
FirewallRules: [{2BFDCA10-D873-4098-A023-AF8A8D52659D}] => (Allow) C:\Users\Duc
Hong\AppData\Roaming\Spotify\spotify.exe
FirewallRules: [{95AFAF81-213D-48BB-9D2E-9FC489C69485}] => (Allow) C:\Users\Duc
Hong\AppData\Roaming\Spotify\spotify.exe
FirewallRules: [{E419D7CD-9FEB-40AD-8036-CEF8EE2A3E58}] => (Allow) C:\Program
Files (x86)\uTorrent\uTorrent.exe
FirewallRules: [{7EB67D77-8A9B-425E-8A9D-556828BD9F2A}] => (Allow) C:\Program
Files (x86)\uTorrent\uTorrent.exe
FirewallRules: [{E7314D54-19FD-4376-952A-C283F866565A}] => (Allow)
E:\Temp\Steam\steamapps\common\Team Fortress 2\hl2.exe
FirewallRules: [{A9537D58-5E28-443C-9DF3-773B75BE8B9C}] => (Allow)
E:\Temp\Steam\steamapps\common\Team Fortress 2\hl2.exe
FirewallRules: [{5405FDE4-13D9-46A4-BA72-2C3D637A820A}] => (Allow)
E:\Temp\Steam\steamapps\common\Sid Meier's Civilization V\Launcher.exe
FirewallRules: [{4D112B3C-965E-4D2B-8A4C-A3BC7790EB24}] => (Allow)
E:\Temp\Steam\steamapps\common\Sid Meier's Civilization V\Launcher.exe
FirewallRules: [{57563CA2-4C58-4DB6-A9D8-63CCEE8D3D58}] => (Allow) C:\Program
Files\Intel\WiFi\bin\PanDhcpDns.exe
FirewallRules: [{EECB906E-0A72-4349-ABC2-51F722808688}] => (Allow) C:\Program
Files (x86)\VMware\VMware Player\vmware-authd.exe
FirewallRules: [{E113D9E6-3F09-4DFD-9AE0-63C1DDFBFF5F}] => (Allow) C:\Program
Files (x86)\VMware\VMware Player\vmware-authd.exe
FirewallRules: [TCP Query User{D2BD56E1-FECA-4760-BFF6-7B483CFCD029}C:\program
files (x86)\mozilla firefox\firefox.exe] => (Allow) C:\program files
(x86)\mozilla firefox\firefox.exe
FirewallRules: [UDP Query User{31909EE8-B773-4D7F-8A9B-F43C433277C1}C:\program
files (x86)\mozilla firefox\firefox.exe] => (Allow) C:\program files
(x86)\mozilla firefox\firefox.exe
FirewallRules: [{D584DDB2-8E7C-45B2-828F-ACE4C55E5EEF}] => (Allow) C:\Program
Files\Bonjour\mDNSResponder.exe
FirewallRules: [{0E7DD122-51EE-4061-BA2E-AC6519ACC2AD}] => (Allow) C:\Program
Files\Bonjour\mDNSResponder.exe
FirewallRules: [{55B30F08-3CE8-40C4-A149-EC7C5462450F}] => (Allow) C:\Program
Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{6A093041-DBDC-47C2-A540-CFBC73668DB9}] => (Allow) C:\Program
Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{2E92677B-4DF7-48B8-A955-03BC56D592A8}] => (Allow) C:\Program
Files (x86)\iTunes\iTunes.exe
FirewallRules: [{C61C7218-4C30-48CF-A3C2-6D208730DCEE}] => (Allow) C:\Users\Duc
Hong\AppData\Roaming\Spotify\spotify.exe
FirewallRules: [{0CB55171-3C48-4165-B73A-D3D703E0BF74}] => (Allow) C:\Users\Duc
Hong\AppData\Roaming\Spotify\spotify.exe
FirewallRules: [{62290C84-E203-48CD-96FE-25F287B35C58}] => (Allow) C:\Program
Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{CF008ED2-2D02-4F90-9DE1-AF2683AC3A75}] => (Allow) C:\Program
Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{4A2F08C8-3C2D-4E62-AB32-9E6F21033E5D}] => (Allow)
E:\Temp\Steam\steamapps\common\Counter-Strike Global Offensive\csgo.exe
FirewallRules: [{5A10E92E-14BC-4EA2-87C5-DFA76406A1B6}] => (Allow)
E:\Temp\Steam\steamapps\common\Counter-Strike Global Offensive\csgo.exe
FirewallRules: [{450E7EC7-2C50-4F23-96AB-7ECDB5C88FFC}] => (Allow) C:\Program
Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
