API tools faq
paste
Guest User

Untitled

a guest
Mar 5th, 2015
410
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 28.39 KB | None | 0 0
raw download clone embed print report
  1. Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 04-03-2015 01
  2. Ran by Darken (administrator) on DARKEN-PC on 04-03-2015 20:33:33
  3. Running from C:\Users\Darken\Desktop
  4. Loaded Profiles: Darken (Available profiles: Darken)
  5. Platform: Windows 7 Enterprise Service Pack 1 (X64) OS Language: English (United States)
  6. Internet Explorer Version 9 (Default browser: Chrome)
  7. Boot Mode: Normal
  8. Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
  9.  
  10. ==================== Processes (Whitelisted) =================
  11.  
  12. (If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
  13.  
  14. (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
  15. (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
  16. (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
  17. (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
  18. (ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\AAHM\1.00.20\aaHMSvc.exe
  19. (ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.13\AsSysCtrlService.exe
  20. (ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\AsusFanControlService\1.02.00\AsusFanControlService.exe
  21. (Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe
  22. (Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe
  23. (DTS, Inc) C:\Program Files\Realtek\Audio\HDA\DTSU2PAuSrv64.exe
  24. (ESET) C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe
  25. (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
  26. (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
  27. (TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
  28. (VMware, Inc.) C:\Windows\SysWOW64\vmnat.exe
  29. (VMware, Inc.) C:\Windows\SysWOW64\vmnetdhcp.exe
  30. (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
  31. (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
  32. (ESET) C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
  33. () C:\keyremappers\KeyRemapper CWW\KeyRemapper.exe
  34. (Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
  35. (Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
  36. (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
  37. (VMware, Inc.) C:\Program Files (x86)\VMware\VMware Workstation\vmware-tray.exe
  38. (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
  39. (Microsoft Corporation) C:\Windows\splwow64.exe
  40. (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
  41. (Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
  42. (TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\TeamViewer.exe
  43. (TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\tv_w32.exe
  44. (TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\tv_x64.exe
  45. (Microsoft Corporation) C:\Windows\System32\taskmgr.exe
  46. () C:\Program Files (x86)\ASUS\AXSP\1.00.19\atkexComSvc.exe
  47. (VMware, Inc.) C:\Program Files (x86)\VMware\VMware Workstation\vmware.exe
  48. (Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe
  49. (VMware, Inc.) C:\Program Files (x86)\VMware\VMware Workstation\vmware-unity-helper.exe
  50. (VMware, Inc.) C:\Program Files (x86)\VMware\VMware Workstation\x64\vmware-vmx.exe
  51. (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
  52. (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
  53. (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
  54. (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
  55. (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
  56. (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
  57. (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
  58. (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
  59. (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
  60. (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
  61. (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
  62. (Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
  63. (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
  64. (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
  65. (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
  66. (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
  67. (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
  68. (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
  69. (NoahSystem) C:\NTTGame\KnightOnlineEn\KnightOnLine.exe
  70. (Wellbia.com) C:\NTTGame\KnightOnlineEn\XIGNCODE\xxd-0.xem
  71. (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
  72. (Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
  73. (Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
  74. (Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
  75. (Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWelcome.exe
  76. (Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDScan.exe
  77. (Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe
  78. (Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
  79.  
  80.  
  81. ==================== Registry (Whitelisted) ==================
  82.  
  83. (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
  84.  
  85. HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [7202520 2013-08-19] (Realtek Semiconductor)
  86. HKLM\...\Run: [RtHDVBg_DTS] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1321688 2013-08-07] (Realtek Semiconductor)
  87. HKLM\...\Run: [egui] => C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe [5618456 2013-09-12] (ESET)
  88. HKLM-x32\...\Run: [BCSSync] => C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [91520 2010-03-13] (Microsoft Corporation)
  89. HKLM-x32\...\Run: [vmware-tray.exe] => C:\Program Files (x86)\VMware\VMware Workstation\vmware-tray.exe [112856 2014-04-14] (VMware, Inc.)
