Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 26-04-2017
Ran by [removed] (administrator) on NIEL-PC (27-04-2017 02:55:51)
Running from C:\Users\[removed]\Downloads
[removed]
Platform: Windows 8.1 Pro (X64) Language: English (United States)
Internet Explorer Version 11 (Default browser not detected!)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(@ByELDI) C:\Program Files\KMSpico\Service_KMS.exe
(IvoSoft) C:\Program Files\Classic Shell\ClassicStartMenu.exe
(Microsoft Corporation) C:\Windows\System32\alg.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
(45) C:\Program Files\H9VM7U9JOK\H9VM7U9JO.exe
(45) C:\Program Files\5BVRXCG4J6\5BVRXCG4J.exe
(45) C:\Program Files\NUVHQ8FEBP\NUVHQ8FEB.exe
(BitTorrent Inc.) C:\Users\Niel\AppData\Roaming\BitTorrent\BitTorrent.exe
(45) C:\Program Files\BVB4TSKTNL\BVB4TSKTN.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(45) C:\Program Files\4RNITOO9T5\4RNITOO9T.exe
(45) C:\Program Files\BPL76IA803\FAB9LOEEN.exe
(45) C:\Program Files\3IB9MZ9FRW\3IB9MZ9FR.exe
(45) C:\Program Files\4BONLDL8HE\4BONLDL8H.exe
(BitTorrent Inc.) C:\Users\Niel\AppData\Roaming\BitTorrent\updates\7.9.9_43389\bittorrentie.exe
(BitTorrent Inc.) C:\Users\Niel\AppData\Roaming\BitTorrent\updates\7.9.9_43389\bittorrentie.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Power Software Ltd) C:\Program Files\PowerISO\PWRISOVM.EXE
(Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Tonec Inc.) C:\Program Files (x86)\Internet Download Manager\IDMan.exe
(Tonec Inc.) C:\Program Files (x86)\Internet Download Manager\IEMonitor.exe
(AVAST Software) C:\Users\Niel\Downloads\Programs\aswMBR.exe
(AVAST Software) C:\Users\Niel\Downloads\Programs\aswMBR.exe

==================== Registry (Whitelisted) ====================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [Classic Start Menu] => C:\Program Files\Classic Shell\ClassicStartMenu.exe [161728 2015-11-13] (IvoSoft)
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [176952 2016-06-01] (Apple Inc.)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe [767176 2015-07-16] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [AMD AVT] => Cmd.exe /c start "AMD Accelerated Video Transcoding device initialization" /min "C:\Program Files (x86)\AMD AVT\bin\kdbsync.exe" aml
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [595480 2016-03-20] (Oracle Corporation)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [67384 2016-04-22] (Apple Inc.)
HKLM-x32\...\Run: [WindowsDefender] => -
HKU\S-1-5-21-3336116062-2625747668-4257245518-1001\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [8455960 2015-08-20] (Piriform Ltd)
HKU\S-1-5-21-3336116062-2625747668-4257245518-1001\...\Run: [IDMan] => C:\Program Files (x86)\Internet Download Manager\IDMan.exe [3911248 2015-11-10] (Tonec Inc.)
