[removed]
Platform: Windows 7 Ultimate Service Pack 1 (X64) Language: English (United States)
Internet Explorer Version 11 (Default browser: "C:\Program Files (x86)\SeaMonkey\seamonkey.exe" -requestPending -osint -url "%1")
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(Intel Corporation) C:\Windows\System32\igfxCUIService.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Comodo) C:\Program Files (x86)\Comodo\Dragon\dragon_updater.exe
(LogMeIn, Inc.) C:\Program Files (x86)\LogMeIn Hamachi\LMIGuardianSvc.exe
(Maxthon) C:\Program Files (x86)\Maxthon App Store\1.1.0.10848\MaxthonAppstoreSvc.exe
(Maxthon) C:\Program Files (x86)\Maxthon\Modules\Service\Update\MaxthonUpdateSvc.exe
(Malwarebytes) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe
(Malwarebytes) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe
(LogMeIn Inc.) C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe
(Malwarebytes) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe
(Epic Privacy Browser) C:\Users\salty-san\AppData\Local\Epic Privacy Browser\Installer\EpicUpdate.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Power Software Ltd) C:\Program Files\PowerISO\PWRISOVM.EXE
(Lenovo) C:\Windows\System32\LenovoUpdate.exe
(Intel Corporation) C:\Windows\System32\igfxEM.exe
(Intel Corporation) C:\Windows\System32\igfxHK.exe
(Intel Corporation) C:\Windows\System32\igfxTray.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\avastui.exe
(Nullsoft, Inc.) C:\Program Files (x86)\Winamp\winampa.exe
(Nullsoft, Inc.) C:\Program Files (x86)\Winamp\winamp.exe
==================== Registry (Whitelisted) ===========================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\…\Run: [Eraser] => C:\Program Files\Eraser\Eraser.exe [1074088 2015-09-03] (The Eraser Project)
HKLM-x32\…\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [292848 2014-06-09] (Intel Corporation)
HKLM-x32\…\Run: [PWRISOVM.EXE] => C:\Program Files\PowerISO\PWRISOVM.EXE [408888 2015-07-23] (Power Software Ltd)
HKLM-x32\…\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [7400576 2016-05-12] (AVAST Software)
HKLM-x32\…\Run: [WinampAgent] => C:\Program Files (x86)\Winamp\winampa.exe [85600 2013-12-13] (Nullsoft, Inc.)
HKLM-x32\…\Run: [LogMeIn Hamachi Ui] => C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe [5565448 2016-04-05] (LogMeIn Inc.)
HKU\S-1-5-21-384921765-1548902971-3406650631-1000\…\Run: [Shotty] => C:\Program Files\Shotty\Shotty.exe [724480 2016-02-11] (hxxp://shotty.devs-on.net)
HKU\S-1-5-21-384921765-1548902971-3406650631-1000\…\Run: [Epic Privacy Browser Installer] => C:\Users\salty-san\AppData\Local\Epic Privacy Browser\Installer\EpicUpdate.exe [509096 2016-02-28] (Epic Privacy Browser)
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll [2016-05-09] (AVAST Software)
BootExecute: autocheck autochk * PCloudBroom64.exe \systemroot\system32\BroomData.bitPCloudBroom64.exe \systemroot\system32\BroomData.bit
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
Tcpip\..\Interfaces\{BB2A1C55-6917-4C3A-8770-C53876319A70}: [DhcpNameServer] 192.168.0.1
Internet Explorer:
==================
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
HKU\S-1-5-21-384921765-1548902971-3406650631-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar;=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar;=msnhome
HKU\S-1-5-21-384921765-1548902971-3406650631-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar;=iesearch
HKU\S-1-5-21-384921765-1548902971-3406650631-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.nyaa.se/
BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office\Office15\OCHelper.dll [2012-10-01] (Microsoft Corporation)
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll [2016-05-09] (AVAST Software)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office15\URLREDIR.DLL [2012-10-01] (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL [2012-10-01] (Microsoft Corporation)
BHO-x32: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll [2012-10-01] (Microsoft Corporation)
BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2016-05-09] (AVAST Software)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office15\URLREDIR.DLL [2012-10-01] (Microsoft Corporation)
BHO-x32: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\Office15\GROOVEEX.DLL [2012-10-01] (Microsoft Corporation)
DPF: HKLM-x32 {7530BFB8-7293-4D34-9923-61A11451AFC5} hxxp://download.eset.com/special/eos/OnlineScanner.cab
Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office\Office15\MSOSB.DLL [2012-10-01] (Microsoft Corporation)
FireFox:
========
FF ProfilePath: C:\Users\salty-san\AppData\Roaming\Mozilla\Firefox\Profiles\kl9fv1vt.default
FF DefaultSearchEngine: DuckDuckGo
FF Session Restore: -> is enabled.