  90. HKLM-x32\...\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [4101576 2014-06-24] (Safer-Networking Ltd.)
  91. Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
  92. HKU\S-1-5-21-2099156489-267093865-4274563014-1000\...\Run: [KeyMapperStarup] => C:\keyremappers\KeyRemapper CWW\KeyRemapper.exe [155864 2008-04-11] ()
  93. HKU\S-1-5-21-2099156489-267093865-4274563014-1000\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [31087200 2015-01-23] (Skype Technologies S.A.)
  94. HKU\S-1-5-21-2099156489-267093865-4274563014-1000\...\MountPoints2: {56c2ea47-ad6a-11e3-8c89-806e6f6e6963} - D:\.\Bin\ASSETUP.exe
  95. HKU\S-1-5-21-2099156489-267093865-4274563014-1000\...\MountPoints2: {e9d59455-ef19-11e3-9ebe-005056c00008} - F:\startup.exe
  96. Startup: C:\Users\Darken\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\t4sks - Shortcut.lnk
  97. ShortcutTarget: t4sks - Shortcut.lnk -> C:\Users\Darken\Desktop\t4sks.rtf ()
  98. BootExecute: autocheck autochk * sdnclean64.exe
  99.  
  100. ==================== Internet (Whitelisted) ====================
  101.  
  102. (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
  103.  
  104. HKU\S-1-5-21-2099156489-267093865-4274563014-1000\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
  105. HKU\S-1-5-21-2099156489-267093865-4274563014-1000\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.sk/
  106. SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
  107. SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
  108. SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
  109. BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
  110. BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)
  111. BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
  112. BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
  113. BHO-x32: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
  114. BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
  115. DPF: HKLM {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab
  116. Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
  117. Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)
  118. Handler-x32: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
  119. Tcpip\Parameters: [DhcpNameServer] 207.182.148.138 8.8.8.8
  120.  
  121. FireFox:
  122. ========
  123. FF ProfilePath: C:\Users\Darken\AppData\Roaming\Mozilla\Firefox\Profiles\jbdhequ4.default
  124. FF Plugin: @microsoft.com/GENUINE -> disabled No File
  125. FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
  126. FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
  127. FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
  128. FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
  129. FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
  130. FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
  131. FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll (Google Inc.)
  132. FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll (Google Inc.)
  133. FF Plugin-x32: @videolan.org/vlc,version=2.1.3 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
  134. FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
  135. FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi [2014-07-14]
  136. FF HKLM\...\Thunderbird\Extensions: [[email protected]] - C:\Program Files\ESET\ESET NOD32 Antivirus\Mozilla Thunderbird
  137. FF Extension: ESET Smart Security Extension - C:\Program Files\ESET\ESET NOD32 Antivirus\Mozilla Thunderbird [2014-03-17]
  138. FF HKLM-x32\...\Thunderbird\Extensions: [[email protected]] - C:\Program Files\ESET\ESET NOD32 Antivirus\Mozilla Thunderbird
  139.  
  140. Chrome:
  141. =======
  142. CHR StartupUrls: Default -> "hxxp://www.google.com/"
  143. CHR Profile: C:\Users\Darken\AppData\Local\Google\Chrome\User Data\Default
  144. CHR Extension: (Google Docs) - C:\Users\Darken\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-03-16]
  145. CHR Extension: (Google Drive) - C:\Users\Darken\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-03-16]
  146. CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Darken\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-05-25]
  147. CHR Extension: (YouTube) - C:\Users\Darken\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-03-16]
  148. CHR Extension: (Adblock Plus) - C:\Users\Darken\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2014-04-06]
  149. CHR Extension: (Google Search) - C:\Users\Darken\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-03-16]
  150. CHR Extension: (Google Wallet) - C:\Users\Darken\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-03-16]
  151. CHR Extension: (Gmail) - C:\Users\Darken\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-03-16]
  152. CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\ChromeExtension\skype_chrome_extension.crx [2014-07-14]
  153.  