HKU\S-1-5-21-3336116062-2625747668-4257245518-1001\...\Run: [GoogleDriveSync] => C:\Program Files (x86)\Google\Drive\googledrivesync.exe [23819304 2017-03-21] (Google)
HKU\S-1-5-21-3336116062-2625747668-4257245518-1001\...\Run: [Windows Defender] => -
HKU\S-1-5-21-3336116062-2625747668-4257245518-1001\...\Run: [SQP0EJ2RG3D0N37] => C:\Program Files\H9VM7U9JOK\H9VM7U9JO.exe [1101312 2017-04-27] (45)
HKU\S-1-5-21-3336116062-2625747668-4257245518-1001\...\Run: [OFTSSUR7CTIDZ1F] => C:\Program Files\5BVRXCG4J6\5BVRXCG4J.exe [1101312 2017-04-27] (45)
HKU\S-1-5-21-3336116062-2625747668-4257245518-1001\...\Run: [W48BVI2EKMRDT95] => C:\Program Files\NUVHQ8FEBP\NUVHQ8FEB.exe [1101312 2017-04-27] (45)
HKU\S-1-5-21-3336116062-2625747668-4257245518-1001\...\Run: [BENM19A9VTQODAC] => C:\Program Files\BVB4TSKTNL\BVB4TSKTN.exe [1101312 2017-04-27] (45)
HKU\S-1-5-21-3336116062-2625747668-4257245518-1001\...\Run: [2JBHSEBGLSTQV99] => C:\Program Files\4RNITOO9T5\4RNITOO9T.exe [1101312 2017-04-27] (45)
HKU\S-1-5-21-3336116062-2625747668-4257245518-1001\...\Run: [0NP6O3L0ZB5PESK] => C:\Program Files\BPL76IA803\FAB9LOEEN.exe [1101312 2017-04-27] (45)
HKU\S-1-5-21-3336116062-2625747668-4257245518-1001\...\Run: [1O0MTOYX7CCAOBJ] => C:\Program Files\3IB9MZ9FRW\3IB9MZ9FR.exe [1101312 2017-04-27] (45)
HKU\S-1-5-21-3336116062-2625747668-4257245518-1001\...\Run: [AJO4R26717HN3VW] => C:\Program Files\4BONLDL8HE\4BONLDL8H.exe [1101312 2017-04-27] (45)
HKU\S-1-5-21-3336116062-2625747668-4257245518-1001\...\MountPoints2: {31ab9ac7-8527-11e6-82af-b8ac6f535cb7} - "F:\SETUP.EXE" 
HKU\S-1-5-21-3336116062-2625747668-4257245518-1001\...\MountPoints2: {31ab9ad1-8527-11e6-82af-b8ac6f535cb7} - "G:\SETUP.EXE" 
HKLM\...\Providers\wzgpufsb: C:\Program Files (x86)\Plarety Cache\local64spl.dll [314880 2017-04-27] ()
ShellExecuteHooks: No Name - {E8B867B6-267D-11E7-A22E-64006A5CFC23} - C:\Users\Niel\AppData\Roaming\Drorecultsesaly\Drkuentaterjeph.dll [147456 2017-04-27] ()
ShellIconOverlayIdentifiers: [   IDM Shell Extension] -> {CDC95B92-E27C-4745-A8C5-64A52A78855D} => C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll [2015-08-14] (Tonec Inc.)
ShellIconOverlayIdentifiers: [  GoogleDriveBlacklisted] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll [2017-03-21] (Google)
ShellIconOverlayIdentifiers: [  GoogleDriveSynced] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll [2017-03-21] (Google)
ShellIconOverlayIdentifiers: [  GoogleDriveSyncing] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll [2017-03-21] (Google)
Startup: C:\Users\Niel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Autochartist MetaTrader Plugin - Auto Update.lnk [2017-04-27]
ShortcutTarget: Autochartist MetaTrader Plugin - Auto Update.lnk -> C:\Users\Niel\AppData\Roaming\MetaQuotes\Terminal\50CA3DFB510CC5A8F28B48D1BF2A5702\MQL4\AutochartistExpert_Advisor_AutoUpdater.exe (Pantaray Research Ltd.)
