API tools faq
paste
Guest User

FRST AND ADDITION LOGS

a guest
Dec 19th, 2017
126
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 53.41 KB | None | 0 0
raw download clone embed print report
  1. Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 17-12-2017
  2. Ran by Hakeem (administrator) on HAKEEM-PC (19-12-2017 02:48:10)
  3. Running from C:\Users\Hakeem\Desktop
  4. Loaded Profiles: Hakeem (Available Profiles: Hakeem)
  5. Platform: Microsoft Windows 7 Ultimate Service Pack 1 (X86) Language: English (United States)
  6. Internet Explorer Version 11 (Default browser: IE)
  7. Boot Mode: Normal
  8. Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
  9.  
  10. ==================== Processes (Whitelisted) =================
  11.  
  12. (If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
  13.  
  14. (Microsoft Corporation) C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
  15. (Google Inc.) C:\Program Files\Google\Update\1.3.33.7\GoogleCrashHandler.exe
  16. (TeamViewer GmbH) C:\Program Files\TeamViewer\TeamViewer_Service.exe
  17. (Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
  18. (Microsoft Corporation) C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
  19. (Intel Corporation) C:\Windows\System32\igfxtray.exe
  20. (Intel Corporation) C:\Windows\System32\hkcmd.exe
  21. (Intel Corporation) C:\Windows\System32\igfxpers.exe
  22. (Intel Corporation) C:\Windows\System32\igfxsrvc.exe
  23. (Hewlett-Packard) C:\Program Files\HP\HP Software Update\hpwuschd2.exe
  24. (Microsoft @ 2015) C:\Users\Hakeem\AppData\Roaming\euro_stub.exe
  25. (Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe
  26. (Microsoft Corporation) C:\Windows\System32\wuauclt.exe
  27. (Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
  28. (Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
  29. (Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
  30. (Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
  31. (Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
  32. (Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
  33. (Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
  34. (Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
  35. (Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
  36. (Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
  37. (Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
  38. (Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
  39. () C:\Program Files\Mullvad\mullvad.exe
  40. (Farbar) C:\Users\Hakeem\Desktop\FRST(1).exe
  41.  
  42. ==================== Registry (Whitelisted) ===========================
  43.  
  44. (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
  45.  
  46. HKLM\...\Run: [GrooveMonitor] => C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [31016 2006-10-26] (Microsoft Corporation)
  47. HKLM\...\Run: [HP Software Update] => C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe [49208 2010-06-09] (Hewlett-Packard)
  48. HKLM\...\Run: [Microsoft Default Manager] => C:\Program Files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe [439568 2010-05-10] (Microsoft Corporation)
  49. HKU\S-1-5-21-570141002-2484250258-4068607221-1000\...\Run: [Web Companion] => C:\Program Files\Lavasoft\Web Companion\Application\WebCompanion.exe --minimize
  50. HKU\S-1-5-21-570141002-2484250258-4068607221-1000\...\Run: [BlackBerryLink.exe] => "C:\Program Files\Research In Motion\BlackBerry Link\BlackBerryLink.exe" /minimize
  51. HKU\S-1-5-21-570141002-2484250258-4068607221-1000\...\Run: [Windows 10 Update] => C:\Users\Hakeem\AppData\Roaming\euro_stub.exe [79872 2017-12-18] (Microsoft @ 2015)
  52. HKU\S-1-5-18\...\RunOnce: [SPReview] => C:\Windows\System32\SPReview\SPReview.exe [280576 2017-05-21] (Microsoft Corporation)
  53. Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk [2017-05-03]
  54. ShortcutTarget: Adobe Gamma Loader.lnk -> C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)
  55.  
  56. ==================== Internet (Whitelisted) ====================
  57.  
  58. (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
  59.  
  60. Tcpip\Parameters: [DhcpNameServer] 192.168.176.251 192.168.176.252 192.168.176.253 192.168.176.254
  61. Tcpip\..\Interfaces\{2243CB7C-9F03-4464-81FA-C43989EDA5FB}: [NameServer] 193.138.219.228
  62. Tcpip\..\Interfaces\{2243CB7C-9F03-4464-81FA-C43989EDA5FB}: [DhcpNameServer] 192.168.176.251 192.168.176.252 192.168.176.253 192.168.176.254
  63. Tcpip\..\Interfaces\{60BDDA1B-23B5-4E65-970A-059D32232B45}: [NameServer] 193.138.219.228
  64. Tcpip\..\Interfaces\{D5495F60-C533-451D-B521-E734479C35DE}: [NameServer] 193.138.219.228
  65.  
  66. Internet Explorer:
  67. ==================
  68. BHO: Search Helper -> {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} -> C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll [2010-07-27] (Microsoft Corporation)
  69. BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll [2006-10-26] (Microsoft Corporation)
  70. BHO: Bing Bar BHO -> {d2ce3e00-f94a-4740-988e-03dc2f38c34f} -> C:\Program Files\MSN Toolbar\Platform\6.3.2291.0\npwinext.dll [2010-08-24] (Microsoft Corporation)
  71. Toolbar: HKLM - @C:\Program Files\MSN Toolbar\Platform\6.3.2291.0\npwinext.dll,-100 - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files\MSN Toolbar\Platform\6.3.2291.0\npwinext.dll [2010-08-24] (Microsoft Corporation)
  72. Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll [2006-10-26] (Microsoft Corporation)
  73.  
  74. FireFox:
  75. ========
  76. FF DefaultProfile: hjucpyqh.default
  77. FF ProfilePath: C:\Users\Hakeem\AppData\Roaming\Mozilla\Firefox\Profiles\hjucpyqh.default [2017-12-19]
  78. FF Extension: (Windscribe VPN) - C:\Users\Hakeem\AppData\Roaming\Mozilla\Firefox\Profiles\hjucpyqh.default\Extensions\@windscribeff.xpi [2017-11-20]
  79. FF ProfilePath: C:\Users\Hakeem\AppData\Roaming\Comodo\IceDragon\Profiles\grmga28h.default [2017-07-19]
  80. FF HKLM\...\Firefox\Extensions: [{27182e60-b5f3-411c-b545-b44205977502}] - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\firefoxextension\SearchHelperExtension
  81. FF Extension: (Search Helper Extension) - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\firefoxextension\SearchHelperExtension [2017-05-05] [Legacy] [not signed]
  82. FF HKLM\...\Firefox\Extensions: [{3252b9ae-c69a-4eaf-9502-dc9c1f6c009e}] - C:\Program Files\Microsoft\Search Enhancement Pack\Default Manager\DMExtension
  83. FF Extension: (Default Manager) - C:\Program Files\Microsoft\Search Enhancement Pack\Default Manager\DMExtension [2017-05-05] [Legacy] [not signed]
  84. FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\4.0.50401.0\npctrl.dll [2010-03-31] ( Microsoft Corporation)
  85. FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.33.7\npGoogleUpdate3.dll [2017-12-13] (Google Inc.)
  86. FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.33.7\npGoogleUpdate3.dll [2017-12-13] (Google Inc.)
  87. FF Plugin: @videolan.org/vlc,version=2.2.1 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2015-04-13] (VideoLAN)
  88. FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2017-11-01] (Adobe Systems Inc.)
  89.  
  90. Chrome:
  91. =======
  92. CHR Profile: C:\Users\Hakeem\AppData\Local\Google\Chrome\User Data\Default [2017-12-19]
  93. CHR Extension: (Docs) - C:\Users\Hakeem\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2017-10-12]
  94. CHR Extension: (Google Drive) - C:\Users\Hakeem\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2017-04-12]
  95. CHR Extension: (YouTube) - C:\Users\Hakeem\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2017-04-12]
  96. CHR Extension: (Google Search) - C:\Users\Hakeem\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2017-04-11]
  97. CHR Extension: (GMass: Powerful mail merge for Gmail) - C:\Users\Hakeem\AppData\Local\Google\Chrome\User Data\Default\Extensions\ehomdgjhgmbidokdgicgmdiedadncbgf [2017-09-21]
  98. CHR Extension: (Google Docs Offline) - C:\Users\Hakeem\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2017-04-11]
  99. CHR Extension: (Chrome Web Store Payments) - C:\Users\Hakeem\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-08-21]
  100. CHR Extension: (Gmail) - C:\Users\Hakeem\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2017-04-12]
  101. CHR Extension: (Chrome Media Router) - C:\Users\Hakeem\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-12-13]
  102.  
  103. ==================== Services (Whitelisted) ====================
  104.  
