Good day.
I was searching for a Microsoft Office at thepiratebay today, and as I was downloading stuff from there, my browsers (Firefox and Chrome) suddenly keeps opening ads, frequently being obstructive and annoying (since it closes the currently opened tab sometimes).
Your help will be much appreciated. Thank you!
Attached are the aswMBR and FRST results as per instructions on the pinned post.
PS: you're my only hope
_________________________________________________________________________________________________________
aswMBR.txt
aswMBR version 1.0.1.2252 Copyright© 2014 AVAST Software
Run date: 2017-04-27 02:54:21
—————————–
02:54:21.735 OS Version: Windows x64 6.2.9200
02:54:21.735 Number of processors: 4 586 0x2502
02:54:21.735 ComputerName: NIEL-PC UserName: Niel
02:54:23.142 Initialize success
02:54:23.345 VM: initialized successfully
02:54:23.345 VM: Intel CPU supported
03:02:32.294 VM: supported disk I/O storport.sys
03:02:43.142 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\0000002d
03:02:43.145 Disk 0 Vendor: WDC_WD3200BEVT-75ZCT2 11.01A11 Size: 305245MB BusType: 11
03:02:43.301 VM: Disk 0 MBR read successfully
03:02:43.305 Disk 0 MBR scan
03:02:43.312 Disk 0 Windows 7 default MBR code
03:02:43.327 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 100 MB offset 2048
03:02:43.345 Disk 0 Partition 2 00 07 HPFS/NTFS NTFS 304243 MB offset 206848
03:02:43.376 Disk 0 Partition 3 00 27 Hidden NTFS WinRE NTFS 450 MB offset 623296512
03:02:43.386 Disk 0 Partition 4 00 27 Hidden NTFS WinRE NTFS 450 MB offset 624218112
03:02:43.427 Disk 0 scanning C:\Windows\system32\drivers
03:02:50.928 Service scanning
03:03:08.405 Modules scanning
03:03:08.405 Disk 0 trace - called modules:
03:03:08.436 ntoskrnl.exe CLASSPNP.SYS disk.sys storport.sys hal.dll storahci.sys
03:03:08.436 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xffffe001f6cc4060]
03:03:08.436 3 CLASSPNP.SYS[fffff801c241dabb] -> nt!IofCallDriver -> \Device\0000002d[0xffffe001f6aff5b0]
03:03:08.452 Disk 0 statistics 103414/0/17 @ 7.38 MB/s
03:03:08.452 Scan finished successfully
03:04:14.512 Disk 0 MBR has been saved successfully to "C:\Users\Niel\Desktop\MBR.dat"
03:04:14.527 The log file has been saved successfully to "C:\Users\Niel\Desktop\aswMBR.txt"
_________________________________________________________________________________________________________
FRST.txt
Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 26-04-2017
Ran by [removed] (administrator) on NIEL-PC (27-04-2017 02:55:51)
Running from C:\Users\[removed]\Downloads
[removed]
Platform: Windows 8.1 Pro (X64) Language: English (United States)
Internet Explorer Version 11 (Default browser not detected!)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(@ByELDI) C:\Program Files\KMSpico\Service_KMS.exe
(IvoSoft) C:\Program Files\Classic Shell\ClassicStartMenu.exe
(Microsoft Corporation) C:\Windows\System32\alg.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
(45) C:\Program Files\H9VM7U9JOK\H9VM7U9JO.exe
(45) C:\Program Files\5BVRXCG4J6\5BVRXCG4J.exe
(45) C:\Program Files\NUVHQ8FEBP\NUVHQ8FEB.exe
(BitTorrent Inc.) C:\Users\Niel\AppData\Roaming\BitTorrent\BitTorrent.exe
(45) C:\Program Files\BVB4TSKTNL\BVB4TSKTN.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(45) C:\Program Files\4RNITOO9T5\4RNITOO9T.exe
(45) C:\Program Files\BPL76IA803\FAB9LOEEN.exe
(45) C:\Program Files\3IB9MZ9FRW\3IB9MZ9FR.exe
(45) C:\Program Files\4BONLDL8HE\4BONLDL8H.exe
(BitTorrent Inc.) C:\Users\Niel\AppData\Roaming\BitTorrent\updates\7.9.9_43389\bittorrentie.exe
(BitTorrent Inc.) C:\Users\Niel\AppData\Roaming\BitTorrent\updates\7.9.9_43389\bittorrentie.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Power Software Ltd) C:\Program Files\PowerISO\PWRISOVM.EXE
(Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Tonec Inc.) C:\Program Files (x86)\Internet Download Manager\IDMan.exe
(Tonec Inc.) C:\Program Files (x86)\Internet Download Manager\IEMonitor.exe
(AVAST Software) C:\Users\Niel\Downloads\Programs\aswMBR.exe
(AVAST Software) C:\Users\Niel\Downloads\Programs\aswMBR.exe
==================== Registry (Whitelisted) ====================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\…\Run: [Classic Start Menu] => C:\Program Files\Classic Shell\ClassicStartMenu.exe [161728 2015-11-13] (IvoSoft)
HKLM\…\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [176952 2016-06-01] (Apple Inc.)
HKLM-x32\…\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe [767176 2015-07-16] (Advanced Micro Devices, Inc.)
HKLM-x32\…\Run: [AMD AVT] => Cmd.exe /c start "AMD Accelerated Video Transcoding device initialization" /min "C:\Program Files (x86)\AMD AVT\bin\kdbsync.exe" aml
HKLM-x32\…\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [595480 2016-03-20] (Oracle Corporation)
HKLM-x32\…\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [67384 2016-04-22] (Apple Inc.)
HKLM-x32\…\Run: [WindowsDefender] => -
HKU\S-1-5-21-3336116062-2625747668-4257245518-1001\…\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [8455960 2015-08-20] (Piriform Ltd)
HKU\S-1-5-21-3336116062-2625747668-4257245518-1001\…\Run: [IDMan] => C:\Program Files (x86)\Internet Download Manager\IDMan.exe [3911248 2015-11-10] (Tonec Inc.)