FirewallRules: [{32706039-9609-4992-BEEB-8ED8864C4607}] => (Allow) C:\Program
Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
FirewallRules: [{F739246A-3A2D-4765-808B-7BB1F4458A55}] => (Allow) C:\Program
Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe
FirewallRules: [{B1667E06-E235-41E6-B974-A2480A44B3EA}] => (Allow) C:\Program
Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe
FirewallRules: [{C902004C-0182-4F8A-92B3-90CDD0848EEE}] => (Allow) C:\Program
Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{CA9C0864-93C5-4403-A96A-481A312E25AB}] => (Allow) C:\Program
Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{FB800EB4-BE51-4D8C-8E4F-CFC1270DB18B}] => (Allow)
E:\Temp\Steam\steamapps\common\Warframe\Tools\Launcher.exe
FirewallRules: [{C72A1B67-D93C-43AC-BE28-B0ACE3FE8839}] => (Allow)
E:\Temp\Steam\steamapps\common\Warframe\Tools\Launcher.exe
FirewallRules: [TCP Query User{EB9F9A8C-6653-487F-B17B-9F501F2579C1}C:\program
files (x86)\skype\phone\skype.exe] => (Allow) C:\program files
(x86)\skype\phone\skype.exe
FirewallRules: [UDP Query User{56B69EA0-F89E-4E3A-86A9-17B0A681F65D}C:\program
files (x86)\skype\phone\skype.exe] => (Allow) C:\program files
(x86)\skype\phone\skype.exe
FirewallRules: [{8D865167-D700-4BE4-9F4A-CA556B393C38}] => (Allow)
E:\Temp\Steam\steamapps\common\the witcher 2\Launcher.exe
FirewallRules: [{E0ABD53F-A995-438C-9AF4-7F12976B664F}] => (Allow)
E:\Temp\Steam\steamapps\common\the witcher 2\Launcher.exe
FirewallRules: [{70336664-A8F7-4643-8DE1-888C970ADC52}] => (Allow)
E:\Temp\Test\FarCry 4\bin\FarCry4.exe
FirewallRules: [{72959202-F7E2-4BC0-9E68-D9CE43FA28F0}] => (Allow)
E:\Temp\Test\FarCry 4\bin\FarCry4.exe
FirewallRules: [{A5616C7D-29F6-4A47-BCBB-F7E60F43C9E9}] => (Allow)
E:\Temp\Test\FarCry 4\bin\IGE_WPF64.exe
FirewallRules: [{5A969598-A826-47D0-ADB8-1F16B5161795}] => (Allow)
E:\Temp\Test\FarCry 4\bin\IGE_WPF64.exe
FirewallRules: [{6B564610-4D4B-4514-8E99-BA30320C8C45}] => (Allow) C:\Program
Files (x86)\Google\Chrome\Application\chrome.exe
FirewallRules: [{8275C44B-588A-44A8-AA31-5CA246C843D7}] => (Allow) C:\Users\Duc
Hong\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe
FirewallRules: [{341B590C-72BE-41C1-8D3B-81B7B97F31C4}] => (Allow) C:\Program
Files (x86)\Windows Live\Contacts\wlcomm.exe
FirewallRules: [{9C62EFEB-4763-4789-983E-C443E1323C56}] => (Allow) LPort=2869
FirewallRules: [{A0BBA649-A813-4E72-B461-002ADF599BB2}] => (Allow) LPort=1900
FirewallRules: [{7A1895A9-2842-4905-B03D-7FE4C9AE9DF0}] => (Allow) C:\Program
Files (x86)\Windows Live\Messenger\msnmsgr.exe
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (05/30/2015 06:10:44 AM) (Source: NvStreamSvc) (EventID: 2001) (User: )
Description: NvStreamSvcFailed continue stopping. [6]
Error: (05/29/2015 05:49:16 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Activation context generation failed for
"C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_624760d1ecb7236e.manifest1".Error
in manifest or policy file
"C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_624760d1ecb7236e.manifest2"
on line
C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_624760d1ecb7236e.manifest3.