  105. (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
  106.  
  107. R2 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe [4563920 2017-11-01] (Malwarebytes)
  108. R2 TeamViewer; C:\Program Files\TeamViewer\TeamViewer_Service.exe [10884848 2017-05-23] (TeamViewer GmbH)
  109. R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [680960 2013-05-26] (Microsoft Corporation)
  110.  
  111. ===================== Drivers (Whitelisted) ======================
  112.  
  113. (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
  114.  
  115. S3 blackberryncm; C:\Windows\System32\DRIVERS\blackberryncm6.sys [20992 2014-04-15] (BlackBerry) [File not signed]
  116. R1 ESProtectionDriver; C:\Windows\system32\drivers\mbae.sys [59896 2017-11-29] ()
  117. R2 MBAMChameleon; C:\Windows\System32\Drivers\MbamChameleon.sys [168376 2017-12-18] (Malwarebytes)
  118. R3 MBAMFarflt; C:\Windows\System32\DRIVERS\farflt.sys [91576 2017-12-19] (Malwarebytes)
  119. R3 MBAMProtection; C:\Windows\System32\DRIVERS\mbam.sys [40376 2017-12-19] (Malwarebytes)
  120. R0 MBAMSwissArmy; C:\Windows\System32\Drivers\mbamswissarmy.sys [221112 2017-12-18] (Malwarebytes)
  121. R3 MBAMWebProtection; C:\Windows\System32\DRIVERS\mwac.sys [65824 2017-12-19] (Malwarebytes)
  122. S3 rimvndis; C:\Windows\System32\Drivers\rimvndis6.sys [14336 2014-06-23] (Research in Motion Limited)
  123. R3 tap0901; C:\Windows\System32\DRIVERS\tap0901.sys [35288 2017-05-13] (The OpenVPN Project)
  124. S3 usbrndis6; C:\Windows\System32\DRIVERS\usb80236.sys [15872 2013-02-11] (Microsoft Corporation)
  125. S3 wdm_usb; C:\Windows\System32\DRIVERS\usb2ser.sys [128704 2016-08-15] (MBB)
  126. S3 ewusbmbb; system32\DRIVERS\ewusbwwan.sys [X]
  127. S3 huawei_enumerator; system32\DRIVERS\ew_jubusenum.sys [X]
  128. S3 hwdatacard; system32\DRIVERS\ewusbmdm.sys [X]
  129. S3 RimUsb; System32\Drivers\RimUsb.sys [X]
  130. S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [X]
  131. S3 tsusbhub; system32\drivers\tsusbhub.sys [X]
  132. S3 VGPU; System32\drivers\rdvgkmd.sys [X]
  133.  
  134. ==================== NetSvcs (Whitelisted) ===================
  135.  
  136. (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
  137.  
  138.  
  139. ==================== One Month Created files and folders ========
  140.  
  141. (If an entry is included in the fixlist, the file/folder will be moved.)
  142.  
  143. 2017-12-19 02:48 - 2017-12-19 02:49 - 000011275 _____ C:\Users\Hakeem\Desktop\FRST.txt
  144. 2017-12-19 02:41 - 2017-12-19 02:41 - 000000000 ____D C:\Users\Hakeem\Desktop\FRST-OlderVersion
  145. 2017-12-18 21:51 - 2017-12-18 21:51 - 000001935 _____ C:\Users\Hakeem\Desktop\JRT.txt
  146. 2017-12-18 21:46 - 2017-12-18 21:46 - 000000052 _____ C:\Users\Hakeem\Desktop\dangote.txt
  147. 2017-12-18 19:01 - 2017-12-19 01:56 - 000000053 _____ C:\Users\Hakeem\Desktop\airrrrrrrrr.txt
  148. 2017-12-18 03:42 - 2017-12-18 03:42 - 000080065 _____ C:\Users\Hakeem\Desktop\receipt of transfer.zip
  149. 2017-12-18 02:22 - 2017-12-19 02:37 - 000065824 _____ (Malwarebytes) C:\Windows\system32\Drivers\mwac.sys
  150. 2017-12-18 02:22 - 2017-12-19 01:22 - 000091576 _____ (Malwarebytes) C:\Windows\system32\Drivers\farflt.sys
  151. 2017-12-18 02:22 - 2017-12-19 01:22 - 000040376 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbam.sys
  152. 2017-12-18 02:22 - 2017-12-18 02:22 - 000221112 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbamswissarmy.sys
  153. 2017-12-18 02:22 - 2017-12-18 02:22 - 000168376 _____ (Malwarebytes) C:\Windows\system32\Drivers\MbamChameleon.sys
  154. 2017-12-18 01:33 - 2017-12-18 01:33 - 000079906 _____ C:\Users\Hakeem\Desktop\receipt of transfer.exe
  155. 2017-12-18 01:29 - 2017-12-18 01:29 - 000079872 ____H (Microsoft @ 2015) C:\Users\Hakeem\AppData\Roaming\euro_stub.exe
  156. 2017-12-17 22:52 - 2017-12-17 22:52 - 000089600 ____H (Microsoft @ 2015) C:\Users\Hakeem\AppData\Roaming\dhl_tracking.exe
  157. 2017-12-17 21:50 - 2017-12-17 21:50 - 000019907 _____ C:\Users\Hakeem\Desktop\doctor.txt
  158. 2017-12-17 19:49 - 2017-12-17 19:49 - 068850274 __RSH () C:\Users\Hakeem\AppData\Roaming\eeSQOM64aK.exe
  159. 2017-12-17 07:40 - 2017-12-17 07:41 - 000000000 ____D C:\Users\Hakeem\Desktop\New folder
  160. 2017-12-16 20:44 - 2017-11-25 21:54 - 001885696 _____ C:\Users\Hakeem\Desktop\Flow Crypter V4.exe
  161. 2017-12-16 18:22 - 2017-12-16 11:28 - 001818768 _____ C:\Users\Hakeem\Desktop\Flow crypter v4.rar
  162. 2017-12-16 11:28 - 2017-12-16 11:28 - 001818768 _____ C:\Users\Hakeem\Downloads\Flow crypter v4.rar
  163. 2017-12-13 21:00 - 2017-07-24 19:01 - 000000000 ____D C:\Users\Hakeem\Desktop\linkedin.com
  164. 2017-12-13 20:51 - 2017-12-13 20:52 - 001138166 _____ C:\Users\Hakeem\Downloads\linkedin17.zip
  165. 2017-12-13 20:50 - 2017-12-13 20:50 - 000014577 _____ C:\Users\Hakeem\Downloads\azzzz.html
  166. 2017-12-13 13:19 - 2017-12-13 13:19 - 000000059 ____H C:\Users\Hakeem\AppData\Roaming\TMP_4728
  167. 2017-12-13 13:14 - 2017-12-13 13:14 - 000083968 ____H (Microsoft @ 2015) C:\Users\Hakeem\AppData\Roaming\swift_remittance.exe
  168. 2017-12-13 12:43 - 2017-12-13 12:43 - 000001980 _____ C:\Users\Public\Desktop\Malwarebytes.lnk
  169. 2017-12-13 12:43 - 2017-12-13 12:43 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes
  170. 2017-12-13 12:43 - 2017-12-13 12:43 - 000000000 ____D C:\ProgramData\Malwarebytes
  171. 2017-12-13 12:43 - 2017-12-13 12:43 - 000000000 ____D C:\Program Files\Malwarebytes
  172. 2017-12-13 12:43 - 2017-11-29 09:11 - 000059896 _____ C:\Windows\system32\Drivers\mbae.sys
  173. 2017-12-13 12:20 - 2017-12-13 12:42 - 083316440 _____ (Malwarebytes ) C:\Users\Hakeem\Downloads\mb3-setup-consumer-3.3.1.2183-1.0.262-1.0.3374.exe
  174. 2017-12-13 11:49 - 2017-12-13 11:49 - 000000047 ____H C:\Users\Hakeem\Documents\TMP_4728
  175. 2017-12-13 11:46 - 2017-12-18 22:40 - 000270848 _____ () C:\Users\Hakeem\AppData\Roaming\Ranger.BrowserLogging.dll
  176. 2017-12-13 11:46 - 2017-12-18 22:40 - 000202240 _____ C:\Users\Hakeem\AppData\Roaming\ranger.browserlogging.vault.dll
  177. 2017-12-13 11:46 - 2017-12-13 11:46 - 000078336 ____H (Microsoft @ 2015) C:\Users\Hakeem\Documents\stub_orion.exe
  178. 2017-12-13 11:29 - 2017-12-11 10:40 - 001444775 _____ C:\Users\Hakeem\Desktop\orion_2.1.zip
  179. 2017-12-13 05:15 - 2017-12-13 05:15 - 000000711 _____ C:\Users\Hakeem\Desktop\connect.zip
  180. 2017-12-13 05:09 - 2017-11-16 16:15 - 002402816 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
  181. 2017-12-13 05:09 - 2017-11-14 12:36 - 000347336 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
  182. 2017-12-13 05:09 - 2017-11-13 13:37 - 013679616 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
  183. 2017-12-13 05:09 - 2017-11-13 13:15 - 000416256 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
  184. 2017-12-13 05:09 - 2017-11-13 13:15 - 000279040 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
  185. 2017-12-13 05:09 - 2017-11-13 13:15 - 000076288 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
  186. 2017-12-13 05:09 - 2017-11-13 13:10 - 020269056 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
  187. 2017-12-13 05:09 - 2017-11-13 12:32 - 000499200 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
  188. 2017-12-13 05:09 - 2017-11-13 12:31 - 000064000 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
  189. 2017-12-13 05:09 - 2017-11-07 08:56 - 002724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
  190. 2017-12-13 05:09 - 2017-11-07 08:56 - 000004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