HKU\S-1-5-21-3336116062-2625747668-4257245518-1001\…\Run: [GoogleDriveSync] => C:\Program Files (x86)\Google\Drive\googledrivesync.exe [23819304 2017-03-21] (Google)
HKU\S-1-5-21-3336116062-2625747668-4257245518-1001\…\Run: [Windows Defender] => -
HKU\S-1-5-21-3336116062-2625747668-4257245518-1001\…\Run: [SQP0EJ2RG3D0N37] => C:\Program Files\H9VM7U9JOK\H9VM7U9JO.exe [1101312 2017-04-27] (45)
HKU\S-1-5-21-3336116062-2625747668-4257245518-1001\…\Run: [OFTSSUR7CTIDZ1F] => C:\Program Files\5BVRXCG4J6\5BVRXCG4J.exe [1101312 2017-04-27] (45)
HKU\S-1-5-21-3336116062-2625747668-4257245518-1001\…\Run: [W48BVI2EKMRDT95] => C:\Program Files\NUVHQ8FEBP\NUVHQ8FEB.exe [1101312 2017-04-27] (45)
HKU\S-1-5-21-3336116062-2625747668-4257245518-1001\…\Run: [BENM19A9VTQODAC] => C:\Program Files\BVB4TSKTNL\BVB4TSKTN.exe [1101312 2017-04-27] (45)
HKU\S-1-5-21-3336116062-2625747668-4257245518-1001\…\Run: [2JBHSEBGLSTQV99] => C:\Program Files\4RNITOO9T5\4RNITOO9T.exe [1101312 2017-04-27] (45)
HKU\S-1-5-21-3336116062-2625747668-4257245518-1001\…\Run: [0NP6O3L0ZB5PESK] => C:\Program Files\BPL76IA803\FAB9LOEEN.exe [1101312 2017-04-27] (45)
HKU\S-1-5-21-3336116062-2625747668-4257245518-1001\…\Run: [1O0MTOYX7CCAOBJ] => C:\Program Files\3IB9MZ9FRW\3IB9MZ9FR.exe [1101312 2017-04-27] (45)
HKU\S-1-5-21-3336116062-2625747668-4257245518-1001\…\Run: [AJO4R26717HN3VW] => C:\Program Files\4BONLDL8HE\4BONLDL8H.exe [1101312 2017-04-27] (45)
HKU\S-1-5-21-3336116062-2625747668-4257245518-1001\…\MountPoints2: {31ab9ac7-8527-11e6-82af-b8ac6f535cb7} - "F:\SETUP.EXE"
HKU\S-1-5-21-3336116062-2625747668-4257245518-1001\…\MountPoints2: {31ab9ad1-8527-11e6-82af-b8ac6f535cb7} - "G:\SETUP.EXE"
HKLM\…\Providers\wzgpufsb: C:\Program Files (x86)\Plarety Cache\local64spl.dll [314880 2017-04-27] ()
ShellExecuteHooks: No Name - {E8B867B6-267D-11E7-A22E-64006A5CFC23} - C:\Users\Niel\AppData\Roaming\Drorecultsesaly\Drkuentaterjeph.dll [147456 2017-04-27] ()
ShellIconOverlayIdentifiers: [ IDM Shell Extension] -> {CDC95B92-E27C-4745-A8C5-64A52A78855D} => C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll [2015-08-14] (Tonec Inc.)
ShellIconOverlayIdentifiers: [ GoogleDriveBlacklisted] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll [2017-03-21] (Google)
ShellIconOverlayIdentifiers: [ GoogleDriveSynced] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll [2017-03-21] (Google)
ShellIconOverlayIdentifiers: [ GoogleDriveSyncing] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll [2017-03-21] (Google)
Startup: C:\Users\Niel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Autochartist MetaTrader Plugin - Auto Update.lnk [2017-04-27]
ShortcutTarget: Autochartist MetaTrader Plugin - Auto Update.lnk -> C:\Users\Niel\AppData\Roaming\MetaQuotes\Terminal\50CA3DFB510CC5A8F28B48D1BF2A5702\MQL4\AutochartistExpert_Advisor_AutoUpdater.exe (Pantaray Research Ltd.)
Startup: C:\Users\Niel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\JetBoost - Shortcut.lnk [2017-04-27]
ShortcutTarget: JetBoost - Shortcut.lnk -> C:\Program Files (x86)\BlueSprig\JetBoost\JetBoost.exe (BlueSprig)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\..\Interfaces\{2F73DEAA-845D-4B45-A11D-796595B74C10}: [NameServer] 114.108.195.1,114.108.193.201
Tcpip\..\Interfaces\{7D1D36F5-B308-4A28-AE13-8AA4E4E644A6}: [DhcpNameServer] [removed]
Tcpip\..\Interfaces\{DD5834B4-4715-48C0-96D1-8E75BD504E42}: [DhcpNameServer] [removed] [removed]
Internet Explorer:
==================
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page =
HKU\S-1-5-21-3336116062-2625747668-4257245518-1001\Software\Microsoft\Internet Explorer\Main,Start Page =
HKU\S-1-5-21-3336116062-2625747668-4257245518-1001\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/en-ph/?ocid=iehp
SearchScopes: HKLM-x32 -> DefaultScope value is missing
BHO: IDM integration (IDMIEHlprObj Class) -> {0055C089-8582-441B-A0BF-17B458C2A3A8} -> C:\Program Files (x86)\Internet Download Manager\IDMIECC64.dll [2015-09-28] (Internet Download Manager, Tonec Inc.)
BHO: ClassicIEBHO Class -> {EA801577-E6AD-4BD5-8F71-4BE0154331A4} -> C:\Program Files\Classic Shell\ClassicIEDLL_64.dll [2015-11-13] (IvoSoft)
BHO-x32: IDM integration (IDMIEHlprObj Class) -> {0055C089-8582-441B-A0BF-17B458C2A3A8} -> C:\Program Files (x86)\Internet Download Manager\IDMIECC.dll [2015-09-28] (Internet Download Manager, Tonec Inc.)
BHO-x32: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_77\bin\ssv.dll [2016-04-09] (Oracle Corporation)
BHO-x32: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_77\bin\jp2ssv.dll [2016-04-09] (Oracle Corporation)
BHO-x32: ClassicIEBHO Class -> {EA801577-E6AD-4BD5-8F71-4BE0154331A4} -> C:\Program Files\Classic Shell\ClassicIEDLL_32.dll [2015-11-13] (IvoSoft)
FireFox:
========
FF DefaultProfile: new9o6kp.default
FF ProfilePath: C:\Users\Niel\AppData\Roaming\Mozilla\Firefox\Profiles\new9o6kp.default [2017-04-27]
FF DefaultSearchEngine: Mozilla\Firefox\Profiles\new9o6kp.default -> initialpage123
FF SelectedSearchEngine: Mozilla\Firefox\Profiles\new9o6kp.default -> initialpage123
FF NetworkProxy: Mozilla\Firefox\Profiles\new9o6kp.default -> no_proxies_on", "localhost, 127.0.0.1, 192.168.1.0/24,"
FF NetworkProxy: Mozilla\Firefox\Profiles\new9o6kp.default -> socks", "127.0.0.1"
FF NetworkProxy: Mozilla\Firefox\Profiles\new9o6kp.default -> socks_port", 9050
FF NetworkProxy: Mozilla\Firefox\Profiles\new9o6kp.default -> socks_remote_dns", true
FF NetworkProxy: Mozilla\Firefox\Profiles\new9o6kp.default -> type", 0
FF Extension: (Tables) - C:\Users\Niel\AppData\Roaming\Mozilla\Firefox\Profiles\new9o6kp.default\Extensions\[removed] [2017-04-17]
FF Extension: (Site Deployment Checker) - C:\Program Files (x86)\Mozilla Firefox\browser\features\[removed] [2017-04-26] [not signed]
FF HKU\S-1-5-21-3336116062-2625747668-4257245518-1001\…\Firefox\Extensions: [[removed]] - C:\Program Files (x86)\Internet Download Manager\idmmzcc2.xpi
FF Extension: (IDM integration) - C:\Program Files (x86)\Internet Download Manager\idmmzcc2.xpi [2015-11-09]
FF HKU\S-1-5-21-3336116062-2625747668-4257245518-1001\…\SeaMonkey\Extensions: [[removed]] - C:\Program Files (x86)\Internet Download Manager\idmmzcc2.xpi
FF HKU\S-1-5-21-3336116062-2625747668-4257245518-1001\…\SeaMonkey\Extensions: [[removed]] - C:\Users\Niel\AppData\Roaming\IDM\idmmzcc5
FF Extension: (IDM CC) - C:\Users\Niel\AppData\Roaming\IDM\idmmzcc5 [2017-04-27] [not signed]
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_20_0_0_306.dll [2016-02-20] ()
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_20_0_0_306.dll [2016-02-20] ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2015-12-18] ()
FF Plugin-x32: @java.com/DTPlugin,version=11.77.2 -> C:\Program Files (x86)\Java\jre1.8.0_77\bin\dtplugin\npDeployJava1.dll [2016-04-09] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.77.2 -> C:\Program Files (x86)\Java\jre1.8.0_77\bin\plugin2\npjp2.dll [2016-04-09] (Oracle Corporation)
FF Plugin-x32: @softnyxNpruntime -> C:\Game\SoftnyxGame\NyxLauncherIS\npSoftnyx.dll [2015-09-22] ( )
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.32.7\npGoogleUpdate3.dll [2017-03-22] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.32.7\npGoogleUpdate3.dll [2017-03-22] (Google Inc.)
