Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

C:\Windows\system32\userinit.exe malware infection


  • This topic is locked This topic is locked
12 replies to this topic

#1 User1412

User1412

  • Members
  • 19 posts
  • OFFLINE
  •  
  • Local time:09:25 PM

Posted 27 May 2015 - 02:27 AM

I'm using laptop with Windows 8.1 Pro. Recently, i ran Malwarebytes to scan and check my computer for infections and I found this, please find it in attachments.

 

There's thing with HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON|Userinit, C:\Windows\system32\userinit.exe,C:\Windows\taskhost.exe /boot, if i remove it, will it cause damage to my system?

 

Need help.

Attached Files



BC AdBot (Login to Remove)

 


m

#2 xXToffeeXx

xXToffeeXx

    Bleepin' Polar Bear


  • Malware Response Instructor
  • 6,015 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:The Arctic Circle
  • Local time:10:25 AM

Posted 27 May 2015 - 05:03 AM

Greetings and :welcome: to BleepingComputer,
My name is xXToffeeXx, but feel free to call me Toffee if it is easier for you. I will be helping you with your malware problems.
 
A few points to cover before we start:

  • Do not run any tools without being instructed to as this makes my job much harder in trying to figure out what you have done.
  • Make sure to read my instructions fully before attempting a step.
  • If you have problems or questions with any of the steps, feel free to ask me. I will be happy to answer any questions you have.
  • Please follow the topic by clicking on the "Follow this topic" button, and make sure a tick is in the "receive notifications" and is set to "Instantly". Any replies should be made in this topic by clicking the "Reply to this topic" button.
  • Important information in my posts will often be in bold, make sure to take note of these.
  • I will attempt to reply as soon as possible, and normally within 24 hours of your reply. If this is not possible or I have a delay then I will let you know.
  • I will bump a topic after 3 days of no activity, and then will give you another 2 days to reply before a topic is closed. If you need more time than this please let me know.
  • Let's get going now :thumbup2:

==========================
 
Hi User1412,
 
You should be able to delete it fine, yes.
 
Please download Farbar Recovery Scan Tool and save it to your Desktop.
 
Note: You need to run the version compatible with your system. If you are not sure which version applies to your system, download both of them and try to run them. Only one of them will run on your system, that will be the right version.

  • Right-click FRST then click "Run as administrator" (XP users: click run after receipt of Windows Security Warning - Open File).
  • When the tool opens, click Yes to disclaimer.
  • Press the Scan button.
  • When finished, it will produce a log called FRST.txt in the same directory the tool was run from.
  • Please copy and paste the log in your next reply.

Note 2: The first time the tool is run it generates another log (Addition.txt - also located in the same directory the tool was run from). Please also paste that, along with the FRST.txt into your next reply.
 
--------------
 
To recap, in your next reply I would like to see the following. Make sure to copy & paste them unless I ask otherwise:

  • FRST.txt
  • Addition.txt

xXToffeeXx~


~If I am helping you and you have not had a reply from me in two days, please send me a PM~

~Currently in my last year of school, so replies might be more delayed~

 

logo-25.pngID Ransomware - Identify What Ransomware Encrypted Your Files [Support Topic] - If we have helped you out and you want to support what we do, you can do so here

 

 ~Twitter~ | ~Malware Analyst at Emsisoft~


#3 User1412

User1412
  • Topic Starter

  • Members
  • 19 posts
  • OFFLINE
  •  
  • Local time:09:25 PM

Posted 27 May 2015 - 09:15 AM

Good day Toffee :)

 

Here are your requested log:

 