Startup: C:\Users\Niel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\JetBoost - Shortcut.lnk [2017-04-27]
ShortcutTarget: JetBoost - Shortcut.lnk -> C:\Program Files (x86)\BlueSprig\JetBoost\JetBoost.exe (BlueSprig)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\..\Interfaces\{2F73DEAA-845D-4B45-A11D-796595B74C10}: [NameServer] 114.108.195.1,114.108.193.201
Tcpip\..\Interfaces\{7D1D36F5-B308-4A28-AE13-8AA4E4E644A6}: [DhcpNameServer] [removed]
Tcpip\..\Interfaces\{DD5834B4-4715-48C0-96D1-8E75BD504E42}: [DhcpNameServer] [removed] [removed]

Internet Explorer:
==================
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = 
HKU\S-1-5-21-3336116062-2625747668-4257245518-1001\Software\Microsoft\Internet Explorer\Main,Start Page = 
HKU\S-1-5-21-3336116062-2625747668-4257245518-1001\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/en-ph/?ocid=iehp
SearchScopes: HKLM-x32 -> DefaultScope value is missing
BHO: IDM integration (IDMIEHlprObj Class) -> {0055C089-8582-441B-A0BF-17B458C2A3A8} -> C:\Program Files (x86)\Internet Download Manager\IDMIECC64.dll [2015-09-28] (Internet Download Manager, Tonec Inc.)
BHO: ClassicIEBHO Class -> {EA801577-E6AD-4BD5-8F71-4BE0154331A4} -> C:\Program Files\Classic Shell\ClassicIEDLL_64.dll [2015-11-13] (IvoSoft)
BHO-x32: IDM integration (IDMIEHlprObj Class) -> {0055C089-8582-441B-A0BF-17B458C2A3A8} -> C:\Program Files (x86)\Internet Download Manager\IDMIECC.dll [2015-09-28] (Internet Download Manager, Tonec Inc.)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_77\bin\ssv.dll [2016-04-09] (Oracle Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_77\bin\jp2ssv.dll [2016-04-09] (Oracle Corporation)
BHO-x32: ClassicIEBHO Class -> {EA801577-E6AD-4BD5-8F71-4BE0154331A4} -> C:\Program Files\Classic Shell\ClassicIEDLL_32.dll [2015-11-13] (IvoSoft)

FireFox:
========
FF DefaultProfile: new9o6kp.default
FF ProfilePath: C:\Users\Niel\AppData\Roaming\Mozilla\Firefox\Profiles\new9o6kp.default [2017-04-27]
FF DefaultSearchEngine: Mozilla\Firefox\Profiles\new9o6kp.default -> initialpage123
FF SelectedSearchEngine: Mozilla\Firefox\Profiles\new9o6kp.default -> initialpage123
FF NetworkProxy: Mozilla\Firefox\Profiles\new9o6kp.default -> no_proxies_on", "localhost, 127.0.0.1, 192.168.1.0/24,"
FF NetworkProxy: Mozilla\Firefox\Profiles\new9o6kp.default -> socks", "127.0.0.1"
FF NetworkProxy: Mozilla\Firefox\Profiles\new9o6kp.default -> socks_port", 9050
FF NetworkProxy: Mozilla\Firefox\Profiles\new9o6kp.default -> socks_remote_dns", true
FF NetworkProxy: Mozilla\Firefox\Profiles\new9o6kp.default -> type", 0
FF Extension: (Tables) - C:\Users\Niel\AppData\Roaming\Mozilla\Firefox\Profiles\new9o6kp.default\Extensions\[removed] [2017-04-17]
FF Extension: (Site Deployment Checker) - C:\Program Files (x86)\Mozilla Firefox\browser\features\[removed] [2017-04-26] [not signed]
FF HKU\S-1-5-21-3336116062-2625747668-4257245518-1001\...\Firefox\Extensions: [[removed]] - C:\Program Files (x86)\Internet Download Manager\idmmzcc2.xpi
FF Extension: (IDM integration) - C:\Program Files (x86)\Internet Download Manager\idmmzcc2.xpi [2015-11-09]
FF HKU\S-1-5-21-3336116062-2625747668-4257245518-1001\...\SeaMonkey\Extensions: [[removed]] - C:\Program Files (x86)\Internet Download Manager\idmmzcc2.xpi
FF HKU\S-1-5-21-3336116062-2625747668-4257245518-1001\...\SeaMonkey\Extensions: [[removed]] - C:\Users\Niel\AppData\Roaming\IDM\idmmzcc5
FF Extension: (IDM CC) - C:\Users\Niel\AppData\Roaming\IDM\idmmzcc5 [2017-04-27] [not signed]
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_20_0_0_306.dll [2016-02-20] ()
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_20_0_0_306.dll [2016-02-20] ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2015-12-18] ()
FF Plugin-x32: @java.com/DTPlugin,version=11.77.2 -> C:\Program Files (x86)\Java\jre1.8.0_77\bin\dtplugin\npDeployJava1.dll [2016-04-09] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.77.2 -> C:\Program Files (x86)\Java\jre1.8.0_77\bin\plugin2\npjp2.dll [2016-04-09] (Oracle Corporation)
FF Plugin-x32: @softnyxNpruntime -> C:\Game\SoftnyxGame\NyxLauncherIS\npSoftnyx.dll [2015-09-22] ( )
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.32.7\npGoogleUpdate3.dll [2017-03-22] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.32.7\npGoogleUpdate3.dll [2017-03-22] (Google Inc.)