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~2\Office15\NPSPWRAP.DLL [2012-10-01] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files (x86)\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2012-10-01] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office15\NPSPWRAP.DLL [2012-10-01] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.30.3\npGoogleUpdate3.dll [2016-05-11] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.30.3\npGoogleUpdate3.dll [2016-05-11] (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.2.1 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2015-04-13] (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2016-05-03] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-384921765-1548902971-3406650631-1000: @updates.epicbrowser.com/Epic Privacy Browser Installer;version=3 -> C:\Users\salty-san\AppData\Local\Epic Privacy Browser\Installer\1.3.27.13\npEpicUpdate3.dll [2016-02-28] (Epic Privacy Browser)
FF Plugin HKU\S-1-5-21-384921765-1548902971-3406650631-1000: @updates.epicbrowser.com/Epic Privacy Browser Installer;version=9 -> C:\Users\salty-san\AppData\Local\Epic Privacy Browser\Installer\1.3.27.13\npEpicUpdate3.dll [2016-02-28] (Epic Privacy Browser)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npMeetingJoinPluginOC.dll [2012-10-01] (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll [2016-05-03] (Adobe Systems Inc.)
FF HKLM\…\Firefox\Extensions: [[removed]] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: Avast Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2016-05-09]
FF HKLM-x32\…\Firefox\Extensions: [[removed]] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF HKLM-x32\…\Firefox\Extensions: [[removed]] - C:\Program Files\AVAST Software\Avast\SafePrice\FF
FF Extension: Avast SafePrice - C:\Program Files\AVAST Software\Avast\SafePrice\FF [2016-05-09]
Chrome:
=======
CHR Session Restore: Default -> is enabled.
CHR Profile: C:\Users\salty-san\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Slides) - C:\Users\salty-san\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-11-08]
CHR Extension: (Google Docs) - C:\Users\salty-san\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-11-08]
CHR Extension: (Google Drive) - C:\Users\salty-san\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-11-08]
CHR Extension: (YouTube) - C:\Users\salty-san\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-11-08]
CHR Extension: (Google Search) - C:\Users\salty-san\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-11-08]
CHR Extension: (Google Sheets) - C:\Users\salty-san\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-11-08]
CHR Extension: (Google Docs Offline) - C:\Users\salty-san\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-03-17]
CHR Extension: (Avast Online Security) - C:\Users\salty-san\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2016-04-08]
CHR Extension: (Chrome Web Store Payments) - C:\Users\salty-san\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2016-04-03]
CHR Extension: (Gmail) - C:\Users\salty-san\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-11-08]
CHR HKLM-x32\…\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2016-05-09]
==================== Services (Whitelisted) ========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [243296 2016-05-09] (AVAST Software)
R2 DragonUpdater; C:\Program Files (x86)\Comodo\Dragon\dragon_updater.exe [2307768 2016-05-05] (Comodo)
R2 igfxCUIService1.0.0.0; C:\Windows\system32\igfxCUIService.exe [318568 2014-10-10] (Intel Corporation)
R3 LenovoUpdate; C:\Windows\System32\LenovoUpdate.exe [26608 2016-05-25] (Lenovo)
R2 LMIGuardianSvc; C:\Program Files (x86)\LogMeIn Hamachi\LMIGuardianSvc.exe [417552 2016-04-05] (LogMeIn, Inc.)
