API tools faq
paste
Guest User

Fixlog

a guest
Dec 19th, 2017
147
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 59.70 KB | None | 0 0
raw download clone embed print report
  1. Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 17-12-2017
  2. Ran by Hakeem (administrator) on HAKEEM-PC (19-12-2017 02:48:10)
  3. Running from C:\Users\Hakeem\Desktop
  4. Loaded Profiles: Hakeem (Available Profiles: Hakeem)
  5. Platform: Microsoft Windows 7 Ultimate Service Pack 1 (X86) Language: English (United States)
  6. Internet Explorer Version 11 (Default browser: IE)
  7. Boot Mode: Normal
  8. Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
  9.  
  10. ==================== Processes (Whitelisted) =================
  11.  
  12. (If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
  13.  
  14. (Microsoft Corporation) C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
  15. (Google Inc.) C:\Program Files\Google\Update\1.3.33.7\GoogleCrashHandler.exe
  16. (TeamViewer GmbH) C:\Program Files\TeamViewer\TeamViewer_Service.exe
  17. (Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
  18. (Microsoft Corporation) C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
  19. (Intel Corporation) C:\Windows\System32\igfxtray.exe
  20. (Intel Corporation) C:\Windows\System32\hkcmd.exe
  21. (Intel Corporation) C:\Windows\System32\igfxpers.exe
  22. (Intel Corporation) C:\Windows\System32\igfxsrvc.exe
  23. (Hewlett-Packard) C:\Program Files\HP\HP Software Update\hpwuschd2.exe
  24. (Microsoft @ 2015) C:\Users\Hakeem\AppData\Roaming\euro_stub.exe
  25. (Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe
  26. (Microsoft Corporation) C:\Windows\System32\wuauclt.exe
  27. (Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
  28. (Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
  29. (Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
  30. (Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
  31. (Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
  32. (Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
  33. (Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
  34. (Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
  35. (Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
  36. (Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
  37. (Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
  38. (Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
  39. () C:\Program Files\Mullvad\mullvad.exe
  40. (Farbar) C:\Users\Hakeem\Desktop\FRST(1).exe
  41.  
  42. ==================== Registry (Whitelisted) ===========================
  43.  
  44. (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
  45.  
  46. HKLM\...\Run: [GrooveMonitor] => C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [31016 2006-10-26] (Microsoft Corporation)
  47. HKLM\...\Run: [HP Software Update] => C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe [49208 2010-06-09] (Hewlett-Packard)
  48. HKLM\...\Run: [Microsoft Default Manager] => C:\Program Files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe [439568 2010-05-10] (Microsoft Corporation)
  49. HKU\S-1-5-21-570141002-2484250258-4068607221-1000\...\Run: [Web Companion] => C:\Program Files\Lavasoft\Web Companion\Application\WebCompanion.exe --minimize
  50. HKU\S-1-5-21-570141002-2484250258-4068607221-1000\...\Run: [BlackBerryLink.exe] => "C:\Program Files\Research In Motion\BlackBerry Link\BlackBerryLink.exe" /minimize
  51. HKU\S-1-5-21-570141002-2484250258-4068607221-1000\...\Run: [Windows 10 Update] => C:\Users\Hakeem\AppData\Roaming\euro_stub.exe [79872 2017-12-18] (Microsoft @ 2015)
  52. HKU\S-1-5-18\...\RunOnce: [SPReview] => C:\Windows\System32\SPReview\SPReview.exe [280576 2017-05-21] (Microsoft Corporation)
  53. Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk [2017-05-03]
  54. ShortcutTarget: Adobe Gamma Loader.lnk -> C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)
  55.  
  56. ==================== Internet (Whitelisted) ====================
  57.  
  58. (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
  59.  
  60. Tcpip\Parameters: [DhcpNameServer] 192.168.176.251 192.168.176.252 192.168.176.253 192.168.176.254
  61. Tcpip\..\Interfaces\{2243CB7C-9F03-4464-81FA-C43989EDA5FB}: [NameServer] 193.138.219.228
  62. Tcpip\..\Interfaces\{2243CB7C-9F03-4464-81FA-C43989EDA5FB}: [DhcpNameServer] 192.168.176.251 192.168.176.252 192.168.176.253 192.168.176.254
  63. Tcpip\..\Interfaces\{60BDDA1B-23B5-4E65-970A-059D32232B45}: [NameServer] 193.138.219.228
  64. Tcpip\..\Interfaces\{D5495F60-C533-451D-B521-E734479C35DE}: [NameServer] 193.138.219.228
  65.  
  66. Internet Explorer:
  67. ==================
  68. BHO: Search Helper -> {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} -> C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll [2010-07-27] (Microsoft Corporation)
  69. BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll [2006-10-26] (Microsoft Corporation)
  70. BHO: Bing Bar BHO -> {d2ce3e00-f94a-4740-988e-03dc2f38c34f} -> C:\Program Files\MSN Toolbar\Platform\6.3.2291.0\npwinext.dll [2010-08-24] (Microsoft Corporation)
  71. Toolbar: HKLM - @C:\Program Files\MSN Toolbar\Platform\6.3.2291.0\npwinext.dll,-100 - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files\MSN Toolbar\Platform\6.3.2291.0\npwinext.dll [2010-08-24] (Microsoft Corporation)
  72. Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll [2006-10-26] (Microsoft Corporation)
  73.  
  74. FireFox:
  75. ========
  76. FF DefaultProfile: hjucpyqh.default
  77. FF ProfilePath: C:\Users\Hakeem\AppData\Roaming\Mozilla\Firefox\Profiles\hjucpyqh.default [2017-12-19]
  78. FF Extension: (Windscribe VPN) - C:\Users\Hakeem\AppData\Roaming\Mozilla\Firefox\Profiles\hjucpyqh.default\Extensions\@windscribeff.xpi [2017-11-20]
  79. FF ProfilePath: C:\Users\Hakeem\AppData\Roaming\Comodo\IceDragon\Profiles\grmga28h.default [2017-07-19]
  80. FF HKLM\...\Firefox\Extensions: [{27182e60-b5f3-411c-b545-b44205977502}] - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\firefoxextension\SearchHelperExtension
  81. FF Extension: (Search Helper Extension) - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\firefoxextension\SearchHelperExtension [2017-05-05] [Legacy] [not signed]
  82. FF HKLM\...\Firefox\Extensions: [{3252b9ae-c69a-4eaf-9502-dc9c1f6c009e}] - C:\Program Files\Microsoft\Search Enhancement Pack\Default Manager\DMExtension
  83. FF Extension: (Default Manager) - C:\Program Files\Microsoft\Search Enhancement Pack\Default Manager\DMExtension [2017-05-05] [Legacy] [not signed]
  84. FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\4.0.50401.0\npctrl.dll [2010-03-31] ( Microsoft Corporation)
  85. FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.33.7\npGoogleUpdate3.dll [2017-12-13] (Google Inc.)
  86. FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.33.7\npGoogleUpdate3.dll [2017-12-13] (Google Inc.)
  87. FF Plugin: @videolan.org/vlc,version=2.2.1 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2015-04-13] (VideoLAN)
  88. FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2017-11-01] (Adobe Systems Inc.)
  89.  
  90. Chrome:
  91. =======
  92. CHR Profile: C:\Users\Hakeem\AppData\Local\Google\Chrome\User Data\Default [2017-12-19]
  93. CHR Extension: (Docs) - C:\Users\Hakeem\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2017-10-12]
  94. CHR Extension: (Google Drive) - C:\Users\Hakeem\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2017-04-12]
  95. CHR Extension: (YouTube) - C:\Users\Hakeem\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2017-04-12]
  96. CHR Extension: (Google Search) - C:\Users\Hakeem\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2017-04-11]
  97. CHR Extension: (GMass: Powerful mail merge for Gmail) - C:\Users\Hakeem\AppData\Local\Google\Chrome\User Data\Default\Extensions\ehomdgjhgmbidokdgicgmdiedadncbgf [2017-09-21]
  98. CHR Extension: (Google Docs Offline) - C:\Users\Hakeem\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2017-04-11]
  99. CHR Extension: (Chrome Web Store Payments) - C:\Users\Hakeem\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-08-21]
  100. CHR Extension: (Gmail) - C:\Users\Hakeem\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2017-04-12]
  101. CHR Extension: (Chrome Media Router) - C:\Users\Hakeem\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-12-13]
  102.  
  103. ==================== Services (Whitelisted) ====================
  104.  
  105. (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
  106.  
  107. R2 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe [4563920 2017-11-01] (Malwarebytes)
  108. R2 TeamViewer; C:\Program Files\TeamViewer\TeamViewer_Service.exe [10884848 2017-05-23] (TeamViewer GmbH)
  109. R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [680960 2013-05-26] (Microsoft Corporation)
  110.  
  111. ===================== Drivers (Whitelisted) ======================
  112.  
  113. (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
  114.  