A component version required by the application conflicts with another component
version already active.
Conflicting components are:.
Component 1:
C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_624760d1ecb7236e.manifest.
Component 2:
C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_a9f497a901334c74.manifest.
Error: (05/29/2015 05:17:42 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Activation context generation failed for
"C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_624760d1ecb7236e.manifest1".Error
in manifest or policy file
"C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_624760d1ecb7236e.manifest2"
on line
C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_624760d1ecb7236e.manifest3.
A component version required by the application conflicts with another component
version already active.
Conflicting components are:.
Component 1:
C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_624760d1ecb7236e.manifest.
Component 2:
C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_a9f497a901334c74.manifest.
Error: (05/29/2015 05:17:41 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Activation context generation failed for
"C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_624760d1ecb7236e.manifest1".Error
in manifest or policy file
"C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_624760d1ecb7236e.manifest2"
on line
C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_624760d1ecb7236e.manifest3.
A component version required by the application conflicts with another component
version already active.
Conflicting components are:.
Component 1:
C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_624760d1ecb7236e.manifest.
Component 2:
C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_a9f497a901334c74.manifest.
Error: (05/29/2015 05:17:31 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Activation context generation failed for
"C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_624760d1ecb7236e.manifest1".Error
in manifest or policy file
"C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_624760d1ecb7236e.manifest2"
on line
C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_624760d1ecb7236e.manifest3.
A component version required by the application conflicts with another component
version already active.
Conflicting components are:.
Component 1:
C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_624760d1ecb7236e.manifest.
Component 2:
C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_a9f497a901334c74.manifest.
Error: (05/29/2015 05:17:31 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Activation context generation failed for
"C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_624760d1ecb7236e.manifest1".Error
in manifest or policy file
"C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_624760d1ecb7236e.manifest2"
on line
C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_624760d1ecb7236e.manifest3.
A component version required by the application conflicts with another component
version already active.
Conflicting components are:.
Component 1:
C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_624760d1ecb7236e.manifest.
Component 2:
C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_a9f497a901334c74.manifest.
Error: (05/29/2015 05:15:57 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Activation context generation failed for
"C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_624760d1ecb7236e.manifest1".Error
in manifest or policy file
"C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_624760d1ecb7236e.manifest2"
on line
C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_624760d1ecb7236e.manifest3.
A component version required by the application conflicts with another component
version already active.
Conflicting components are:.
Component 1:
C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_624760d1ecb7236e.manifest.
Component 2:
C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_a9f497a901334c74.manifest.
Error: (05/28/2015 05:58:33 PM) (Source: NvStreamSvc) (EventID: 2001) (User: )
Description: NvStreamSvcFailed continue stopping. [6]
Error: (05/28/2015 07:09:30 AM) (Source: Application Error) (EventID: 1000)
(User: )
Description: Faulting application name: UpdateChecker.exe, version: 0.0.0.0,
time stamp: 0x54dc4378
Faulting module name: alvupdt.dll, version: 1.0.0.10, time stamp: 0x5510b8fc
Exception code: 0xc0000005
Fault offset: 0x00016eb6
Faulting process id: 0x1af8
Faulting application start time: 0xUpdateChecker.exe0
Faulting application path: UpdateChecker.exe1
Faulting module path: UpdateChecker.exe2
Report Id: UpdateChecker.exe3
Faulting package full name: UpdateChecker.exe4
Faulting package-relative application ID: UpdateChecker.exe5
Error: (05/28/2015 06:54:04 AM) (Source: SideBySide) (EventID: 78) (User: )
Description: Activation context generation failed for
"C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_624760d1ecb7236e.manifest1".Error
in manifest or policy file
"C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_624760d1ecb7236e.manifest2"
on line
C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_624760d1ecb7236e.manifest3.