Chrome:
=======
CHR HKLM\…\Chrome\Extension: [ngpampappnmepgilojfohadhhmbhlaek] - C:\Program Files (x86)\Internet Download Manager\IDMGCExt.crx [2015-11-09]
CHR HKU\S-1-5-21-3336116062-2625747668-4257245518-1001\SOFTWARE\Google\Chrome\Extensions\…\Chrome\Extension: [lmjegmlicamnimmfhcmpkclmigmmcbeh] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\…\Chrome\Extension: [ngpampappnmepgilojfohadhhmbhlaek] - C:\Program Files (x86)\Internet Download Manager\IDMGCExt.crx [2015-11-09]
==================== Services (Whitelisted) ====================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [83768 2016-03-02] (Apple Inc.)
S3 EasyAntiCheat; C:\Windows\SysWOW64\EasyAntiCheat.exe [238376 2016-03-19] (EasyAntiCheat Ltd)
R2 Service KMSELDI; C:\Program Files\KMSpico\Service_KMS.exe [985280 2015-08-12] (@ByELDI) [File not signed]
S3 TunngleService; C:\Program Files (x86)\Tunngle\TnglCtrl.exe [814064 2015-12-22] (Tunngle.net GmbH)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [346872 2013-08-22] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23840 2013-08-22] (Microsoft Corporation)
===================== Drivers (Whitelisted) ======================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R3 AtiHDAudioService; C:\Windows\system32\drivers\AtihdWB6.sys [102912 2015-07-15] (Advanced Micro Devices)
R3 BCM43XX; C:\Windows\system32\DRIVERS\bcmwl63al.sys [5170176 2013-07-02] (Broadcom Corporation)
S3 dtlitescsibus; C:\Windows\System32\drivers\dtlitescsibus.sys [30264 2017-04-26] (Disc Soft Ltd)
S3 dtliteusbbus; C:\Windows\System32\drivers\dtliteusbbus.sys [47672 2017-04-26] (Disc Soft Ltd)
S3 sshid; C:\Windows\System32\drivers\sshid.sys [51400 2016-01-28] (SteelSeries ApS)
R3 tap0901t; C:\Windows\system32\DRIVERS\tap0901t.sys [47736 2015-12-21] (Tunngle.net)
S3 WdBoot; C:\Windows\system32\drivers\WdBoot.sys [34760 2013-08-22] (Microsoft Corporation)
S3 WdFilter; C:\Windows\system32\drivers\WdFilter.sys [265056 2013-08-22] (Microsoft Corporation)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [124256 2013-08-22] (Microsoft Corporation)
S3 xhunter1; \??\C:\Windows\xhunter1.sys [X]
S3 xspirit; \??\C:\Windows\xspirit.sys [X]
U3 aswMBR; \??\C:\Users\Niel\AppData\Local\Temp\aswMBR.sys [X] <==== ATTENTION
U3 aswVmm; \??\C:\Users\Niel\AppData\Local\Temp\aswVmm.sys [X] <==== ATTENTION
==================== NetSvcs (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
==================== One Month Created files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2017-04-27 02:55 - 2017-04-27 02:56 - 00015078 _____ C:\Users\Niel\Downloads\FRST.txt
2017-04-27 02:55 - 2017-04-27 02:55 - 00000000 ____D C:\FRST
2017-04-27 02:46 - 2017-04-27 02:48 - 02427392 _____ (Farbar) C:\Users\Niel\Downloads\FRST64.exe
2017-04-27 02:39 - 2017-04-27 02:41 - 04089296 _____ C:\Users\Niel\Downloads\AdwCleaner.exe
2017-04-27 02:29 - 2017-04-27 02:29 - 00000824 _____ C:\Users\Public\Desktop\PowerISO.lnk
2017-04-27 02:29 - 2017-04-27 02:29 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PowerISO
2017-04-27 02:29 - 2017-04-27 02:29 - 00000000 ____D C:\Program Files\PowerISO
2017-04-27 02:29 - 2016-05-25 07:06 - 00137280 _____ (Power Software Ltd) C:\Windows\system32\Drivers\scdemu.sys
2017-04-27 02:24 - 2017-04-27 02:25 - 00000000 ____D C:\Users\Niel\Downloads\PowerISO FULL 6.6 + Crack [TechTools.NET]
2017-04-27 02:23 - 2017-04-27 02:28 - 00000000 ____D C:\Users\Niel\Downloads\Microsoft Office Professional Plus 2016 + Activation Tool [danhuk]
2017-04-27 02:22 - 2017-04-27 02:27 - 00000000 ____D C:\Users\Niel\AppData\LocalLow\BitTorrent
2017-04-27 01:42 - 2017-04-27 01:42 - 00000000 ____D C:\Program Files\4BONLDL8HE
2017-04-27 01:35 - 2017-04-27 01:36 - 00000000 ____D C:\Program Files\3IB9MZ9FRW
2017-04-27 01:29 - 2017-04-27 01:30 - 04102600 _____ C:\Users\Niel\Downloads\adwcleaner_6.046.exe
2017-04-27 01:23 - 2017-04-27 01:23 - 00000000 ____D C:\Program Files\BPL76IA803
2017-04-27 01:19 - 2017-04-27 01:19 - 01895968 _____ C:\Users\Niel\AppData\Roaming\Movecore.tst
2017-04-27 01:19 - 2017-04-27 01:19 - 00278509 _____ C:\Users\Niel\AppData\Roaming\Stringdex.bin
2017-04-27 01:19 - 2017-04-27 01:19 - 00000000 ____D C:\Program Files\BVB4TSKTNL
2017-04-27 01:19 - 2017-04-27 01:19 - 00000000 ____D C:\Program Files\4RNITOO9T5
2017-04-27 01:19 - 2017-04-27 01:18 - 01060864 _____ C:\Users\Niel\AppData\Roaming\Movecore.exe
2017-04-27 01:18 - 2017-04-27 01:18 - 00000000 ____D C:\Program Files\NUVHQ8FEBP
2017-04-27 01:17 - 2017-04-27 01:17 - 00000000 ____D C:\Program Files\H9VM7U9JOK
2017-04-27 01:17 - 2017-04-27 01:17 - 00000000 ____D C:\Program Files\5BVRXCG4J6
2017-04-27 01:16 - 2017-04-27 02:30 - 00000000 ____D C:\Users\Niel\AppData\LocalLow\Mozilla
2017-04-27 01:15 - 2017-04-27 01:16 - 00000000 ____D C:\Users\Niel\AppData\Local\Nwijerqerty
2017-04-27 01:15 - 2017-04-27 01:15 - 00006070 _____ C:\Windows\System32\Tasks\Plarety Cache
2017-04-27 01:15 - 2017-04-27 01:15 - 00000000 ____D C:\Users\Niel\AppData\Roaming\Drorecultsesaly
2017-04-27 01:15 - 2017-04-27 01:15 - 00000000 ____D C:\Program Files (x86)\Plarety Cache
2017-04-27 01:15 - 2017-04-27 01:15 - 00000000 ____D C:\Program Files (x86)\Hersisyaraogh
2017-04-27 01:06 - 2017-04-27 01:06 - 00000000 ____D C:\Windows\system32\SSL
2017-04-26 23:02 - 2017-04-27 01:16 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2017-04-26 20:34 - 2017-04-26 20:35 - 00000000 ____D C:\Users\Niel\Downloads\Microsoft.Powerpoint.2010
2017-04-26 20:32 - 2017-04-26 20:32 - 00000000 ____D C:\Users\Niel\AppData\Local\Disc_Soft_Ltd