  115. S3 blackberryncm; C:\Windows\System32\DRIVERS\blackberryncm6.sys [20992 2014-04-15] (BlackBerry) [File not signed]
  116. R1 ESProtectionDriver; C:\Windows\system32\drivers\mbae.sys [59896 2017-11-29] ()
  117. R2 MBAMChameleon; C:\Windows\System32\Drivers\MbamChameleon.sys [168376 2017-12-18] (Malwarebytes)
  118. R3 MBAMFarflt; C:\Windows\System32\DRIVERS\farflt.sys [91576 2017-12-19] (Malwarebytes)
  119. R3 MBAMProtection; C:\Windows\System32\DRIVERS\mbam.sys [40376 2017-12-19] (Malwarebytes)
  120. R0 MBAMSwissArmy; C:\Windows\System32\Drivers\mbamswissarmy.sys [221112 2017-12-18] (Malwarebytes)
  121. R3 MBAMWebProtection; C:\Windows\System32\DRIVERS\mwac.sys [65824 2017-12-19] (Malwarebytes)
  122. S3 rimvndis; C:\Windows\System32\Drivers\rimvndis6.sys [14336 2014-06-23] (Research in Motion Limited)
  123. R3 tap0901; C:\Windows\System32\DRIVERS\tap0901.sys [35288 2017-05-13] (The OpenVPN Project)
  124. S3 usbrndis6; C:\Windows\System32\DRIVERS\usb80236.sys [15872 2013-02-11] (Microsoft Corporation)
  125. S3 wdm_usb; C:\Windows\System32\DRIVERS\usb2ser.sys [128704 2016-08-15] (MBB)
  126. S3 ewusbmbb; system32\DRIVERS\ewusbwwan.sys [X]
  127. S3 huawei_enumerator; system32\DRIVERS\ew_jubusenum.sys [X]
  128. S3 hwdatacard; system32\DRIVERS\ewusbmdm.sys [X]
  129. S3 RimUsb; System32\Drivers\RimUsb.sys [X]
  130. S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [X]
  131. S3 tsusbhub; system32\drivers\tsusbhub.sys [X]
  132. S3 VGPU; System32\drivers\rdvgkmd.sys [X]
  133.  
  134. ==================== NetSvcs (Whitelisted) ===================
  135.  
  136. (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
  137.  
  138.  
  139. ==================== One Month Created files and folders ========
  140.  
  141. (If an entry is included in the fixlist, the file/folder will be moved.)
  142.  
  143. 2017-12-19 02:48 - 2017-12-19 02:49 - 000011275 _____ C:\Users\Hakeem\Desktop\FRST.txt
  144. 2017-12-19 02:41 - 2017-12-19 02:41 - 000000000 ____D C:\Users\Hakeem\Desktop\FRST-OlderVersion
  145. 2017-12-18 21:51 - 2017-12-18 21:51 - 000001935 _____ C:\Users\Hakeem\Desktop\JRT.txt
  146. 2017-12-18 21:46 - 2017-12-18 21:46 - 000000052 _____ C:\Users\Hakeem\Desktop\dangote.txt
  147. 2017-12-18 19:01 - 2017-12-19 01:56 - 000000053 _____ C:\Users\Hakeem\Desktop\airrrrrrrrr.txt
  148. 2017-12-18 03:42 - 2017-12-18 03:42 - 000080065 _____ C:\Users\Hakeem\Desktop\receipt of transfer.zip
  149. 2017-12-18 02:22 - 2017-12-19 02:37 - 000065824 _____ (Malwarebytes) C:\Windows\system32\Drivers\mwac.sys
  150. 2017-12-18 02:22 - 2017-12-19 01:22 - 000091576 _____ (Malwarebytes) C:\Windows\system32\Drivers\farflt.sys
  151. 2017-12-18 02:22 - 2017-12-19 01:22 - 000040376 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbam.sys
  152. 2017-12-18 02:22 - 2017-12-18 02:22 - 000221112 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbamswissarmy.sys
  153. 2017-12-18 02:22 - 2017-12-18 02:22 - 000168376 _____ (Malwarebytes) C:\Windows\system32\Drivers\MbamChameleon.sys
  154. 2017-12-18 01:33 - 2017-12-18 01:33 - 000079906 _____ C:\Users\Hakeem\Desktop\receipt of transfer.exe
  155. 2017-12-18 01:29 - 2017-12-18 01:29 - 000079872 ____H (Microsoft @ 2015) C:\Users\Hakeem\AppData\Roaming\euro_stub.exe
  156. 2017-12-17 22:52 - 2017-12-17 22:52 - 000089600 ____H (Microsoft @ 2015) C:\Users\Hakeem\AppData\Roaming\dhl_tracking.exe
  157. 2017-12-17 21:50 - 2017-12-17 21:50 - 000019907 _____ C:\Users\Hakeem\Desktop\doctor.txt
  158. 2017-12-17 19:49 - 2017-12-17 19:49 - 068850274 __RSH () C:\Users\Hakeem\AppData\Roaming\eeSQOM64aK.exe
  159. 2017-12-17 07:40 - 2017-12-17 07:41 - 000000000 ____D C:\Users\Hakeem\Desktop\New folder
  160. 2017-12-16 20:44 - 2017-11-25 21:54 - 001885696 _____ C:\Users\Hakeem\Desktop\Flow Crypter V4.exe
  161. 2017-12-16 18:22 - 2017-12-16 11:28 - 001818768 _____ C:\Users\Hakeem\Desktop\Flow crypter v4.rar
  162. 2017-12-16 11:28 - 2017-12-16 11:28 - 001818768 _____ C:\Users\Hakeem\Downloads\Flow crypter v4.rar
  163. 2017-12-13 21:00 - 2017-07-24 19:01 - 000000000 ____D C:\Users\Hakeem\Desktop\linkedin.com
  164. 2017-12-13 20:51 - 2017-12-13 20:52 - 001138166 _____ C:\Users\Hakeem\Downloads\linkedin17.zip
  165. 2017-12-13 20:50 - 2017-12-13 20:50 - 000014577 _____ C:\Users\Hakeem\Downloads\azzzz.html
  166. 2017-12-13 13:19 - 2017-12-13 13:19 - 000000059 ____H C:\Users\Hakeem\AppData\Roaming\TMP_4728
  167. 2017-12-13 13:14 - 2017-12-13 13:14 - 000083968 ____H (Microsoft @ 2015) C:\Users\Hakeem\AppData\Roaming\swift_remittance.exe
  168. 2017-12-13 12:43 - 2017-12-13 12:43 - 000001980 _____ C:\Users\Public\Desktop\Malwarebytes.lnk
  169. 2017-12-13 12:43 - 2017-12-13 12:43 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes
  170. 2017-12-13 12:43 - 2017-12-13 12:43 - 000000000 ____D C:\ProgramData\Malwarebytes
  171. 2017-12-13 12:43 - 2017-12-13 12:43 - 000000000 ____D C:\Program Files\Malwarebytes
  172. 2017-12-13 12:43 - 2017-11-29 09:11 - 000059896 _____ C:\Windows\system32\Drivers\mbae.sys
  173. 2017-12-13 12:20 - 2017-12-13 12:42 - 083316440 _____ (Malwarebytes ) C:\Users\Hakeem\Downloads\mb3-setup-consumer-3.3.1.2183-1.0.262-1.0.3374.exe
  174. 2017-12-13 11:49 - 2017-12-13 11:49 - 000000047 ____H C:\Users\Hakeem\Documents\TMP_4728
  175. 2017-12-13 11:46 - 2017-12-18 22:40 - 000270848 _____ () C:\Users\Hakeem\AppData\Roaming\Ranger.BrowserLogging.dll
  176. 2017-12-13 11:46 - 2017-12-18 22:40 - 000202240 _____ C:\Users\Hakeem\AppData\Roaming\ranger.browserlogging.vault.dll
  177. 2017-12-13 11:46 - 2017-12-13 11:46 - 000078336 ____H (Microsoft @ 2015) C:\Users\Hakeem\Documents\stub_orion.exe
  178. 2017-12-13 11:29 - 2017-12-11 10:40 - 001444775 _____ C:\Users\Hakeem\Desktop\orion_2.1.zip
  179. 2017-12-13 05:15 - 2017-12-13 05:15 - 000000711 _____ C:\Users\Hakeem\Desktop\connect.zip
  180. 2017-12-13 05:09 - 2017-11-16 16:15 - 002402816 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
  181. 2017-12-13 05:09 - 2017-11-14 12:36 - 000347336 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
  182. 2017-12-13 05:09 - 2017-11-13 13:37 - 013679616 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
  183. 2017-12-13 05:09 - 2017-11-13 13:15 - 000416256 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
  184. 2017-12-13 05:09 - 2017-11-13 13:15 - 000279040 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
  185. 2017-12-13 05:09 - 2017-11-13 13:15 - 000076288 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
  186. 2017-12-13 05:09 - 2017-11-13 13:10 - 020269056 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
  187. 2017-12-13 05:09 - 2017-11-13 12:32 - 000499200 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
  188. 2017-12-13 05:09 - 2017-11-13 12:31 - 000064000 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
  189. 2017-12-13 05:09 - 2017-11-07 08:56 - 002724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
  190. 2017-12-13 05:09 - 2017-11-07 08:56 - 000004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
  191. 2017-12-13 05:09 - 2017-11-07 08:46 - 000341504 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
  192. 2017-12-13 05:09 - 2017-11-07 08:46 - 000062464 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
  193. 2017-12-13 05:09 - 2017-11-07 08:46 - 000047616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