  191. 2017-12-13 05:09 - 2017-11-07 08:46 - 000341504 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
  192. 2017-12-13 05:09 - 2017-11-07 08:46 - 000062464 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
  193. 2017-12-13 05:09 - 2017-11-07 08:46 - 000047616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
  194. 2017-12-13 05:09 - 2017-11-07 08:44 - 002293760 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
  195. 2017-12-13 05:09 - 2017-11-07 08:41 - 000047104 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
  196. 2017-12-13 05:09 - 2017-11-07 08:41 - 000030720 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
  197. 2017-12-13 05:09 - 2017-11-07 08:40 - 000476160 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
  198. 2017-12-13 05:09 - 2017-11-07 08:39 - 000662016 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
  199. 2017-12-13 05:09 - 2017-11-07 08:39 - 000104960 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
  200. 2017-12-13 05:09 - 2017-11-07 08:38 - 000620032 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
  201. 2017-12-13 05:09 - 2017-11-07 08:38 - 000115712 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
  202. 2017-12-13 05:09 - 2017-11-07 08:35 - 000667648 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
  203. 2017-12-13 05:09 - 2017-11-07 08:29 - 000060416 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
  204. 2017-12-13 05:09 - 2017-11-07 08:28 - 000091136 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
  205. 2017-12-13 05:09 - 2017-11-07 08:28 - 000073216 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx
  206. 2017-12-13 05:09 - 2017-11-07 08:27 - 004509696 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
  207. 2017-12-13 05:09 - 2017-11-07 08:26 - 000168960 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
  208. 2017-12-13 05:09 - 2017-11-07 08:24 - 000130048 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
  209. 2017-12-13 05:09 - 2017-11-07 08:19 - 000230400 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
  210. 2017-12-13 05:09 - 2017-11-07 08:18 - 000694272 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
  211. 2017-12-13 05:09 - 2017-11-07 08:18 - 000690688 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
  212. 2017-12-13 05:09 - 2017-11-07 08:17 - 002058752 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
  213. 2017-12-13 05:09 - 2017-11-07 08:17 - 001155072 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
  214. 2017-12-13 05:09 - 2017-11-07 08:04 - 002767872 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
  215. 2017-12-13 05:09 - 2017-11-07 08:01 - 001313280 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
  216. 2017-12-13 05:09 - 2017-11-07 07:58 - 000710144 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
  217. 2017-12-13 05:09 - 2017-11-07 04:13 - 000002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
  218. 2017-12-13 05:09 - 2017-11-04 03:10 - 000158720 _____ (Microsoft Corporation) C:\Windows\system32\itircl.dll
  219. 2017-12-13 05:09 - 2017-11-04 03:10 - 000142336 _____ (Microsoft Corporation) C:\Windows\system32\itss.dll
  220. 2017-12-13 05:09 - 2017-11-02 03:11 - 000271360 _____ (Microsoft Corporation) C:\Windows\system32\iprtrmgr.dll
  221. 2017-12-13 05:09 - 2017-11-02 03:11 - 000115200 _____ (Microsoft Corporation) C:\Windows\system32\rtm.dll
  222. 2017-12-13 05:09 - 2017-11-02 03:11 - 000075264 _____ (Microsoft Corporation) C:\Windows\system32\mprdim.dll
  223. 2017-12-13 05:09 - 2017-11-02 02:56 - 000008192 _____ (Microsoft Corporation) C:\Windows\system32\iprtprio.dll
  224. 2017-12-13 05:09 - 2017-10-16 10:46 - 000953344 _____ (Microsoft Corporation) C:\Windows\system32\gpedit.dll
  225. 2017-12-13 05:09 - 2017-10-11 12:14 - 000247808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rdbss.sys
  226. 2017-12-13 05:04 - 2017-12-13 05:04 - 000001204 _____ C:\Users\Hakeem\Desktop\allha.php
  227. 2017-12-13 04:00 - 2017-12-18 18:57 - 000002101 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
  228. 2017-12-13 04:00 - 2017-12-18 18:57 - 000002089 _____ C:\Users\Public\Desktop\Google Chrome.lnk
  229. 2017-12-13 03:39 - 2017-12-13 03:42 - 001129816 _____ (Google Inc.) C:\Users\Hakeem\Downloads\ChromeSetup(1).exe
  230. 2017-12-13 03:07 - 2017-12-13 03:09 - 000113799 _____ C:\Users\Hakeem\Desktop\dbx.zip
  231. 2017-12-13 02:30 - 2017-12-13 02:31 - 000000000 ____D C:\Users\Hakeem\Desktop\linkdin
  232. 2017-12-13 02:28 - 2017-12-13 02:28 - 000021185 _____ C:\Users\Hakeem\Downloads\LINKIN FIXED.zip
  233. 2017-12-13 02:27 - 2017-12-13 02:27 - 000136894 _____ C:\Users\Hakeem\Downloads\DROPBB.zip
  234. 2017-12-11 10:54 - 2017-12-11 10:54 - 000000000 ____D C:\Users\Hakeem\AppData\Local\TeamViewer
  235. 2017-12-11 10:46 - 2017-12-12 21:39 - 000000000 ____D C:\Users\Hakeem\Desktop\Orion Keylogger 2.1
  236. 2017-12-11 10:39 - 2017-12-11 10:40 - 001444775 _____ C:\Users\Hakeem\Downloads\orion_2.1.zip
  237. 2017-12-11 07:06 - 2017-12-11 07:06 - 000250968 _____ C:\Windows\Minidump\121117-17222-01.dmp
  238. 2017-12-09 10:58 - 2017-12-17 19:01 - 000000027 _____ C:\Users\Hakeem\Desktop\ikkktsee.txt
  239. 2017-12-06 08:26 - 2017-12-06 21:29 - 000000000 ____D C:\Users\Hakeem\Desktop\allleads
  240. 2017-12-06 02:45 - 2017-12-06 02:57 - 000001235 _____ C:\Users\Hakeem\Desktop.msf
  241. 2017-12-05 23:51 - 2017-12-05 23:59 - 000000000 ____D C:\Users\Hakeem\AppData\Local\Thunderbird
  242. 2017-12-05 23:51 - 2017-12-05 23:51 - 000002004 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Thunderbird.lnk
  243. 2017-12-05 23:51 - 2017-12-05 23:51 - 000001992 _____ C:\Users\Public\Desktop\Mozilla Thunderbird.lnk
  244. 2017-12-05 23:51 - 2017-12-05 23:51 - 000000000 ____D C:\Users\Hakeem\AppData\Roaming\Thunderbird
  245. 2017-12-05 23:51 - 2017-12-05 23:51 - 000000000 ____D C:\ProgramData\Mozilla
  246. 2017-12-05 23:51 - 2017-12-05 23:51 - 000000000 ____D C:\Program Files\Mozilla Thunderbird
  247. 2017-12-05 23:47 - 2017-12-05 23:50 - 019828840 _____ (Mozilla) C:\Users\Hakeem\Downloads\Thunderbird-Setup-17-0-8.exe
  248. 2017-12-05 06:24 - 2017-12-05 06:24 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\pidgin-otr
  249. 2017-12-05 06:19 - 2017-12-05 06:22 - 007140873 _____ C:\Users\Hakeem\Downloads\pidgin-otr-4.0.2.exe
  250. 2017-11-30 22:44 - 2017-12-19 02:36 - 000000000 ____D C:\Program Files\Mullvad
  251. 2017-11-30 22:44 - 2017-11-30 22:44 - 012794677 _____ C:\Users\Hakeem\Downloads\mullvad-65.exe
  252. 2017-11-30 22:44 - 2017-11-30 22:44 - 000000939 _____ C:\Users\Hakeem\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Mullvad.lnk
  253. 2017-11-30 11:41 - 2017-11-30 11:45 - 000539719 _____ C:\Users\Hakeem\Downloads\Unconfirmed 758777.crdownload
  254. 2017-11-27 10:10 - 2017-12-18 22:37 - 000004319 _____ C:\Users\Hakeem\Desktop\na so.txt
  255. 2017-11-26 03:10 - 2017-11-26 03:13 - 010406558 _____ C:\Users\Hakeem\Downloads\wordpress-4.9.zip
  256. 2017-11-25 19:58 - 2017-11-25 19:58 - 000000053 _____ C:\Users\Hakeem\Downloads\google5ce67675a78f7530.html
  257. 2017-11-25 19:58 - 2017-11-25 19:58 - 000000053 _____ C:\Users\Hakeem\Downloads\google5ce67675a78f7530 (1).html
  258. 2017-11-25 18:18 - 2017-11-25 18:18 - 000000000 ____D C:\Users\Hakeem\AppData\Local\ElevatedDiagnostics
  259. 2017-11-25 18:02 - 2017-11-25 18:02 - 000712772 _____ C:\Users\Hakeem\Downloads\'Autopilot
  260. 2017-11-25 04:25 - 2017-12-13 18:34 - 000000673 _____ C:\Users\Hakeem\Desktop\winbet.txt
  261.  