  154. ==================== Services (Whitelisted) =================
  155.  
  156. (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
  157.  
  158. R2 asComSvc; C:\Program Files (x86)\ASUS\AXSP\1.00.19\atkexComSvc.exe [920736 2013-09-17] ()
  159. S4 ASGT; C:\Windows\SysWOW64\ASGT.exe [55296 2012-01-17] () [File not signed]
  160. R2 asHmComSvc; C:\Program Files (x86)\ASUS\AAHM\1.00.20\aaHMSvc.exe [951936 2013-09-17] (ASUSTeK Computer Inc.)
  161. R2 AsSysCtrlService; C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.13\AsSysCtrlService.exe [149120 2012-02-17] (ASUSTeK Computer Inc.)
  162. R2 AsusFanControlService; C:\Program Files (x86)\ASUS\AsusFanControlService\1.02.00\AsusFanControlService.exe [1632256 2012-11-09] (ASUSTeK Computer Inc.) [File not signed]
  163. R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1390176 2014-07-14] (Microsoft Corporation)
  164. R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1767520 2014-07-14] (Microsoft Corporation)
  165. R2 DTSAudioSvc; C:\Program Files\Realtek\Audio\HDA\DTSU2PAuSrv64.exe [240584 2012-10-02] (DTS, Inc)
  166. R2 ekrn; C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe [1337752 2013-09-12] (ESET)
  167. S2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1871160 2014-11-21] (Malwarebytes Corporation)
  168. S2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [969016 2014-11-21] (Malwarebytes Corporation)
  169. R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1593632 2014-01-21] (NVIDIA Corporation)
  170. R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [16939296 2014-01-21] (NVIDIA Corporation)
  171. R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1738168 2014-06-24] (Safer-Networking Ltd.)
  172. R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [2088408 2014-06-27] (Safer-Networking Ltd.)
  173. R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2014-04-25] (Safer-Networking Ltd.)
  174. S2 ST2012_Svc; C:\Program Files (x86)\Spyware Terminator\st_rsser64.exe [3037520 2015-01-22] (Crawler Group)
  175. R2 TeamViewer; C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe [5436176 2015-02-17] (TeamViewer GmbH)
  176. S3 VMwareHostd; C:\Program Files (x86)\VMware\VMware Workstation\vmware-hostd.exe [14407384 2014-04-14] ()
  177. R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
  178.  
  179. ==================== Drivers (Whitelisted) ====================
  180.  
  181. (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
  182.  