  194. 2017-12-13 05:09 - 2017-11-07 08:44 - 002293760 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
  195. 2017-12-13 05:09 - 2017-11-07 08:41 - 000047104 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
  196. 2017-12-13 05:09 - 2017-11-07 08:41 - 000030720 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
  197. 2017-12-13 05:09 - 2017-11-07 08:40 - 000476160 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
  198. 2017-12-13 05:09 - 2017-11-07 08:39 - 000662016 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
  199. 2017-12-13 05:09 - 2017-11-07 08:39 - 000104960 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
  200. 2017-12-13 05:09 - 2017-11-07 08:38 - 000620032 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
  201. 2017-12-13 05:09 - 2017-11-07 08:38 - 000115712 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
  202. 2017-12-13 05:09 - 2017-11-07 08:35 - 000667648 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
  203. 2017-12-13 05:09 - 2017-11-07 08:29 - 000060416 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
  204. 2017-12-13 05:09 - 2017-11-07 08:28 - 000091136 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
  205. 2017-12-13 05:09 - 2017-11-07 08:28 - 000073216 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx
  206. 2017-12-13 05:09 - 2017-11-07 08:27 - 004509696 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
  207. 2017-12-13 05:09 - 2017-11-07 08:26 - 000168960 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
  208. 2017-12-13 05:09 - 2017-11-07 08:24 - 000130048 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
  209. 2017-12-13 05:09 - 2017-11-07 08:19 - 000230400 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
  210. 2017-12-13 05:09 - 2017-11-07 08:18 - 000694272 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
  211. 2017-12-13 05:09 - 2017-11-07 08:18 - 000690688 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
  212. 2017-12-13 05:09 - 2017-11-07 08:17 - 002058752 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
  213. 2017-12-13 05:09 - 2017-11-07 08:17 - 001155072 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
  214. 2017-12-13 05:09 - 2017-11-07 08:04 - 002767872 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
  215. 2017-12-13 05:09 - 2017-11-07 08:01 - 001313280 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
  216. 2017-12-13 05:09 - 2017-11-07 07:58 - 000710144 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
  217. 2017-12-13 05:09 - 2017-11-07 04:13 - 000002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
  218. 2017-12-13 05:09 - 2017-11-04 03:10 - 000158720 _____ (Microsoft Corporation) C:\Windows\system32\itircl.dll
  219. 2017-12-13 05:09 - 2017-11-04 03:10 - 000142336 _____ (Microsoft Corporation) C:\Windows\system32\itss.dll
  220. 2017-12-13 05:09 - 2017-11-02 03:11 - 000271360 _____ (Microsoft Corporation) C:\Windows\system32\iprtrmgr.dll
  221. 2017-12-13 05:09 - 2017-11-02 03:11 - 000115200 _____ (Microsoft Corporation) C:\Windows\system32\rtm.dll
  222. 2017-12-13 05:09 - 2017-11-02 03:11 - 000075264 _____ (Microsoft Corporation) C:\Windows\system32\mprdim.dll
  223. 2017-12-13 05:09 - 2017-11-02 02:56 - 000008192 _____ (Microsoft Corporation) C:\Windows\system32\iprtprio.dll
  224. 2017-12-13 05:09 - 2017-10-16 10:46 - 000953344 _____ (Microsoft Corporation) C:\Windows\system32\gpedit.dll
  225. 2017-12-13 05:09 - 2017-10-11 12:14 - 000247808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rdbss.sys
  226. 2017-12-13 05:04 - 2017-12-13 05:04 - 000001204 _____ C:\Users\Hakeem\Desktop\allha.php
  227. 2017-12-13 04:00 - 2017-12-18 18:57 - 000002101 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
  228. 2017-12-13 04:00 - 2017-12-18 18:57 - 000002089 _____ C:\Users\Public\Desktop\Google Chrome.lnk
  229. 2017-12-13 03:39 - 2017-12-13 03:42 - 001129816 _____ (Google Inc.) C:\Users\Hakeem\Downloads\ChromeSetup(1).exe
  230. 2017-12-13 03:07 - 2017-12-13 03:09 - 000113799 _____ C:\Users\Hakeem\Desktop\dbx.zip
  231. 2017-12-13 02:30 - 2017-12-13 02:31 - 000000000 ____D C:\Users\Hakeem\Desktop\linkdin
  232. 2017-12-13 02:28 - 2017-12-13 02:28 - 000021185 _____ C:\Users\Hakeem\Downloads\LINKIN FIXED.zip
  233. 2017-12-13 02:27 - 2017-12-13 02:27 - 000136894 _____ C:\Users\Hakeem\Downloads\DROPBB.zip
  234. 2017-12-11 10:54 - 2017-12-11 10:54 - 000000000 ____D C:\Users\Hakeem\AppData\Local\TeamViewer
  235. 2017-12-11 10:46 - 2017-12-12 21:39 - 000000000 ____D C:\Users\Hakeem\Desktop\Orion Keylogger 2.1
  236. 2017-12-11 10:39 - 2017-12-11 10:40 - 001444775 _____ C:\Users\Hakeem\Downloads\orion_2.1.zip
  237. 2017-12-11 07:06 - 2017-12-11 07:06 - 000250968 _____ C:\Windows\Minidump\121117-17222-01.dmp
  238. 2017-12-09 10:58 - 2017-12-17 19:01 - 000000027 _____ C:\Users\Hakeem\Desktop\ikkktsee.txt
  239. 2017-12-06 08:26 - 2017-12-06 21:29 - 000000000 ____D C:\Users\Hakeem\Desktop\allleads
  240. 2017-12-06 02:45 - 2017-12-06 02:57 - 000001235 _____ C:\Users\Hakeem\Desktop.msf
  241. 2017-12-05 23:51 - 2017-12-05 23:59 - 000000000 ____D C:\Users\Hakeem\AppData\Local\Thunderbird
  242. 2017-12-05 23:51 - 2017-12-05 23:51 - 000002004 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Thunderbird.lnk
  243. 2017-12-05 23:51 - 2017-12-05 23:51 - 000001992 _____ C:\Users\Public\Desktop\Mozilla Thunderbird.lnk
  244. 2017-12-05 23:51 - 2017-12-05 23:51 - 000000000 ____D C:\Users\Hakeem\AppData\Roaming\Thunderbird
  245. 2017-12-05 23:51 - 2017-12-05 23:51 - 000000000 ____D C:\ProgramData\Mozilla
  246. 2017-12-05 23:51 - 2017-12-05 23:51 - 000000000 ____D C:\Program Files\Mozilla Thunderbird
  247. 2017-12-05 23:47 - 2017-12-05 23:50 - 019828840 _____ (Mozilla) C:\Users\Hakeem\Downloads\Thunderbird-Setup-17-0-8.exe
  248. 2017-12-05 06:24 - 2017-12-05 06:24 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\pidgin-otr
  249. 2017-12-05 06:19 - 2017-12-05 06:22 - 007140873 _____ C:\Users\Hakeem\Downloads\pidgin-otr-4.0.2.exe
  250. 2017-11-30 22:44 - 2017-12-19 02:36 - 000000000 ____D C:\Program Files\Mullvad
  251. 2017-11-30 22:44 - 2017-11-30 22:44 - 012794677 _____ C:\Users\Hakeem\Downloads\mullvad-65.exe
  252. 2017-11-30 22:44 - 2017-11-30 22:44 - 000000939 _____ C:\Users\Hakeem\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Mullvad.lnk
  253. 2017-11-30 11:41 - 2017-11-30 11:45 - 000539719 _____ C:\Users\Hakeem\Downloads\Unconfirmed 758777.crdownload
  254. 2017-11-27 10:10 - 2017-12-18 22:37 - 000004319 _____ C:\Users\Hakeem\Desktop\na so.txt
  255. 2017-11-26 03:10 - 2017-11-26 03:13 - 010406558 _____ C:\Users\Hakeem\Downloads\wordpress-4.9.zip
  256. 2017-11-25 19:58 - 2017-11-25 19:58 - 000000053 _____ C:\Users\Hakeem\Downloads\google5ce67675a78f7530.html
  257. 2017-11-25 19:58 - 2017-11-25 19:58 - 000000053 _____ C:\Users\Hakeem\Downloads\google5ce67675a78f7530 (1).html
  258. 2017-11-25 18:18 - 2017-11-25 18:18 - 000000000 ____D C:\Users\Hakeem\AppData\Local\ElevatedDiagnostics
  259. 2017-11-25 18:02 - 2017-11-25 18:02 - 000712772 _____ C:\Users\Hakeem\Downloads\'Autopilot
  260. 2017-11-25 04:25 - 2017-12-13 18:34 - 000000673 _____ C:\Users\Hakeem\Desktop\winbet.txt
  261.  
  262. ==================== One Month Modified files and folders ========
  263.  
  264. (If an entry is included in the fixlist, the file/folder will be moved.)
  265.  