Chrome: 
=======
CHR HKLM\...\Chrome\Extension: [ngpampappnmepgilojfohadhhmbhlaek] - C:\Program Files (x86)\Internet Download Manager\IDMGCExt.crx [2015-11-09]
CHR HKU\S-1-5-21-3336116062-2625747668-4257245518-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [lmjegmlicamnimmfhcmpkclmigmmcbeh] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [ngpampappnmepgilojfohadhhmbhlaek] - C:\Program Files (x86)\Internet Download Manager\IDMGCExt.crx [2015-11-09]

==================== Services (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [83768 2016-03-02] (Apple Inc.)
S3 EasyAntiCheat; C:\Windows\SysWOW64\EasyAntiCheat.exe [238376 2016-03-19] (EasyAntiCheat Ltd)
R2 Service KMSELDI; C:\Program Files\KMSpico\Service_KMS.exe [985280 2015-08-12] (@ByELDI) [File not signed]
S3 TunngleService; C:\Program Files (x86)\Tunngle\TnglCtrl.exe [814064 2015-12-22] (Tunngle.net GmbH)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [346872 2013-08-22] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23840 2013-08-22] (Microsoft Corporation)

===================== Drivers (Whitelisted) ======================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R3 AtiHDAudioService; C:\Windows\system32\drivers\AtihdWB6.sys [102912 2015-07-15] (Advanced Micro Devices)
R3 BCM43XX; C:\Windows\system32\DRIVERS\bcmwl63al.sys [5170176 2013-07-02] (Broadcom Corporation)
S3 dtlitescsibus; C:\Windows\System32\drivers\dtlitescsibus.sys [30264 2017-04-26] (Disc Soft Ltd)
S3 dtliteusbbus; C:\Windows\System32\drivers\dtliteusbbus.sys [47672 2017-04-26] (Disc Soft Ltd)
S3 sshid; C:\Windows\System32\drivers\sshid.sys [51400 2016-01-28] (SteelSeries ApS)
R3 tap0901t; C:\Windows\system32\DRIVERS\tap0901t.sys [47736 2015-12-21] (Tunngle.net)
S3 WdBoot; C:\Windows\system32\drivers\WdBoot.sys [34760 2013-08-22] (Microsoft Corporation)
S3 WdFilter; C:\Windows\system32\drivers\WdFilter.sys [265056 2013-08-22] (Microsoft Corporation)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [124256 2013-08-22] (Microsoft Corporation)
S3 xhunter1; \??\C:\Windows\xhunter1.sys [X]
S3 xspirit; \??\C:\Windows\xspirit.sys [X]
U3 aswMBR; \??\C:\Users\Niel\AppData\Local\Temp\aswMBR.sys [X] <==== ATTENTION
U3 aswVmm; \??\C:\Users\Niel\AppData\Local\Temp\aswVmm.sys [X] <==== ATTENTION

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2017-04-27 02:55 - 2017-04-27 02:56 - 00015078 _____ C:\Users\Niel\Downloads\FRST.txt
2017-04-27 02:55 - 2017-04-27 02:55 - 00000000 ____D C:\FRST
2017-04-27 02:46 - 2017-04-27 02:48 - 02427392 _____ (Farbar) C:\Users\Niel\Downloads\FRST64.exe
2017-04-27 02:39 - 2017-04-27 02:41 - 04089296 _____ C:\Users\Niel\Downloads\AdwCleaner.exe