A component version required by the application conflicts with another component
version already active.
Conflicting components are:.
Component 1:
C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_624760d1ecb7236e.manifest.
Component 2:
C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_a9f497a901334c74.manifest.
System errors:
=============
Error: (05/30/2015 02:16:07 PM) (Source: Service Control Manager) (EventID:
7000) (User: )
Description: The VBoxAsw Support Driver service failed to start due to the
following error:
%%2
Error: (05/30/2015 03:53:18 AM) (Source: Schannel) (EventID: 4120) (User: NT
AUTHORITY)
Description: A fatal alert was generated and sent to the remote endpoint. This
may result in termination of the connection. The TLS protocol defined fatal
error code is 20. The Windows SChannel error state is 960.
Error: (05/30/2015 03:28:05 AM) (Source: Schannel) (EventID: 4120) (User: NT
AUTHORITY)
Description: A fatal alert was generated and sent to the remote endpoint. This
may result in termination of the connection. The TLS protocol defined fatal
error code is 20. The Windows SChannel error state is 960.
Error: (05/28/2015 06:00:21 PM) (Source: Service Control Manager) (EventID:
7000) (User: )
Description: The Software Protection service failed to start due to the
following error:
%%1053
Error: (05/28/2015 06:00:21 PM) (Source: Service Control Manager) (EventID:
7009) (User: )
Description: A timeout was reached (30000 milliseconds) while waiting for the
Software Protection service to connect.
Error: (05/28/2015 05:59:37 PM) (Source: Service Control Manager) (EventID:
7000) (User: )
Description: The VBoxAsw Support Driver service failed to start due to the
following error:
%%2
Error: (05/28/2015 05:35:52 PM) (Source: volsnap) (EventID: 36) (User: )
Description: The shadow copies of volume C: were aborted because the shadow copy
storage could not grow due to a user imposed limit.
Error: (05/28/2015 07:00:39 AM) (Source: Service Control Manager) (EventID:
7000) (User: )
Description: The VBoxAsw Support Driver service failed to start due to the
following error:
%%2
Error: (05/28/2015 06:51:52 AM) (Source: DCOM) (EventID: 10010) (User:
HongHoangPC)
Description: {BF6C1E47-86EC-4194-9CE5-13C15DCB2001}
Error: (05/28/2015 06:51:22 AM) (Source: DCOM) (EventID: 10010) (User:
HongHoangPC)
Description: {1B1F472E-3221-4826-97DB-2C2324D389AE}
Microsoft Office:
=========================
Error: (05/30/2015 06:10:44 AM) (Source: NvStreamSvc) (EventID: 2001) (User: )
Description: NvStreamSvcFailed continue stopping. [6]
Error: (05/29/2015 05:49:16 PM) (Source: SideBySide) (EventID: 78) (User: )
Description:
C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_624760d1ecb7236e.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_a9f497a901334c74.manifestE:\Software\Programs\esetsmartinstaller_enu.exe
Error: (05/29/2015 05:17:42 PM) (Source: SideBySide) (EventID: 78) (User: )
Description:
C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_624760d1ecb7236e.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_a9f497a901334c74.manifestC:\Users\Duc
Hong\Downloads\Programs\esetsmartinstaller_enu.exe
Error: (05/29/2015 05:17:41 PM) (Source: SideBySide) (EventID: 78) (User: )
Description:
C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_624760d1ecb7236e.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_a9f497a901334c74.manifestC:\Users\Duc
Hong\Downloads\Programs\esetsmartinstaller_enu.exe
Error: (05/29/2015 05:17:31 PM) (Source: SideBySide) (EventID: 78) (User: )
Description:
C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_624760d1ecb7236e.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_a9f497a901334c74.manifestC:\Users\Duc
Hong\Downloads\Programs\esetsmartinstaller_enu.exe
Error: (05/29/2015 05:17:31 PM) (Source: SideBySide) (EventID: 78) (User: )
Description:
C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_624760d1ecb7236e.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_a9f497a901334c74.manifestC:\Users\Duc
Hong\Downloads\Programs\esetsmartinstaller_enu.exe
Error: (05/29/2015 05:15:57 PM) (Source: SideBySide) (EventID: 78) (User: )
Description:
C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_624760d1ecb7236e.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_a9f497a901334c74.manifestC:\Users\Duc
Hong\Downloads\Programs\esetsmartinstaller_enu.exe
Error: (05/28/2015 05:58:33 PM) (Source: NvStreamSvc) (EventID: 2001) (User: )
Description: NvStreamSvcFailed continue stopping. [6]
Error: (05/28/2015 07:09:30 AM) (Source: Application Error) (EventID: 1000)
(User: )
Description:
UpdateChecker.exe0.0.0.054dc4378alvupdt.dll1.0.0.105510b8fcc000000500016eb61af801d098c110704a4cC:\Program
Files (x86)\ASUS\ASUS Live Update\UpdateChecker.exeC:\Program Files
(x86)\ASUS\ASUS Live Update\alvupdt.dlla99ff224-04b4-11e5-82d5-7824afb1d22b
Error: (05/28/2015 06:54:04 AM) (Source: SideBySide) (EventID: 78) (User: )
Description:
C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_624760d1ecb7236e.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_a9f497a901334c74.manifestE:\Software\Tools\Security
(update regularly pls)\esetsmartinstaller_enu.exe
CodeIntegrity Errors:
===================================
Date: 2015-05-17 02:43:02.789
Description: Windows is unable to verify the image integrity of the file
\Device\HarddiskVolume4\Windows\SysWOW64\drivers\DrvAgent64.SYS because file
hash could not be found on the system. A recent hardware or software change
might have installed a file that is signed incorrectly or damaged, or that might
be malicious software from an unknown source.
Date: 2015-05-17 02:43:02.723
Description: Windows is unable to verify the image integrity of the file
\Device\HarddiskVolume4\Windows\SysWOW64\drivers\DrvAgent64.SYS because file
hash could not be found on the system. A recent hardware or software change
might have installed a file that is signed incorrectly or damaged, or that might
be malicious software from an unknown source.
Date: 2015-05-17 02:43:02.658
Description: Windows is unable to verify the image integrity of the file
\Device\HarddiskVolume4\Windows\SysWOW64\drivers\DrvAgent64.SYS because file
hash could not be found on the system. A recent hardware or software change
might have installed a file that is signed incorrectly or damaged, or that might
be malicious software from an unknown source.
Date: 2015-05-17 02:43:02.595
Description: Windows is unable to verify the image integrity of the file
\Device\HarddiskVolume4\Windows\SysWOW64\drivers\DrvAgent64.SYS because file
hash could not be found on the system. A recent hardware or software change
might have installed a file that is signed incorrectly or damaged, or that might
be malicious software from an unknown source.
Date: 2015-05-17 02:43:02.527
Description: Windows is unable to verify the image integrity of the file
\Device\HarddiskVolume4\Windows\SysWOW64\drivers\DrvAgent64.SYS because file
hash could not be found on the system. A recent hardware or software change
might have installed a file that is signed incorrectly or damaged, or that might
be malicious software from an unknown source.