  266. 2017-12-19 02:48 - 2017-07-18 17:06 - 000000000 ____D C:\FRST
  267. 2017-12-19 02:41 - 2017-07-19 08:24 - 001752576 _____ (Farbar) C:\Users\Hakeem\Desktop\FRST(1).exe
  268. 2017-12-19 01:30 - 2009-07-13 16:34 - 000016944 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
  269. 2017-12-19 01:30 - 2009-07-13 16:34 - 000016944 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
  270. 2017-12-19 01:25 - 2017-05-25 08:39 - 000000000 ____D C:\Users\Hakeem\AppData\LocalLow\Mozilla
  271. 2017-12-19 01:22 - 2009-07-13 16:53 - 000000006 ____H C:\Windows\Tasks\SA.DAT
  272. 2017-12-18 21:54 - 2017-07-20 00:44 - 000024688 _____ C:\Windows\system32\Drivers\TrueSight.sys
  273. 2017-12-18 21:48 - 2017-05-29 09:13 - 000000000 ____D C:\Users\Hakeem\AppData\Roaming\.purple
  274. 2017-12-18 02:38 - 2017-05-24 09:42 - 000000000 ____D C:\Users\Hakeem\AppData\Local\CrashDumps
  275. 2017-12-17 07:59 - 2017-06-12 01:10 - 000000000 ____D C:\Program Files\TeamViewer
  276. 2017-12-16 02:01 - 2009-07-13 16:53 - 000032618 _____ C:\Windows\Tasks\SCHEDLGU.TXT
  277. 2017-12-15 00:57 - 2009-07-13 14:37 - 000000000 ____D C:\Windows\rescache
  278. 2017-12-13 17:59 - 2009-07-13 16:33 - 000411680 _____ C:\Windows\system32\FNTCACHE.DAT
  279. 2017-12-13 17:57 - 2009-07-13 14:37 - 000000000 ____D C:\Windows\system32\Setup
  280. 2017-12-13 10:51 - 2017-04-11 08:50 - 000109280 _____ C:\Users\Hakeem\AppData\Local\GDIPFONTCACHEV1.DAT
  281. 2017-12-13 07:11 - 2017-05-25 06:07 - 000000000 ____D C:\Program Files\Mozilla Firefox
  282. 2017-12-13 07:11 - 2017-04-11 08:47 - 000000000 ____D C:\Program Files\Mozilla Maintenance Service
  283. 2017-12-13 03:59 - 2017-08-20 06:11 - 000000000 ____D C:\Program Files\Google
  284. 2017-12-13 03:01 - 2017-04-11 08:21 - 000000000 ____D C:\Users\Hakeem
  285. 2017-12-13 03:00 - 2009-07-13 14:37 - 000000000 ____D C:\Windows\registration
  286. 2017-12-13 03:00 - 2009-07-13 14:37 - 000000000 ____D C:\Windows\inf
  287. 2017-12-11 11:03 - 2017-06-12 01:10 - 000000000 ____D C:\Users\Hakeem\AppData\Roaming\TeamViewer
  288. 2017-12-11 07:06 - 2017-04-12 17:42 - 000000000 ____D C:\Windows\Minidump
  289. 2017-12-11 07:05 - 2017-04-12 17:42 - 203500508 _____ C:\Windows\MEMORY.DMP
  290. 2017-12-10 04:46 - 2017-04-11 12:29 - 000002276 _____ C:\Users\Hakeem\Desktop\wallet.txt
  291. 2017-12-06 04:56 - 2017-07-24 04:24 - 000000000 ____D C:\Users\Hakeem\AppData\Roaming\TurboMailer
  292. 2017-12-05 06:24 - 2017-07-15 02:12 - 000000000 ____D C:\Program Files\pidgin-otr
  293. 2017-12-03 22:00 - 2017-04-11 08:27 - 000781790 _____ C:\Windows\system32\PerfStringBackup.INI
  294. 2017-11-25 18:18 - 2009-07-13 14:37 - 000000000 ____D C:\Windows\system32\NDF
  295.  
  296. ==================== Files in the root of some directories =======
  297.  
  298. 2017-12-17 22:52 - 2017-12-17 22:52 - 000089600 ____H (Microsoft @ 2015) C:\Users\Hakeem\AppData\Roaming\dhl_tracking.exe
  299. 2017-11-12 04:01 - 2017-11-12 04:01 - 067566946 __RSH () C:\Users\Hakeem\AppData\Roaming\eeA86qomIo.exe
  300. 2017-12-17 19:49 - 2017-12-17 19:49 - 068850274 __RSH () C:\Users\Hakeem\AppData\Roaming\eeSQOM64aK.exe
  301. 2017-12-18 01:29 - 2017-12-18 01:29 - 000079872 ____H (Microsoft @ 2015) C:\Users\Hakeem\AppData\Roaming\euro_stub.exe
  302. 2017-12-13 11:46 - 2017-12-18 22:40 - 000270848 _____ () C:\Users\Hakeem\AppData\Roaming\Ranger.BrowserLogging.dll
  303. 2017-12-13 11:46 - 2017-12-18 22:40 - 000202240 _____ () C:\Users\Hakeem\AppData\Roaming\ranger.browserlogging.vault.dll
  304. 2017-12-13 13:14 - 2017-12-13 13:14 - 000083968 ____H (Microsoft @ 2015) C:\Users\Hakeem\AppData\Roaming\swift_remittance.exe
  305. 2017-12-13 13:19 - 2017-12-13 13:19 - 000000059 ____H () C:\Users\Hakeem\AppData\Roaming\TMP_4728
  306. 2017-10-25 20:29 - 2017-10-27 02:54 - 000059234 ___SH () C:\Users\Hakeem\AppData\Local\CSIDL_
  307. 2017-05-24 04:27 - 2017-08-19 07:57 - 000000600 _____ () C:\Users\Hakeem\AppData\Local\PUTTY.RND
  308.  
  309. Some files in TEMP:
  310. ====================
  311. 2017-11-12 23:00 - 2017-11-12 23:00 - 000253952 _____ () C:\Users\Hakeem\AppData\Local\Temp\awmoo.exe
  312. 2017-12-17 07:26 - 2017-12-17 07:26 - 000007680 ____H () C:\Users\Hakeem\AppData\Local\Temp\bfsvc.exe
  313. 2017-11-12 04:02 - 2017-04-21 03:15 - 000805376 _____ (Microsoft Corporation) C:\Users\Hakeem\AppData\Local\Temp\cdo2249078341.dll
  314. 2017-11-13 05:47 - 2017-11-13 05:47 - 000253952 _____ () C:\Users\Hakeem\AppData\Local\Temp\ciagi.exe
  315. 2017-12-17 23:24 - 2017-12-17 23:24 - 000229376 _____ () C:\Users\Hakeem\AppData\Local\Temp\ckewe.exe
  316. 2017-11-12 10:34 - 2017-11-12 10:34 - 000253952 _____ () C:\Users\Hakeem\AppData\Local\Temp\csoge.exe
  317. 2017-10-29 21:35 - 2017-09-13 03:10 - 001310528 _____ (Microsoft Corporation) C:\Users\Hakeem\AppData\Local\Temp\dllnt_dump.dll
  318. 2017-12-18 18:52 - 2017-12-18 18:52 - 000229376 _____ () C:\Users\Hakeem\AppData\Local\Temp\iooqi.exe
  319. 2017-12-17 22:44 - 2017-12-17 22:44 - 000229376 _____ () C:\Users\Hakeem\AppData\Local\Temp\qgyuu.exe
  320. 2017-12-17 07:27 - 2017-12-17 07:27 - 000270848 _____ () C:\Users\Hakeem\AppData\Local\Temp\Ranger.BrowserLogging.dll
  321. 2017-12-17 07:27 - 2017-12-17 07:27 - 000202240 _____ () C:\Users\Hakeem\AppData\Local\Temp\ranger.browserlogging.vault.dll
  322. 2017-11-14 18:58 - 2017-11-14 18:58 - 000253952 _____ () C:\Users\Hakeem\AppData\Local\Temp\rhfft.exe
  323. 2017-11-13 03:11 - 2017-11-13 03:11 - 000253952 _____ () C:\Users\Hakeem\AppData\Local\Temp\sggqg.exe
  324. 2017-11-12 06:14 - 2017-11-12 06:14 - 000253952 _____ () C:\Users\Hakeem\AppData\Local\Temp\uoqum.exe
  325. 2017-11-14 05:40 - 2017-11-14 05:40 - 000253952 _____ () C:\Users\Hakeem\AppData\Local\Temp\zphfv.exe
  326. 2017-11-08 07:42 - 2017-11-08 07:53 - 000000000 _____ () C:\Users\Hakeem\AppData\Local\Temp\{0CDFA6E4-2973-4A2A-B1CB-6CB713C48180}-62.0.3202.89_61.0.3163.100_chrome_updater.exe
  327.  
  328. ==================== Bamital & volsnap ======================
  329.  
  330. (There is no automatic fix for files that do not pass verification.)
  331.  
  332. C:\Windows\explorer.exe => File is digitally signed
  333. C:\Windows\system32\winlogon.exe => File is digitally signed
  334. C:\Windows\system32\wininit.exe => File is digitally signed
  335. C:\Windows\system32\svchost.exe => File is digitally signed
  336. C:\Windows\system32\services.exe => File is digitally signed
  337. C:\Windows\system32\User32.dll => File is digitally signed
  338. C:\Windows\system32\userinit.exe => File is digitally signed
  339. C:\Windows\system32\rpcss.dll => File is digitally signed
  340. C:\Windows\system32\dnsapi.dll => File is digitally signed
  341. C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed
  342.  
  343. LastRegBack: 2017-12-19 00:45
  344.  