2017-04-27 02:29 - 2017-04-27 02:29 - 00000824 _____ C:\Users\Public\Desktop\PowerISO.lnk
2017-04-27 02:29 - 2017-04-27 02:29 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PowerISO
2017-04-27 02:29 - 2017-04-27 02:29 - 00000000 ____D C:\Program Files\PowerISO
2017-04-27 02:29 - 2016-05-25 07:06 - 00137280 _____ (Power Software Ltd) C:\Windows\system32\Drivers\scdemu.sys
2017-04-27 02:24 - 2017-04-27 02:25 - 00000000 ____D C:\Users\Niel\Downloads\PowerISO FULL 6.6 + Crack [TechTools.NET]
2017-04-27 02:23 - 2017-04-27 02:28 - 00000000 ____D C:\Users\Niel\Downloads\Microsoft Office Professional Plus 2016 + Activation Tool [danhuk]
2017-04-27 02:22 - 2017-04-27 02:27 - 00000000 ____D C:\Users\Niel\AppData\LocalLow\BitTorrent
2017-04-27 01:42 - 2017-04-27 01:42 - 00000000 ____D C:\Program Files\4BONLDL8HE
2017-04-27 01:35 - 2017-04-27 01:36 - 00000000 ____D C:\Program Files\3IB9MZ9FRW
2017-04-27 01:29 - 2017-04-27 01:30 - 04102600 _____ C:\Users\Niel\Downloads\adwcleaner_6.046.exe
2017-04-27 01:23 - 2017-04-27 01:23 - 00000000 ____D C:\Program Files\BPL76IA803
2017-04-27 01:19 - 2017-04-27 01:19 - 01895968 _____ C:\Users\Niel\AppData\Roaming\Movecore.tst
2017-04-27 01:19 - 2017-04-27 01:19 - 00278509 _____ C:\Users\Niel\AppData\Roaming\Stringdex.bin
2017-04-27 01:19 - 2017-04-27 01:19 - 00000000 ____D C:\Program Files\BVB4TSKTNL
2017-04-27 01:19 - 2017-04-27 01:19 - 00000000 ____D C:\Program Files\4RNITOO9T5
2017-04-27 01:19 - 2017-04-27 01:18 - 01060864 _____ C:\Users\Niel\AppData\Roaming\Movecore.exe
2017-04-27 01:18 - 2017-04-27 01:18 - 00000000 ____D C:\Program Files\NUVHQ8FEBP
2017-04-27 01:17 - 2017-04-27 01:17 - 00000000 ____D C:\Program Files\H9VM7U9JOK
2017-04-27 01:17 - 2017-04-27 01:17 - 00000000 ____D C:\Program Files\5BVRXCG4J6
2017-04-27 01:16 - 2017-04-27 02:30 - 00000000 ____D C:\Users\Niel\AppData\LocalLow\Mozilla
2017-04-27 01:15 - 2017-04-27 01:16 - 00000000 ____D C:\Users\Niel\AppData\Local\Nwijerqerty
2017-04-27 01:15 - 2017-04-27 01:15 - 00006070 _____ C:\Windows\System32\Tasks\Plarety Cache
2017-04-27 01:15 - 2017-04-27 01:15 - 00000000 ____D C:\Users\Niel\AppData\Roaming\Drorecultsesaly
2017-04-27 01:15 - 2017-04-27 01:15 - 00000000 ____D C:\Program Files (x86)\Plarety Cache
2017-04-27 01:15 - 2017-04-27 01:15 - 00000000 ____D C:\Program Files (x86)\Hersisyaraogh
2017-04-27 01:06 - 2017-04-27 01:06 - 00000000 ____D C:\Windows\system32\SSL
2017-04-26 23:02 - 2017-04-27 01:16 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2017-04-26 20:34 - 2017-04-26 20:35 - 00000000 ____D C:\Users\Niel\Downloads\Microsoft.Powerpoint.2010
2017-04-26 20:32 - 2017-04-26 20:32 - 00000000 ____D C:\Users\Niel\AppData\Local\Disc_Soft_Ltd