2017-04-26 20:30 - 2017-04-26 20:30 - 00047672 _____ (Disc Soft Ltd) C:\Windows\system32\Drivers\dtliteusbbus.sys
2017-04-26 20:30 - 2017-04-26 20:30 - 00000000 ____D C:\Users\Public\Documents\Daemon Tools Images
2017-04-26 20:29 - 2017-04-26 20:31 - 00000000 ____D C:\Users\Niel\AppData\Roaming\DAEMON Tools Lite
2017-04-26 20:29 - 2017-04-26 20:29 - 00030264 _____ (Disc Soft Ltd) C:\Windows\system32\Drivers\dtlitescsibus.sys
2017-04-26 20:29 - 2017-04-26 20:29 - 00000000 ____D C:\ProgramData\DAEMON Tools Lite
2017-04-26 20:16 - 2017-04-26 20:56 - 00000000 ____D C:\Program Files (x86)\WinCDEmu
2017-04-26 20:16 - 2017-04-26 20:16 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinCDEmu
2017-04-26 19:40 - 2017-04-26 19:40 - 00000000 ____D C:\Windows\System32\Tasks\OfficeSoftwareProtectionPlatform
2017-04-26 19:39 - 2017-04-26 19:39 - 00000000 ____D C:\Users\Niel\AppData\Local\Microsoft Help
2017-04-22 02:28 - 2017-04-22 02:28 - 03300028 _____ C:\Windows\357a6f3a5b47f04c5a99baf41128655a.exe
2017-04-01 08:28 - 2017-04-01 08:28 - 00000000 ____D C:\Users\Niel\Downloads\Video
2017-03-28 18:23 - 2017-04-27 02:01 - 00001338 _____ C:\Users\Niel\Desktop\NyxLauncher - Shortcut.lnk
2017-03-28 11:10 - 2017-03-28 11:19 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SoftnyxGame
2017-03-28 11:10 - 2017-03-28 11:10 - 00000126 _____ C:\Users\Niel\AppData\Roaming\Microsoft\Windows\Start Menu\GunboundIS.url
2017-03-28 11:10 - 2017-03-28 11:10 - 00000000 ____D C:\Game
2017-03-28 10:30 - 2017-03-28 10:30 - 00003362 _____ C:\Windows\System32\Tasks\AutoPico Daily Restart
==================== One Month Modified files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2017-04-27 02:52 - 2016-02-20 05:12 - 00000000 ____D C:\Users\Niel\AppData\Roaming\BitTorrent
2017-04-27 02:46 - 2016-02-20 04:56 - 00003598 _____ C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-3336116062-2625747668-4257245518-1001
2017-04-27 02:45 - 2016-03-27 21:01 - 00000000 ____D C:\AdwCleaner
2017-04-27 02:45 - 2016-02-22 20:51 - 00000000 ____D C:\Users\Niel\AppData\Roaming\IDM
2017-04-27 02:42 - 2016-03-27 19:49 - 00192216 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2017-04-27 02:41 - 2016-03-27 19:49 - 00001118 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2017-04-27 02:41 - 2016-03-27 19:49 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2017-04-27 02:41 - 2016-03-27 19:49 - 00000000 ____D C:\Program Files (x86)\Malwarebytes Anti-Malware
2017-04-27 02:28 - 2016-03-15 20:04 - 00000000 ____D C:\Users\Niel\AppData\Local\Google
2017-04-27 02:28 - 2016-03-15 20:04 - 00000000 ____D C:\Program Files (x86)\Google
2017-04-27 02:27 - 2016-02-20 05:39 - 00000000 ____D C:\Users\Niel\AppData\Local\ClassicShell
2017-04-27 02:27 - 2013-08-22 22:45 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2017-04-27 02:26 - 2016-02-20 04:51 - 00000000 ____D C:\Users\Niel
2017-04-27 02:01 - 2016-10-07 11:09 - 00002358 _____ C:\Users\Public\Desktop\Port Forward Network Utilities.lnk
2017-04-27 02:01 - 2016-08-08 01:04 - 00001640 _____ C:\Users\Public\Desktop\Batman Arkham Asylum GOTY.lnk
2017-04-27 02:01 - 2016-08-07 12:42 - 00000977 _____ C:\Users\Public\Desktop\DS3 Tool.lnk
2017-04-27 02:01 - 2016-08-07 01:05 - 00001198 _____ C:\Users\Public\Desktop\Half-Life 2 Episode Two.lnk
2017-04-27 02:01 - 2016-08-07 01:05 - 00001198 _____ C:\Users\Public\Desktop\Half-Life 2 Episode One.lnk
2017-04-27 02:01 - 2016-08-07 01:05 - 00001138 _____ C:\Users\Public\Desktop\Half-Life.lnk
2017-04-27 02:01 - 2016-08-06 00:19 - 00001234 _____ C:\Users\Niel\Desktop\Tales from the Borderlands Episode 5.lnk
2017-04-27 02:01 - 2016-08-04 09:02 - 00001807 _____ C:\Users\Public\Desktop\Tales from the Borderlands.lnk
2017-04-27 02:01 - 2016-08-01 02:33 - 00001475 _____ C:\Users\Public\Desktop\Borderlands Game Of The Year Edition.lnk
2017-04-27 02:01 - 2016-07-25 09:48 - 00002197 _____ C:\Users\Niel\Desktop\BorderlandsPreSequel - Shortcut.lnk
2017-04-27 02:01 - 2016-07-18 23:15 - 00001500 _____ C:\Users\Public\Desktop\Borderlands The Pre Sequel.lnk
2017-04-27 02:01 - 2016-07-06 14:41 - 00000813 _____ C:\Users\Niel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Start Tor Browser.lnk
2017-04-27 02:01 - 2016-06-26 19:59 - 00001655 _____ C:\Users\Public\Desktop\DEADBOLT.lnk
2017-04-27 02:01 - 2016-06-25 23:55 - 00002523 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Apple Software Update.lnk
2017-04-27 02:01 - 2016-06-21 19:05 - 00001425 _____ C:\Users\Niel\Desktop\Risk of Rain - Shortcut.lnk
2017-04-27 02:01 - 2016-06-15 17:21 - 00000872 _____ C:\Users\Public\Desktop\CCleaner.lnk
2017-04-27 02:01 - 2016-05-22 22:38 - 00001731 _____ C:\Users\Niel\Desktop\Google Drive.lnk
2017-04-27 02:01 - 2016-05-10 15:03 - 00001163 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\vShare Helper.lnk
2017-04-27 02:01 - 2016-03-25 01:16 - 00001931 _____ C:\Users\Public\Desktop\MetaTrader 4.lnk
2017-04-27 02:01 - 2016-02-20 05:20 - 00001065 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2017-04-27 02:01 - 2016-02-20 04:51 - 00001019 _____ C:\Users\Niel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2017-04-27 01:46 - 2016-02-22 20:50 - 00000000 ____D C:\Program Files (x86)\Internet Download Manager
2017-04-27 01:27 - 2013-08-22 21:36 - 00000000 ____D C:\Windows\Inf
2017-04-27 01:22 - 2016-02-20 05:20 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2017-04-27 01:08 - 2013-08-22 21:25 - 00262144 ___SH C:\Windows\system32\config\BBI
2017-04-26 21:58 - 2016-02-28 20:55 - 00000000 ____D C:\Users\Niel\AppData\Roaming\vlc