FRST.txt

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 27-05-2015
Ran by Duc Hong (administrator) on HONGHOANGPC on 28-05-2015 00:08:58
Running from C:\Users\Duc Hong\Downloads\Programs
Loaded Profiles: Duc Hong (Available Profiles: Duc Hong)
Platform: Windows 8.1 Pro with Media Center (X64) OS Language: English (United States)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\AsLdrSrv.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe
(Avast Software s.r.o.) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Hanwang Technology Co.,Ltd. ) C:\Program Files\ASUS\ASUS FaceID\HWFaceKeyService.exe
(ASUS Cloud Corporation) C:\Program Files (x86)\ASUS\WebStorage\2.1.2.301\AsusWSWinService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\ibtsiva.exe
(Intel® Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Intel® Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(SoftEther VPN Project at University of Tsukuba, Japan.) C:\Program Files\SoftEther VPN Client\vpnclient_x64.exe
(VMware, Inc.) C:\Windows\SysWOW64\vmnat.exe
(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe
(VMware, Inc.) C:\Program Files (x86)\VMware\VMware Player\vmware-authd.exe
(VMware, Inc.) C:\Windows\SysWOW64\vmnetdhcp.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
(Motorola Solutions, Inc.) C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe
(Motorola Solutions, Inc.) C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\FWService\IntelMeFWService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe
(Microsoft) C:\Windows\taskhost.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\Splendid\ColorUService.exe
(ASUSTek Computer Inc.) C:\Program Files\ASUS\ASUS Console\ASUS Console Starter.exe
(ASUS) C:\Program Files (x86)\ASUS\Splendid\ACMON.exe
(Microsoft Corporation) C:\Windows\System32\InputMethod\JPN\JpnIME.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(AsusTek) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPLoader.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(SoftEther VPN Project at University of Tsukuba, Japan.) C:\Program Files\SoftEther VPN Client\vpnclient_x64.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Tonec Inc.) C:\Program Files (x86)\Internet Download Manager\IDMan.exe
(© 2015 Microsoft Corporation) C:\Users\Duc Hong\AppData\Local\Microsoft\BingSvc\BingSvc.exe
(Microsoft Corporation) C:\Windows\System32\StikyNot.exe
() C:\Program Files\Rainmeter\Rainmeter.exe
(Internet Download Manager, Tonec Inc.) C:\Program Files (x86)\Internet Download Manager\IDMIntegrator64.exe
(Tonec Inc.) C:\Program Files (x86)\Internet Download Manager\IEMonitor.exe
(Avast Software s.r.o.) C:\Program Files\AVAST Software\Avast\avastui.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(AsusTek) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPHelper.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\ASUS Live Update\LiveUpdate.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(AsusTek) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPCenter.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [SoftEther VPN Client UI Helper] => C:\Program Files\SoftEther VPN Client\vpnclient_x64.exe [4374072 2015-01-21] (SoftEther VPN Project at University of Tsukuba, Japan.)
HKLM\...\Run: [BTMTrayAgent] => rundll32.exe "C:\Program Files (x86)\Intel\Bluetooth\btmshellex.dll",TrayApp
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2685072 2015-05-02] (NVIDIA Corporation)
HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart
HKLM-x32\...\Run: [ASUSPRP] => C:\Program Files (x86)\ASUS\APRP\APRP.EXE [1080992 2014-05-17] (ASUSTek Computer Inc.)
HKLM-x32\...\Run: [WebStorage] => C:\Program Files (x86)\ASUS\WebStorage\2.1.2.301\ASUSWSLoader.exe [63296 2014-02-25] ()
HKLM-x32\...\Run: [ASUS InstantKey] => C:\Program Files (x86)\ASUS\ASUS Instant Key\Ikey_start.exe [14448 2014-01-29] (ASUS)
HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [5515496 2015-05-13] (Avast Software s.r.o.)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [334896 2015-04-30] (Oracle Corporation)
HKLM\...\Winlogon: [Userinit] C:\Windows\system32\userinit.exe,C:\Windows\taskhost.exe /boot
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-1926068397-2398490202-140176465-1002\...\Run: [Google Update] => C:\Users\Duc Hong\AppData\Local\Google\Update\GoogleUpdate.exe [107848 2015-04-17] (Google Inc.)
HKU\S-1-5-21-1926068397-2398490202-140176465-1002\...\Run: [IDM Helper] => C:\Program Files (x86)\Internet Download Manager\IDMGrHlp.exe [513560 2015-02-04] (Tonec Inc.)
HKU\S-1-5-21-1926068397-2398490202-140176465-1002\...\Run: [IDMan] => C:\Program Files (x86)\Internet Download Manager\IDMan.exe [3903056 2015-05-20] (Tonec Inc.)
HKU\S-1-5-21-1926068397-2398490202-140176465-1002\...\Run: [BingSvc] => C:\Users\Duc Hong\AppData\Local\Microsoft\BingSvc\BingSvc.exe [144008 2015-04-07] (© 2015 Microsoft Corporation)
HKU\S-1-5-21-1926068397-2398490202-140176465-1002\...\Run: [RESTART_STICKY_NOTES] => C:\Windows\System32\StikyNot.exe [479744 2014-10-29] (Microsoft Corporation)
HKU\S-1-5-21-1926068397-2398490202-140176465-1002\...\Policies\Explorer: [NoLowDiskSpaceChecks] 1
HKU\S-1-5-21-1926068397-2398490202-140176465-1002\...\Policies\Explorer: [LinkResolveIgnoreLinkInfo] 1
HKU\S-1-5-21-1926068397-2398490202-140176465-1002\...\Policies\Explorer: [NoResolveSearch] 1
HKU\S-1-5-21-1926068397-2398490202-140176465-1002\...\Policies\Explorer: [NoInternetOpenWith] 1
HKU\S-1-5-21-1926068397-2398490202-140176465-1002\Control Panel\Desktop\\SCRNSAVE.EXE ->
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\SoftEther VPN Client Manager Startup.lnk [2015-01-21]
ShortcutTarget: SoftEther VPN Client Manager Startup.lnk -> C:\Program Files\SoftEther VPN Client\vpncmgr_x64.exe (SoftEther VPN Project at University of Tsukuba, Japan.)
Startup: C:\Users\Duc Hong\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Rainmeter.lnk [2015-01-07]
ShortcutTarget: Rainmeter.lnk -> C:\Program Files\Rainmeter\Rainmeter.exe ()
ShellIconOverlayIdentifiers: [!AsusWSShellExt_B] -> {6D4133E5-0742-4ADC-8A8C-9303440F7191} => C:\Program Files (x86)\Common Files\AWS\2.1.2.301\ASUSWSShellExt64.dll [2013-06-26] (ASUS Cloud Corporation.)
ShellIconOverlayIdentifiers: [!AsusWSShellExt_O] -> {64174815-8D98-4CE6-8646-4C039977D809} => C:\Program Files (x86)\Common Files\AWS\2.1.2.301\ASUSWSShellExt64.dll [2013-06-26] (ASUS Cloud Corporation.)
ShellIconOverlayIdentifiers: [!AsusWSShellExt_U] -> {1C5AB7B1-0B38-4EC4-9093-7FD277E2AF4E} => C:\Program Files (x86)\Common Files\AWS\2.1.2.301\ASUSWSShellExt64.dll [2013-06-26] (ASUS Cloud Corporation.)
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll [2015-05-01] (Avast Software s.r.o.)
ShellIconOverlayIdentifiers: [IDM Shell Extension] -> {CDC95B92-E27C-4745-A8C5-64A52A78855D} => C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll [2014-04-21] (Tonec Inc.)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-1926068397-2398490202-140176465-1002\Software\Microsoft\Internet Explorer\Main,Start Page =
HKU\S-1-5-21-1926068397-2398490202-140176465-1002\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://asus13.msn.com/?pc=ASJB
HKU\S-1-5-21-1926068397-2398490202-140176465-1002\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/en-au/?ocid=iehp
SearchScopes: HKU\S-1-5-21-1926068397-2398490202-140176465-1002 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-1926068397-2398490202-140176465-1002 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO: IDM integration (IDMIEHlprObj Class) -> {0055C089-8582-441B-A0BF-17B458C2A3A8} -> C:\Program Files (x86)\Internet Download Manager\IDMIECC64.dll [2015-05-20] (Internet Download Manager, Tonec Inc.)
BHO: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_45\bin\ssv.dll [2015-05-27] (Oracle Corporation)
BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2014-07-14] (Microsoft Corporation)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
BHO: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_45\bin\jp2ssv.dll [2015-05-27] (Oracle Corporation)
BHO-x32: ATLAS Toolbar -> {3C6301ED-0F78-4AF2-8150-D9C052361A8E} -> C:\Program Files (x86)\ATLAS V14\ATLIECP.DLL [2011-07-06] (FUJITSU LIMITED)
BHO-x32: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\ssv.dll [2015-05-27] (Oracle Corporation)
BHO-x32: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2014-07-14] (Microsoft Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
BHO-x32: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\jp2ssv.dll [2015-05-27] (Oracle Corporation)
Toolbar: HKLM-x32 - ATLAS Toolbar - {3C6301ED-0F78-4AF2-8150-D9C052361A8E} - C:\Program Files (x86)\ATLAS V14\ATLIECP.DLL [2011-07-06] (FUJITSU LIMITED)
Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2014-07-14] (Microsoft Corporation)
Handler-x32: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2014-07-14] (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 172.20.10.1