  262. ==================== One Month Modified files and folders ========
  263.  
  264. (If an entry is included in the fixlist, the file/folder will be moved.)
  265.  
  266. 2017-12-19 02:48 - 2017-07-18 17:06 - 000000000 ____D C:\FRST
  267. 2017-12-19 02:41 - 2017-07-19 08:24 - 001752576 _____ (Farbar) C:\Users\Hakeem\Desktop\FRST(1).exe
  268. 2017-12-19 01:30 - 2009-07-13 16:34 - 000016944 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
  269. 2017-12-19 01:30 - 2009-07-13 16:34 - 000016944 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
  270. 2017-12-19 01:25 - 2017-05-25 08:39 - 000000000 ____D C:\Users\Hakeem\AppData\LocalLow\Mozilla
  271. 2017-12-19 01:22 - 2009-07-13 16:53 - 000000006 ____H C:\Windows\Tasks\SA.DAT
  272. 2017-12-18 21:54 - 2017-07-20 00:44 - 000024688 _____ C:\Windows\system32\Drivers\TrueSight.sys
  273. 2017-12-18 21:48 - 2017-05-29 09:13 - 000000000 ____D C:\Users\Hakeem\AppData\Roaming\.purple
  274. 2017-12-18 02:38 - 2017-05-24 09:42 - 000000000 ____D C:\Users\Hakeem\AppData\Local\CrashDumps
  275. 2017-12-17 07:59 - 2017-06-12 01:10 - 000000000 ____D C:\Program Files\TeamViewer
  276. 2017-12-16 02:01 - 2009-07-13 16:53 - 000032618 _____ C:\Windows\Tasks\SCHEDLGU.TXT
  277. 2017-12-15 00:57 - 2009-07-13 14:37 - 000000000 ____D C:\Windows\rescache
  278. 2017-12-13 17:59 - 2009-07-13 16:33 - 000411680 _____ C:\Windows\system32\FNTCACHE.DAT
  279. 2017-12-13 17:57 - 2009-07-13 14:37 - 000000000 ____D C:\Windows\system32\Setup
  280. 2017-12-13 10:51 - 2017-04-11 08:50 - 000109280 _____ C:\Users\Hakeem\AppData\Local\GDIPFONTCACHEV1.DAT
  281. 2017-12-13 07:11 - 2017-05-25 06:07 - 000000000 ____D C:\Program Files\Mozilla Firefox
  282. 2017-12-13 07:11 - 2017-04-11 08:47 - 000000000 ____D C:\Program Files\Mozilla Maintenance Service
  283. 2017-12-13 03:59 - 2017-08-20 06:11 - 000000000 ____D C:\Program Files\Google
  284. 2017-12-13 03:01 - 2017-04-11 08:21 - 000000000 ____D C:\Users\Hakeem
  285. 2017-12-13 03:00 - 2009-07-13 14:37 - 000000000 ____D C:\Windows\registration
  286. 2017-12-13 03:00 - 2009-07-13 14:37 - 000000000 ____D C:\Windows\inf
  287. 2017-12-11 11:03 - 2017-06-12 01:10 - 000000000 ____D C:\Users\Hakeem\AppData\Roaming\TeamViewer
  288. 2017-12-11 07:06 - 2017-04-12 17:42 - 000000000 ____D C:\Windows\Minidump
  289. 2017-12-11 07:05 - 2017-04-12 17:42 - 203500508 _____ C:\Windows\MEMORY.DMP
  290. 2017-12-10 04:46 - 2017-04-11 12:29 - 000002276 _____ C:\Users\Hakeem\Desktop\wallet.txt
  291. 2017-12-06 04:56 - 2017-07-24 04:24 - 000000000 ____D C:\Users\Hakeem\AppData\Roaming\TurboMailer
  292. 2017-12-05 06:24 - 2017-07-15 02:12 - 000000000 ____D C:\Program Files\pidgin-otr
  293. 2017-12-03 22:00 - 2017-04-11 08:27 - 000781790 _____ C:\Windows\system32\PerfStringBackup.INI
  294. 2017-11-25 18:18 - 2009-07-13 14:37 - 000000000 ____D C:\Windows\system32\NDF
  295.  
  296. ==================== Files in the root of some directories =======
  297.  
  298. 2017-12-17 22:52 - 2017-12-17 22:52 - 000089600 ____H (Microsoft @ 2015) C:\Users\Hakeem\AppData\Roaming\dhl_tracking.exe
  299. 2017-11-12 04:01 - 2017-11-12 04:01 - 067566946 __RSH () C:\Users\Hakeem\AppData\Roaming\eeA86qomIo.exe
  300. 2017-12-17 19:49 - 2017-12-17 19:49 - 068850274 __RSH () C:\Users\Hakeem\AppData\Roaming\eeSQOM64aK.exe
  301. 2017-12-18 01:29 - 2017-12-18 01:29 - 000079872 ____H (Microsoft @ 2015) C:\Users\Hakeem\AppData\Roaming\euro_stub.exe
  302. 2017-12-13 11:46 - 2017-12-18 22:40 - 000270848 _____ () C:\Users\Hakeem\AppData\Roaming\Ranger.BrowserLogging.dll
  303. 2017-12-13 11:46 - 2017-12-18 22:40 - 000202240 _____ () C:\Users\Hakeem\AppData\Roaming\ranger.browserlogging.vault.dll
  304. 2017-12-13 13:14 - 2017-12-13 13:14 - 000083968 ____H (Microsoft @ 2015) C:\Users\Hakeem\AppData\Roaming\swift_remittance.exe
  305. 2017-12-13 13:19 - 2017-12-13 13:19 - 000000059 ____H () C:\Users\Hakeem\AppData\Roaming\TMP_4728
  306. 2017-10-25 20:29 - 2017-10-27 02:54 - 000059234 ___SH () C:\Users\Hakeem\AppData\Local\CSIDL_
  307. 2017-05-24 04:27 - 2017-08-19 07:57 - 000000600 _____ () C:\Users\Hakeem\AppData\Local\PUTTY.RND
  308.  