Date: 2015-05-17 02:43:02.462
Description: Windows is unable to verify the image integrity of the file
\Device\HarddiskVolume4\Windows\SysWOW64\drivers\DrvAgent64.SYS because file
hash could not be found on the system. A recent hardware or software change
might have installed a file that is signed incorrectly or damaged, or that might
be malicious software from an unknown source.
Date: 2015-05-17 02:43:02.397
Description: Windows is unable to verify the image integrity of the file
\Device\HarddiskVolume4\Windows\SysWOW64\drivers\DrvAgent64.SYS because file
hash could not be found on the system. A recent hardware or software change
might have installed a file that is signed incorrectly or damaged, or that might
be malicious software from an unknown source.
Date: 2015-05-17 02:43:02.333
Description: Windows is unable to verify the image integrity of the file
\Device\HarddiskVolume4\Windows\SysWOW64\drivers\DrvAgent64.SYS because file
hash could not be found on the system. A recent hardware or software change
might have installed a file that is signed incorrectly or damaged, or that might
be malicious software from an unknown source.
Date: 2015-05-17 02:42:58.259
Description: Windows is unable to verify the image integrity of the file
\Device\HarddiskVolume4\Windows\SysWOW64\drivers\DrvAgent64.SYS because file
hash could not be found on the system. A recent hardware or software change
might have installed a file that is signed incorrectly or damaged, or that might
be malicious software from an unknown source.
Date: 2015-05-17 02:42:58.195
Description: Windows is unable to verify the image integrity of the file
\Device\HarddiskVolume4\Windows\SysWOW64\drivers\DrvAgent64.SYS because file
hash could not be found on the system. A recent hardware or software change
might have installed a file that is signed incorrectly or damaged, or that might
be malicious software from an unknown source.
==================== Memory info ===========================
Processor: Intel® Core™ i7-4710HQ CPU @ 2.50GHz
Percentage of memory in use: 33%
Total physical RAM: 8075.06 MB
Available physical RAM: 5405.47 MB
Total Pagefile: 16267.06 MB
Available Pagefile: 13560.92 MB
Total Virtual: 131072 MB
Available Virtual: 131071.83 MB
==================== Drives ================================
Drive c: (OS) (Fixed) (Total:72.6 GB) (Free:25.4 GB) NTFS ==>[System with boot
components (obtained from reading drive)]
Drive d: (DucHong) (Fixed) (Total:418.9 GB) (Free:290.49 GB) NTFS
Drive e: (Miscellaneous) (Fixed) (Total:300 GB) (Free:80.13 GB) NTFS
Drive f: (Misc.2) (Fixed) (Total:118.9 GB) (Free:95.63 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (Size: 931.5 GB) (Disk ID: EE7E28CB)
Partition: GPT Partition Type.
==================== End of log ============================
* Back to top
--------------------------------------------------------------------------------
#10 XXTOFFEEXX
xXToffeeXx
Bleepin' Polar Bear
*
* Malware Response Instructor
* 6,088 posts
* OFFLINE
* Gender:Female
* Location:The Arctic Circle
* Local time:03:44 AM
Posted 30 May 2015 - 01:28 PM
Hi User1412,
Quote
> I used to do some exploits with software and read them from online materials
> so there's lots of cracks and keygens there ;b
Ah yes, that would make sense.
How is your computer running?
xXToffeeXx~
~If I am helping you and you have not had a reply from me in two days, please
send me a PM~
ID Ransomware - Identify What Ransomware Encrypted Your Files [Support Topic] -
If we have helped you out and you want to support what we do, you can do so here
~Twitter~ | ~Malware Analyst at Emsisoft~
* Back to top
--------------------------------------------------------------------------------
#11 USER1412
User1412
* Topic Starter
*
* Members
* 23 posts
* OFFLINE
* Local time:01:44 PM
Posted 31 May 2015 - 02:04 AM
My computer is running good now. Thanks for your help, Toffee.