  183. R0 asahci64; C:\Windows\System32\DRIVERS\asahci64.sys [49760 2012-01-06] (Asmedia Technology)
  184. R1 AsIO; C:\Windows\SysWow64\drivers\AsIO.sys [15232 2012-08-22] ()
  185. R1 AsUpIO; C:\Windows\SysWow64\drivers\AsUpIO.sys [14464 2013-01-15] ()
  186. S3 ASUSFILTER; C:\Windows\SysWow64\drivers\ASUSFILTER.sys [46152 2011-09-20] (MCCI Corporation)
  187. R1 eamonm; C:\Windows\System32\DRIVERS\eamonm.sys [239320 2013-09-17] (ESET)
  188. U5 edevmon; C:\Windows\System32\Drivers\edevmon.sys [239296 2013-09-17] (ESET)
  189. R1 ehdrv; C:\Windows\System32\DRIVERS\ehdrv.sys [168256 2013-09-17] (ESET)
  190. R2 epfwwfpr; C:\Windows\System32\DRIVERS\epfwwfpr.sys [157432 2013-09-17] (ESET)
  191. S3 IOMap; C:\Windows\system32\drivers\IOMap64.sys [24824 2013-07-02] (ASUSTeK Computer Inc.)
  192. R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-11-21] (Malwarebytes Corporation)
  193. R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [129752 2015-03-04] (Malwarebytes Corporation)
  194. R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2014-11-21] (Malwarebytes Corporation)
  195. S3 NVFLASH; C:\Windows\system32\drivers\nvflash.sys [15648 2013-04-19] ()
  196. R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [39200 2013-12-27] (NVIDIA Corporation)
  197. R0 sptd; C:\Windows\System32\Drivers\sptd.sys [871408 2014-06-08] () [File not signed]
  198. R2 sp_rsdrv2; C:\Windows\System32\DRIVERS\stflt.sys [51496 2014-04-11] (Windows (R) Win 7 DDK provider)
  199. R0 vsock; C:\Windows\System32\drivers\vsock.sys [73296 2013-10-08] (VMware, Inc.)
  200. R2 vstor2-mntapi20-shared; C:\Windows\SysWow64\drivers\vstor2-mntapi20-shared.sys [33872 2013-02-22] (VMware, Inc.)
  201. U3 act18849; C:\Windows\System32\Drivers\act18849.sys [0 ] (Microsoft Corporation) <==== ATTENTION (zero size file/folder)
  202. S3 VGPU; System32\drivers\rdvgkmd.sys [X]
  203. R3 xhunter1; \??\C:\Windows\xhunter1.sys [X]
  204.  
  205. ==================== NetSvcs (Whitelisted) ===================
  206.  
  207. (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
  208.  
  209.  
  210. ==================== One Month Created Files and Folders ========
  211.  
  212. (If an entry is included in the fixlist, the file\folder will be moved.)
  213.  
  214. 2015-03-04 20:33 - 2015-03-04 20:33 - 00018231 _____ () C:\Users\Darken\Desktop\FRST.txt
  215. 2015-03-04 20:32 - 2015-03-04 20:33 - 00000000 ____D () C:\FRST
  216. 2015-03-04 20:31 - 2015-03-04 20:32 - 02092544 _____ (Farbar) C:\Users\Darken\Desktop\FRST64.exe
  217. 2015-03-04 20:27 - 2015-03-04 20:27 - 00000000 ____D () C:\Windows\System32\Tasks\Safer-Networking
  218. 2015-03-04 20:26 - 2015-03-04 20:30 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2
  219. 2015-03-04 20:26 - 2015-03-04 20:27 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
  220. 2015-03-04 20:26 - 2015-03-04 20:26 - 00001391 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot-S&D Start Center.lnk
  221. 2015-03-04 20:26 - 2015-03-04 20:26 - 00001379 _____ () C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
  222. 2015-03-04 20:26 - 2015-03-04 20:26 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy 2
  223. 2015-03-04 20:26 - 2013-09-20 10:49 - 00021040 _____ (Safer Networking Limited) C:\Windows\system32\sdnclean64.exe
  224. 2015-03-04 19:50 - 2015-03-04 20:25 - 46525608 _____ (Safer-Networking Ltd. ) C:\Users\Darken\Downloads\spybot-2.4.exe
  225. 2015-03-04 00:14 - 2015-03-04 00:14 - 01055936 _____ (Adobe) C:\Users\Darken\Downloads\install_flashplayer16x32_mssd_aaa_aih (1).exe
  226. 2015-03-04 00:00 - 2015-03-04 00:00 - 00000000 _____ () C:\Users\Darken\Desktop\New Text Document.txt
  227. 2015-03-03 22:39 - 2015-03-03 22:40 - 01055936 _____ (Adobe) C:\Users\Darken\Downloads\install_flashplayer16x32_mssd_aaa_aih.exe
  228. 2015-03-03 10:19 - 2015-03-03 10:19 - 00000944 _____ () C:\Users\Darken\Desktop\JRT.txt