2017-04-26 21:12 - 2016-02-20 04:53 - 00863592 _____ C:\Windows\system32\PerfStringBackup.INI
2017-04-26 20:52 - 2013-08-22 22:44 - 00356424 _____ C:\Windows\system32\FNTCACHE.DAT
2017-04-26 20:51 - 2016-02-22 20:51 - 00000000 ____D C:\Users\Niel\AppData\Roaming\DMCache
2017-04-26 20:47 - 2013-08-23 03:11 - 00000000 ____D C:\Windows\ShellNew
2017-04-26 20:46 - 2013-08-22 23:36 - 00000000 ____D C:\Program Files\Common Files\microsoft shared
2017-04-01 08:36 - 2016-02-20 06:03 - 00000000 ____D C:\Program Files\Steam
2017-03-28 21:59 - 2016-02-20 06:58 - 00000000 ____D C:\Users\Niel\AppData\Local\Steam
2017-03-28 20:05 - 2016-05-22 22:35 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Drive
2017-03-28 10:30 - 2016-02-20 05:53 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\KMSpico
2017-03-28 10:30 - 2016-02-20 05:52 - 00000000 ____D C:\Program Files\KMSpico
==================== Files in the root of some directories =======
2017-04-27 01:19 - 2017-04-27 01:18 - 1060864 _____ () C:\Users\Niel\AppData\Roaming\Movecore.exe
2017-04-27 01:19 - 2017-04-27 01:19 - 1895968 _____ () C:\Users\Niel\AppData\Roaming\Movecore.tst
2016-02-04 22:19 - 2016-02-04 22:19 - 0032768 _____ (FelineSoft) C:\Users\Niel\AppData\Roaming\Project1.exe
2017-04-27 01:19 - 2017-04-27 01:19 - 0278509 _____ () C:\Users\Niel\AppData\Roaming\Stringdex.bin
2016-01-03 22:47 - 2016-01-03 22:47 - 0322552 _____ (Alexander Roshal) C:\Users\Niel\AppData\Roaming\UnRAR.exe
2016-07-29 20:16 - 2016-07-29 20:16 - 0007602 _____ () C:\Users\Niel\AppData\Local\Resmon.ResmonCfg
2016-07-15 19:46 - 2016-05-16 19:46 - 0000032 ____R () C:\ProgramData\hash.dat
Files to move or delete:
====================
C:\ProgramData\hash.dat
Some files in TEMP:
====================
2017-04-27 01:05 - 2017-04-27 01:05 - 1242624 _____ () C:\Users\Niel\AppData\Local\Temp\CodecFixDivx.exe
2017-04-27 01:15 - 2017-04-27 01:15 - 0763904 _____ () C:\Users\Niel\AppData\Local\Temp\DMDD__11426_il6.exe
2017-04-27 01:05 - 2017-04-27 01:05 - 0028672 _____ (Western Visayas College of Science and TechnologyT) C:\Users\Niel\AppData\Local\Temp\fox.exe
2017-04-27 01:18 - 2017-04-27 01:18 - 1909694 _____ (WeMonetize ) C:\Users\Niel\AppData\Local\Temp\PNDGUC5.exe
2017-04-27 01:05 - 2017-04-27 01:05 - 4321588 _____ () C:\Users\Niel\AppData\Local\Temp\start.exe
==================== Bamital & volsnap ======================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2017-04-26 22:49
==================== End of FRST.txt ============================
_________________________________________________________________________________________________________
Addition.txt
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 26-04-2017
Ran by [removed] (27-04-2017 02:56:53)
Running from C:\Users\[removed]\Downloads
Windows 8.1 Pro (X64) (2016-02-19 20:51:01)
Boot Mode: Normal
==========================================================
==================== Accounts: =============================
Administrator (S-1-5-21-3336116062-2625747668-4257245518-500 - Administrator - Disabled)
Guest (S-1-5-21-3336116062-2625747668-4257245518-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-3336116062-2625747668-4257245518-1003 - Limited - Enabled)
Niel (S-1-5-21-3336116062-2625747668-4257245518-1001 - Administrator - Enabled) => C:\Users\Niel
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
7-Zip 15.14 (x64) (HKLM\…\7-Zip) (Version: 15.14 - Igor Pavlov)
Adobe Flash Player 20 NPAPI (HKLM-x32\…\Adobe Flash Player NPAPI) (Version: 20.0.0.306 - Adobe Systems Incorporated)
AMD Catalyst Install Manager (HKLM\…\{529C5283-F484-94CA-8D10-3A69FD0776D3}) (Version: 8.0.916.0 - Advanced Micro Devices, Inc.)
Apple Application Support (32-bit) (HKLM-x32\…\{26356515-5821-40FA-9C3D-9785052A1062}) (Version: 4.3.1 - Apple Inc.)
Apple Application Support (64-bit) (HKLM\…\{C2651553-6CA3-4822-B2E6-BC4ACA6E0EA2}) (Version: 4.3.1 - Apple Inc.)
Apple Mobile Device Support (HKLM\…\{2E4AF2A6-50EA-4260-9BA4-5E582D11879A}) (Version: 9.3.0.15 - Apple Inc.)
Apple Software Update (HKLM-x32\…\{56EC47AA-5813-4FF6-8E75-544026FBEA83}) (Version: 2.2.0.150 - Apple Inc.)
Batman Arkham Asylum - Game of the Year Edition (HKLM-x32\…\Batman Arkham Asylum - Game of the Year Edition_is1) (Version: - )
Battle.net (HKLM-x32\…\Battle.net) (Version: - Blizzard Entertainment)
BitTorrent (HKU\S-1-5-21-3336116062-2625747668-4257245518-1001\…\BitTorrent) (Version: 7.9.9.43389 - BitTorrent Inc.)
Borderlands Game Of The Year Edition version 1.0.0.0 (HKLM-x32\…\Borderlands Game Of The Year Edition_is1) (Version: 1.0.0.0 - Mr DJ)
Borderlands The Pre Sequel version 1.0.6.0 (HKLM-x32\…\Borderlands The Pre Sequel_is1) (Version: 1.0.6.0 - Mr DJ)
CCleaner (HKLM\…\CCleaner) (Version: 5.09 - Piriform)
Classic Shell (HKLM\…\{D4B3454F-7529-4F5F-851D-2C36933F7D64}) (Version: 4.2.5 - IvoSoft)
Counter-Strike: Global Offensive (HKLM\…\Steam App 730) (Version: - Valve)
DEADBOLT (HKLM-x32\…\1457453536_is1) (Version: 2.0.0.3 - GOG.com)
Defraggler (HKLM\…\Defraggler) (Version: 2.19 - Piriform)
Dota 2 (HKLM\…\Steam App 570) (Version: - Valve)
Google Drive (HKLM-x32\…\{A1238426-ECDF-4639-BE2F-8D12A97AE23C}) (Version: 2.34.5075.1619 - Google, Inc.)
Google Update Helper (x32 Version: 1.3.32.7 - Google Inc.) Hidden
GunboundIS (HKLM-x32\…\GunboundIS_is1) (Version: - Softnyx co.,ltd.)
Half-Life 2 3in1 version 1745010 (HKLM\…\{033AFD9F-4A3E-4FB2-9EE2-CD333F668F64}_is1) (Version: 1745010 - Strogino CS Portal)
HiAlgo BOOST 5.0 (HKU\S-1-5-21-3336116062-2625747668-4257245518-1001\…\HiAlgoBOOST) (Version: 5.0 - HiAlgo Inc.)