2017-04-26 20:30 - 2017-04-26 20:30 - 00047672 _____ (Disc Soft Ltd) C:\Windows\system32\Drivers\dtliteusbbus.sys
2017-04-26 20:30 - 2017-04-26 20:30 - 00000000 ____D C:\Users\Public\Documents\Daemon Tools Images
2017-04-26 20:29 - 2017-04-26 20:31 - 00000000 ____D C:\Users\Niel\AppData\Roaming\DAEMON Tools Lite
2017-04-26 20:29 - 2017-04-26 20:29 - 00030264 _____ (Disc Soft Ltd) C:\Windows\system32\Drivers\dtlitescsibus.sys
2017-04-26 20:29 - 2017-04-26 20:29 - 00000000 ____D C:\ProgramData\DAEMON Tools Lite
2017-04-26 20:16 - 2017-04-26 20:56 - 00000000 ____D C:\Program Files (x86)\WinCDEmu
2017-04-26 20:16 - 2017-04-26 20:16 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinCDEmu
2017-04-26 19:40 - 2017-04-26 19:40 - 00000000 ____D C:\Windows\System32\Tasks\OfficeSoftwareProtectionPlatform
2017-04-26 19:39 - 2017-04-26 19:39 - 00000000 ____D C:\Users\Niel\AppData\Local\Microsoft Help
2017-04-22 02:28 - 2017-04-22 02:28 - 03300028 _____ C:\Windows\357a6f3a5b47f04c5a99baf41128655a.exe
2017-04-01 08:28 - 2017-04-01 08:28 - 00000000 ____D C:\Users\Niel\Downloads\Video
2017-03-28 18:23 - 2017-04-27 02:01 - 00001338 _____ C:\Users\Niel\Desktop\NyxLauncher - Shortcut.lnk
2017-03-28 11:10 - 2017-03-28 11:19 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SoftnyxGame
2017-03-28 11:10 - 2017-03-28 11:10 - 00000126 _____ C:\Users\Niel\AppData\Roaming\Microsoft\Windows\Start Menu\GunboundIS.url
2017-03-28 11:10 - 2017-03-28 11:10 - 00000000 ____D C:\Game
2017-03-28 10:30 - 2017-03-28 10:30 - 00003362 _____ C:\Windows\System32\Tasks\AutoPico Daily Restart

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2017-04-27 02:52 - 2016-02-20 05:12 - 00000000 ____D C:\Users\Niel\AppData\Roaming\BitTorrent
2017-04-27 02:46 - 2016-02-20 04:56 - 00003598 _____ C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-3336116062-2625747668-4257245518-1001
2017-04-27 02:45 - 2016-03-27 21:01 - 00000000 ____D C:\AdwCleaner
2017-04-27 02:45 - 2016-02-22 20:51 - 00000000 ____D C:\Users\Niel\AppData\Roaming\IDM
2017-04-27 02:42 - 2016-03-27 19:49 - 00192216 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2017-04-27 02:41 - 2016-03-27 19:49 - 00001118 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2017-04-27 02:41 - 2016-03-27 19:49 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2017-04-27 02:41 - 2016-03-27 19:49 - 00000000 ____D C:\Program Files (x86)\Malwarebytes Anti-Malware
2017-04-27 02:28 - 2016-03-15 20:04 - 00000000 ____D C:\Users\Niel\AppData\Local\Google
2017-04-27 02:28 - 2016-03-15 20:04 - 00000000 ____D C:\Program Files (x86)\Google
2017-04-27 02:27 - 2016-02-20 05:39 - 00000000 ____D C:\Users\Niel\AppData\Local\ClassicShell