  229. 2015-03-03 09:58 - 2015-03-03 09:58 - 01388333 _____ (Thisisu) C:\Users\Darken\Downloads\JRT.exe
  230. 2015-03-03 09:22 - 2015-03-03 10:34 - 00000000 ____D () C:\AdwCleaner
  231. 2015-03-03 09:21 - 2015-03-03 09:21 - 02126848 _____ () C:\Users\Darken\Downloads\adwcleaner_4.111.exe
  232. 2015-03-02 21:14 - 2015-03-02 21:14 - 00509440 _____ (Tech Support Guy System) C:\Users\Darken\Downloads\SysInfo.exe
  233. 2015-02-27 01:32 - 2015-02-27 01:32 - 00000000 _____ () C:\Users\Darken\Desktop\DIMMMMMMMMMMMMEEEEEEEEEEEEEEEEERRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR.txt
  234. 2015-02-26 17:35 - 2015-02-26 18:52 - 01952850 _____ () C:\Users\Darken\Desktop\New Bitmap Image (2).bmp
  235. 2015-02-25 19:06 - 2015-02-25 19:06 - 00000000 ____D () C:\Users\Darken\Tracing
  236. 2015-02-23 22:19 - 2015-02-23 22:19 - 00146843 _____ () C:\Users\Darken\Downloads\watch (7).htm
  237. 2015-02-23 22:00 - 2015-02-23 22:00 - 00130930 _____ () C:\Users\Darken\Downloads\download (1).htm
  238. 2015-02-23 21:59 - 2015-02-23 21:59 - 00188068 _____ () C:\Users\Darken\Downloads\watch (6).htm
  239. 2015-02-23 21:59 - 2015-02-23 21:59 - 00085767 _____ () C:\Users\Darken\Downloads\download.htm
  240. 2015-02-23 21:10 - 2015-02-23 21:10 - 00173912 _____ () C:\Users\Darken\Downloads\watch (4).htm
  241. 2015-02-23 21:10 - 2015-02-23 21:10 - 00173653 _____ () C:\Users\Darken\Downloads\watch (5).htm
  242. 2015-02-23 21:09 - 2015-02-23 21:09 - 00177551 _____ () C:\Users\Darken\Downloads\watch (2).htm
  243. 2015-02-23 21:09 - 2015-02-23 21:09 - 00173585 _____ () C:\Users\Darken\Downloads\watch (3).htm
  244. 2015-02-23 21:09 - 2015-02-23 21:09 - 00173266 _____ () C:\Users\Darken\Downloads\watch (1).htm
  245. 2015-02-23 21:09 - 2015-02-23 21:09 - 00173130 _____ () C:\Users\Darken\Downloads\watch.htm
  246. 2015-02-22 18:12 - 2015-02-22 18:12 - 00265129 _____ () C:\Users\Darken\Downloads\Martin Ardouin - Profile Pictures.html
  247. 2015-02-22 18:12 - 2015-02-22 18:12 - 00000000 ____D () C:\Users\Darken\Downloads\Martin Ardouin - Profile Pictures_files
  248. 2015-02-21 12:28 - 2015-02-21 12:28 - 00000000 ____D () C:\Program Files (x86)\ESET
  249. 2015-02-21 11:20 - 2015-02-21 11:20 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
  250. 2015-02-21 11:20 - 2015-02-21 11:20 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
  251. 2015-02-21 11:20 - 2014-11-21 06:14 - 00093400 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
  252. 2015-02-21 11:20 - 2014-11-21 06:14 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
  253. 2015-02-21 11:20 - 2014-11-21 06:14 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
  254. 2015-02-21 11:18 - 2015-02-21 11:19 - 20447072 _____ (Malwarebytes Corporation ) C:\Users\Darken\Downloads\mbam-setup-2.0.4.1028.exe
  255. 2015-02-16 09:56 - 2015-02-16 09:56 - 10602865 _____ () C:\Users\Darken\Documents\Konan's Theme.mp4
  256. 2015-02-13 09:23 - 2015-02-13 09:23 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CPUID
  257. 2015-02-13 08:59 - 2015-02-13 09:00 - 01190544 _____ ( ) C:\Users\Darken\Downloads\hwmonitor_1.26.exe
  258. 2015-02-10 16:04 - 2015-02-10 16:04 - 00000000 ____D () C:\Users\Darken\Downloads\Attachments_2015210
  259. 2015-02-10 16:03 - 2015-02-10 16:03 - 01349967 _____ () C:\Users\Darken\Downloads\Attachments_2015210.zip
  260. 2015-02-10 08:00 - 2015-02-10 15:36 - 00000000 ____D () C:\Program Files (x86)\Mozilla Thunderbird
  261. 2015-02-09 07:38 - 2015-02-09 07:38 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
  262. 2015-02-05 10:33 - 2015-02-05 10:33 - 03861080 _____ (REKCAHZ & Mirae Technology) C:\Users\Darken\Downloads\AnyOTPSetup (1).exe
  263. 2015-02-02 00:45 - 2015-02-02 00:45 - 99309206 _____ () C:\Users\Darken\Documents\Sakrateal - Necromantic Drums (Dark meditation_Ritual ambient_Dark ambient_Music trance).mp4
  264.  