FireFox:
========
FF ProfilePath: C:\Users\Duc Hong\AppData\Roaming\Mozilla\Firefox\Profiles\62c9k4xd.default-1422598942125
FF Homepage: www.google.com.au
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_16_0_0_235.dll [2015-01-12] ()
FF Plugin: @java.com/DTPlugin,version=11.45.2 -> C:\Program Files\Java\jre1.8.0_45\bin\dtplugin\npDeployJava1.dll [2015-05-27] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.45.2 -> C:\Program Files\Java\jre1.8.0_45\bin\plugin2\npjp2.dll [2015-05-27] (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-16] ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_235.dll [2015-01-12] ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2014-10-30] ()
FF Plugin-x32: @foxitsoftware.com/Foxit PhantomPDF Plugin,version=1.0,application/pdf -> C:\Program Files (x86)\Foxit Software\Foxit PhantomPDF\plugins\npFoxitPhantomPDFPlugin.dll [2014-10-20] (Foxit Corporation)
FF Plugin-x32: @foxitsoftware.com/Foxit PhantomPDF Plugin,version=1.0,application/vnd.fdf -> C:\Program Files (x86)\Foxit Software\Foxit PhantomPDF\plugins\npFoxitPhantomPDFPlugin.dll [2014-10-20] (Foxit Corporation)
FF Plugin-x32: @foxitsoftware.com/Foxit PhantomPDF Plugin,version=1.0,application/vnd.xdp -> C:\Program Files (x86)\Foxit Software\Foxit PhantomPDF\plugins\npFoxitPhantomPDFPlugin.dll [2014-10-20] (Foxit Corporation)
FF Plugin-x32: @foxitsoftware.com/Foxit PhantomPDF Plugin,version=1.0,application/vnd.xfdf -> C:\Program Files (x86)\Foxit Software\Foxit PhantomPDF\plugins\npFoxitPhantomPDFPlugin.dll [2014-10-20] (Foxit Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5 -> C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIIPT.dll [2013-09-04] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2013-09-04] (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=11.45.2 -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\dtplugin\npDeployJava1.dll [2015-05-27] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.45.2 -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\plugin2\npjp2.dll [2015-05-27] (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-15] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2014-03-31] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-05-16] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-05-16] (Google Inc.)
FF Plugin HKU\S-1-5-21-1926068397-2398490202-140176465-1002: @talk.google.com/GoogleTalkPlugin -> C:\Users\Duc Hong\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll [2015-04-17] (Google)
FF Plugin HKU\S-1-5-21-1926068397-2398490202-140176465-1002: @talk.google.com/O1DPlugin -> C:\Users\Duc Hong\AppData\Roaming\Mozilla\plugins\npo1d.dll [2015-04-17] (Google)
FF Plugin HKU\S-1-5-21-1926068397-2398490202-140176465-1002: @tools.google.com/Google Update;version=3 -> C:\Users\Duc Hong\AppData\Local\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-05-16] (Google Inc.)
FF Plugin HKU\S-1-5-21-1926068397-2398490202-140176465-1002: @tools.google.com/Google Update;version=9 -> C:\Users\Duc Hong\AppData\Local\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-05-16] (Google Inc.)
FF Plugin HKU\S-1-5-21-1926068397-2398490202-140176465-1002: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\Duc Hong\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll [2015-05-12] (Unity Technologies ApS)
FF Plugin ProgramFiles/Appdata: C:\Users\Duc Hong\AppData\Roaming\mozilla\plugins\npgoogletalk.dll [2015-04-17] (Google)
FF Plugin ProgramFiles/Appdata: C:\Users\Duc Hong\AppData\Roaming\mozilla\plugins\npo1d.dll [2015-04-17] (Google)
FF Extension: FT DeepDark - C:\Users\Duc Hong\AppData\Roaming\Mozilla\Firefox\Profiles\62c9k4xd.default-1422598942125\Extensions\{77d2ed30-4cd2-11e0-b8af-0800200c9a66} [2015-04-15]
FF Extension: Ank Pixiv Tool - C:\Users\Duc Hong\AppData\Roaming\Mozilla\Firefox\Profiles\62c9k4xd.default-1422598942125\Extensions\ankpixiv@snca.net.xpi [2015-01-30]
FF Extension: MEGA - C:\Users\Duc Hong\AppData\Roaming\Mozilla\Firefox\Profiles\62c9k4xd.default-1422598942125\Extensions\firefox@mega.co.nz.xpi [2015-01-30]
FF Extension: NicoFox - C:\Users\Duc Hong\AppData\Roaming\Mozilla\Firefox\Profiles\62c9k4xd.default-1422598942125\Extensions\nicofox@littlebtc.xpi [2015-01-30]
FF Extension: Restart Button - C:\Users\Duc Hong\AppData\Roaming\Mozilla\Firefox\Profiles\62c9k4xd.default-1422598942125\Extensions\restartbutton@strk.jp.xpi [2015-01-30]
FF Extension: Stylish - C:\Users\Duc Hong\AppData\Roaming\Mozilla\Firefox\Profiles\62c9k4xd.default-1422598942125\Extensions\{46551EC9-40F0-4e47-8E18-8E5CF550CFB8}.xpi [2015-01-30]
FF Extension: Download Status Bar - C:\Users\Duc Hong\AppData\Roaming\Mozilla\Firefox\Profiles\62c9k4xd.default-1422598942125\Extensions\{6c28e999-e900-4635-a39d-b1ec90ba0c0f}.xpi [2015-01-30]
FF Extension: Search by Image for Google - C:\Users\Duc Hong\AppData\Roaming\Mozilla\Firefox\Profiles\62c9k4xd.default-1422598942125\Extensions\{ab4b5718-3998-4a2c-91ae-18a7c2db513e}.xpi [2015-01-30]
FF Extension: Adblock Plus - C:\Users\Duc Hong\AppData\Roaming\Mozilla\Firefox\Profiles\62c9k4xd.default-1422598942125\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2015-01-30]
FF Extension: Greasemonkey - C:\Users\Duc Hong\AppData\Roaming\Mozilla\Firefox\Profiles\62c9k4xd.default-1422598942125\Extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}.xpi [2015-01-30]
FF Extension: YouTube Flash Video Player - C:\Users\Duc Hong\AppData\Roaming\Mozilla\Firefox\Profiles\62c9k4xd.default-1422598942125\Extensions\{f3bd3dd2-2888-44c5-91a2-2caeb33fb898}.xpi [2015-05-05]
FF Extension: No Name - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi [2015-05-18]
FF HKU\S-1-5-21-1926068397-2398490202-140176465-1002\...\Firefox\Extensions: [mozilla_cc@internetdownloadmanager.com] - C:\Users\Duc Hong\AppData\Roaming\IDM\idmmzcc5
FF Extension: IDM CC - C:\Users\Duc Hong\AppData\Roaming\IDM\idmmzcc5 [2015-05-27]
FF HKU\S-1-5-21-1926068397-2398490202-140176465-1002\...\SeaMonkey\Extensions: [mozilla_cc@internetdownloadmanager.com] - C:\Users\Duc Hong\AppData\Roaming\IDM\idmmzcc5