2017-04-27 02:27 - 2013-08-22 22:45 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2017-04-27 02:26 - 2016-02-20 04:51 - 00000000 ____D C:\Users\Niel
2017-04-27 02:01 - 2016-10-07 11:09 - 00002358 _____ C:\Users\Public\Desktop\Port Forward Network Utilities.lnk
2017-04-27 02:01 - 2016-08-08 01:04 - 00001640 _____ C:\Users\Public\Desktop\Batman Arkham Asylum GOTY.lnk
2017-04-27 02:01 - 2016-08-07 12:42 - 00000977 _____ C:\Users\Public\Desktop\DS3 Tool.lnk
2017-04-27 02:01 - 2016-08-07 01:05 - 00001198 _____ C:\Users\Public\Desktop\Half-Life 2 Episode Two.lnk
2017-04-27 02:01 - 2016-08-07 01:05 - 00001198 _____ C:\Users\Public\Desktop\Half-Life 2 Episode One.lnk
2017-04-27 02:01 - 2016-08-07 01:05 - 00001138 _____ C:\Users\Public\Desktop\Half-Life.lnk
2017-04-27 02:01 - 2016-08-06 00:19 - 00001234 _____ C:\Users\Niel\Desktop\Tales from the Borderlands Episode 5.lnk
2017-04-27 02:01 - 2016-08-04 09:02 - 00001807 _____ C:\Users\Public\Desktop\Tales from the Borderlands.lnk
2017-04-27 02:01 - 2016-08-01 02:33 - 00001475 _____ C:\Users\Public\Desktop\Borderlands Game Of The Year Edition.lnk
2017-04-27 02:01 - 2016-07-25 09:48 - 00002197 _____ C:\Users\Niel\Desktop\BorderlandsPreSequel - Shortcut.lnk
2017-04-27 02:01 - 2016-07-18 23:15 - 00001500 _____ C:\Users\Public\Desktop\Borderlands The Pre Sequel.lnk
2017-04-27 02:01 - 2016-07-06 14:41 - 00000813 _____ C:\Users\Niel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Start Tor Browser.lnk
2017-04-27 02:01 - 2016-06-26 19:59 - 00001655 _____ C:\Users\Public\Desktop\DEADBOLT.lnk
2017-04-27 02:01 - 2016-06-25 23:55 - 00002523 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Apple Software Update.lnk
2017-04-27 02:01 - 2016-06-21 19:05 - 00001425 _____ C:\Users\Niel\Desktop\Risk of Rain - Shortcut.lnk
2017-04-27 02:01 - 2016-06-15 17:21 - 00000872 _____ C:\Users\Public\Desktop\CCleaner.lnk
2017-04-27 02:01 - 2016-05-22 22:38 - 00001731 _____ C:\Users\Niel\Desktop\Google Drive.lnk
2017-04-27 02:01 - 2016-05-10 15:03 - 00001163 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\vShare Helper.lnk
2017-04-27 02:01 - 2016-03-25 01:16 - 00001931 _____ C:\Users\Public\Desktop\MetaTrader 4.lnk
2017-04-27 02:01 - 2016-02-20 05:20 - 00001065 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2017-04-27 02:01 - 2016-02-20 04:51 - 00001019 _____ C:\Users\Niel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2017-04-27 01:46 - 2016-02-22 20:50 - 00000000 ____D C:\Program Files (x86)\Internet Download Manager
2017-04-27 01:27 - 2013-08-22 21:36 - 00000000 ____D C:\Windows\Inf
2017-04-27 01:22 - 2016-02-20 05:20 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2017-04-27 01:08 - 2013-08-22 21:25 - 00262144 ___SH C:\Windows\system32\config\BBI