  265. ==================== One Month Modified Files and Folders =======
  266.  
  267. (If an entry is included in the fixlist, the file\folder will be moved.)
  268.  
  269. 2015-03-04 20:33 - 2014-03-17 19:16 - 00000000 ____D () C:\Users\Darken\AppData\Roaming\Skype
  270. 2015-03-04 20:01 - 2014-03-30 18:21 - 00000936 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA1cf4c3c6fa13d89.job
  271. 2015-03-04 19:23 - 2014-03-17 01:32 - 01370489 _____ () C:\Windows\WindowsUpdate.log
  272. 2015-03-04 17:07 - 2014-03-16 20:15 - 00000932 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
  273. 2015-03-04 00:55 - 2009-07-14 06:13 - 00786702 _____ () C:\Windows\system32\PerfStringBackup.INI
  274. 2015-03-04 00:54 - 2014-06-09 18:22 - 00000000 ____D () C:\Users\Darken\AppData\Local\VMware
  275. 2015-03-04 00:54 - 2014-03-30 10:02 - 00000000 ____D () C:\Users\Darken\AppData\Roaming\VMware
  276. 2015-03-04 00:49 - 2014-04-18 15:35 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
  277. 2015-03-04 00:49 - 2014-03-30 09:58 - 00000000 ____D () C:\ProgramData\VMware
  278. 2015-03-04 00:49 - 2014-03-16 19:56 - 00000000 ____D () C:\ProgramData\NVIDIA
  279. 2015-03-04 00:49 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
  280. 2015-03-04 00:49 - 2009-07-14 05:51 - 00048742 _____ () C:\Windows\setupact.log
  281. 2015-03-04 00:11 - 2014-07-01 18:59 - 00000000 ____D () C:\Program Files (x86)\TeamViewer
  282. 2015-03-03 10:06 - 2009-07-14 05:45 - 00021744 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
  283. 2015-03-03 10:06 - 2009-07-14 05:45 - 00021744 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
  284. 2015-03-02 21:40 - 2014-06-21 19:18 - 00000000 ____D () C:\ProgramData\Orbit
  285. 2015-02-28 21:42 - 2014-05-06 00:22 - 00000000 ____D () C:\Users\Darken\AppData\Roaming\vlc
  286. 2015-02-27 16:20 - 2014-04-11 16:32 - 00000000 ____D () C:\ProgramData\Spyware Terminator
  287. 2015-02-25 19:06 - 2014-03-17 01:33 - 00000000 ____D () C:\Users\Darken
  288. 2015-02-25 19:05 - 2014-10-03 10:11 - 00000000 ___RD () C:\Program Files (x86)\Skype
  289. 2015-02-25 19:05 - 2014-03-17 19:16 - 00000000 ____D () C:\ProgramData\Skype
  290. 2015-02-24 08:14 - 2010-11-21 04:47 - 00035990 _____ () C:\Windows\PFRO.log
  291. 2015-02-19 11:00 - 2013-02-17 22:58 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
  292. 2015-02-18 23:53 - 2015-01-28 15:25 - 00000971 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamViewer 10.lnk
  293. 2015-02-13 09:03 - 2014-03-17 02:33 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
  294. 2015-02-10 17:04 - 2015-01-31 16:18 - 05760054 _____ () C:\Users\Darken\Desktop\New Bitmap Image.bmp
  295. 2015-02-09 13:57 - 2014-07-05 09:36 - 00000000 _____ () C:\Windows\Path.idx