Chrome:
=======
CHR Profile: C:\Users\Duc Hong\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Docs) - C:\Users\Duc Hong\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-01-08]
CHR Extension: (Google Drive) - C:\Users\Duc Hong\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-01-08]
CHR Extension: (YouTube) - C:\Users\Duc Hong\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-01-08]
CHR Extension: (Bing) - C:\Users\Duc Hong\AppData\Local\Google\Chrome\User Data\Default\Extensions\bmkckgpgekmanipelfidlhmkfcjicion [2015-05-27]
CHR Extension: (Adblock Plus) - C:\Users\Duc Hong\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2015-03-25]
CHR Extension: (Google Search) - C:\Users\Duc Hong\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-01-08]
CHR Extension: (Bookmark Manager) - C:\Users\Duc Hong\AppData\Local\Google\Chrome\User Data\Default\Extensions\gmlllbghnfkpflemihljekbapjopfjik [2015-04-24]
CHR Extension: (Chrome Hotword Shared Module) - C:\Users\Duc Hong\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-03-18]
CHR Extension: (Skype Click to Call) - C:\Users\Duc Hong\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl [2015-05-27]
CHR Extension: (IDM Integration Module) - C:\Users\Duc Hong\AppData\Local\Google\Chrome\User Data\Default\Extensions\ngpampappnmepgilojfohadhhmbhlaek [2015-04-24]
CHR Extension: (Google Wallet) - C:\Users\Duc Hong\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-01-08]
CHR Extension: (Gmail) - C:\Users\Duc Hong\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-01-08]
CHR HKLM\...\Chrome\Extension: [ngpampappnmepgilojfohadhhmbhlaek] - C:\Program Files (x86)\Internet Download Manager\IDMGCExt.crx [2015-05-20]
CHR HKU\S-1-5-21-1926068397-2398490202-140176465-1002\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [bmkckgpgekmanipelfidlhmkfcjicion] - https://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\ChromeExtension\skype_chrome_extension.crx [2014-07-14]
CHR HKLM-x32\...\Chrome\Extension: [ngpampappnmepgilojfohadhhmbhlaek] - C:\Program Files (x86)\Internet Download Manager\IDMGCExt.crx [2015-05-20]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 ASUS FaceID Service; C:\Program Files\ASUS\ASUS FaceID\HWFaceKeyService.exe [261648 2013-10-25] (Hanwang Technology Co.,Ltd. )
R2 Asus WebStorage Windows Service; C:\Program Files (x86)\ASUS\WebStorage\2.1.2.301\AsusWSWinService.exe [71680 2014-02-25] (ASUS Cloud Corporation) [File not signed]
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [343336 2015-05-01] (Avast Software s.r.o.)
S3 BthHFSrv; C:\Windows\System32\BthHFSrv.dll [324608 2014-10-29] (Microsoft Corporation)
R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1390176 2014-07-14] (Microsoft Corporation)
R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1767520 2014-07-14] (Microsoft Corporation)
R2 DiagTrack; C:\Windows\system32\diagtrack.dll [1429504 2015-03-05] (Microsoft Corporation)
R2 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [1152656 2015-05-02] (NVIDIA Corporation)
R2 iBtSiva; C:\Program Files (x86)\Intel\Bluetooth\ibtsiva.exe [125168 2014-12-04] (Intel Corporation)
R2 Intel® Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [733696 2013-05-12] (Intel® Corporation) [File not signed]
S3 Intel® Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [822232 2013-05-12] (Intel® Corporation)
R2 Intel® ME Service; C:\Program Files (x86)\Intel\Intel® Management Engine Components\FWService\IntelMeFWService.exe [131544 2013-09-04] (Intel Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe [169432 2013-09-04] (Intel Corporation)
S2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [1080120 2015-04-14] (Malwarebytes Corporation)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [268192 2014-12-04] ()
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1884304 2015-05-02] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [22997648 2015-05-02] (NVIDIA Corporation)
S3 rpcapd; C:\Program Files (x86)\WinPcap\rpcapd.exe [118520 2013-03-01] (Riverbed Technology, Inc.)
R2 SEVPNCLIENT; C:\Program Files\SoftEther VPN Client\vpnclient_x64.exe [4374072 2015-01-21] (SoftEther VPN Project at University of Tsukuba, Japan.)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [366520 2015-02-04] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2015-02-04] (Microsoft Corporation)
R2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [3820960 2014-12-04] (Intel® Corporation)
S3 AvastVBoxSvc; C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe [X]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29168 2015-05-01] ()
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [89944 2015-05-01] (Avast Software s.r.o.)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93528 2015-05-01] (Avast Software s.r.o.)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65736 2015-05-01] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1047320 2015-05-01] (Avast Software s.r.o.)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [442264 2015-05-01] (Avast Software s.r.o.)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [137288 2015-05-01] (Avast Software s.r.o.)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [272248 2015-05-01] ()
R3 ATP; C:\Windows\System32\drivers\AsusTP.sys [70928 2014-02-14] (ASUS Corporation)
S3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [226304 2014-03-18] (Microsoft Corporation)
S3 btmaux; C:\Windows\system32\DRIVERS\btmaux.sys [141624 2014-10-28] (Motorola Solutions, Inc.)
R3 btmhsf; C:\Windows\system32\DRIVERS\btmhsf.sys [1448248 2014-11-26] (Motorola Solutions, Inc.)
S3 DrvAgent64; C:\Windows\SysWOW64\Drivers\DrvAgent64.SYS [13824 2015-05-17] (Phoenix Technologies) [File not signed]
R1 dtsoftbus01; C:\Windows\System32\drivers\dtsoftbus01.sys [283064 2015-01-08] (Disc Soft Ltd)
R3 ibtusb; C:\Windows\system32\DRIVERS\ibtusb.sys [230128 2014-12-04] (Intel Corporation)
R3 kbfiltr; C:\Windows\System32\drivers\kbfiltr.sys [17280 2012-08-06] ( )
S3 ManyCam; C:\Windows\system32\DRIVERS\mcvidrv.sys [49272 2014-12-29] (Visicom Media Inc.)
S3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-04-14] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [64216 2015-04-14] (Malwarebytes Corporation)
S3 mcaudrv_simple; C:\Windows\system32\drivers\mcaudrv_x64.sys [35960 2014-12-29] (Visicom Media Inc.)
R3 MEIx64; C:\Windows\system32\DRIVERS\TeeDriverx64.sys [99288 2013-09-04] (Intel Corporation)
R3 Neo_VPN2; C:\Windows\system32\DRIVERS\Neo_VPN2.sys [28768 2015-01-14] (SoftEther VPN Project at University of Tsukuba, Japan.)
R3 NETwNb64; C:\Windows\system32\DRIVERS\Netwbw02.sys [3494680 2014-12-08] (Intel Corporation)
S3 NETwNe64; C:\Windows\system32\DRIVERS\NETwew02.sys [4649440 2013-06-19] (Intel Corporation)
R2 NPF; C:\Windows\System32\drivers\npf.sys [36600 2013-03-01] (Riverbed Technology, Inc.)
R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [19600 2015-05-02] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\Windows\system32\drivers\nvvad64v.sys [38032 2014-11-22] (NVIDIA Corporation)
R2 plctrl; C:\Program Files\ASUS\P4G\plctrl.sys [14136 2014-02-12] (Windows ® Win 7 DDK provider)
R1 SeLow; C:\Windows\system32\DRIVERS\SeLow_x64.sys [38368 2015-01-21] (SoftEther VPN Project at University of Tsukuba, Japan.)
U5 UnlockerDriver5; C:\Program Files\Unlocker\UnlockerDriver5.sys [12352 2010-07-02] ()
R3 vmkbd2; C:\Windows\system32\drivers\VMkbd.sys [33472 2015-02-06] (VMware, Inc.)
R0 vsock; C:\Windows\System32\drivers\vsock.sys [76480 2015-01-07] (VMware, Inc.)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2015-02-04] (Microsoft Corporation)
U0 msahci; system32\drivers\msahci.sys
S2 VBoxAswDrv; \??\C:\Program Files\AVAST Software\Avast\ng\vbox\VBoxAswDrv.sys [X]
S3 WinRing0_1_2_0; \??\C:\Program Files (x86)\BatteryCare\WinRing0x64.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-05-28 00:08 - 2015-05-28 00:09 - 00000000 ____D () C:\FRST