  345. ==================== End of FRST.txt ============================
  346.  
  347.  
  348.  
  349.  
  350.  
  351. Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 17-12-2017
  352. Ran by Hakeem (administrator) on HAKEEM-PC (19-12-2017 02:48:10)
  353. Running from C:\Users\Hakeem\Desktop
  354. Loaded Profiles: Hakeem (Available Profiles: Hakeem)
  355. Platform: Microsoft Windows 7 Ultimate Service Pack 1 (X86) Language: English (United States)
  356. Internet Explorer Version 11 (Default browser: IE)
  357. Boot Mode: Normal
  358. Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
  359.  
  360. ==================== Processes (Whitelisted) =================
  361.  
  362. (If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
  363.  
  364. (Microsoft Corporation) C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
  365. (Google Inc.) C:\Program Files\Google\Update\1.3.33.7\GoogleCrashHandler.exe
  366. (TeamViewer GmbH) C:\Program Files\TeamViewer\TeamViewer_Service.exe
  367. (Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
  368. (Microsoft Corporation) C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
  369. (Intel Corporation) C:\Windows\System32\igfxtray.exe
  370. (Intel Corporation) C:\Windows\System32\hkcmd.exe
  371. (Intel Corporation) C:\Windows\System32\igfxpers.exe
  372. (Intel Corporation) C:\Windows\System32\igfxsrvc.exe
  373. (Hewlett-Packard) C:\Program Files\HP\HP Software Update\hpwuschd2.exe
  374. (Microsoft @ 2015) C:\Users\Hakeem\AppData\Roaming\euro_stub.exe
  375. (Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe
  376. (Microsoft Corporation) C:\Windows\System32\wuauclt.exe
  377. (Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
  378. (Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
  379. (Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
  380. (Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
  381. (Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
  382. (Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
  383. (Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
  384. (Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
  385. (Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
  386. (Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
  387. (Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
  388. (Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
  389. () C:\Program Files\Mullvad\mullvad.exe
  390. (Farbar) C:\Users\Hakeem\Desktop\FRST(1).exe
  391.  
  392. ==================== Registry (Whitelisted) ===========================
  393.  
  394. (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
  395.  
  396. HKLM\...\Run: [GrooveMonitor] => C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [31016 2006-10-26] (Microsoft Corporation)
  397. HKLM\...\Run: [HP Software Update] => C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe [49208 2010-06-09] (Hewlett-Packard)
  398. HKLM\...\Run: [Microsoft Default Manager] => C:\Program Files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe [439568 2010-05-10] (Microsoft Corporation)
  399. HKU\S-1-5-21-570141002-2484250258-4068607221-1000\...\Run: [Web Companion] => C:\Program Files\Lavasoft\Web Companion\Application\WebCompanion.exe --minimize
  400. HKU\S-1-5-21-570141002-2484250258-4068607221-1000\...\Run: [BlackBerryLink.exe] => "C:\Program Files\Research In Motion\BlackBerry Link\BlackBerryLink.exe" /minimize
  401. HKU\S-1-5-21-570141002-2484250258-4068607221-1000\...\Run: [Windows 10 Update] => C:\Users\Hakeem\AppData\Roaming\euro_stub.exe [79872 2017-12-18] (Microsoft @ 2015)
  402. HKU\S-1-5-18\...\RunOnce: [SPReview] => C:\Windows\System32\SPReview\SPReview.exe [280576 2017-05-21] (Microsoft Corporation)
  403. Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk [2017-05-03]
  404. ShortcutTarget: Adobe Gamma Loader.lnk -> C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)
  405.  
  406. ==================== Internet (Whitelisted) ====================
  407.  
  408. (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
  409.  
  410. Tcpip\Parameters: [DhcpNameServer] 192.168.176.251 192.168.176.252 192.168.176.253 192.168.176.254
  411. Tcpip\..\Interfaces\{2243CB7C-9F03-4464-81FA-C43989EDA5FB}: [NameServer] 193.138.219.228
  412. Tcpip\..\Interfaces\{2243CB7C-9F03-4464-81FA-C43989EDA5FB}: [DhcpNameServer] 192.168.176.251 192.168.176.252 192.168.176.253 192.168.176.254
  413. Tcpip\..\Interfaces\{60BDDA1B-23B5-4E65-970A-059D32232B45}: [NameServer] 193.138.219.228
  414. Tcpip\..\Interfaces\{D5495F60-C533-451D-B521-E734479C35DE}: [NameServer] 193.138.219.228
  415.  
  416. Internet Explorer:
  417. ==================
  418. BHO: Search Helper -> {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} -> C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll [2010-07-27] (Microsoft Corporation)
  419. BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll [2006-10-26] (Microsoft Corporation)
  420. BHO: Bing Bar BHO -> {d2ce3e00-f94a-4740-988e-03dc2f38c34f} -> C:\Program Files\MSN Toolbar\Platform\6.3.2291.0\npwinext.dll [2010-08-24] (Microsoft Corporation)
  421. Toolbar: HKLM - @C:\Program Files\MSN Toolbar\Platform\6.3.2291.0\npwinext.dll,-100 - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files\MSN Toolbar\Platform\6.3.2291.0\npwinext.dll [2010-08-24] (Microsoft Corporation)
  422. Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll [2006-10-26] (Microsoft Corporation)
  423.  
  424. FireFox:
  425. ========
  426. FF DefaultProfile: hjucpyqh.default
  427. FF ProfilePath: C:\Users\Hakeem\AppData\Roaming\Mozilla\Firefox\Profiles\hjucpyqh.default [2017-12-19]
  428. FF Extension: (Windscribe VPN) - C:\Users\Hakeem\AppData\Roaming\Mozilla\Firefox\Profiles\hjucpyqh.default\Extensions\@windscribeff.xpi [2017-11-20]
  429. FF ProfilePath: C:\Users\Hakeem\AppData\Roaming\Comodo\IceDragon\Profiles\grmga28h.default [2017-07-19]
  430. FF HKLM\...\Firefox\Extensions: [{27182e60-b5f3-411c-b545-b44205977502}] - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\firefoxextension\SearchHelperExtension
  431. FF Extension: (Search Helper Extension) - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\firefoxextension\SearchHelperExtension [2017-05-05] [Legacy] [not signed]
  432. FF HKLM\...\Firefox\Extensions: [{3252b9ae-c69a-4eaf-9502-dc9c1f6c009e}] - C:\Program Files\Microsoft\Search Enhancement Pack\Default Manager\DMExtension
  433. FF Extension: (Default Manager) - C:\Program Files\Microsoft\Search Enhancement Pack\Default Manager\DMExtension [2017-05-05] [Legacy] [not signed]
  434. FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\4.0.50401.0\npctrl.dll [2010-03-31] ( Microsoft Corporation)
  435. FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.33.7\npGoogleUpdate3.dll [2017-12-13] (Google Inc.)
  436. FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.33.7\npGoogleUpdate3.dll [2017-12-13] (Google Inc.)
  437. FF Plugin: @videolan.org/vlc,version=2.2.1 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2015-04-13] (VideoLAN)
  438. FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2017-11-01] (Adobe Systems Inc.)
  439.  
  440. Chrome:
  441. =======
  442. CHR Profile: C:\Users\Hakeem\AppData\Local\Google\Chrome\User Data\Default [2017-12-19]
  443. CHR Extension: (Docs) - C:\Users\Hakeem\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2017-10-12]
  444. CHR Extension: (Google Drive) - C:\Users\Hakeem\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2017-04-12]
  445. CHR Extension: (YouTube) - C:\Users\Hakeem\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2017-04-12]
  446. CHR Extension: (Google Search) - C:\Users\Hakeem\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2017-04-11]
  447. CHR Extension: (GMass: Powerful mail merge for Gmail) - C:\Users\Hakeem\AppData\Local\Google\Chrome\User Data\Default\Extensions\ehomdgjhgmbidokdgicgmdiedadncbgf [2017-09-21]
  448. CHR Extension: (Google Docs Offline) - C:\Users\Hakeem\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2017-04-11]
  449. CHR Extension: (Chrome Web Store Payments) - C:\Users\Hakeem\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-08-21]
  450. CHR Extension: (Gmail) - C:\Users\Hakeem\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2017-04-12]
  451. CHR Extension: (Chrome Media Router) - C:\Users\Hakeem\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-12-13]
  452.  
  453. ==================== Services (Whitelisted) ====================
  454.  
  455. (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
  456.  
  457. R2 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe [4563920 2017-11-01] (Malwarebytes)
  458. R2 TeamViewer; C:\Program Files\TeamViewer\TeamViewer_Service.exe [10884848 2017-05-23] (TeamViewer GmbH)
  459. R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [680960 2013-05-26] (Microsoft Corporation)
  460.  
  461. ===================== Drivers (Whitelisted) ======================
  462.  
  463. (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
  464.  