R2 MaxthonAppStoreSvc; C:\Program Files (x86)\Maxthon App Store\1.1.0.10848\MaxthonAppstoreSvc.exe [1867544 2015-08-11] (Maxthon)
R2 MaxthonUpdateSvc; C:\Program Files (x86)\Maxthon\Modules\Service\Update\MaxthonUpdateSvc.exe [1872152 2015-05-11] (Maxthon)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1514464 2016-03-10] (Malwarebytes)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [1136608 2016-03-10] (Malwarebytes)
S3 rpcapd; C:\Program Files (x86)\WinPcap\rpcapd.exe [118520 2013-03-01] (Riverbed Technology, Inc.)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2015-08-05] (Microsoft Corporation)
===================== Drivers (Whitelisted) ==========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [37656 2016-05-09] (AVAST Software)
R1 aswKbd; C:\Windows\system32\drivers\aswKbd.sys [37144 2016-05-09] (AVAST Software)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [107792 2016-05-09] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [103064 2016-05-09] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [74544 2016-05-09] (AVAST Software)
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1070904 2016-05-09] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [465792 2016-05-09] (AVAST Software)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [166432 2016-05-09] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [287528 2016-05-09] (AVAST Software)
S3 ebdrv; C:\Windows\system32\drivers\evbda.sys [3286016 2009-06-10] (Broadcom Corporation)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [27008 2016-03-10] (Malwarebytes)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [192216 2016-05-25] (Malwarebytes)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [64896 2016-03-10] (Malwarebytes Corporation)
R2 NPF; C:\Windows\System32\drivers\npf.sys [36600 2013-03-01] (Riverbed Technology, Inc.)
S3 PSKMAD; C:\Windows\System32\DRIVERS\PSKMAD.sys [50320 2015-01-29] (Panda Security, S.L.)
R3 RSP2STOR; C:\Windows\System32\DRIVERS\RtsP2Stor.sys [294104 2014-12-10] (Realtek Semiconductor Corp.)
R3 RTWlanE; C:\Windows\System32\DRIVERS\rtwlane.sys [3513048 2015-03-23] (Realtek Semiconductor Corporation )
S3 VGPU; System32\drivers\rdvgkmd.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
==================== One Month Created files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2016-05-25 19:22 - 2016-05-25 19:22 - 00014689 _____ C:\Users\salty-san\Desktop\FRST.txt
2016-05-24 15:21 - 2016-05-25 11:42 - 00192216 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2016-05-24 15:21 - 2016-05-24 15:21 - 00001102 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2016-05-24 15:21 - 2016-05-24 15:21 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2016-05-24 15:21 - 2016-05-24 15:21 - 00000000 ____D C:\ProgramData\Malwarebytes
2016-05-24 15:21 - 2016-05-24 15:21 - 00000000 ____D C:\Program Files (x86)\Malwarebytes Anti-Malware
2016-05-24 15:21 - 2016-03-10 14:09 - 00064896 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2016-05-24 15:21 - 2016-03-10 14:08 - 00140672 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbamchameleon.sys
2016-05-24 15:21 - 2016-03-10 14:08 - 00027008 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbam.sys
2016-05-24 15:03 - 2016-05-24 15:07 - 00000000 ____D C:\AdwCleaner