2015-05-27 21:59 - 2015-05-27 22:48 - 00057738 _____ () C:\Windows\WindowsUpdate.log
2015-05-27 19:03 - 2015-05-27 19:03 - 00097888 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2015-05-27 19:03 - 2015-05-27 19:03 - 00000000 ____D () C:\Program Files (x86)\Java
2015-05-27 17:25 - 2015-05-27 17:25 - 00001073 _____ () C:\Users\Duc Hong\Desktop\Notepad++.lnk
2015-05-27 16:52 - 2015-05-27 16:52 - 00002062 _____ () C:\Users\Duc Hong\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\FileHippo App Manager.lnk
2015-05-27 16:52 - 2015-05-27 16:52 - 00000000 ____D () C:\ProgramData\IsolatedStorage
2015-05-27 16:52 - 2015-05-27 16:52 - 00000000 ____D () C:\Program Files (x86)\FileHippo.com
2015-05-26 17:00 - 2015-05-26 17:07 - 00010620 _____ () C:\Users\Duc Hong\Documents\My Movie.wlmp
2015-05-26 16:04 - 2015-05-26 16:04 - 00000000 ____D () C:\Windows\en
2015-05-26 16:03 - 2015-05-26 16:03 - 00002504 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live Messenger.lnk
2015-05-26 16:03 - 2015-05-26 16:03 - 00001476 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live Mail.lnk
2015-05-26 16:03 - 2015-05-26 16:03 - 00001392 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Photo Gallery.lnk
2015-05-26 16:03 - 2015-05-26 16:03 - 00001323 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Movie Maker.lnk
2015-05-26 16:03 - 2015-05-26 16:03 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live
2015-05-26 16:03 - 2015-05-26 16:03 - 00000000 ____D () C:\Program Files\Windows Live
2015-05-26 16:03 - 2015-05-26 16:03 - 00000000 ____D () C:\Program Files (x86)\Microsoft SQL Server Compact Edition
2015-05-26 16:01 - 2015-05-26 16:03 - 00000000 ____D () C:\Program Files (x86)\Windows Live
2015-05-26 16:01 - 2015-05-26 16:01 - 00003108 _____ () C:\Windows\System32\Tasks\Microsoft OneDrive Auto Update Task-S-1-5-21-1926068397-2398490202-140176465-1002
2015-05-26 16:01 - 2015-05-26 16:01 - 00000000 ___RD () C:\Users\Duc Hong\OneDrive
2015-05-26 16:00 - 2015-05-26 16:00 - 00000000 ____D () C:\ProgramData\Microsoft OneDrive
2015-05-26 15:59 - 2015-05-26 16:39 - 00000000 ____D () C:\Users\Duc Hong\AppData\Local\Windows Live
2015-05-26 15:56 - 2015-05-26 16:56 - 00000000 ____D () C:\Users\Duc Hong\AppData\Roaming\avidemux
2015-05-26 15:56 - 2015-05-26 15:56 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avidemux (64bits)
2015-05-25 23:37 - 2015-04-16 16:17 - 00325464 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\USBXHCI.SYS
2015-05-25 23:37 - 2015-04-14 08:37 - 00275968 _____ (Microsoft Corporation) C:\Windows\system32\authz.dll
2015-05-25 23:37 - 2015-04-14 08:34 - 00180224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authz.dll
2015-05-25 23:37 - 2015-04-10 10:40 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\UIAutomationCore.dll
2015-05-25 23:37 - 2015-04-10 10:17 - 01018880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\UIAutomationCore.dll
2015-05-25 23:37 - 2015-04-09 08:41 - 00158720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rgb9rast.dll
2015-05-25 23:37 - 2015-04-02 08:42 - 03097600 _____ (Microsoft Corporation) C:\Windows\system32\msftedit.dll
2015-05-25 23:37 - 2015-04-02 08:30 - 02483712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msftedit.dll
2015-05-25 23:37 - 2015-04-01 14:21 - 00337408 _____ (Microsoft Corporation) C:\Windows\system32\SearchProtocolHost.exe
2015-05-25 23:37 - 2015-04-01 14:18 - 00468480 _____ (Microsoft Corporation) C:\Windows\system32\mssph.dll
2015-05-25 23:37 - 2015-04-01 14:17 - 00248832 _____ (Microsoft Corporation) C:\Windows\system32\mssphtb.dll
2015-05-25 23:37 - 2015-04-01 14:08 - 00774144 _____ (Microsoft Corporation) C:\Windows\system32\mssvp.dll
2015-05-25 23:37 - 2015-04-01 13:46 - 03633664 _____ (Microsoft Corporation) C:\Windows\system32\tquery.dll
2015-05-25 23:37 - 2015-04-01 13:17 - 02551808 _____ (Microsoft Corporation) C:\Windows\system32\mssrch.dll
2015-05-25 23:37 - 2015-04-01 13:17 - 00903168 _____ (Microsoft Corporation) C:\Windows\system32\SearchIndexer.exe
2015-05-25 23:37 - 2015-04-01 12:53 - 00391680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mssph.dll
2015-05-25 23:37 - 2015-04-01 12:53 - 00272896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SearchProtocolHost.exe
2015-05-25 23:37 - 2015-04-01 12:45 - 02749952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tquery.dll
2015-05-25 23:37 - 2015-04-01 12:45 - 00699392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mssvp.dll
2015-05-25 23:37 - 2015-04-01 12:14 - 01920000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mssrch.dll
2015-05-25 23:37 - 2015-04-01 12:12 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SearchIndexer.exe
2015-05-25 23:37 - 2015-03-20 13:49 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\compstui.dll
2015-05-25 23:37 - 2015-03-20 13:08 - 00477184 _____ (Microsoft Corporation) C:\Windows\system32\puiobj.dll
2015-05-25 23:37 - 2015-03-20 12:37 - 00367104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\puiobj.dll
2015-05-25 23:37 - 2015-03-20 12:07 - 01091072 _____ (Microsoft Corporation) C:\Windows\system32\localspl.dll
2015-05-25 23:37 - 2015-03-02 11:43 - 00222208 _____ (Microsoft Corporation) C:\Windows\system32\rastapi.dll
2015-05-25 23:37 - 2015-03-02 11:21 - 00207872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rastapi.dll
2015-05-25 03:29 - 2015-05-25 03:29 - 00000000 ____D () C:\Users\Duc Hong\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Ubisoft
2015-05-25 03:29 - 2015-05-25 03:29 - 00000000 ____D () C:\Users\Duc Hong\AppData\Local\Ubisoft Game Launcher
2015-05-25 03:29 - 2015-05-25 03:29 - 00000000 ____D () C:\Program Files (x86)\Ubisoft
2015-05-23 15:12 - 2015-05-23 15:12 - 00000000 ____D () C:\Users\Duc Hong\AppData\Roaming\Aegisub
2015-05-20 23:57 - 2015-05-20 22:55 - 00197616 _____ (Tonec Inc.) C:\Windows\system32\Drivers\idmwfp.sys
2015-05-20 18:18 - 2015-05-20 18:53 - 00001004 _____ () C:\Users\Duc Hong\Desktop\Logic and stuffs.java
2015-05-19 04:49 - 2015-05-19 09:21 - 00000000 ____D () C:\Users\Duc Hong\Documents\Witcher 2
2015-05-19 04:49 - 2015-05-19 04:49 - 00000000 ____D () C:\Users\Duc Hong\AppData\Local\The Witcher 2
2015-05-19 04:46 - 2015-05-19 04:46 - 00000000 ____D () C:\Users\Duc Hong\Documents\Rockstar Games
2015-05-19 04:46 - 2015-05-19 04:46 - 00000000 ____D () C:\Users\Duc Hong\AppData\Local\Rockstar Games
2015-05-19 04:45 - 2015-05-19 04:45 - 00000000 ____D () C:\ProgramData\Socialclub
2015-05-18 18:21 - 2015-05-18 18:21 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-05-18 17:10 - 2015-05-18 17:10 - 00000000 ____D () C:\Users\Default\AppData\Local\NVIDIA Corporation
2015-05-18 17:10 - 2015-05-18 17:10 - 00000000 ____D () C:\Users\Default\AppData\Local\NVIDIA
2015-05-18 17:10 - 2015-05-18 17:10 - 00000000 ____D () C:\Users\Default User\AppData\Local\NVIDIA Corporation
2015-05-18 17:10 - 2015-05-18 17:10 - 00000000 ____D () C:\Users\Default User\AppData\Local\NVIDIA
2015-05-18 05:43 - 2015-05-01 06:35 - 00124112 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll
2015-05-18 05:43 - 2015-05-01 06:35 - 00102608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PresentationCFFRasterizerNative_v0300.dll
2015-05-18 05:36 - 2015-04-10 10:34 - 02256896 _____ (Microsoft Corporation) C:\Windows\system32\dwmcore.dll
2015-05-18 05:36 - 2015-04-10 10:11 - 01943040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dwmcore.dll
2015-05-18 05:35 - 2015-05-01 09:05 - 00429568 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-05-18 05:35 - 2015-05-01 08:48 - 00358912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2015-05-18 05:35 - 2015-04-25 07:32 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\UtcResources.dll