IDM Patch 6.25 build 03 (HKLM-x32\…\IDM Patch 6.25 build 03) (Version: build 03 - SandySeedings Team)
initialpage123 - Uninstall (HKLM-x32\…\{BC5C9215-7CAB-4A87-97FE-E0D304BA1BEE}) (Version: - ) <==== ATTENTION
Internet Download Manager (HKLM-x32\…\Internet Download Manager) (Version: - Tonec Inc.)
iTunes (HKLM\…\{9F4BF859-C3A4-4AB6-BDD1-9C5D58188598}) (Version: 12.4.1.6 - Apple Inc.)
Java 8 Update 77 (HKLM-x32\…\{26A24AE4-039D-4CA4-87B4-2F83218077F0}) (Version: 8.0.770.3 - Oracle Corporation)
JetBoost (HKLM-x32\…\JetBoost_is1) (Version: 2.0.0 - BlueSprig)
KMSpico (HKLM\…\{8B29D47F-92E2-4C20-9EE0-F710991F5D7C}_is1) (Version: - )
Magic ISO Maker v5.5 (build 0281) (HKLM-x32\…\Magic ISO Maker v5.5 (build 0281)) (Version: - )
Malwarebytes Anti-Malware version 2.2.1.1043 (HKLM-x32\…\Malwarebytes Anti-Malware_is1) (Version: 2.2.1.1043 - Malwarebytes)
MetaTrader 4 (HKLM-x32\…\MetaTrader 4) (Version: 6.00 - MetaQuotes Software Corp.)
Microsoft Games for Windows - LIVE Redistributable (HKLM-x32\…\{832D9DE0-8AFC-4689-9819-4DBBDEBD3E4F}) (Version: 3.5.92.0 - Microsoft Corporation)
Microsoft Games for Windows Marketplace (HKLM-x32\…\{67F42018-F647-4D3C-BE62-F8CB4FE2FCD5}) (Version: 3.5.67.0 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\…\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\…\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 Redistributable - x86 10.0.40219 (HKLM-x32\…\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\…\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (HKLM-x32\…\{050d4fc8-5d48-4b8f-8972-47c82c46020f}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM-x32\…\{f65db027-aff3-4070-886a-0d87064aabb1}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft XNA Framework Redistributable 3.1 (HKLM-x32\…\{19BFDA5D-1FE2-4F25-97F9-1A79DD04EE20}) (Version: 3.1.10527.0 - Microsoft Corporation)
MotioninJoy Gamepad tool 0.7.1001 (HKLM\…\{330DAC67-5B62-452A-A0E4-6B4A5923940F}_is1) (Version: 0.7.1001 - www.motioninjoy.com)
Mozilla Firefox 52.0.2 (x86 en-US) (HKLM-x32\…\Mozilla Firefox 52.0.2 (x86 en-US)) (Version: 52.0.2 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\…\MozillaMaintenanceService) (Version: 52.0.2.6291 - Mozilla)
NVIDIA PhysX (HKLM-x32\…\{8B922CF8-8A6C-41CE-A858-F1755D7F5D29}) (Version: 9.12.1031 - NVIDIA Corporation)
NyxLauncherIS (HKLM-x32\…\NyxLauncherIS_is1) (Version: - Softnyx co.,ltd.)
Port Forward Network Utilities (HKLM-x32\…\{88B1D36C-7B70-4C48-8D2F-AAB956ECF4C3}) (Version: 3.0.5.2 - Portforward, LLC)
PowerISO (HKLM-x32\…\PowerISO) (Version: 6.6 - Power Software Ltd)
SlimDX Runtime .NET 2.0 (January 2012) (HKLM-x32\…\{014A2868-BE56-4888-A16C-693989B8F153}) (Version: 2.0.13.43 - SlimDX Group)
Social2Search (HKLM\…\755a401c018b0fb466d587507ebac1cd) (Version: 11.13.1.97 (i1.0) - Social2Search) <==== ATTENTION
Tales from the Borderlands (HKLM-x32\…\1432213337_is1) (Version: 2.0.0.1 - GOG.com)
Tales from the Borderlands Episode 5 (HKLM-x32\…\Tales from the Borderlands Episode 5_is1) (Version: - )
Tunngle (HKLM-x32\…\Tunngle_is1) (Version: 5.8.4 - Tunngle.net GmbH)
VLC media player (HKLM-x32\…\VLC media player) (Version: 2.2.2 - VideoLAN)
vShare Helper (HKU\S-1-5-21-3336116062-2625747668-4257245518-1001\…\vShare Helper) (Version: 1.0.1.6 - vShare.com Co.,LTD)
Windows 8.1 KMS Activator Ultimate v1.4.1 (HKLM-x32\…\Windows 8.1 KMS Activator Ultimate v1.4.1_is1) (Version: v1.4.1 - )
WinRAR 5.20 (64-bit) (HKLM\…\WinRAR archiver) (Version: 5.20.0 - win.rar GmbH)
Wise Auto Shutdown 1.51 (HKLM-x32\…\Wise Auto Shutdown_is1) (Version: 1.51 - WiseCleaner.com, Inc.)
==================== Custom CLSID (Whitelisted): ==========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
==================== Scheduled Tasks (Whitelisted) =============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
Task: {1E51CC20-AE4D-4525-A4F1-BC010704D766} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2015-08-20] (Piriform Ltd)
Task: {526BA259-76C4-4AE5-A2CE-8D79A9C03D6C} - System32\Tasks\Plarety Cache => C:\Program Files (x86)\Hersisyaraogh\rererle.exe [2017-04-27] (Google Inc.)
Task: {54A78B97-37DB-467A-9218-0A808B54CD87} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2016-05-22] (Google Inc.)
Task: {657B8844-9FAE-43C7-89D0-7B9E1372BEEB} - \WiseCleaner\WASSkipUAC -> No File <==== ATTENTION
Task: {7B1C9DEC-AF59-4D0B-A01A-74EE89233931} - System32\Tasks\AutoPico Daily Restart => C:\Program Files\KMSpico\AutoPico.exe [2015-08-12] (@ByELDI)
Task: {A747FFDA-3765-46CE-BC8D-DEE57CAFA158} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2016-05-22] (Google Inc.)
Task: {FCFD5438-7791-4A34-A8BB-C8551B34CFFE} - System32\Tasks\JetBoost_AutoUpdate => C:\Program Files (x86)\BlueSprig\JetBoost\AutoUpdate.exe [2012-11-28] (BlueSprig)
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
==================== Shortcuts =============================
(The entries could be listed to be restored or removed.)
==================== Loaded Modules (Whitelisted) ==============
2017-04-27 01:15 - 2017-04-27 01:15 - 00314880 _____ () C:\Program Files (x86)\Plarety Cache\local64spl.dll
2016-04-22 01:07 - 2016-04-22 01:07 - 00092472 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
2016-04-22 01:07 - 2016-04-22 01:07 - 01337144 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
2015-08-20 00:20 - 2015-08-20 00:20 - 00055576 _____ () C:\Program Files\CCleaner\branding.dll
==================== Alternate Data Streams (Whitelisted) =========
(If an entry is included in the fixlist, only the ADS will be removed.)
==================== Safe Mode (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== Association (Whitelisted) ===============
(If an entry is included in the fixlist, the registry item will be restored to default or removed.)
==================== Internet Explorer trusted/restricted ===============
(If an entry is included in the fixlist, it will be removed from the registry.)
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2013-08-22 21:25 - 2017-04-27 01:18 - 00001123 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 cpm.paneladmin.pro
127.0.0.1 publisher.hmdiadmingate.xyz
127.0.0.1 distribution.hmdiadmingate.xyz
127.0.0.1 hmdicrewtracksystem.xyz
127.0.0.1 linkmate.space
127.0.0.1 space1.adminpressure.space
127.0.0.1 trackpressure.website
127.0.0.1 doctorlink.space
127.0.0.1 beautifllink.xyz
==================== Other Areas ============================
(Currently there is no automatic fix for this section.)