  309. Some files in TEMP:
  310. ====================
  311. 2017-11-12 23:00 - 2017-11-12 23:00 - 000253952 _____ () C:\Users\Hakeem\AppData\Local\Temp\awmoo.exe
  312. 2017-12-17 07:26 - 2017-12-17 07:26 - 000007680 ____H () C:\Users\Hakeem\AppData\Local\Temp\bfsvc.exe
  313. 2017-11-12 04:02 - 2017-04-21 03:15 - 000805376 _____ (Microsoft Corporation) C:\Users\Hakeem\AppData\Local\Temp\cdo2249078341.dll
  314. 2017-11-13 05:47 - 2017-11-13 05:47 - 000253952 _____ () C:\Users\Hakeem\AppData\Local\Temp\ciagi.exe
  315. 2017-12-17 23:24 - 2017-12-17 23:24 - 000229376 _____ () C:\Users\Hakeem\AppData\Local\Temp\ckewe.exe
  316. 2017-11-12 10:34 - 2017-11-12 10:34 - 000253952 _____ () C:\Users\Hakeem\AppData\Local\Temp\csoge.exe
  317. 2017-10-29 21:35 - 2017-09-13 03:10 - 001310528 _____ (Microsoft Corporation) C:\Users\Hakeem\AppData\Local\Temp\dllnt_dump.dll
  318. 2017-12-18 18:52 - 2017-12-18 18:52 - 000229376 _____ () C:\Users\Hakeem\AppData\Local\Temp\iooqi.exe
  319. 2017-12-17 22:44 - 2017-12-17 22:44 - 000229376 _____ () C:\Users\Hakeem\AppData\Local\Temp\qgyuu.exe
  320. 2017-12-17 07:27 - 2017-12-17 07:27 - 000270848 _____ () C:\Users\Hakeem\AppData\Local\Temp\Ranger.BrowserLogging.dll
  321. 2017-12-17 07:27 - 2017-12-17 07:27 - 000202240 _____ () C:\Users\Hakeem\AppData\Local\Temp\ranger.browserlogging.vault.dll
  322. 2017-11-14 18:58 - 2017-11-14 18:58 - 000253952 _____ () C:\Users\Hakeem\AppData\Local\Temp\rhfft.exe
  323. 2017-11-13 03:11 - 2017-11-13 03:11 - 000253952 _____ () C:\Users\Hakeem\AppData\Local\Temp\sggqg.exe
  324. 2017-11-12 06:14 - 2017-11-12 06:14 - 000253952 _____ () C:\Users\Hakeem\AppData\Local\Temp\uoqum.exe
  325. 2017-11-14 05:40 - 2017-11-14 05:40 - 000253952 _____ () C:\Users\Hakeem\AppData\Local\Temp\zphfv.exe
  326. 2017-11-08 07:42 - 2017-11-08 07:53 - 000000000 _____ () C:\Users\Hakeem\AppData\Local\Temp\{0CDFA6E4-2973-4A2A-B1CB-6CB713C48180}-62.0.3202.89_61.0.3163.100_chrome_updater.exe
  327.  
  328. ==================== Bamital & volsnap ======================
  329.  
  330. (There is no automatic fix for files that do not pass verification.)
  331.  
  332. C:\Windows\explorer.exe => File is digitally signed
  333. C:\Windows\system32\winlogon.exe => File is digitally signed
  334. C:\Windows\system32\wininit.exe => File is digitally signed
  335. C:\Windows\system32\svchost.exe => File is digitally signed
  336. C:\Windows\system32\services.exe => File is digitally signed
  337. C:\Windows\system32\User32.dll => File is digitally signed
  338. C:\Windows\system32\userinit.exe => File is digitally signed
  339. C:\Windows\system32\rpcss.dll => File is digitally signed
  340. C:\Windows\system32\dnsapi.dll => File is digitally signed
  341. C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed
  342.  
  343. LastRegBack: 2017-12-19 00:45
  344.  
  345. ==================== End of FRST.txt ============================
  346.  
  347.  
  348.  
  349.  
  350.  
  351. Additional scan result of Farbar Recovery Scan Tool (x86) Version: 17-12-2017
  352. Ran by Hakeem (19-12-2017 02:49:51)
  353. Running from C:\Users\Hakeem\Desktop
  354. Microsoft Windows 7 Ultimate Service Pack 1 (X86) (2017-04-11 20:21:41)
  355. Boot Mode: Normal
  356. ==========================================================
  357.  
  358.  
  359. ==================== Accounts: =============================
  360.  
  361. Administrator (S-1-5-21-570141002-2484250258-4068607221-500 - Administrator - Disabled)
  362. Guest (S-1-5-21-570141002-2484250258-4068607221-501 - Limited - Disabled)
  363. Hakeem (S-1-5-21-570141002-2484250258-4068607221-1000 - Administrator - Enabled) => C:\Users\Hakeem
  364.  
  365. ==================== Security Center ========================
  366.  
  367. (If an entry is included in the fixlist, it will be removed.)
  368.  
  369. AV: Malwarebytes (Enabled - Up to date) {23007AD3-69FE-687C-2629-D584AFFAF72B}
  370. AS: Malwarebytes (Enabled - Up to date) {98619B37-4FC4-67F2-1C99-EEF6D47DBD96}
  371. AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
  372.  
  373. ==================== Installed Programs ======================
  374.  
  375. (Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
  376.  
  377. 7capture 1.2.0.21 (HKLM\...\7capture_is1) (Version: 1.2.0.21 - IBE Software)
  378. Adobe Photoshop 7.0 (HKLM\...\Adobe Photoshop 7.0) (Version: 7.0 - Adobe Systems, Inc.)
  379. Adobe Reader XI (11.0.23) (HKLM\...\{AC76BA86-7AD7-1033-7B44-AB0000000001}) (Version: 11.0.23 - Adobe Systems Incorporated)
  380. Advanced Mass Sender 4.3 (HKLM\...\Advanced Mass Sender 4.3) (Version: - )
  381. Bing Bar Platform (HKLM\...\{623B8278-8CAD-45C1-B844-58B687C07805}) (Version: 6.3.2291.0 - Microsoft Corporation) Hidden
  382. Bing Rewards Client Installer (HKLM\...\{61EDBE71-5D3E-4AB7-AD95-E53FEAF68C17}) (Version: 16.0.345.0 - Microsoft Corporation) Hidden
  383. Coupon Printer for Windows (HKLM\...\Coupon Printer for Windows5.0.0.0) (Version: 5.0.0.0 - Coupons.com Incorporated)
  384. FileZilla Client 3.27.0.1 (HKLM\...\FileZilla Client) (Version: 3.27.0.1 - Tim Kosse)
  385. Google Chrome (HKLM\...\Google Chrome) (Version: 63.0.3239.108 - Google Inc.)
  386. Google Update Helper (HKLM\...\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}) (Version: 1.3.33.7 - Google Inc.) Hidden
  387. HP Deskjet 2050 J510 series Basic Device Software (HKLM\...\{E654D1E3-B18B-4953-BFBC-F16227323E05}) (Version: 22.50.231.0 - Hewlett-Packard Co.)
  388. HP Deskjet 2050 J510 series Help (HKLM\...\{7A3DF2E2-CF13-44FB-A93E-F71D5381DB3F}) (Version: 140.0.61.61 - Hewlett Packard)
  389. HP Photo Creations (HKLM\...\HP Photo Creations) (Version: 1.0.0.3781 - HP Photo Creations Powered by RocketLife)
  390. HP Update (HKLM\...\{B0069CFA-5BB9-4C03-B1C6-89CE290E5AFE}) (Version: 5.002.006.003 - Hewlett-Packard)
  391. Intel(R) Graphics Media Accelerator Driver (HKLM\...\HDMI) (Version: 8.15.10.1930 - Intel Corporation)
  392. Malwarebytes version 3.3.1.2183 (HKLM\...\{35065F43-4BB2-439A-BFF7-0F1014F2E0CD}_is1) (Version: 3.3.1.2183 - Malwarebytes)
  393. Microsoft .NET Framework 4.7 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.7.02053 - Microsoft Corporation)
  394. Microsoft Office Enterprise 2007 (HKLM\...\ENTERPRISE) (Version: 12.0.4518.1014 - Microsoft Corporation)
  395. Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 4.0.50401.0 - Microsoft Corporation)
  396. Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
  397. Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
  398. Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
  399. Mozilla Firefox 57.0.2 (x86 en-US) (HKLM\...\Mozilla Firefox 57.0.2 (x86 en-US)) (Version: 57.0.2 - Mozilla)
  400. Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 57.0.2.6549 - Mozilla)
  401. Mozilla Thunderbird 17.0.8 (x86 en-US) (HKLM\...\Mozilla Thunderbird 17.0.8 (x86 en-US)) (Version: 17.0.8 - Mozilla)
  402. Mullvad (HKLM\...\Product) (Version: - )
  403. Notepad++ (32-bit x86) (HKLM\...\Notepad++) (Version: 7.3.3 - Notepad++ Team)
  404. Pidgin (HKLM\...\Pidgin) (Version: 2.12.0 - )
  405. pidgin-otr 4.0.2 (HKLM\...\pidgin-otr) (Version: 4.0.2 - Cypherpunks CA)
  406. RogueKiller version 12.11.7.0 (HKLM\...\8B3D7924-ED89-486B-8322-E8594065D5CB_is1) (Version: 12.11.7.0 - Adlice Software)
  407. SendBlaster 3 (HKLM\...\{486575DF-CC13-4F89-8636-C2CC5BDA7246}) (Version: 003.001.00006 - eDisplay srl)
  408. TeamViewer 12 (HKLM\...\TeamViewer) (Version: 12.0.78313 - TeamViewer)
  409. Telegram Desktop version 1.1.7 (HKU\S-1-5-21-570141002-2484250258-4068607221-1000\...\{53F49750-6209-4FBF-9CA8-7A333C87D1ED}_is1) (Version: 1.1.7 - Telegram Messenger LLP)
  410. TurboMailer 2 (HKLM\...\{9E156899-D3A1-4F10-8323-364A095FCFDB}}_is1) (Version: - Xellsoft.com)
  411. VLC media player (HKLM\...\VLC media player) (Version: 2.2.1 - VideoLAN)
  412. WinHTTrack Website Copier 3.49-1 (HKLM\...\WinHTTrack Website Copier_is1) (Version: 3.49.1 - HTTrack)
  413. WinRAR 4.01 (32-bit) (HKLM\...\WinRAR archiver) (Version: 4.01.0 - win.rar GmbH)
  414. XAMPP (HKLM\...\xampp) (Version: 5.6.30-0 - Bitnami)
  415.  