2015-05-18 05:35 - 2015-04-22 03:14 - 24971776 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-05-18 05:35 - 2015-04-22 02:50 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-05-18 05:35 - 2015-04-22 02:50 - 00417792 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2015-05-18 05:35 - 2015-04-22 02:49 - 02885120 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-05-18 05:35 - 2015-04-22 02:37 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-05-18 05:35 - 2015-04-22 02:35 - 00816640 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-05-18 05:35 - 2015-04-22 02:31 - 06025728 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-05-18 05:35 - 2015-04-22 02:24 - 19691008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-05-18 05:35 - 2015-04-22 02:13 - 00107520 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
2015-05-18 05:35 - 2015-04-22 02:11 - 00504320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-05-18 05:35 - 2015-04-22 02:09 - 00341504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2015-05-18 05:35 - 2015-04-22 02:08 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-05-18 05:35 - 2015-04-22 02:07 - 00145408 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll
2015-05-18 05:35 - 2015-04-22 02:05 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-05-18 05:35 - 2015-04-22 02:04 - 02278400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-05-18 05:35 - 2015-04-22 01:59 - 01032704 _____ (Microsoft Corporation) C:\Windows\system32\inetcomm.dll
2015-05-18 05:35 - 2015-04-22 01:58 - 00664576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2015-05-18 05:35 - 2015-04-22 01:52 - 00262144 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2015-05-18 05:35 - 2015-04-22 01:49 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-05-18 05:35 - 2015-04-22 01:49 - 00720384 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-05-18 05:35 - 2015-04-22 01:49 - 00374272 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-05-18 05:35 - 2015-04-22 01:46 - 02125824 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-05-18 05:35 - 2015-04-22 01:40 - 14401536 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-05-18 05:35 - 2015-04-22 01:38 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2015-05-18 05:35 - 2015-04-22 01:37 - 00128000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll
2015-05-18 05:35 - 2015-04-22 01:36 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2015-05-18 05:35 - 2015-04-22 01:32 - 00880128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcomm.dll
2015-05-18 05:35 - 2015-04-22 01:31 - 04305920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-05-18 05:35 - 2015-04-22 01:28 - 00230400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2015-05-18 05:35 - 2015-04-22 01:27 - 02352128 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-05-18 05:35 - 2015-04-22 01:26 - 00688640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-05-18 05:35 - 2015-04-22 01:26 - 00327168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2015-05-18 05:35 - 2015-04-22 01:25 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-05-18 05:35 - 2015-04-22 01:17 - 12828672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-05-18 05:35 - 2015-04-22 01:15 - 01547264 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-05-18 05:35 - 2015-04-22 01:03 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-05-18 05:35 - 2015-04-22 01:02 - 01882112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-05-18 05:35 - 2015-04-22 00:58 - 01310208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-05-18 05:35 - 2015-04-22 00:56 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2015-05-18 05:35 - 2015-04-14 08:48 - 04180480 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-05-18 05:35 - 2015-04-10 11:00 - 01996800 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2015-05-18 05:35 - 2015-04-10 10:50 - 01387008 _____ (Microsoft Corporation) C:\Windows\system32\FntCache.dll
2015-05-18 05:35 - 2015-04-10 10:26 - 01560576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll
2015-05-18 05:35 - 2015-04-09 08:55 - 00410128 _____ (Microsoft Corporation) C:\Windows\system32\services.exe
2015-05-18 05:35 - 2015-03-30 15:47 - 00561928 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2015-05-18 05:35 - 2015-03-27 13:27 - 00445440 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll
2015-05-18 05:35 - 2015-03-27 12:50 - 00324096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certcli.dll
2015-05-18 05:35 - 2015-03-27 12:48 - 01441792 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-05-18 05:35 - 2015-03-20 11:56 - 00080384 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ahcache.sys
2015-05-18 05:35 - 2015-03-13 11:11 - 02162176 _____ (Microsoft Corporation) C:\Windows\system32\SRH.dll
2015-05-18 05:35 - 2015-03-13 10:39 - 01812992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SRH.dll
2015-05-18 05:35 - 2015-03-13 10:29 - 00410017 _____ () C:\Windows\system32\ApnDatabase.xml
2015-05-18 05:35 - 2015-03-05 09:09 - 01429504 _____ (Microsoft Corporation) C:\Windows\system32\diagtrack.dll
2015-05-17 19:44 - 2015-05-17 19:44 - 00000000 ____H () C:\Users\Duc Hong\Documents\Default.rdp
2015-05-17 02:42 - 2015-05-17 07:57 - 00000000 ____D () C:\Program Files (x86)\eSupport.com
2015-05-17 02:42 - 2015-05-17 02:42 - 00013824 _____ (Phoenix Technologies) C:\Windows\SysWOW64\Drivers\DrvAgent64.SYS
2015-05-17 02:42 - 2015-05-17 02:42 - 00000000 ____D () C:\Users\Duc Hong\AppData\Local\eSupport.com
2015-05-16 22:44 - 2015-05-16 22:44 - 00014480 _____ () C:\Windows\system32\Drivers\nvflash.sys
2015-05-16 22:34 - 2015-05-16 22:34 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Oracle VM VirtualBox
2015-05-16 22:34 - 2015-05-13 17:11 - 00922704 _____ (Oracle Corporation) C:\Windows\system32\Drivers\VBoxDrv.sys
2015-05-16 22:34 - 2015-05-13 17:10 - 00128592 _____ (Oracle Corporation) C:\Windows\system32\Drivers\VBoxUSBMon.sys
2015-05-13 21:21 - 2015-05-13 21:21 - 00000000 ____D () C:\Users\Duc Hong\AppData\Roaming\Mediatronic
2015-05-13 21:17 - 2015-05-26 17:27 - 00000000 ____D () C:\Users\Duc Hong\Desktop\New folder
2015-05-13 17:10 - 2015-05-13 17:10 - 00141440 _____ (Oracle Corporation) C:\Windows\system32\Drivers\VBoxNetAdp.sys
2015-05-11 18:25 - 2015-05-11 18:25 - 00019851 _____ () C:\Users\Duc Hong\Desktop\ListOf4V2.java
2015-05-11 17:26 - 2015-05-27 16:20 - 00003474 _____ () C:\Windows\System32\Tasks\ASUS Live Update1
2015-05-11 17:26 - 2015-05-11 17:26 - 00003382 _____ () C:\Windows\System32\Tasks\Update Checker
2015-05-09 14:32 - 2015-05-09 14:32 - 00000218 _____ () C:\Users\Duc Hong\AppData\Local\recently-used.xbel
2015-05-09 14:31 - 2015-05-09 14:31 - 00000000 ____D () C:\ProgramData\InstallShield
2015-05-09 14:30 - 2015-05-09 14:33 - 00000000 ____D () C:\Users\Duc Hong\AppData\Roaming\driveridentifier
2015-05-07 20:59 - 2015-05-07 21:00 - 00022659 _____ () C:\Users\Duc Hong\Desktop\ListofNV.java
2015-05-06 20:19 - 2015-05-06 20:19 - 00012476 _____ () C:\Users\Duc Hong\Downloads\Smartphone-OS-rundown.odt
2015-05-06 18:14 - 2015-05-06 18:14 - 00000000 ____D () C:\Users\Duc Hong\Documents\OneNote Notebooks
2015-05-05 06:18 - 2015-05-05 06:18 - 00000000 ____D () C:\Users\Duc Hong\AppData\Local\ali213GameLauncher
2015-05-04 18:52 - 2015-05-26 16:39 - 00000000 ____D () C:\Users\Duc Hong\Tracing
2015-05-04 18:47 - 2015-05-21 15:31 - 00000000 ____D () C:\Users\Duc Hong\AppData\Roaming\Skype
2015-05-04 18:47 - 2015-05-04 18:47 - 00000000 ___RD () C:\Program Files (x86)\Skype
2015-05-04 18:47 - 2015-05-04 18:47 - 00000000 ____D () C:\Users\Duc Hong\AppData\Local\Skype
2015-05-04 18:47 - 2015-05-04 18:47 - 00000000 ____D () C:\ProgramData\Skype
2015-05-04 18:47 - 2015-05-04 18:47 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2015-05-04 18:47 - 2015-05-04 18:47 - 00000000 ____D () C:\extensions
2015-05-02 21:29 - 2010-06-02 04:55 - 00527192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_7.dll
2015-05-02 21:29 - 2010-06-02 04:55 - 00239960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_7.dll
2015-05-02 21:29 - 2010-06-02 04:55 - 00074072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_5.dll