2016-05-24 14:59 - 2016-05-24 14:59 - 22851472 _____ (Malwarebytes ) C:\Users\salty-san\Desktop\mbam-setup-2.2.1.1043.exe
2016-05-24 14:58 - 2016-05-24 14:58 - 01610816 _____ (Malwarebytes) C:\Users\salty-san\Desktop\JRT.exe
2016-05-24 14:57 - 2016-05-24 14:57 - 03651136 _____ C:\Users\salty-san\Desktop\AdwCleaner.exe
2016-05-24 13:32 - 2016-05-24 13:32 - 00000000 ____D C:\Users\salty-san\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Hero Editor
2016-05-24 13:32 - 2016-05-24 13:32 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Hero Editor
2016-05-24 13:27 - 2016-05-24 13:31 - 00249856 ____N (Microsoft Corporation) C:\Windows\Setup1.exe
2016-05-24 13:27 - 2016-05-24 13:31 - 00073216 _____ (Microsoft Corporation) C:\Windows\ST6UNST.EXE
2016-05-24 13:27 - 2016-05-24 13:27 - 00001895 _____ C:\Windows\ST6UNST.000
2016-05-24 13:21 - 2016-05-24 13:21 - 00001578 _____ C:\Users\salty-san\Desktop\Diablo II - Lord of Destruction.lnk
2016-05-24 13:21 - 2016-05-24 13:21 - 00000000 ____D C:\Users\salty-san\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Diablo II
2016-05-24 13:18 - 2016-05-24 13:18 - 00000000 ____D C:\ProgramData\Mozilla
2016-05-24 13:17 - 2016-05-24 13:23 - 00030691 _____ C:\Windows\DIIUnin.dat
2016-05-24 13:17 - 2016-05-24 13:21 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Diablo II
2016-05-24 13:17 - 2016-05-24 13:17 - 00094208 _____ (Blizzard Entertainment) C:\Windows\DIIUnin.exe
2016-05-24 13:17 - 2016-05-24 13:17 - 00002829 _____ C:\Windows\DIIUnin.pif
2016-05-24 13:17 - 2016-05-24 13:17 - 00001578 _____ C:\Users\Public\Desktop\Diablo II.lnk
2016-05-21 19:25 - 2016-05-21 19:25 - 00001613 _____ C:\Users\Public\Desktop\League of Legends.lnk
2016-05-21 19:25 - 2016-05-21 19:25 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\League of Legends
2016-05-21 19:24 - 2016-05-21 19:24 - 27864920 _____ (Riot Games) C:\Users\salty-san\Downloads\LeagueofLegends_NA_Installer_9_15_2014.exe
2016-05-21 18:52 - 2016-05-21 18:52 - 780152425 _____ C:\Windows\MEMORY.DMP
2016-05-21 18:52 - 2016-05-21 18:52 - 00262144 _____ C:\Windows\Minidump\052116-18517-01.dmp
2016-05-21 18:52 - 2016-05-21 18:52 - 00000000 ____D C:\Windows\Minidump
2016-05-21 10:33 - 2016-05-21 10:33 - 00015428 _____ C:\ComboFix.txt
2016-05-21 10:19 - 2011-06-26 09:45 - 00256000 _____ C:\Windows\PEV.exe
2016-05-21 10:19 - 2010-11-07 20:20 - 00208896 _____ C:\Windows\MBR.exe
2016-05-21 10:19 - 2000-08-31 03:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2016-05-21 10:19 - 2000-08-31 03:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2016-05-21 10:19 - 2000-08-31 03:00 - 00098816 _____ C:\Windows\sed.exe
2016-05-21 10:19 - 2000-08-31 03:00 - 00080412 _____ C:\Windows\grep.exe
2016-05-21 10:19 - 2000-08-31 03:00 - 00068096 _____ C:\Windows\zip.exe
2016-05-21 10:16 - 2016-05-21 10:16 - 05659526 ____R (Swearware) C:\Users\salty-san\Desktop\ItBe.exe
2016-05-21 01:30 - 2013-04-08 16:30 - 00022752 _____ C:\Windows\system32\PCloudBroom64.exe
2016-05-21 01:29 - 2016-05-21 10:11 - 00000322 _____ C:\Windows\SysWOW64\BroomData.bit
2016-05-19 09:48 - 2016-05-25 19:22 - 00000000 ____D C:\FRST
2016-05-19 09:48 - 2016-05-19 09:48 - 02382336 _____ (Farbar) C:\Users\salty-san\Desktop\FRST64.exe
2016-05-19 09:46 - 2016-05-19 09:46 - 05198336 _____ (AVAST Software) C:\Users\salty-san\Desktop\aswMBR.exe
2016-05-19 02:16 - 2016-05-19 02:16 - 00001035 _____ C:\Users\salty-san\Desktop\RMPrepUSB.lnk