HKU\S-1-5-21-3336116062-2625747668-4257245518-1001\Control Panel\Desktop\\Wallpaper -> C:\Windows.old.001\Users\Niel\Desktop\wallhaven-12839.png
DNS Servers: [removed] - [removed]
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 0) (ConsentPromptBehaviorUser: 3) (EnableLUA: 0)
Windows Firewall is enabled.
==================== MSCONFIG/TASK MANAGER disabled items ==
HKLM\…\StartupApproved\Run32: => "StartCCC"
HKLM\…\StartupApproved\Run32: => "AMD AVT"
HKLM\…\StartupApproved\Run32: => "APSDaemon"
HKU\S-1-5-21-3336116062-2625747668-4257245518-1001\…\StartupApproved\StartupFolder: => "Autochartist MetaTrader Plugin - Auto Update.lnk"
HKU\S-1-5-21-3336116062-2625747668-4257245518-1001\…\StartupApproved\StartupFolder: => "JetBoost - Shortcut.lnk"
HKU\S-1-5-21-3336116062-2625747668-4257245518-1001\…\StartupApproved\Run: => "CCleaner Monitoring"
HKU\S-1-5-21-3336116062-2625747668-4257245518-1001\…\StartupApproved\Run: => "IDMan"
HKU\S-1-5-21-3336116062-2625747668-4257245518-1001\…\StartupApproved\Run: => "BlueStacks Agent"
HKU\S-1-5-21-3336116062-2625747668-4257245518-1001\…\StartupApproved\Run: => "GoogleDriveSync"
==================== FirewallRules (Whitelisted) ===============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139
FirewallRules: [{6593F266-BC7F-4822-AA57-4704A172144A}] => (Allow) C:\Users\Niel\AppData\Roaming\BitTorrent\BitTorrent.exe
FirewallRules: [{94743052-4649-4ACF-A171-CC4EAFB4763D}] => (Allow) C:\Users\Niel\AppData\Roaming\BitTorrent\BitTorrent.exe
FirewallRules: [{2C18BC01-F7EA-4633-A427-1C8F48000BE0}] => (Allow) C:\Users\Niel\AppData\Roaming\BitTorrent\BitTorrent.exe
FirewallRules: [{F72311D1-528B-4C72-9186-7F34F3B2298E}] => (Allow) C:\Users\Niel\AppData\Roaming\BitTorrent\BitTorrent.exe
FirewallRules: [{157A072E-C3AF-4155-92EA-D3167B856BBF}] => (Allow) C:\Users\Niel\AppData\Roaming\BitTorrent\BitTorrent.exe
FirewallRules: [{514FE13F-CD76-44D0-A1BD-392DF0DE4DC5}] => (Allow) C:\Users\Niel\AppData\Roaming\BitTorrent\BitTorrent.exe
FirewallRules: [{4A8813FD-05B0-47B9-93AA-EBBFC04B38BD}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{C761CB7B-9CAC-4C75-88B1-E5B6052D7DD3}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{05E458D9-6038-4433-90A3-5C3BE7E94A7D}] => (Allow) C:\Program Files\Steam\Steam.exe
FirewallRules: [{7D7D7145-B2D2-49E0-9AD9-A805D46FDCBF}] => (Allow) C:\Program Files\Steam\Steam.exe
FirewallRules: [{C1C9B8EF-1A84-4A62-9187-EF7DA8C1B154}] => (Allow) C:\Program Files\Steam\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{95C53870-AD19-4A9D-9CF9-401B473BF82A}] => (Allow) C:\Program Files\Steam\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{96269F13-7AD7-4ECC-A683-C5CAD669DBD6}] => (Allow) C:\Program Files (x86)\Tunngle\TnglCtrl.exe
FirewallRules: [{67FE4D4D-696F-4E93-8946-8828C15CC0B1}] => (Allow) C:\Program Files (x86)\Tunngle\TnglCtrl.exe
FirewallRules: [{92D28E5E-0462-41D1-9F57-85DB1208746A}] => (Allow) C:\Program Files (x86)\Tunngle\Tunngle.exe
FirewallRules: [{271CCF7F-3E2C-418A-A6CA-2E405E8F2126}] => (Allow) C:\Program Files (x86)\Tunngle\Tunngle.exe
FirewallRules: [TCP Query User{95DB2666-E4EB-425A-BCE1-DFE5DE1F70D6}C:\program files (x86)\hearthstone\hearthstone.exe] => (Allow) C:\program files (x86)\hearthstone\hearthstone.exe
FirewallRules: [UDP Query User{6A55143A-9DAD-4D0E-B810-41C179E8AFF6}C:\program files (x86)\hearthstone\hearthstone.exe] => (Allow) C:\program files (x86)\hearthstone\hearthstone.exe
FirewallRules: [{304DA6D1-7A1F-4DBE-975B-06A2335A7F8B}] => (Allow) C:\Program Files\iTunes\iTunes.exe
FirewallRules: [{5EC15B58-44B6-4679-AA4D-1D0E78473440}] => (Allow) C:\Program Files\Steam\steamapps\common\Counter-Strike Global Offensive\csgo.exe
FirewallRules: [{4BBD093D-294C-4F58-B21C-E4EC5DA460C8}] => (Allow) C:\Program Files\Steam\steamapps\common\Counter-Strike Global Offensive\csgo.exe
FirewallRules: [{2D4001D8-992E-4B0D-A796-C335530EB490}] => (Allow) C:\Program Files (x86)\Mr DJ\Borderlands The Pre Sequel\Binaries\Win32\Launcher.exe
FirewallRules: [{353D3556-164E-465F-9E4F-B1E08DA2231A}] => (Allow) C:\Program Files (x86)\Mr DJ\Borderlands The Pre Sequel\Binaries\Win32\Launcher.exe
FirewallRules: [TCP Query User{E88E71EF-F388-4FFB-B7C0-89035D202F98}C:\program files (x86)\mr dj\borderlands the pre sequel\binaries\win32\borderlandspresequel.exe] => (Allow) C:\program files (x86)\mr dj\borderlands the pre sequel\binaries\win32\borderlandspresequel.exe
FirewallRules: [UDP Query User{B9F608F3-B94E-4C87-A3C4-EB6F458948BE}C:\program files (x86)\mr dj\borderlands the pre sequel\binaries\win32\borderlandspresequel.exe] => (Allow) C:\program files (x86)\mr dj\borderlands the pre sequel\binaries\win32\borderlandspresequel.exe
FirewallRules: [TCP Query User{E3520AD3-ED37-4991-90E5-9086402FE09B}C:\program files (x86)\mr dj\borderlands the pre sequel\binaries\win32\borderlandspresequel.exe] => (Allow) C:\program files (x86)\mr dj\borderlands the pre sequel\binaries\win32\borderlandspresequel.exe
FirewallRules: [UDP Query User{4A6AAFE5-C20D-4BB2-9312-797A1E3DDF3E}C:\program files (x86)\mr dj\borderlands the pre sequel\binaries\win32\borderlandspresequel.exe] => (Allow) C:\program files (x86)\mr dj\borderlands the pre sequel\binaries\win32\borderlandspresequel.exe
FirewallRules: [{E9A6C2A2-3B27-4044-807D-0E0AB6C5ECC6}] => (Allow) C:\Program Files (x86)\Mr DJ\Borderlands Game Of The Year Edition\Binaries\Borderlands.exe
FirewallRules: [{6B837C1E-66C9-472B-8F27-1A9AB0D87760}] => (Allow) C:\Program Files (x86)\Mr DJ\Borderlands Game Of The Year Edition\Binaries\Borderlands.exe
FirewallRules: [TCP Query User{40641283-80B7-4B30-A520-0C501284D146}C:\program files (x86)\rocksteady studios\batman arkham asylum - game of the year edition\binaries\shippingpc-bmgame.exe] => (Allow) C:\program files (x86)\rocksteady studios\batman arkham asylum - game of the year edition\binaries\shippingpc-bmgame.exe
FirewallRules: [UDP Query User{6D5E56DC-976E-499C-B42E-37F4E219E663}C:\program files (x86)\rocksteady studios\batman arkham asylum - game of the year edition\binaries\shippingpc-bmgame.exe] => (Allow) C:\program files (x86)\rocksteady studios\batman arkham asylum - game of the year edition\binaries\shippingpc-bmgame.exe
FirewallRules: [TCP Query User{2717B73E-8C4E-42AD-9E78-9AD5A2F90238}C:\program files\steam\steamapps\common\dota 2 beta\game\bin\win32\dota2.exe] => (Allow) C:\program files\steam\steamapps\common\dota 2 beta\game\bin\win32\dota2.exe