2015-05-02 21:29 - 2010-05-26 11:41 - 02106216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_43.dll
2015-05-02 21:29 - 2010-05-26 11:41 - 01998168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_43.dll
2015-05-02 21:29 - 2010-05-26 11:41 - 01868128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dcsx_43.dll
2015-05-02 21:29 - 2010-05-26 11:41 - 00470880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_43.dll
2015-05-02 21:29 - 2010-05-26 11:41 - 00248672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx11_43.dll
2015-05-02 21:29 - 2010-02-04 10:01 - 00528216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_6.dll
2015-05-02 21:29 - 2010-02-04 10:01 - 00238936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_6.dll
2015-05-02 21:29 - 2010-02-04 10:01 - 00074072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_4.dll
2015-05-02 21:29 - 2010-02-04 10:01 - 00022360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\X3DAudio1_7.dll
2015-05-02 21:29 - 2009-09-04 17:44 - 00515416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_5.dll
2015-05-02 21:29 - 2009-09-04 17:44 - 00238936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_5.dll
2015-05-02 21:29 - 2009-09-04 17:29 - 05501792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dcsx_42.dll
2015-05-02 21:29 - 2009-09-04 17:29 - 01974616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_42.dll
2015-05-02 21:29 - 2009-09-04 17:29 - 01892184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_42.dll
2015-05-02 21:29 - 2009-09-04 17:29 - 00453456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_42.dll
2015-05-02 21:29 - 2009-09-04 17:29 - 00235344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx11_42.dll
2015-05-02 21:28 - 2009-09-04 17:44 - 00069464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_3.dll
2015-05-02 21:28 - 2009-03-16 14:18 - 00517448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_4.dll
2015-05-02 21:28 - 2009-03-16 14:18 - 00235352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_4.dll
2015-05-02 21:28 - 2009-03-16 14:18 - 00022360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\X3DAudio1_6.dll
2015-05-02 21:28 - 2009-03-09 15:27 - 04178264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_41.dll
2015-05-02 21:28 - 2009-03-09 15:27 - 01846632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_41.dll
2015-05-02 21:28 - 2009-03-09 15:27 - 00453456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_41.dll
2015-05-02 21:28 - 2008-10-27 10:04 - 00514384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_3.dll
2015-05-02 21:28 - 2008-10-27 10:04 - 00235856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_3.dll
2015-05-02 21:28 - 2008-10-27 10:04 - 00070992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_2.dll
2015-05-02 21:28 - 2008-10-27 10:04 - 00023376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\X3DAudio1_5.dll
2015-05-02 21:28 - 2008-10-15 06:22 - 04379984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_40.dll
2015-05-02 21:28 - 2008-10-15 06:22 - 02036576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_40.dll
2015-05-02 21:28 - 2008-10-15 06:22 - 00452440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_40.dll
2015-05-02 21:28 - 2008-07-31 10:41 - 00238088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_2.dll
2015-05-02 21:28 - 2008-07-31 10:41 - 00068616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_1.dll
2015-05-02 21:28 - 2008-07-31 10:40 - 00509448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_2.dll
2015-05-02 21:28 - 2008-07-10 11:01 - 00467984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_39.dll
2015-05-02 21:28 - 2008-07-10 11:00 - 03851784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_39.dll
2015-05-02 21:28 - 2008-07-10 11:00 - 01493528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_39.dll
2015-05-02 21:28 - 2008-05-30 14:19 - 00507400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_1.dll
2015-05-02 21:28 - 2008-05-30 14:18 - 00238088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_1.dll
2015-05-02 21:28 - 2008-05-30 14:17 - 00065032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_0.dll
2015-05-02 21:28 - 2008-05-30 14:17 - 00025608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\X3DAudio1_4.dll
2015-05-02 21:28 - 2008-05-30 14:11 - 03850760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_38.dll
2015-05-02 21:28 - 2008-05-30 14:11 - 01491992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_38.dll
2015-05-02 21:28 - 2008-05-30 14:11 - 00467984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_38.dll
2015-05-02 21:28 - 2008-03-05 16:03 - 00479752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_0.dll
2015-05-02 21:28 - 2008-03-05 16:03 - 00238088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_0.dll
2015-05-02 21:28 - 2008-03-05 16:00 - 00025608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\X3DAudio1_3.dll
2015-05-02 21:28 - 2008-03-05 15:56 - 03786760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_37.dll
2015-05-02 21:28 - 2008-03-05 15:56 - 01420824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_37.dll
2015-05-02 21:28 - 2008-02-05 23:07 - 00462864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_37.dll
2015-05-02 21:28 - 2007-10-22 03:39 - 00267272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_10.dll
2015-05-02 21:28 - 2007-10-22 03:37 - 00017928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\X3DAudio1_2.dll
2015-05-02 21:28 - 2007-10-12 15:14 - 03734536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_36.dll
2015-05-02 21:28 - 2007-10-12 15:14 - 01374232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_36.dll
2015-05-02 21:28 - 2007-10-02 09:56 - 00444776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_36.dll
2015-05-02 21:28 - 2007-07-20 00:57 - 00267112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_9.dll
2015-05-02 21:28 - 2007-07-19 18:14 - 03727720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_35.dll
2015-05-02 21:28 - 2007-07-19 18:14 - 01358192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_35.dll
2015-05-02 21:28 - 2007-07-19 18:14 - 00444776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_35.dll
2015-05-02 21:28 - 2007-06-20 20:46 - 00266088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_8.dll
2015-05-02 21:28 - 2007-05-16 16:45 - 03497832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_34.dll
2015-05-02 21:28 - 2007-05-16 16:45 - 01124720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_34.dll
2015-05-02 21:28 - 2007-05-16 16:45 - 00443752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_34.dll
2015-05-02 21:28 - 2007-04-04 18:55 - 00261480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_7.dll
2015-05-02 21:28 - 2007-04-04 18:53 - 00081768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xinput1_3.dll
2015-05-02 21:28 - 2007-03-15 16:57 - 00443752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_33.dll
2015-05-02 21:28 - 2007-03-12 16:42 - 03495784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_33.dll
2015-05-02 21:28 - 2007-03-12 16:42 - 01123696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_33.dll
2015-05-02 21:28 - 2007-03-05 12:42 - 00015128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\x3daudio1_1.dll
2015-05-02 21:28 - 2007-01-24 15:27 - 00255848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_6.dll
2015-05-02 21:28 - 2006-12-08 12:02 - 00251672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_5.dll
2015-05-02 21:28 - 2006-11-29 13:06 - 03426072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_32.dll
2015-05-02 21:28 - 2006-11-29 13:06 - 00440080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10.dll
2015-05-02 21:28 - 2006-09-28 16:05 - 02414360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_31.dll