  296. 2015-02-09 13:27 - 2014-07-16 03:18 - 00001640 _____ () C:\Windows\MB.idx
  297. 2015-02-08 13:03 - 2014-07-05 09:31 - 01048576 _____ () C:\Windows\PE_Rom.dll
  298. 2015-02-06 16:48 - 2014-03-30 18:21 - 00003932 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA1cf4c3c6fa13d89
  299. 2015-02-06 16:48 - 2014-03-16 20:15 - 00003680 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
  300. 2015-02-05 10:34 - 2014-08-04 14:39 - 03807744 _____ () C:\Users\Darken\AppData\Roaming\AnyOTPSetup.msi
  301.  
  302. ==================== Files in the root of some directories =======
  303.  
  304. 2014-08-04 14:39 - 2015-02-05 10:34 - 3807744 _____ () C:\Users\Darken\AppData\Roaming\AnyOTPSetup.msi
  305. 2014-04-09 13:02 - 2014-04-11 06:38 - 0000000 _____ () C:\Users\Darken\AppData\Roaming\bitlord_log.txt
  306. 2014-04-11 06:57 - 2014-04-11 06:57 - 0000218 _____ () C:\Users\Darken\AppData\Local\recently-used.xbel
  307. 2014-07-10 20:19 - 2014-07-10 20:19 - 0000017 _____ () C:\Users\Darken\AppData\Local\resmon.resmoncfg
  308. 2014-03-17 02:34 - 2014-03-17 02:34 - 0000000 ____H () C:\ProgramData\DP45977C.lfl
  309.  
  310. Some content of TEMP:
  311. ====================
  312. C:\Users\Darken\AppData\Local\Temp\156e3900a39f55658659e7bab90868b2.dll
  313. C:\Users\Darken\AppData\Local\Temp\e6c49d58476ad0b53c1b7368ea006ca3.dll
  314. C:\Users\Darken\AppData\Local\Temp\Quarantine.exe
  315. C:\Users\Darken\AppData\Local\Temp\sqlite3.dll
  316.  
  317.  
  318. ==================== Bamital & volsnap Check =================
  319.  
  320. (There is no automatic fix for files that do not pass verification.)
  321.  
  322. C:\Windows\System32\winlogon.exe => File is digitally signed
  323. C:\Windows\System32\wininit.exe => File is digitally signed
  324. C:\Windows\SysWOW64\wininit.exe => File is digitally signed
  325. C:\Windows\explorer.exe => File is digitally signed
  326. C:\Windows\SysWOW64\explorer.exe => File is digitally signed
  327. C:\Windows\System32\svchost.exe => File is digitally signed
  328. C:\Windows\SysWOW64\svchost.exe => File is digitally signed
  329. C:\Windows\System32\services.exe => File is digitally signed
  330. C:\Windows\System32\User32.dll => MD5 is legit
  331. C:\Windows\SysWOW64\User32.dll => MD5 is legit
  332. C:\Windows\System32\userinit.exe => File is digitally signed
  333. C:\Windows\SysWOW64\userinit.exe => File is digitally signed
  334. C:\Windows\System32\rpcss.dll => File is digitally signed
  335. C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
  336.  
  337.  
  338. LastRegBack: 2015-02-23 06:14
  339.  
  340. ==================== End Of Log ============================
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!