FirewallRules: [UDP Query User{0839DE37-59B0-4BF7-8FED-CDA61F75EBC4}C:\program files\steam\steamapps\common\dota 2 beta\game\bin\win32\dota2.exe] => (Allow) C:\program files\steam\steamapps\common\dota 2 beta\game\bin\win32\dota2.exe
FirewallRules: [TCP Query User{E4D89E03-0588-4A06-95DB-C3BB819F2732}C:\program files (x86)\portforward\port forward network utilities\pfportchecker.exe] => (Allow) C:\program files (x86)\portforward\port forward network utilities\pfportchecker.exe
FirewallRules: [UDP Query User{D4BFA3C3-DC11-47E2-A851-C8BFB3BFE0AB}C:\program files (x86)\portforward\port forward network utilities\pfportchecker.exe] => (Allow) C:\program files (x86)\portforward\port forward network utilities\pfportchecker.exe
FirewallRules: [TCP Query User{176CCF58-4645-4CD2-8B0D-C327E42FFB9E}C:\game\softnyxgame\gunboundis\gunbound.gme] => (Allow) C:\game\softnyxgame\gunboundis\gunbound.gme
FirewallRules: [UDP Query User{56032331-37E2-40C9-BAEA-476A3E337DC6}C:\game\softnyxgame\gunboundis\gunbound.gme] => (Allow) C:\game\softnyxgame\gunboundis\gunbound.gme
FirewallRules: [{2181FC42-21AF-4CA9-BF3D-569DC4303BEC}] => (Allow) C:\Program Files\Steam\bin\cef\cef.win7\steamwebhelper.exe
FirewallRules: [{598C6588-C6DA-4FC1-B5D9-330026149534}] => (Allow) C:\Program Files\Steam\bin\cef\cef.win7\steamwebhelper.exe
FirewallRules: [TCP Query User{40045582-A9C2-4BCE-9E51-BC4782CAA898}C:\game\softnyxgame\nyxlauncheris\full_downloader.exe] => (Block) C:\game\softnyxgame\nyxlauncheris\full_downloader.exe
FirewallRules: [UDP Query User{B4095D5C-73C0-47D4-BD03-963513383B39}C:\game\softnyxgame\nyxlauncheris\full_downloader.exe] => (Block) C:\game\softnyxgame\nyxlauncheris\full_downloader.exe
==================== Restore Points =========================
28-03-2017 20:06:39 Scheduled Checkpoint
26-04-2017 19:38:11 Installed Microsoft PowerPoint 2010
27-04-2017 01:18:58 Restore Operation
27-04-2017 01:46:42 JRT Pre-Junkware Removal
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (04/27/2017 01:25:43 AM) (Source: Perflib) (EventID: 1023) (User: )
Description: Windows cannot load the extensible counter DLL rdyboost. The first four bytes (DWORD) of the Data section contains the Windows error code.
Error: (04/27/2017 01:25:41 AM) (Source: Perflib) (EventID: 1008) (User: )
Description: The Open Procedure for service "BITS" in DLL "C:\Windows\System32\bitsperf.dll" failed. Performance data for this service will not be available. The first four bytes (DWORD) of the Data section contains the error code.
Error: (04/27/2017 01:24:32 AM) (Source: System Restore) (EventID: 8210) (User: )
Description: An unspecified error occurred during System Restore: (Scheduled Checkpoint). Additional information: 0x80070571.
Error: (04/26/2017 08:38:33 PM) (Source: Windows Search Service) (EventID: 3007) (User: )
Description: Performance monitoring cannot be initialized for the gatherer object, because the counters are not loaded or the shared memory object cannot be opened. This only affects availability of the perfmon counters. Restart the computer.
Context: Application, SystemIndex Catalog
Error: (04/26/2017 07:56:47 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: The program MagicISO.exe version 5.5.0.281 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel.
Process ID: 5fc
Start Time: 01d2be83997ddc80
Termination Time: 4294967295
Application Path: C:\Program Files (x86)\MagicISO\MagicISO.exe
Report Id: 69dab5eb-2a77-11e7-82b0-b8ac6f535cb7
Faulting package full name:
Faulting package-relative application ID:
Error: (04/26/2017 10:14:03 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: mDNS_Execute: mDNSPlatformRawTime went backwards by 2085904608 ticks; setting correction factor to 1260504260
Error: (04/01/2017 08:36:20 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 14344
Error: (04/01/2017 08:36:20 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 14344
Error: (04/01/2017 08:36:20 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second
Error: (03/30/2017 10:41:29 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 5922203
System errors:
=============
Error: (04/27/2017 02:27:22 AM) (Source: ipnathlp) (EventID: 1233) (User: )
Description: The ICS_IPV6 failed to configure IPv6 stack.
Error: (04/27/2017 02:27:22 AM) (Source: ipnathlp) (EventID: 1233) (User: )
Description: The ICS_IPV6 failed to configure IPv6 stack.
Error: (04/27/2017 02:26:59 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The UAC File Virtualization service failed to start due to the following error:
This driver has been blocked from loading
Error: (04/27/2017 02:25:28 AM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: The Windows Media Player Network Sharing Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 30000 milliseconds: Restart the service.
Error: (04/27/2017 02:25:27 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The iPod Service service terminated unexpectedly. It has done this 1 time(s).
Error: (04/27/2017 02:25:27 AM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: The Application Layer Gateway Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service.
Error: (04/27/2017 02:25:27 AM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: The Windows Search service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 30000 milliseconds: Restart the service.
Error: (04/27/2017 02:25:27 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The Service KMSELDI service terminated unexpectedly. It has done this 1 time(s).
Error: (04/27/2017 02:25:27 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The Bonjour Service service terminated unexpectedly. It has done this 1 time(s).
Error: (04/27/2017 02:25:27 AM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: The Apple Mobile Device Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
==================== Memory info ===========================
Processor: Intel(R) Core(TM) i3 CPU M 330 @ 2.13GHz
Percentage of memory in use: 38%
Total physical RAM: 3956.53 MB
Available physical RAM: 2450.46 MB
Total Virtual: 4660.54 MB
Available Virtual: 2891.2 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:297.11 GB) (Free:49.17 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 298.1 GB) (Disk ID: 2DA44573)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=297.1 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=450 MB) - (Type=27)
Partition 4: (Not Active) - (Size=450 MB) - (Type=27)
==================== End of Addition.txt ============================