2017-04-26 21:58 - 2016-02-28 20:55 - 00000000 ____D C:\Users\Niel\AppData\Roaming\vlc
2017-04-26 21:12 - 2016-02-20 04:53 - 00863592 _____ C:\Windows\system32\PerfStringBackup.INI
2017-04-26 20:52 - 2013-08-22 22:44 - 00356424 _____ C:\Windows\system32\FNTCACHE.DAT
2017-04-26 20:51 - 2016-02-22 20:51 - 00000000 ____D C:\Users\Niel\AppData\Roaming\DMCache
2017-04-26 20:47 - 2013-08-23 03:11 - 00000000 ____D C:\Windows\ShellNew
2017-04-26 20:46 - 2013-08-22 23:36 - 00000000 ____D C:\Program Files\Common Files\microsoft shared
2017-04-01 08:36 - 2016-02-20 06:03 - 00000000 ____D C:\Program Files\Steam
2017-03-28 21:59 - 2016-02-20 06:58 - 00000000 ____D C:\Users\Niel\AppData\Local\Steam
2017-03-28 20:05 - 2016-05-22 22:35 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Drive
2017-03-28 10:30 - 2016-02-20 05:53 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\KMSpico
2017-03-28 10:30 - 2016-02-20 05:52 - 00000000 ____D C:\Program Files\KMSpico

==================== Files in the root of some directories =======

2017-04-27 01:19 - 2017-04-27 01:18 - 1060864 _____ () C:\Users\Niel\AppData\Roaming\Movecore.exe
2017-04-27 01:19 - 2017-04-27 01:19 - 1895968 _____ () C:\Users\Niel\AppData\Roaming\Movecore.tst
2016-02-04 22:19 - 2016-02-04 22:19 - 0032768 _____ (FelineSoft) C:\Users\Niel\AppData\Roaming\Project1.exe
2017-04-27 01:19 - 2017-04-27 01:19 - 0278509 _____ () C:\Users\Niel\AppData\Roaming\Stringdex.bin
2016-01-03 22:47 - 2016-01-03 22:47 - 0322552 _____ (Alexander Roshal) C:\Users\Niel\AppData\Roaming\UnRAR.exe
2016-07-29 20:16 - 2016-07-29 20:16 - 0007602 _____ () C:\Users\Niel\AppData\Local\Resmon.ResmonCfg
2016-07-15 19:46 - 2016-05-16 19:46 - 0000032 ____R () C:\ProgramData\hash.dat

Files to move or delete:
====================
C:\ProgramData\hash.dat


Some files in TEMP:
====================
2017-04-27 01:05 - 2017-04-27 01:05 - 1242624 _____ () C:\Users\Niel\AppData\Local\Temp\CodecFixDivx.exe
2017-04-27 01:15 - 2017-04-27 01:15 - 0763904 _____ () C:\Users\Niel\AppData\Local\Temp\DMDD__11426_il6.exe
2017-04-27 01:05 - 2017-04-27 01:05 - 0028672 _____ (Western Visayas College of Science and TechnologyT) C:\Users\Niel\AppData\Local\Temp\fox.exe
2017-04-27 01:18 - 2017-04-27 01:18 - 1909694 _____ (WeMonetize                                                  ) C:\Users\Niel\AppData\Local\Temp\PNDGUC5.exe
2017-04-27 01:05 - 2017-04-27 01:05 - 4321588 _____ () C:\Users\Niel\AppData\Local\Temp\start.exe

==================== Bamital & volsnap ======================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2017-04-26 22:49

==================== End of FRST.txt ============================