  465. S3 blackberryncm; C:\Windows\System32\DRIVERS\blackberryncm6.sys [20992 2014-04-15] (BlackBerry) [File not signed]
  466. R1 ESProtectionDriver; C:\Windows\system32\drivers\mbae.sys [59896 2017-11-29] ()
  467. R2 MBAMChameleon; C:\Windows\System32\Drivers\MbamChameleon.sys [168376 2017-12-18] (Malwarebytes)
  468. R3 MBAMFarflt; C:\Windows\System32\DRIVERS\farflt.sys [91576 2017-12-19] (Malwarebytes)
  469. R3 MBAMProtection; C:\Windows\System32\DRIVERS\mbam.sys [40376 2017-12-19] (Malwarebytes)
  470. R0 MBAMSwissArmy; C:\Windows\System32\Drivers\mbamswissarmy.sys [221112 2017-12-18] (Malwarebytes)
  471. R3 MBAMWebProtection; C:\Windows\System32\DRIVERS\mwac.sys [65824 2017-12-19] (Malwarebytes)
  472. S3 rimvndis; C:\Windows\System32\Drivers\rimvndis6.sys [14336 2014-06-23] (Research in Motion Limited)
  473. R3 tap0901; C:\Windows\System32\DRIVERS\tap0901.sys [35288 2017-05-13] (The OpenVPN Project)
  474. S3 usbrndis6; C:\Windows\System32\DRIVERS\usb80236.sys [15872 2013-02-11] (Microsoft Corporation)
  475. S3 wdm_usb; C:\Windows\System32\DRIVERS\usb2ser.sys [128704 2016-08-15] (MBB)
  476. S3 ewusbmbb; system32\DRIVERS\ewusbwwan.sys [X]
  477. S3 huawei_enumerator; system32\DRIVERS\ew_jubusenum.sys [X]
  478. S3 hwdatacard; system32\DRIVERS\ewusbmdm.sys [X]
  479. S3 RimUsb; System32\Drivers\RimUsb.sys [X]
  480. S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [X]
  481. S3 tsusbhub; system32\drivers\tsusbhub.sys [X]
  482. S3 VGPU; System32\drivers\rdvgkmd.sys [X]
  483.  
  484. ==================== NetSvcs (Whitelisted) ===================
  485.  
  486. (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
  487.  
  488.  
  489. ==================== One Month Created files and folders ========
  490.  
  491. (If an entry is included in the fixlist, the file/folder will be moved.)
  492.  
  493. 2017-12-19 02:48 - 2017-12-19 02:49 - 000011275 _____ C:\Users\Hakeem\Desktop\FRST.txt
  494. 2017-12-19 02:41 - 2017-12-19 02:41 - 000000000 ____D C:\Users\Hakeem\Desktop\FRST-OlderVersion
  495. 2017-12-18 21:51 - 2017-12-18 21:51 - 000001935 _____ C:\Users\Hakeem\Desktop\JRT.txt
  496. 2017-12-18 21:46 - 2017-12-18 21:46 - 000000052 _____ C:\Users\Hakeem\Desktop\dangote.txt
  497. 2017-12-18 19:01 - 2017-12-19 01:56 - 000000053 _____ C:\Users\Hakeem\Desktop\airrrrrrrrr.txt
  498. 2017-12-18 03:42 - 2017-12-18 03:42 - 000080065 _____ C:\Users\Hakeem\Desktop\receipt of transfer.zip
  499. 2017-12-18 02:22 - 2017-12-19 02:37 - 000065824 _____ (Malwarebytes) C:\Windows\system32\Drivers\mwac.sys
  500. 2017-12-18 02:22 - 2017-12-19 01:22 - 000091576 _____ (Malwarebytes) C:\Windows\system32\Drivers\farflt.sys
  501. 2017-12-18 02:22 - 2017-12-19 01:22 - 000040376 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbam.sys
  502. 2017-12-18 02:22 - 2017-12-18 02:22 - 000221112 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbamswissarmy.sys
  503. 2017-12-18 02:22 - 2017-12-18 02:22 - 000168376 _____ (Malwarebytes) C:\Windows\system32\Drivers\MbamChameleon.sys
  504. 2017-12-18 01:33 - 2017-12-18 01:33 - 000079906 _____ C:\Users\Hakeem\Desktop\receipt of transfer.exe
  505. 2017-12-18 01:29 - 2017-12-18 01:29 - 000079872 ____H (Microsoft @ 2015) C:\Users\Hakeem\AppData\Roaming\euro_stub.exe
  506. 2017-12-17 22:52 - 2017-12-17 22:52 - 000089600 ____H (Microsoft @ 2015) C:\Users\Hakeem\AppData\Roaming\dhl_tracking.exe
  507. 2017-12-17 21:50 - 2017-12-17 21:50 - 000019907 _____ C:\Users\Hakeem\Desktop\doctor.txt
  508. 2017-12-17 19:49 - 2017-12-17 19:49 - 068850274 __RSH () C:\Users\Hakeem\AppData\Roaming\eeSQOM64aK.exe
  509. 2017-12-17 07:40 - 2017-12-17 07:41 - 000000000 ____D C:\Users\Hakeem\Desktop\New folder
  510. 2017-12-16 20:44 - 2017-11-25 21:54 - 001885696 _____ C:\Users\Hakeem\Desktop\Flow Crypter V4.exe
  511. 2017-12-16 18:22 - 2017-12-16 11:28 - 001818768 _____ C:\Users\Hakeem\Desktop\Flow crypter v4.rar
  512. 2017-12-16 11:28 - 2017-12-16 11:28 - 001818768 _____ C:\Users\Hakeem\Downloads\Flow crypter v4.rar
  513. 2017-12-13 21:00 - 2017-07-24 19:01 - 000000000 ____D C:\Users\Hakeem\Desktop\linkedin.com
  514. 2017-12-13 20:51 - 2017-12-13 20:52 - 001138166 _____ C:\Users\Hakeem\Downloads\linkedin17.zip
  515. 2017-12-13 20:50 - 2017-12-13 20:50 - 000014577 _____ C:\Users\Hakeem\Downloads\azzzz.html
  516. 2017-12-13 13:19 - 2017-12-13 13:19 - 000000059 ____H C:\Users\Hakeem\AppData\Roaming\TMP_4728
  517. 2017-12-13 13:14 - 2017-12-13 13:14 - 000083968 ____H (Microsoft @ 2015) C:\Users\Hakeem\AppData\Roaming\swift_remittance.exe
  518. 2017-12-13 12:43 - 2017-12-13 12:43 - 000001980 _____ C:\Users\Public\Desktop\Malwarebytes.lnk
  519. 2017-12-13 12:43 - 2017-12-13 12:43 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes
  520. 2017-12-13 12:43 - 2017-12-13 12:43 - 000000000 ____D C:\ProgramData\Malwarebytes
  521. 2017-12-13 12:43 - 2017-12-13 12:43 - 000000000 ____D C:\Program Files\Malwarebytes
  522. 2017-12-13 12:43 - 2017-11-29 09:11 - 000059896 _____ C:\Windows\system32\Drivers\mbae.sys
  523. 2017-12-13 12:20 - 2017-12-13 12:42 - 083316440 _____ (Malwarebytes ) C:\Users\Hakeem\Downloads\mb3-setup-consumer-3.3.1.2183-1.0.262-1.0.3374.exe
  524. 2017-12-13 11:49 - 2017-12-13 11:49 - 000000047 ____H C:\Users\Hakeem\Documents\TMP_4728
  525. 2017-12-13 11:46 - 2017-12-18 22:40 - 000270848 _____ () C:\Users\Hakeem\AppData\Roaming\Ranger.BrowserLogging.dll
  526. 2017-12-13 11:46 - 2017-12-18 22:40 - 000202240 _____ C:\Users\Hakeem\AppData\Roaming\ranger.browserlogging.vault.dll
  527. 2017-12-13 11:46 - 2017-12-13 11:46 - 000078336 ____H (Microsoft @ 2015) C:\Users\Hakeem\Documents\stub_orion.exe
  528. 2017-12-13 11:29 - 2017-12-11 10:40 - 001444775 _____ C:\Users\Hakeem\Desktop\orion_2.1.zip
  529. 2017-12-13 05:15 - 2017-12-13 05:15 - 000000711 _____ C:\Users\Hakeem\Desktop\connect.zip
  530. 2017-12-13 05:09 - 2017-11-16 16:15 - 002402816 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
  531. 2017-12-13 05:09 - 2017-11-14 12:36 - 000347336 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
  532. 2017-12-13 05:09 - 2017-11-13 13:37 - 013679616 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
  533. 2017-12-13 05:09 - 2017-11-13 13:15 - 000416256 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
  534. 2017-12-13 05:09 - 2017-11-13 13:15 - 000279040 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
  535. 2017-12-13 05:09 - 2017-11-13 13:15 - 000076288 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
  536. 2017-12-13 05:09 - 2017-11-13 13:10 - 020269056 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
  537. 2017-12-13 05:09 - 2017-11-13 12:32 - 000499200 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
  538. 2017-12-13 05:09 - 2017-11-13 12:31 - 000064000 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
  539. 2017-12-13 05:09 - 2017-11-07 08:56 - 002724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
  540. 2017-12-13 05:09 - 2017-11-07 08:56 - 000004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
  541. 2017-12-13 05:09 - 2017-11-07 08:46 - 000341504 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
  542. 2017-12-13 05:09 - 2017-11-07 08:46 - 000062464 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
  543. 2017-12-13 05:09 - 2017-11-07 08:46 - 000047616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