2016-05-19 02:16 - 2016-05-19 02:16 - 00000000 ____D C:\Users\salty-san\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\RMPrepUSB
2016-05-19 02:16 - 2016-05-19 02:16 - 00000000 ____D C:\Program Files (x86)\RMPrepUSB
2016-05-19 01:44 - 2016-05-19 02:52 - 00000000 ____D C:\Make_PE3
2016-05-18 23:28 - 2016-05-18 23:28 - 00000000 ____D C:\Users\salty-san\AppData\Roaming\OfficeRecovery
2016-05-18 23:27 - 2016-05-18 23:27 - 00002419 _____ C:\Users\salty-san\Desktop\FreeUndelete.lnk
2016-05-18 23:27 - 2016-05-18 23:27 - 00000000 ____D C:\Users\salty-san\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\FreeUndelete
2016-05-18 23:27 - 2016-05-18 23:27 - 00000000 ____D C:\Users\salty-san\AppData\Local\Apps\OfficeRecovery
2016-05-16 16:21 - 2016-05-16 16:21 - 00000902 _____ C:\Users\Public\Desktop\WinToUSB.lnk
2016-05-16 16:21 - 2016-05-16 16:21 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinToUSB
2016-05-16 16:21 - 2016-05-16 16:21 - 00000000 ____D C:\Program Files\WinToUSB
2016-05-16 02:42 - 2009-04-20 07:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2016-05-16 02:37 - 2016-05-16 02:37 - 00000000 ____D C:\TheIt301T
2016-05-16 01:32 - 2015-01-29 19:21 - 00050320 _____ (Panda Security, S.L.) C:\Windows\system32\Drivers\PSKMAD.sys
2016-05-16 01:30 - 2016-05-16 01:32 - 00001282 _____ C:\Users\Public\Desktop\Panda Cloud Cleaner.lnk
2016-05-16 01:30 - 2016-05-16 01:30 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Panda Security
2016-05-16 01:30 - 2016-05-16 01:30 - 00000000 ____D C:\Program Files (x86)\Panda Security
2016-05-12 22:29 - 2016-05-12 22:29 - 00000000 ____D C:\Program Files (x86)\Comodo
2016-05-12 17:33 - 2016-05-12 17:33 - 00000000 ____D C:\ProgramData\Realtek
2016-05-12 15:37 - 2016-05-12 15:37 - 00001649 _____ C:\Users\salty-san\Desktop\LiLi USB Creator - Shortcut.lnk
2016-05-12 10:53 - 2016-05-12 10:53 - 00001233 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Glary Undelete.lnk
2016-05-12 10:53 - 2016-05-12 10:53 - 00001221 _____ C:\Users\Public\Desktop\Glary Undelete.lnk
2016-05-12 10:53 - 2016-05-12 10:53 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Glarysoft
2016-05-12 10:53 - 2016-05-12 10:53 - 00000000 ____D C:\Program Files (x86)\Glarysoft
2016-05-12 10:52 - 2016-05-12 10:52 - 00001106 _____ C:\Users\Public\Desktop\UndeleteMyFiles Pro.lnk
2016-05-12 10:52 - 2016-05-12 10:52 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\UndeleteMyFiles
2016-05-12 10:52 - 2016-05-12 10:52 - 00000000 ____D C:\Program Files (x86)\UndeleteMyFiles
2016-05-10 20:54 - 2016-05-10 20:54 - 00001081 _____ C:\Users\Public\Desktop\SWF File Player.lnk
2016-05-10 20:53 - 2016-05-10 20:54 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SWF File Player
2016-05-10 20:53 - 2016-05-10 20:53 - 00000000 ____D C:\Program Files (x86)\SWF File Player
2016-05-10 12:18 - 2016-05-10 12:18 - 00001190 _____ C:\Users\salty-san\Desktop\The I of the Dragon.lnk
2016-05-10 12:17 - 2016-05-10 12:17 - 00000000 ____D C:\Users\salty-san\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Zuxxez
2016-05-10 12:17 - 2016-05-10 12:17 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Zuxxez
2016-05-10 12:15 - 2016-05-10 12:15 - 00000000 ____D C:\Program Files (x86)\Zuxxez
2016-05-09 20:42 - 2016-05-09 20:42 - 00398152 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe
2016-05-09 20:42 - 2016-05-09 20:42 - 00052184 _____ (AVAST Software) C:\Windows\avastSS.scr
2016-05-08 23:36 - 2016-05-09 00:04 - 00000000 ____D C:\Users\salty-san\AppData\Roaming\avidemux
2016-05-08 23:36 - 2016-05-08 23:36 - 00000914 _____ C:\Users\Public\Desktop\Avidemux 2.6 - 64 bits.lnk
2016-05-08 23:36 - 2016-05-08 23:36 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avidemux (64 bits)
2016-05-08 23:36 - 2016-05-08 23:36 - 00000000 ____D C:\Program Files\Avidemux 2.6 - 64 bits
2016-05-08 20:18 - 2016-05-08 20:18 - 00000000 ____D C:\Users\salty-san\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\FunnyGames
2016-05-08 20:18 - 2016-05-08 20:18 - 00000000 ____D C:\Users\salty-san\AppData\Roaming\FunnyGames
2016-05-08 20:18 - 2016-05-08 20:18 - 00000000 ____D C:\Users\salty-san\AppData\Local\FunnyGames
2016-05-04 16:47 - 2016-05-04 16:49 - 00000000 ____D C:\TheIt
2016-05-04 16:16 - 2016-05-24 14:53 - 00000000 ____D C:\Users\salty-san\AppData\Roaming\Avant Profiles
2016-05-04 16:16 - 2016-05-04 16:16 - 00001923 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Avant Browser.lnk
2016-05-04 16:16 - 2016-05-04 16:16 - 00001917 _____ C:\Users\Public\Desktop\Avant Browser.lnk
2016-05-04 16:16 - 2016-05-04 16:16 - 00000000 ____D C:\Users\salty-san\AppData\Roaming\Avant Downloader
2016-05-04 16:16 - 2016-05-04 16:16 - 00000000 ____D C:\Users\salty-san\AppData\Local\Chromium
2016-05-04 16:16 - 2016-05-04 16:16 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avant Browser
2016-05-04 16:16 - 2016-05-04 16:16 - 00000000 ____D C:\Program Files (x86)\Avant Browser
2016-05-04 16:13 - 2016-05-22 19:05 - 00000000 ____D C:\Users\salty-san\AppData\Roaming\SlimBrowser
2016-05-04 16:08 - 2016-05-16 02:03 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FlashPeak SlimBrowser
2016-05-04 16:08 - 2016-05-04 16:08 - 00001021 _____ C:\Users\Public\Desktop\FlashPeak SlimBrowser.lnk
2016-05-04 16:07 - 2016-05-04 16:08 - 00000000 ____D C:\Program Files (x86)\SlimBrowser
2016-05-04 15:54 - 2016-05-04 15:54 - 00001226 _____ C:\Users\Public\Desktop\Comodo Dragon.lnk
2016-05-04 15:54 - 2016-05-04 15:54 - 00000000 ____D C:\Users\salty-san\AppData\Local\Comodo
2016-05-04 15:54 - 2016-05-04 15:54 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Comodo
2016-05-04 15:52 - 2016-05-04 15:52 - 01700352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdiplus.dll
2016-05-04 15:52 - 2016-05-04 15:52 - 01060864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfc71.dll
2016-05-04 15:52 - 2016-05-04 15:52 - 00348160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msvcr71.dll
2016-05-04 15:24 - 2016-05-04 15:24 - 00003600 _____ C:\Windows\System32\Tasks\Maxthon Update
2016-05-04 15:24 - 2016-05-04 15:24 - 00001081 _____ C:\Users\Public\Desktop\Maxthon Cloud Browser.lnk
2016-05-04 15:24 - 2016-05-04 15:24 - 00000000 ____D C:\Users\salty-san\AppData\Roaming\Maxthon3
2016-05-04 15:23 - 2016-05-04 15:24 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maxthon Cloud Browser
2016-05-04 15:23 - 2016-05-04 15:24 - 00000000 ____D C:\Program Files (x86)\Maxthon
2016-05-04 15:23 - 2016-05-04 15:23 - 00001295 _____ C:\Users\Public\Desktop\Maxthon App Store.lnk
2016-05-04 15:23 - 2016-05-04 15:23 - 00000000 ____D C:\Users\salty-san\AppData\Roaming\Maxthon App Store