  416. ==================== Custom CLSID (Whitelisted): ==========================
  417.  
  418. (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
  419.  
  420. CustomCLSID: HKU\S-1-5-21-570141002-2484250258-4068607221-1000_Classes\CLSID\{CB492AF1-2CEF-4E58-BE47-471C77D0C8BA}\InprocServer32 -> C:\Users\Hakeem\AppData\Local\Google\Update\1.3.32.7\psuser.dll => No File
  421. ContextMenuHandlers1: [ANotepad++] -> {00F3C2EC-A6EE-11DE-A03A-EF8F55D89593} => C:\Program Files\Notepad++\NppShell_06.dll [2017-03-07] ()
  422. ContextMenuHandlers1: [WinRAR] -> {B41DB860-8EE4-11D2-9906-E49FADC173CA} => C:\Program Files\WinRAR\rarext.dll [2011-05-28] ()
  423. ContextMenuHandlers3: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2017-11-01] (Malwarebytes)
  424. ContextMenuHandlers4: [WinRAR] -> {B41DB860-8EE4-11D2-9906-E49FADC173CA} => C:\Program Files\WinRAR\rarext.dll [2011-05-28] ()
  425. ContextMenuHandlers5: [igfxcui] -> {3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4} => C:\Windows\system32\igfxpph.dll [2009-09-23] (Intel Corporation)
  426. ContextMenuHandlers6: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2017-11-01] (Malwarebytes)
  427. ContextMenuHandlers6: [WinRAR] -> {B41DB860-8EE4-11D2-9906-E49FADC173CA} => C:\Program Files\WinRAR\rarext.dll [2011-05-28] ()
  428.  
  429. ==================== Scheduled Tasks (Whitelisted) =============
  430.  
  431. (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
  432.  
  433. Task: {0FBEA709-4E39-4271-8ABF-39E80E30E00C} - System32\Tasks\HPCustParticipation HP Deskjet 2050 J510 series => C:\Program Files\HP\HP Deskjet 2050 J510 series\Bin\HPCustPartic.exe [2010-11-16] (Hewlett-Packard Co.)
  434. Task: {1242DEC0-A6F2-4C6F-8579-472523ED69BB} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2017-12-13] (Google Inc.)
  435. Task: {167E61DF-3577-45B8-8858-9AB6A51923CD} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2017-12-13] (Google Inc.)
  436. Task: {91BC85DF-EA06-484C-BA5A-19880C86622F} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2017-09-27] (Adobe Systems Incorporated)
  437. Task: {B3C8ED6D-24CF-4F43-9EE0-BD6330694C55} - System32\Tasks\Microsoft\Windows\Setup\EOSNotify => C:\Windows\system32\EOSNotify.exe [2016-06-25] (Microsoft Corporation)
  438.  
  439. (If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
  440.  
  441.  
  442. ==================== Shortcuts & WMI ========================
  443.  
  444. (The entries could be listed to be restored or removed.)
  445.  
  446.  
  447. ==================== Loaded Modules (Whitelisted) ==============
  448.  
  449. 2017-07-19 04:21 - 2017-07-19 04:21 - 000073384 _____ () C:\Program Files\FileZilla FTP Client\fzshellext.dll
  450. 2017-12-13 12:43 - 2017-11-29 09:11 - 001934792 _____ () C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\SelfProtectionSdk.dll
  451. 2017-12-13 12:43 - 2017-11-29 09:11 - 001798608 _____ () C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\MwacLib.dll
  452. 2017-12-18 18:57 - 2017-12-13 14:21 - 002195800 _____ () C:\Program Files\Google\Chrome\Application\63.0.3239.108\swiftshader\libglesv2.dll
  453. 2017-12-18 18:57 - 2017-12-13 14:21 - 000111448 _____ () C:\Program Files\Google\Chrome\Application\63.0.3239.108\swiftshader\libegl.dll
  454. 2017-10-23 00:41 - 2017-10-23 00:41 - 000055296 _____ () C:\Program Files\Mullvad\mullvad.exe
  455. 2015-12-05 07:34 - 2015-12-05 07:34 - 000047616 _____ () C:\Program Files\Mullvad\_socket.pyd
  456. 2015-12-05 07:34 - 2015-12-05 07:34 - 001420288 _____ () C:\Program Files\Mullvad\_ssl.pyd
  457. 2015-12-05 07:34 - 2015-12-05 07:34 - 001008128 _____ () C:\Program Files\Mullvad\_hashlib.pyd
  458. 2015-12-05 07:33 - 2015-12-05 07:33 - 000137216 _____ () C:\Program Files\Mullvad\pyexpat.pyd
  459. 2015-12-05 07:33 - 2015-12-05 07:33 - 000011264 _____ () C:\Program Files\Mullvad\select.pyd
  460. 2014-11-27 01:09 - 2014-11-27 01:09 - 001176576 _____ () C:\Program Files\Mullvad\wx._core_.pyd
  461. 2014-11-27 01:09 - 2014-11-27 01:09 - 000806400 _____ () C:\Program Files\Mullvad\wx._gdi_.pyd
  462. 2014-11-27 01:09 - 2014-11-27 01:09 - 000816128 _____ () C:\Program Files\Mullvad\wx._windows_.pyd
  463. 2014-11-27 01:09 - 2014-11-27 01:09 - 001067008 _____ () C:\Program Files\Mullvad\wx._controls_.pyd
  464. 2014-11-27 01:10 - 2014-11-27 01:10 - 000733184 _____ () C:\Program Files\Mullvad\wx._misc_.pyd
  465. 2015-12-05 07:33 - 2015-12-05 07:33 - 000092672 _____ () C:\Program Files\Mullvad\_ctypes.pyd
  466. 2017-02-08 03:14 - 2017-02-08 03:14 - 000047616 _____ () C:\Program Files\Mullvad\psutil._psutil_windows.pyd
  467. 2017-02-08 03:14 - 2017-02-08 03:14 - 000015872 _____ () C:\Program Files\Mullvad\netifaces.pyd
  468. 2015-12-05 07:33 - 2015-12-05 07:33 - 000688128 _____ () C:\Program Files\Mullvad\unicodedata.pyd
  469.  
  470. ==================== Alternate Data Streams (Whitelisted) =========
  471.  
  472. (If an entry is included in the fixlist, only the ADS will be removed.)
  473.  
  474.  
  475. ==================== Safe Mode (Whitelisted) ===================
  476.  
  477. (If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" value will be restored.)
  478.  
  479. HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMService => ""="Service"
  480. HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MBAMService => ""="Service"
  481.  
  482. ==================== Association (Whitelisted) ===============
  483.  
  484. (If an entry is included in the fixlist, the registry item will be restored to default or removed.)