  544. 2017-12-13 05:09 - 2017-11-07 08:44 - 002293760 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
  545. 2017-12-13 05:09 - 2017-11-07 08:41 - 000047104 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
  546. 2017-12-13 05:09 - 2017-11-07 08:41 - 000030720 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
  547. 2017-12-13 05:09 - 2017-11-07 08:40 - 000476160 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
  548. 2017-12-13 05:09 - 2017-11-07 08:39 - 000662016 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
  549. 2017-12-13 05:09 - 2017-11-07 08:39 - 000104960 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
  550. 2017-12-13 05:09 - 2017-11-07 08:38 - 000620032 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
  551. 2017-12-13 05:09 - 2017-11-07 08:38 - 000115712 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
  552. 2017-12-13 05:09 - 2017-11-07 08:35 - 000667648 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
  553. 2017-12-13 05:09 - 2017-11-07 08:29 - 000060416 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
  554. 2017-12-13 05:09 - 2017-11-07 08:28 - 000091136 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
  555. 2017-12-13 05:09 - 2017-11-07 08:28 - 000073216 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx
  556. 2017-12-13 05:09 - 2017-11-07 08:27 - 004509696 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
  557. 2017-12-13 05:09 - 2017-11-07 08:26 - 000168960 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
  558. 2017-12-13 05:09 - 2017-11-07 08:24 - 000130048 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
  559. 2017-12-13 05:09 - 2017-11-07 08:19 - 000230400 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
  560. 2017-12-13 05:09 - 2017-11-07 08:18 - 000694272 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
  561. 2017-12-13 05:09 - 2017-11-07 08:18 - 000690688 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
  562. 2017-12-13 05:09 - 2017-11-07 08:17 - 002058752 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
  563. 2017-12-13 05:09 - 2017-11-07 08:17 - 001155072 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
  564. 2017-12-13 05:09 - 2017-11-07 08:04 - 002767872 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
  565. 2017-12-13 05:09 - 2017-11-07 08:01 - 001313280 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
  566. 2017-12-13 05:09 - 2017-11-07 07:58 - 000710144 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
  567. 2017-12-13 05:09 - 2017-11-07 04:13 - 000002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
  568. 2017-12-13 05:09 - 2017-11-04 03:10 - 000158720 _____ (Microsoft Corporation) C:\Windows\system32\itircl.dll
  569. 2017-12-13 05:09 - 2017-11-04 03:10 - 000142336 _____ (Microsoft Corporation) C:\Windows\system32\itss.dll
  570. 2017-12-13 05:09 - 2017-11-02 03:11 - 000271360 _____ (Microsoft Corporation) C:\Windows\system32\iprtrmgr.dll
  571. 2017-12-13 05:09 - 2017-11-02 03:11 - 000115200 _____ (Microsoft Corporation) C:\Windows\system32\rtm.dll
  572. 2017-12-13 05:09 - 2017-11-02 03:11 - 000075264 _____ (Microsoft Corporation) C:\Windows\system32\mprdim.dll
  573. 2017-12-13 05:09 - 2017-11-02 02:56 - 000008192 _____ (Microsoft Corporation) C:\Windows\system32\iprtprio.dll
  574. 2017-12-13 05:09 - 2017-10-16 10:46 - 000953344 _____ (Microsoft Corporation) C:\Windows\system32\gpedit.dll
  575. 2017-12-13 05:09 - 2017-10-11 12:14 - 000247808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rdbss.sys
  576. 2017-12-13 05:04 - 2017-12-13 05:04 - 000001204 _____ C:\Users\Hakeem\Desktop\allha.php
  577. 2017-12-13 04:00 - 2017-12-18 18:57 - 000002101 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
  578. 2017-12-13 04:00 - 2017-12-18 18:57 - 000002089 _____ C:\Users\Public\Desktop\Google Chrome.lnk
  579. 2017-12-13 03:39 - 2017-12-13 03:42 - 001129816 _____ (Google Inc.) C:\Users\Hakeem\Downloads\ChromeSetup(1).exe
  580. 2017-12-13 03:07 - 2017-12-13 03:09 - 000113799 _____ C:\Users\Hakeem\Desktop\dbx.zip
  581. 2017-12-13 02:30 - 2017-12-13 02:31 - 000000000 ____D C:\Users\Hakeem\Desktop\linkdin
  582. 2017-12-13 02:28 - 2017-12-13 02:28 - 000021185 _____ C:\Users\Hakeem\Downloads\LINKIN FIXED.zip
  583. 2017-12-13 02:27 - 2017-12-13 02:27 - 000136894 _____ C:\Users\Hakeem\Downloads\DROPBB.zip
  584. 2017-12-11 10:54 - 2017-12-11 10:54 - 000000000 ____D C:\Users\Hakeem\AppData\Local\TeamViewer
  585. 2017-12-11 10:46 - 2017-12-12 21:39 - 000000000 ____D C:\Users\Hakeem\Desktop\Orion Keylogger 2.1
  586. 2017-12-11 10:39 - 2017-12-11 10:40 - 001444775 _____ C:\Users\Hakeem\Downloads\orion_2.1.zip
  587. 2017-12-11 07:06 - 2017-12-11 07:06 - 000250968 _____ C:\Windows\Minidump\121117-17222-01.dmp
  588. 2017-12-09 10:58 - 2017-12-17 19:01 - 000000027 _____ C:\Users\Hakeem\Desktop\ikkktsee.txt
  589. 2017-12-06 08:26 - 2017-12-06 21:29 - 000000000 ____D C:\Users\Hakeem\Desktop\allleads
  590. 2017-12-06 02:45 - 2017-12-06 02:57 - 000001235 _____ C:\Users\Hakeem\Desktop.msf
  591. 2017-12-05 23:51 - 2017-12-05 23:59 - 000000000 ____D C:\Users\Hakeem\AppData\Local\Thunderbird
  592. 2017-12-05 23:51 - 2017-12-05 23:51 - 000002004 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Thunderbird.lnk
  593. 2017-12-05 23:51 - 2017-12-05 23:51 - 000001992 _____ C:\Users\Public\Desktop\Mozilla Thunderbird.lnk
  594. 2017-12-05 23:51 - 2017-12-05 23:51 - 000000000 ____D C:\Users\Hakeem\AppData\Roaming\Thunderbird
  595. 2017-12-05 23:51 - 2017-12-05 23:51 - 000000000 ____D C:\ProgramData\Mozilla
  596. 2017-12-05 23:51 - 2017-12-05 23:51 - 000000000 ____D C:\Program Files\Mozilla Thunderbird
  597. 2017-12-05 23:47 - 2017-12-05 23:50 - 019828840 _____ (Mozilla) C:\Users\Hakeem\Downloads\Thunderbird-Setup-17-0-8.exe
  598. 2017-12-05 06:24 - 2017-12-05 06:24 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\pidgin-otr
  599. 2017-12-05 06:19 - 2017-12-05 06:22 - 007140873 _____ C:\Users\Hakeem\Downloads\pidgin-otr-4.0.2.exe
  600. 2017-11-30 22:44 - 2017-12-19 02:36 - 000000000 ____D C:\Program Files\Mullvad
  601. 2017-11-30 22:44 - 2017-11-30 22:44 - 012794677 _____ C:\Users\Hakeem\Downloads\mullvad-65.exe
  602. 2017-11-30 22:44 - 2017-11-30 22:44 - 000000939 _____ C:\Users\Hakeem\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Mullvad.lnk
  603. 2017-11-30 11:41 - 2017-11-30 11:45 - 000539719 _____ C:\Users\Hakeem\Downloads\Unconfirmed 758777.crdownload
  604. 2017-11-27 10:10 - 2017-12-18 22:37 - 000004319 _____ C:\Users\Hakeem\Desktop\na so.txt
  605. 2017-11-26 03:10 - 2017-11-26 03:13 - 010406558 _____ C:\Users\Hakeem\Downloads\wordpress-4.9.zip
  606. 2017-11-25 19:58 - 2017-11-25 19:58 - 000000053 _____ C:\Users\Hakeem\Downloads\google5ce67675a78f7530.html
  607. 2017-11-25 19:58 - 2017-11-25 19:58 - 000000053 _____ C:\Users\Hakeem\Downloads\google5ce67675a78f7530 (1).html
  608. 2017-11-25 18:18 - 2017-11-25 18:18 - 000000000 ____D C:\Users\Hakeem\AppData\Local\ElevatedDiagnostics
  609. 2017-11-25 18:02 - 2017-11-25 18:02 - 000712772 _____ C:\Users\Hakeem\Downloads\'Autopilot
  610. 2017-11-25 04:25 - 2017-12-13 18:34 - 000000673 _____ C:\Users\Hakeem\Desktop\winbet.txt
  611.  
  612. ==================== One Month Modified files and folders ========
  613.  
  614. (If an entry is included in the fixlist, the file/folder will be moved.)
  615.  