* Back to top
--------------------------------------------------------------------------------
#12 XXTOFFEEXX
xXToffeeXx
Bleepin' Polar Bear
*
* Malware Response Instructor
* 6,088 posts
* OFFLINE
* Gender:Female
* Location:The Arctic Circle
* Local time:03:44 AM
Posted 31 May 2015 - 12:43 PM
Hi User1412,
You are welcome
Your machine is clean! Feel free to enjoy the use of your cleaned computer.
Please take the time to follow this last post which tells you how to remove the
tools we have used and how to keep your computer clean
---------------
Download Delfix by Xplode to your desktop. Delfix will delete all the used tools
and logfiles.
Double-click Delfix.exe to start the tool.
Make sure the following items are checked:
* Activate UAC
* Remove disinfection tools
* Create registry backup
* Purge System Restore
* Reset system settings
Now click "Run" and wait patiently.
Once finished a logfile will be created. You don't need to copy and paste it
into your next reply.
--------------
Also, feel free to delete any leftover desktop icons and other various files
which have been created throughout the process.
---------------
I have also compiled a list of links which you may be interested in:
* Simple and easy ways to keep your computer safe and secure on the Internet -
Tutorial by Lawrence Abrams, the founder of BleepingComputer.com.
* Miekies' prevention suggestions
* So, how did I get infected?
* Calendar of Updates - See which updates have been released recently.
* How to backup your Data with Cobian Backup - It's always a good idea to have
a backup of all your files as you never know when your hard drive could fail!
* Commonly Used Freeware Replacements - Says what it does on the tin, useful if
you are looking for free programs.
* osalt - Find free, open source alternatives to known commercial software.
Similar to the link above.
This topic will be left open for 3 days in case you have any problems, otherwise
it will closed after that time.
xXToffeeXx~
~If I am helping you and you have not had a reply from me in two days, please
send me a PM~
ID Ransomware - Identify What Ransomware Encrypted Your Files [Support Topic] -
If we have helped you out and you want to support what we do, you can do so here
~Twitter~ | ~Malware Analyst at Emsisoft~
* Back to top
--------------------------------------------------------------------------------
#13 XXTOFFEEXX
xXToffeeXx
Bleepin' Polar Bear
*
* Malware Response Instructor
* 6,088 posts
* OFFLINE
* Gender:Female
* Location:The Arctic Circle
* Local time:03:44 AM
Posted 07 June 2015 - 08:07 AM
It appears that this issue is resolved, therefore I am closing the topic. If
that is not the case and you need or wish to continue with this topic, please
send me or any Moderator a Personal Message (PM) that you would like this topic
re-opened.
~If I am helping you and you have not had a reply from me in two days, please
send me a PM~
ID Ransomware - Identify What Ransomware Encrypted Your Files [Support Topic] -
If we have helped you out and you want to support what we do, you can do so here
~Twitter~ | ~Malware Analyst at Emsisoft~
* Back to top
--------------------------------------------------------------------------------
--------------------------------------------------------------------------------
Back to Virus, Trojan, Spyware, and Malware Removal Help
*
*
*
*
*
*
*
*
*
*
3 USER(S) ARE READING THIS TOPIC
0 members, 3 guests, 0 anonymous users
Reply to quoted posts Clear
1. BleepingComputer.com
2. → Security
3. → Virus, Trojan, Spyware, and Malware Removal Help
4. Privacy Policy
5. Rules ·
*
* Help
Advertise | About Us | Terms of Use | Privacy Policy | Sitemap
| Chat | RSS Feeds | Contact Us Tech Support Forums | Virus
Removal Guides | Downloads | Tutorials | The Computer Glossary |
Uninstall List | Startups | The File Database
© 2004-2021 All Rights Reserved Bleeping Computer LLC .
Site Changelog
Community Forum Software by IP.Board
SIGN IN
* Use Twitter
* Need an account? Register now!
* Username
* Forum Password
I've forgotten my password
* Remember me
This is not recommended for shared computers
* Sign in anonymously
Don't add me to the active users list
* Privacy Policy