2016-05-04 15:23 - 2016-05-04 15:23 - 00000000 ____D C:\Users\Public\Documents\Baidu
2016-05-04 15:23 - 2016-05-04 15:23 - 00000000 ____D C:\Program Files (x86)\Maxthon App Store
2016-05-03 22:51 - 2016-05-25 09:38 - 00003942 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{F51745E5-CA05-4A07-82FD-E977DEA96A94}
2016-04-27 16:46 - 2016-04-27 16:46 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LogMeIn Hamachi
2016-04-27 16:46 - 2016-04-27 16:46 - 00000000 ____D C:\Program Files (x86)\LogMeIn Hamachi
2016-04-27 16:46 - 2016-04-05 16:18 - 00034720 ____H (LogMeIn, Inc.) C:\Windows\system32\hamachi.sys
2016-04-26 23:51 - 2016-04-26 23:51 - 00000000 ____D C:\ProgramData\RELOADED
2016-04-26 23:36 - 2016-04-26 23:36 - 00000850 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Torchlight II.lnk
2016-04-26 23:36 - 2016-04-26 23:36 - 00000838 _____ C:\Users\Public\Desktop\Torchlight II.lnk
2016-04-26 23:35 - 2016-04-26 23:41 - 00000000 ____D C:\Program Files (x86)\Torchlight II
==================== One Month Modified files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2016-05-25 18:57 - 2015-11-08 00:30 - 00000898 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2016-05-25 15:47 - 2016-01-08 20:03 - 00000000 ____D C:\Program Files (x86)\Opera
2016-05-25 11:54 - 2015-11-08 00:30 - 00000894 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2016-05-25 11:25 - 2016-01-04 22:52 - 00004182 _____ C:\Windows\System32\Tasks\avast! Emergency Update
2016-05-25 09:24 - 2009-07-14 07:45 - 00026352 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2016-05-25 09:24 - 2009-07-14 07:45 - 00026352 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2016-05-25 09:20 - 2009-07-14 08:13 - 00781298 _____ C:\Windows\system32\PerfStringBackup.INI
2016-05-25 09:20 - 2009-07-14 06:20 - 00000000 ____D C:\Windows\inf
2016-05-25 09:17 - 2016-03-06 15:37 - 00000000 ____D C:\Users\salty-san\AppData\Local\LogMeIn Hamachi
2016-05-25 09:17 - 2016-02-11 19:04 - 00000000 ____D C:\Users\salty-san\AppData\Local\Shotty
2016-05-25 09:16 - 2015-11-01 23:10 - 00097264 _____ (Lenovo (Beijing) Limited) C:\Windows\system32\LenovoCheck.exe
2016-05-25 09:16 - 2015-11-01 23:10 - 00026608 _____ (Lenovo) C:\Windows\system32\LenovoUpdate.exe
2016-05-25 09:16 - 2009-07-14 08:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2016-05-24 13:50 - 2016-03-26 23:47 - 00000000 ____D C:\Games
2016-05-24 13:26 - 2016-02-05 02:35 - 00000000 ____D C:\Program Files (x86)\SeaMonkey
2016-05-21 22:39 - 2016-01-03 02:37 - 00002441 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk
2016-05-21 19:26 - 2015-11-01 17:02 - 00000000 ____D C:\Users\salty-san\AppData\Roaming\Riot Games
2016-05-21 10:33 - 2016-03-28 15:49 - 00000000 ____D C:\Qoobox
2016-05-21 10:31 - 2009-07-14 05:34 - 00000215 _____ C:\Windows\system.ini
2016-05-20 19:18 - 2016-02-10 21:08 - 00000000 ____D C:\Users\salty-san\Documents\Mount&Blade; Savegames
2016-05-19 21:16 - 2016-02-10 20:58 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GOG.com
2016-05-19 21:16 - 2009-07-14 08:32 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
2016-05-19 20:52 - 2016-02-10 20:57 - 00000000 ____D C:\GOG Games
2016-05-18 09:24 - 2015-12-04 12:06 - 00000000 ____D C:\Users\salty-san\AppData\Roaming\vlc
2016-05-17 15:12 - 2016-02-18 17:23 - 00000440 __RSH C:\ProgramData\ntuser.pol