  616. 2017-12-19 02:48 - 2017-07-18 17:06 - 000000000 ____D C:\FRST
  617. 2017-12-19 02:41 - 2017-07-19 08:24 - 001752576 _____ (Farbar) C:\Users\Hakeem\Desktop\FRST(1).exe
  618. 2017-12-19 01:30 - 2009-07-13 16:34 - 000016944 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
  619. 2017-12-19 01:30 - 2009-07-13 16:34 - 000016944 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
  620. 2017-12-19 01:25 - 2017-05-25 08:39 - 000000000 ____D C:\Users\Hakeem\AppData\LocalLow\Mozilla
  621. 2017-12-19 01:22 - 2009-07-13 16:53 - 000000006 ____H C:\Windows\Tasks\SA.DAT
  622. 2017-12-18 21:54 - 2017-07-20 00:44 - 000024688 _____ C:\Windows\system32\Drivers\TrueSight.sys
  623. 2017-12-18 21:48 - 2017-05-29 09:13 - 000000000 ____D C:\Users\Hakeem\AppData\Roaming\.purple
  624. 2017-12-18 02:38 - 2017-05-24 09:42 - 000000000 ____D C:\Users\Hakeem\AppData\Local\CrashDumps
  625. 2017-12-17 07:59 - 2017-06-12 01:10 - 000000000 ____D C:\Program Files\TeamViewer
  626. 2017-12-16 02:01 - 2009-07-13 16:53 - 000032618 _____ C:\Windows\Tasks\SCHEDLGU.TXT
  627. 2017-12-15 00:57 - 2009-07-13 14:37 - 000000000 ____D C:\Windows\rescache
  628. 2017-12-13 17:59 - 2009-07-13 16:33 - 000411680 _____ C:\Windows\system32\FNTCACHE.DAT
  629. 2017-12-13 17:57 - 2009-07-13 14:37 - 000000000 ____D C:\Windows\system32\Setup
  630. 2017-12-13 10:51 - 2017-04-11 08:50 - 000109280 _____ C:\Users\Hakeem\AppData\Local\GDIPFONTCACHEV1.DAT
  631. 2017-12-13 07:11 - 2017-05-25 06:07 - 000000000 ____D C:\Program Files\Mozilla Firefox
  632. 2017-12-13 07:11 - 2017-04-11 08:47 - 000000000 ____D C:\Program Files\Mozilla Maintenance Service
  633. 2017-12-13 03:59 - 2017-08-20 06:11 - 000000000 ____D C:\Program Files\Google
  634. 2017-12-13 03:01 - 2017-04-11 08:21 - 000000000 ____D C:\Users\Hakeem
  635. 2017-12-13 03:00 - 2009-07-13 14:37 - 000000000 ____D C:\Windows\registration
  636. 2017-12-13 03:00 - 2009-07-13 14:37 - 000000000 ____D C:\Windows\inf
  637. 2017-12-11 11:03 - 2017-06-12 01:10 - 000000000 ____D C:\Users\Hakeem\AppData\Roaming\TeamViewer
  638. 2017-12-11 07:06 - 2017-04-12 17:42 - 000000000 ____D C:\Windows\Minidump
  639. 2017-12-11 07:05 - 2017-04-12 17:42 - 203500508 _____ C:\Windows\MEMORY.DMP
  640. 2017-12-10 04:46 - 2017-04-11 12:29 - 000002276 _____ C:\Users\Hakeem\Desktop\wallet.txt
  641. 2017-12-06 04:56 - 2017-07-24 04:24 - 000000000 ____D C:\Users\Hakeem\AppData\Roaming\TurboMailer
  642. 2017-12-05 06:24 - 2017-07-15 02:12 - 000000000 ____D C:\Program Files\pidgin-otr
  643. 2017-12-03 22:00 - 2017-04-11 08:27 - 000781790 _____ C:\Windows\system32\PerfStringBackup.INI
  644. 2017-11-25 18:18 - 2009-07-13 14:37 - 000000000 ____D C:\Windows\system32\NDF
  645.  
  646. ==================== Files in the root of some directories =======
  647.  
  648. 2017-12-17 22:52 - 2017-12-17 22:52 - 000089600 ____H (Microsoft @ 2015) C:\Users\Hakeem\AppData\Roaming\dhl_tracking.exe
  649. 2017-11-12 04:01 - 2017-11-12 04:01 - 067566946 __RSH () C:\Users\Hakeem\AppData\Roaming\eeA86qomIo.exe
  650. 2017-12-17 19:49 - 2017-12-17 19:49 - 068850274 __RSH () C:\Users\Hakeem\AppData\Roaming\eeSQOM64aK.exe
  651. 2017-12-18 01:29 - 2017-12-18 01:29 - 000079872 ____H (Microsoft @ 2015) C:\Users\Hakeem\AppData\Roaming\euro_stub.exe
  652. 2017-12-13 11:46 - 2017-12-18 22:40 - 000270848 _____ () C:\Users\Hakeem\AppData\Roaming\Ranger.BrowserLogging.dll
  653. 2017-12-13 11:46 - 2017-12-18 22:40 - 000202240 _____ () C:\Users\Hakeem\AppData\Roaming\ranger.browserlogging.vault.dll
  654. 2017-12-13 13:14 - 2017-12-13 13:14 - 000083968 ____H (Microsoft @ 2015) C:\Users\Hakeem\AppData\Roaming\swift_remittance.exe
  655. 2017-12-13 13:19 - 2017-12-13 13:19 - 000000059 ____H () C:\Users\Hakeem\AppData\Roaming\TMP_4728
  656. 2017-10-25 20:29 - 2017-10-27 02:54 - 000059234 ___SH () C:\Users\Hakeem\AppData\Local\CSIDL_
  657. 2017-05-24 04:27 - 2017-08-19 07:57 - 000000600 _____ () C:\Users\Hakeem\AppData\Local\PUTTY.RND
  658.  
  659. Some files in TEMP:
  660. ====================
  661. 2017-11-12 23:00 - 2017-11-12 23:00 - 000253952 _____ () C:\Users\Hakeem\AppData\Local\Temp\awmoo.exe
  662. 2017-12-17 07:26 - 2017-12-17 07:26 - 000007680 ____H () C:\Users\Hakeem\AppData\Local\Temp\bfsvc.exe
  663. 2017-11-12 04:02 - 2017-04-21 03:15 - 000805376 _____ (Microsoft Corporation) C:\Users\Hakeem\AppData\Local\Temp\cdo2249078341.dll
  664. 2017-11-13 05:47 - 2017-11-13 05:47 - 000253952 _____ () C:\Users\Hakeem\AppData\Local\Temp\ciagi.exe
  665. 2017-12-17 23:24 - 2017-12-17 23:24 - 000229376 _____ () C:\Users\Hakeem\AppData\Local\Temp\ckewe.exe
  666. 2017-11-12 10:34 - 2017-11-12 10:34 - 000253952 _____ () C:\Users\Hakeem\AppData\Local\Temp\csoge.exe
  667. 2017-10-29 21:35 - 2017-09-13 03:10 - 001310528 _____ (Microsoft Corporation) C:\Users\Hakeem\AppData\Local\Temp\dllnt_dump.dll
  668. 2017-12-18 18:52 - 2017-12-18 18:52 - 000229376 _____ () C:\Users\Hakeem\AppData\Local\Temp\iooqi.exe
  669. 2017-12-17 22:44 - 2017-12-17 22:44 - 000229376 _____ () C:\Users\Hakeem\AppData\Local\Temp\qgyuu.exe
  670. 2017-12-17 07:27 - 2017-12-17 07:27 - 000270848 _____ () C:\Users\Hakeem\AppData\Local\Temp\Ranger.BrowserLogging.dll
  671. 2017-12-17 07:27 - 2017-12-17 07:27 - 000202240 _____ () C:\Users\Hakeem\AppData\Local\Temp\ranger.browserlogging.vault.dll
  672. 2017-11-14 18:58 - 2017-11-14 18:58 - 000253952 _____ () C:\Users\Hakeem\AppData\Local\Temp\rhfft.exe
  673. 2017-11-13 03:11 - 2017-11-13 03:11 - 000253952 _____ () C:\Users\Hakeem\AppData\Local\Temp\sggqg.exe
  674. 2017-11-12 06:14 - 2017-11-12 06:14 - 000253952 _____ () C:\Users\Hakeem\AppData\Local\Temp\uoqum.exe
  675. 2017-11-14 05:40 - 2017-11-14 05:40 - 000253952 _____ () C:\Users\Hakeem\AppData\Local\Temp\zphfv.exe
  676. 2017-11-08 07:42 - 2017-11-08 07:53 - 000000000 _____ () C:\Users\Hakeem\AppData\Local\Temp\{0CDFA6E4-2973-4A2A-B1CB-6CB713C48180}-62.0.3202.89_61.0.3163.100_chrome_updater.exe
  677.  
  678. ==================== Bamital & volsnap ======================
  679.  
  680. (There is no automatic fix for files that do not pass verification.)
  681.  
  682. C:\Windows\explorer.exe => File is digitally signed
  683. C:\Windows\system32\winlogon.exe => File is digitally signed
  684. C:\Windows\system32\wininit.exe => File is digitally signed
  685. C:\Windows\system32\svchost.exe => File is digitally signed
  686. C:\Windows\system32\services.exe => File is digitally signed
  687. C:\Windows\system32\User32.dll => File is digitally signed
  688. C:\Windows\system32\userinit.exe => File is digitally signed
  689. C:\Windows\system32\rpcss.dll => File is digitally signed
  690. C:\Windows\system32\dnsapi.dll => File is digitally signed
  691. C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed
  692.  
  693. LastRegBack: 2017-12-19 00:45
  694.  
  695. ==================== End of FRST.txt ============================
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!