  485.  
  486.  
  487. ==================== Internet Explorer trusted/restricted ===============
  488.  
  489. (If an entry is included in the fixlist, it will be removed from the registry.)
  490.  
  491. IE trusted site: HKU\.DEFAULT\...\localhost -> localhost
  492. IE trusted site: HKU\.DEFAULT\...\webcompanion.com -> hxxp://webcompanion.com
  493. IE trusted site: HKU\S-1-5-21-570141002-2484250258-4068607221-1000\...\localhost -> localhost
  494. IE trusted site: HKU\S-1-5-21-570141002-2484250258-4068607221-1000\...\webcompanion.com -> hxxp://webcompanion.com
  495.  
  496. ==================== Hosts content: ===============================
  497.  
  498. (If needed Hosts: directive could be included in the fixlist to reset Hosts.)
  499.  
  500. 2009-07-13 14:04 - 2017-07-19 21:54 - 000000035 _____ C:\Windows\system32\Drivers\etc\hosts
  501.  
  502.  
  503. ==================== Other Areas ============================
  504.  
  505. (Currently there is no automatic fix for this section.)
  506.  
  507. HKU\S-1-5-21-570141002-2484250258-4068607221-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\Hakeem\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
  508. DNS Servers: 193.138.219.228
  509. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
  510. Windows Firewall is enabled.
  511.  
  512. ==================== MSCONFIG/TASK MANAGER disabled items ==
  513.  
  514.  
  515. ==================== FirewallRules (Whitelisted) ===============
  516.  
  517. (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
  518.  
  519. FirewallRules: [{4C035A54-B419-4009-BFAC-6CBFBFB26B65}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe
  520. FirewallRules: [{C0F1D9C1-0176-4F9F-BE9E-2502404B353B}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe
  521. FirewallRules: [TCP Query User{D6FB102E-DC39-40EA-A232-A1F985427637}C:\xampp\apache\bin\httpd.exe] => (Allow) C:\xampp\apache\bin\httpd.exe
  522. FirewallRules: [UDP Query User{BA1ADBFC-DC91-4A80-B46B-11197E93A717}C:\xampp\apache\bin\httpd.exe] => (Allow) C:\xampp\apache\bin\httpd.exe
  523. FirewallRules: [TCP Query User{D2523B1A-9721-49AE-AE0F-9BBB1EAF943B}C:\xampp\mysql\bin\mysqld.exe] => (Allow) C:\xampp\mysql\bin\mysqld.exe
  524. FirewallRules: [UDP Query User{B7146805-3733-4A32-BDB8-49B8ED4DA5F7}C:\xampp\mysql\bin\mysqld.exe] => (Allow) C:\xampp\mysql\bin\mysqld.exe
  525. FirewallRules: [TCP Query User{80CD9E75-8549-4FC6-9230-812B9B9F43B9}C:\xampp\filezillaftp\filezillaserver.exe] => (Allow) C:\xampp\filezillaftp\filezillaserver.exe
  526. FirewallRules: [UDP Query User{8C055824-8AC1-4D3B-8BB2-0F182F555D9E}C:\xampp\filezillaftp\filezillaserver.exe] => (Allow) C:\xampp\filezillaftp\filezillaserver.exe
  527. FirewallRules: [{D6445881-17B8-4804-9EE6-2F709CE6A0B2}] => (Allow) C:\Program Files\HP\HP Deskjet 2050 J510 series\Bin\USBSetup.exe
  528. FirewallRules: [{96158AAC-7A3D-4E24-87DD-F05C27A43177}] => (Allow) C:\Program Files\HP\HP Deskjet 2050 J510 series\Bin\USBSetup.exe
  529. FirewallRules: [TCP Query User{F21FB9F8-5896-4F3C-869B-2D5591B4CA8D}C:\users\hakeem\appdata\roaming\telegram desktop\telegram.exe] => (Allow) C:\users\hakeem\appdata\roaming\telegram desktop\telegram.exe
  530. FirewallRules: [UDP Query User{99427240-16F0-42A0-8E50-9FD810CCBEE0}C:\users\hakeem\appdata\roaming\telegram desktop\telegram.exe] => (Allow) C:\users\hakeem\appdata\roaming\telegram desktop\telegram.exe
  531. FirewallRules: [{AADDE57E-198F-40A7-B155-0461850A56C7}] => (Allow) C:\Program Files\TeamViewer\TeamViewer.exe
  532. FirewallRules: [{1773C215-D2B1-48B9-84DA-5921F2E8FE45}] => (Allow) C:\Program Files\TeamViewer\TeamViewer.exe
  533. FirewallRules: [{7188E338-AE0D-4C38-AF9E-A743E87B9939}] => (Allow) C:\Program Files\TeamViewer\TeamViewer_Service.exe
  534. FirewallRules: [{508FE1E9-BD2C-4AC1-966B-296CCE69CFBD}] => (Allow) C:\Program Files\TeamViewer\TeamViewer_Service.exe
  535. FirewallRules: [TCP Query User{62F6AC72-50E1-4406-9DC4-49EF2505FD91}C:\program files\mozilla firefox\firefox.exe] => (Block) C:\program files\mozilla firefox\firefox.exe
  536. FirewallRules: [UDP Query User{BEA411B9-DACB-4973-8F7A-9D3E85530F39}C:\program files\mozilla firefox\firefox.exe] => (Block) C:\program files\mozilla firefox\firefox.exe
  537. FirewallRules: [{88D4373D-CC0F-41D7-9930-00A6BB4A62C6}] => (Allow) C:\Program Files\Google\Chrome\Application\chrome.exe
  538.  
  539. ==================== Restore Points =========================
  540.  
  541. 13-12-2017 10:52:48 Windows Update
  542. 13-12-2017 13:31:21 Windows Update
  543. 18-12-2017 18:46:45 Windows Update
  544. 18-12-2017 21:47:55 JRT Pre-Junkware Removal
  545.  
  546. ==================== Faulty Device Manager Devices =============
  547.  
  548. Name:
  549. Description:
  550. Class Guid:
  551. Manufacturer:
  552. Service:
  553. Problem: : The drivers for this device are not installed. (Code 28)
  554. Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
  555.  
  556.  
  557. ==================== Event log errors: =========================
  558.  
  559. Application errors:
  560. ==================
  561. Error: (12/18/2017 02:37:59 AM) (Source: Application Error) (EventID: 1000) (User: )
  562. Description: Faulting application name: iexplore.exe, version: 11.0.9600.18858, time stamp: 0x58adb8be
  563. Faulting module name: mshtml.dll, version: 11.0.9600.18860, time stamp: 0x5a0a425e
  564. Exception code: 0xc0000602
  565. Fault offset: 0x009f8604
  566. Faulting process id: 0xa64
  567. Faulting application start time: 0x01d3780dc3809730
  568. Faulting application path: C:\Program Files\Internet Explorer\iexplore.exe
  569. Faulting module path: C:\Windows\System32\mshtml.dll
  570. Report Id: 0a6abd4f-e401-11e7-a905-001eec2379f7
  571.  
  572. Error: (12/17/2017 11:11:47 PM) (Source: Application Error) (EventID: 1000) (User: )
  573. Description: Faulting application name: RegAsm.exe, version: 2.0.50727.5483, time stamp: 0x5a379ddd
  574. Faulting module name: KERNELBASE.dll, version: 6.1.7601.23889, time stamp: 0x598d4d1e
  575. Exception code: 0xe0434f4d
  576. Fault offset: 0x0000845d
  577. Faulting process id: 0x%9
  578. Faulting application start time: 0xRegAsm.exe0
  579. Faulting application path: RegAsm.exe1
  580. Faulting module path: RegAsm.exe2
  581. Report Id: RegAsm.exe3
  582.  
  583. Error: (12/17/2017 10:32:59 PM) (Source: Application Error) (EventID: 1000) (User: )
  584. Description: Faulting application name: Orion Keylogger.exe, version: 2.1.0.0, time stamp: 0x59ef8e2f
  585. Faulting module name: KERNELBASE.dll, version: 6.1.7601.23889, time stamp: 0x598d4d1e
  586. Exception code: 0xe0434352
  587. Fault offset: 0x0000845d
  588. Faulting process id: 0xe30
  589. Faulting application start time: 0x01d377eb90aae0a3
  590. Faulting application path: C:\Users\Hakeem\Desktop\Orion Keylogger.exe
  591. Faulting module path: C:\Windows\system32\KERNELBASE.dll
  592. Report Id: d0e8674f-e3de-11e7-8162-001eec2379f7
  593.  