2016-05-13 15:46 - 2016-02-18 21:02 - 00003846 _____ C:\Windows\System32\Tasks\Opera scheduled Autoupdate 1455818550
2016-05-13 08:57 - 2015-11-08 00:30 - 00002195 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2016-05-13 08:57 - 2015-11-08 00:30 - 00002183 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2016-05-12 16:11 - 2016-03-31 15:41 - 00000000 ____D C:\Users\salty-san\Documents\Mami
2016-05-11 11:49 - 2015-11-08 00:30 - 00003894 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2016-05-11 11:49 - 2015-11-08 00:30 - 00003642 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2016-05-11 11:06 - 2016-01-03 02:38 - 00003886 _____ C:\Windows\System32\Tasks\Adobe Acrobat Update Task
2016-05-10 12:18 - 2016-01-03 22:46 - 00000000 ____D C:\Users\salty-san\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games
2016-05-10 08:55 - 2016-03-23 23:11 - 00003890 _____ C:\Windows\System32\Tasks\SafeZone scheduled Autoupdate 1458763845
2016-05-09 20:42 - 2016-01-04 22:52 - 00465792 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSP.sys
2016-05-09 20:42 - 2016-01-04 22:52 - 00287528 _____ (AVAST Software) C:\Windows\system32\Drivers\aswVmm.sys
2016-05-09 20:42 - 2016-01-04 22:52 - 00166432 _____ (AVAST Software) C:\Windows\system32\Drivers\aswStm.sys
2016-05-09 20:42 - 2016-01-04 22:52 - 00107792 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys
2016-05-09 20:42 - 2016-01-04 22:52 - 00103064 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys
2016-05-09 20:42 - 2016-01-04 22:52 - 00074544 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRvrt.sys
2016-05-09 20:42 - 2016-01-04 22:52 - 00037656 _____ (AVAST Software) C:\Windows\system32\Drivers\aswHwid.sys
2016-05-09 20:41 - 2016-03-23 23:10 - 00037144 _____ (AVAST Software) C:\Windows\system32\Drivers\aswKbd.sys
2016-05-09 20:41 - 2016-01-04 22:52 - 01070904 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSnx.sys
2016-05-04 18:27 - 2009-07-14 08:08 - 00032654 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2016-05-04 16:35 - 2015-11-01 13:21 - 00000000 ____D C:\Users\salty-san
2016-04-29 21:06 - 2015-11-05 17:02 - 00000000 ____D C:\Users\salty-san\AppData\Local\Microsoft Games
2016-04-26 23:51 - 2015-11-01 19:10 - 00000000 ____D C:\Users\salty-san\Documents\My Games
==================== Files in the root of some directories =======
2016-03-13 14:21 - 2016-03-21 22:53 - 0000129 _____ () C:\Users\salty-san\AppData\Roaming\Camdata.ini
2016-03-13 14:21 - 2016-03-21 22:53 - 0000408 _____ () C:\Users\salty-san\AppData\Roaming\CamLayout.ini
2016-03-13 14:21 - 2016-03-21 22:53 - 0000408 _____ () C:\Users\salty-san\AppData\Roaming\CamShapes.ini
2016-03-13 14:21 - 2016-03-21 22:53 - 0004548 _____ () C:\Users\salty-san\AppData\Roaming\CamStudio.cfg
2016-03-13 14:21 - 2016-03-21 22:50 - 0000096 _____ () C:\Users\salty-san\AppData\Roaming\version2.xml
Some files in TEMP:
====================
C:\Users\salty-san\AppData\Local\Temp\binkw32.dll
C:\Users\salty-san\AppData\Local\Temp\d2l_Install.exe
C:\Users\salty-san\AppData\Local\Temp\libeay32.dll
C:\Users\salty-san\AppData\Local\Temp\msvcr120.dll
C:\Users\salty-san\AppData\Local\Temp\sqlite3.dll
==================== Bamital & volsnap =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2016-05-18 07:33
==================== End of FRST.txt ============================