  594. Error: (12/17/2017 10:32:59 PM) (Source: .NET Runtime) (EventID: 1026) (User: )
  595. Description: Application: Orion Keylogger.exe
  596. Framework Version: v4.0.30319
  597. Description: The process was terminated due to an unhandled exception.
  598. Exception Info: System.IO.FileNotFoundException
  599. at Orion_Logger.License..ctor()
  600. at Orion_Logger.Program.Main()
  601.  
  602. Error: (12/17/2017 10:32:13 PM) (Source: Application Error) (EventID: 1000) (User: )
  603. Description: Faulting application name: iexplore.exe, version: 11.0.9600.18858, time stamp: 0x58adb8be
  604. Faulting module name: mshtml.dll, version: 11.0.9600.18860, time stamp: 0x5a0a425e
  605. Exception code: 0xc0000602
  606. Fault offset: 0x009f8604
  607. Faulting process id: 0xb80
  608. Faulting application start time: 0x01d377eb74c13c2a
  609. Faulting application path: C:\Program Files\Internet Explorer\iexplore.exe
  610. Faulting module path: C:\Windows\System32\mshtml.dll
  611. Report Id: b5971ae7-e3de-11e7-8162-001eec2379f7
  612.  
  613. Error: (12/17/2017 10:32:11 PM) (Source: Application Error) (EventID: 1005) (User: )
  614. Description: Windows cannot access the file for one of the following reasons:
  615. there is a problem with the network connection, the disk that the file is stored on, or the storage
  616. drivers installed on this computer; or the disk is missing.
  617. Windows closed the program DataManager because of this error.
  618.  
  619. Program: DataManager
  620. File:
  621.  
  622. The error value is listed in the Additional Data section.
  623. User Action
  624. 1. Open the file again.
  625. This situation might be a temporary problem that corrects itself when the program runs again.
  626. 2.
  627. If the file still cannot be accessed and
  628. - It is on the network,
  629. your network administrator should verify that there is not a problem with the network and that the server can be contacted.
  630. - It is on a removable disk, for example, a floppy disk or CD-ROM, verify that the disk is fully inserted into the computer.
  631. 3. Check and repair the file system by running CHKDSK. To run CHKDSK, click Start, click Run, type CMD, and then click OK. At the command prompt, type CHKDSK /F, and then press ENTER.
  632. 4. If the problem persists, restore the file from a backup copy.
  633. 5. Determine whether other files on the same disk can be opened. If not, the disk might be damaged. If it is a hard disk, contact your administrator or computer hardware vendor for
  634. further assistance.
  635.  
  636. Additional Data
  637. Error value: 00000000
  638. Disk type: 0
  639.  
  640. Error: (12/17/2017 10:32:11 PM) (Source: Application Error) (EventID: 1000) (User: )
  641. Description: Faulting application name: eeSQOM64aK.exe, version: 1.0.0.1, time stamp: 0x551912ae
  642. Faulting module name: eeSQOM64aK.exe, version: 1.0.0.1, time stamp: 0x551912ae
  643. Exception code: 0xc0000096
  644. Fault offset: 0x0000146b
  645. Faulting process id: 0xba0
  646. Faulting application start time: 0x01d377eb757d48e0
  647. Faulting application path: C:\Users\Hakeem\AppData\Roaming\eeSQOM64aK.exe
  648. Faulting module path: C:\Users\Hakeem\AppData\Roaming\eeSQOM64aK.exe
  649. Report Id: b47251a6-e3de-11e7-8162-001eec2379f7
  650.  
  651. Error: (12/17/2017 10:29:47 PM) (Source: Application Error) (EventID: 1000) (User: )
  652. Description: Faulting application name: Orion Keylogger.exe, version: 2.1.0.0, time stamp: 0x59ef8e2f
  653. Faulting module name: KERNELBASE.dll, version: 6.1.7601.23889, time stamp: 0x598d4d1e
  654. Exception code: 0xe0434352
  655. Fault offset: 0x0000845d
  656. Faulting process id: 0x1a68
  657. Faulting application start time: 0x01d377eb1cb32b2c
  658. Faulting application path: C:\Users\Hakeem\Desktop\Orion Keylogger.exe
  659. Faulting module path: C:\Windows\system32\KERNELBASE.dll
  660. Report Id: 5e524461-e3de-11e7-be26-001eec2379f7
  661.  
  662. Error: (12/17/2017 10:29:45 PM) (Source: .NET Runtime) (EventID: 1026) (User: )
  663. Description: Application: Orion Keylogger.exe
  664. Framework Version: v4.0.30319
  665. Description: The process was terminated due to an unhandled exception.
  666. Exception Info: System.IO.FileNotFoundException
  667. at Orion_Logger.License..ctor()
  668. at Orion_Logger.Program.Main()
  669.  
  670. Error: (12/17/2017 08:23:49 PM) (Source: Application Hang) (EventID: 1002) (User: )
  671. Description: The program explorer.exe version 6.1.7601.23537 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel.
  672.  
  673. Process ID: 1fc0
  674.  
  675. Start Time: 01d377d971930b73
  676.  
  677. Termination Time: 4403
  678.  
  679. Application Path: C:\Windows\explorer.exe
  680.  
  681. Report Id: b80d43c3-e3cc-11e7-be26-001eec2379f7
  682.  
  683.  
  684. System errors:
  685. =============
  686. Error: (12/17/2017 08:24:02 PM) (Source: Disk) (EventID: 7) (User: )
  687. Description: The device, \Device\Harddisk1\DR3, has a bad block.
  688.  
  689. Error: (12/17/2017 08:23:56 PM) (Source: Disk) (EventID: 7) (User: )
  690. Description: The device, \Device\Harddisk1\DR3, has a bad block.
  691.  
  692. Error: (12/17/2017 08:23:49 PM) (Source: Disk) (EventID: 7) (User: )
  693. Description: The device, \Device\Harddisk1\DR3, has a bad block.
  694.  
  695. Error: (12/17/2017 08:23:42 PM) (Source: Disk) (EventID: 7) (User: )
  696. Description: The device, \Device\Harddisk1\DR3, has a bad block.
  697.  
  698. Error: (12/17/2017 08:23:36 PM) (Source: Disk) (EventID: 7) (User: )
  699. Description: The device, \Device\Harddisk1\DR3, has a bad block.
  700.  
  701. Error: (12/17/2017 08:23:29 PM) (Source: Disk) (EventID: 7) (User: )
  702. Description: The device, \Device\Harddisk1\DR3, has a bad block.
  703.  
  704. Error: (12/17/2017 08:23:22 PM) (Source: Disk) (EventID: 7) (User: )
  705. Description: The device, \Device\Harddisk1\DR3, has a bad block.
  706.  
  707. Error: (12/17/2017 08:23:16 PM) (Source: Disk) (EventID: 7) (User: )
  708. Description: The device, \Device\Harddisk1\DR3, has a bad block.
  709.  
  710. Error: (12/17/2017 08:23:09 PM) (Source: Disk) (EventID: 7) (User: )
  711. Description: The device, \Device\Harddisk1\DR3, has a bad block.
  712.  
  713. Error: (12/17/2017 08:23:02 PM) (Source: Disk) (EventID: 7) (User: )
  714. Description: The device, \Device\Harddisk1\DR3, has a bad block.
  715.  
  716.  
  717. ==================== Memory info ===========================
  718.  
  719. Processor: Intel(R) Core(TM) Duo CPU T2700 @ 2.33GHz
  720. Percentage of memory in use: 65%
  721. Total physical RAM: 3447.43 MB
  722. Available physical RAM: 1200.78 MB
  723. Total Virtual: 6893.18 MB
  724. Available Virtual: 4687.49 MB
  725.  
  726. ==================== Drives ================================
  727.  
  728. Drive c: () (Fixed) (Total:74.52 GB) (Free:27.52 GB) NTFS ==>[drive with boot components (obtained from BCD)]
  729.  
  730. ==================== MBR & Partition Table ==================
  731.  
  732. ========================================================
  733. Disk: 0 (MBR Code: Windows 7 or 8) (Size: 74.5 GB) (Disk ID: AC8CAC8C)
  734. Partition 1: (Active) - (Size=74.5 GB) - (Type=07 NTFS)
  735.  
  736. ==================== End of Addition.txt ============================
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!