2015-05-02 21:28 - 2006-09-28 16:05 - 00237848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_4.dll
2015-05-02 21:28 - 2006-07-28 09:30 - 00236824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_3.dll
2015-05-02 21:28 - 2006-07-28 09:30 - 00062744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xinput1_2.dll
2015-05-02 21:28 - 2006-05-31 07:24 - 00230168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_2.dll
2015-05-02 21:28 - 2006-03-31 12:40 - 02388176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_30.dll
2015-05-02 21:28 - 2006-03-31 12:39 - 00229584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_1.dll
2015-05-02 21:28 - 2006-03-31 12:39 - 00062672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xinput1_1.dll
2015-05-02 21:28 - 2006-02-03 08:43 - 02332368 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_29.dll
2015-05-02 21:28 - 2006-02-03 08:42 - 00230096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_0.dll
2015-05-02 21:28 - 2006-02-03 08:41 - 00014032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\x3daudio1_0.dll
2015-05-02 21:28 - 2005-12-05 18:09 - 02323664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_28.dll
2015-05-02 21:28 - 2005-07-22 19:59 - 02319568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_27.dll
2015-05-02 21:28 - 2005-05-26 15:34 - 02297552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_26.dll
2015-05-02 21:28 - 2005-03-18 17:19 - 02337488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_25.dll
2015-05-02 21:28 - 2005-02-05 19:45 - 02222800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_24.dll
2015-05-01 18:45 - 2015-03-18 03:26 - 00467776 ____C (Microsoft Corporation) C:\Windows\system32\Drivers\USBHUB3.SYS
2015-05-01 18:45 - 2015-03-09 12:02 - 00057856 ____C (Microsoft Corporation) C:\Windows\system32\Drivers\bthhfenum.sys
2015-05-01 18:45 - 2015-01-06 13:01 - 00072192 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ndproxy.sys
2015-05-01 18:45 - 2015-01-06 12:59 - 00080896 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\wanarp.sys
2015-05-01 18:45 - 2015-01-06 11:12 - 00185856 _____ (Microsoft Corporation) C:\Windows\system32\rascfg.dll
2015-05-01 18:45 - 2015-01-06 11:02 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rascfg.dll
2015-05-01 18:44 - 2015-04-03 10:35 - 00445440 _____ (Microsoft Corporation) C:\Windows\system32\PhotoMetadataHandler.dll
2015-05-01 18:44 - 2015-04-03 10:14 - 00364544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PhotoMetadataHandler.dll
2015-05-01 18:44 - 2015-04-02 08:22 - 02985984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dbgeng.dll
2015-05-01 18:44 - 2015-04-02 08:20 - 04417536 _____ (Microsoft Corporation) C:\Windows\system32\dbgeng.dll
2015-05-01 18:44 - 2015-04-01 13:45 - 01491456 _____ (Microsoft Corporation) C:\Windows\system32\dbghelp.dll
2015-05-01 18:44 - 2015-04-01 12:31 - 01207296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dbghelp.dll
2015-05-01 18:44 - 2015-03-24 07:59 - 07476032 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-05-01 18:44 - 2015-03-24 07:59 - 01733952 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2015-05-01 18:44 - 2015-03-24 07:59 - 00360480 _____ (Microsoft Corporation) C:\Windows\system32\sechost.dll
2015-05-01 18:44 - 2015-03-24 07:58 - 01498872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2015-05-01 18:44 - 2015-03-24 07:45 - 00257216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sechost.dll
2015-05-01 18:44 - 2015-03-20 14:12 - 00246272 _____ (Microsoft Corporation) C:\Windows\system32\microsoft-windows-system-events.dll
2015-05-01 18:44 - 2015-03-20 14:10 - 00285184 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2015-05-01 18:44 - 2015-03-20 14:10 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2015-05-01 18:44 - 2015-03-20 13:17 - 00411648 _____ (Microsoft Corporation) C:\Windows\system32\tracerpt.exe
2015-05-01 18:44 - 2015-03-20 12:41 - 00369152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tracerpt.exe
2015-05-01 18:44 - 2015-03-20 12:40 - 00950784 _____ (Microsoft Corporation) C:\Windows\system32\tdh.dll
2015-05-01 18:44 - 2015-03-20 12:16 - 00749568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdh.dll
2015-05-01 18:44 - 2015-03-13 12:58 - 00259072 _____ (Microsoft Corporation) C:\Windows\system32\pku2u.dll
2015-05-01 18:44 - 2015-03-13 12:37 - 00208896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pku2u.dll
2015-05-01 18:44 - 2015-03-06 12:47 - 01696256 _____ (Microsoft Corporation) C:\Windows\system32\wevtsvc.dll
2015-05-01 18:44 - 2015-03-04 11:32 - 00172544 _____ (Microsoft Corporation) C:\Windows\system32\Windows.UI.Input.Inking.dll
2015-05-01 18:44 - 2015-03-04 11:12 - 00141824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.UI.Input.Inking.dll
2015-05-01 18:44 - 2015-01-30 10:53 - 02819584 _____ (Microsoft Corporation) C:\Windows\system32\SettingsHandlers.dll
2015-05-01 18:44 - 2014-11-18 06:17 - 00672984 _____ (Microsoft Corporation) C:\Windows\system32\MDMAgent.exe
2015-05-01 18:44 - 2014-11-18 06:17 - 00273240 _____ (Microsoft Corporation) C:\Windows\system32\SystemSettingsAdminFlows.exe
2015-05-01 18:44 - 2014-11-14 16:58 - 00116736 _____ (Microsoft Corporation) C:\Windows\system32\SystemSettingsDatabase.dll
2015-05-01 18:44 - 2014-11-14 16:54 - 00463872 _____ (Microsoft Corporation) C:\Windows\system32\SystemSettings.Handlers.dll
2015-05-01 18:44 - 2014-11-14 16:46 - 02171904 _____ (Microsoft Corporation) C:\Windows\system32\SystemSettingsAdminFlowUI.dll
2015-05-01 18:43 - 2015-03-11 11:49 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\sdbinst.exe
2015-05-01 18:43 - 2015-03-11 11:09 - 00021504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sdbinst.exe
2015-05-01 18:42 - 2015-03-13 14:03 - 00239424 ____C (Microsoft Corporation) C:\Windows\system32\Drivers\sdbus.sys
2015-05-01 18:42 - 2015-03-13 14:03 - 00154432 ____C (Microsoft Corporation) C:\Windows\system32\Drivers\dumpsd.sys
2015-05-01 18:42 - 2015-03-06 13:08 - 02067968 _____ (Microsoft Corporation) C:\Windows\system32\wpdshext.dll
2015-05-01 18:42 - 2015-03-06 12:43 - 01969664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wpdshext.dll
2015-05-01 18:42 - 2015-03-04 20:25 - 00377152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\clfs.sys
2015-05-01 18:42 - 2015-03-04 13:04 - 00075264 _____ (Microsoft Corporation) C:\Windows\system32\clfsw32.dll
2015-05-01 18:42 - 2015-03-04 12:19 - 00058880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\clfsw32.dll
2015-05-01 18:42 - 2015-02-24 18:32 - 00991552 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\http.sys
2015-05-01 18:39 - 2015-02-18 09:19 - 00186368 _____ (Microsoft Corporation) C:\Windows\system32\dpapisrv.dll
2015-05-01 18:20 - 2015-03-13 12:02 - 00316416 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\udfs.sys
2015-05-01 16:28 - 2015-05-01 16:28 - 00364472 _____ (Avast Software s.r.o.) C:\Windows\system32\aswBoot.exe
2015-05-01 16:28 - 2015-05-01 16:28 - 00043112 _____ (Avast Software s.r.o.) C:\Windows\avastSS.scr
2015-04-30 23:17 - 2015-02-06 17:40 - 00066752 _____ (VMware, Inc.) C:\Windows\system32\Drivers\vmx86.sys
2015-04-30 23:16 - 2015-02-06 17:39 - 00033472 _____ (VMware, Inc.) C:\Windows\system32\Drivers\VMkbd.sys
2015-04-30 23:15 - 2015-02-06 17:40 - 00438464 _____ (VMware, Inc.) C:\Windows\SysWOW64\vmnat.exe
2015-04-30 23:15 - 2015-02-06 17:40 - 00359104 _____ (VMware, Inc.) C:\Windows\SysWOW64\vmnetdhcp.exe
2015-04-30 23:15 - 2015-02-06 17:40 - 00026816 _____ (VMware, Inc.) C:\Windows\system32\Drivers\vmnetuserif.sys
2015-04-30 23:15 - 2015-02-06 17:39 - 00931008 _____ (VMware, Inc.) C:\Windows\system32\vnetlib64.dll
2015-04-30 17:21 - 2015-04-30 17:21 - 00003939 _____ () C:\Users\Duc Hong\Desktop\bubblesortsolution.java
2015-04-28 07:24 - 2015-04-28 07:24 - 00000000 ____D () C:\Users\Duc Hong\AppData\Roaming\NVIDIA

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-05-28 00:00 - 2013-08-23 01:36 - 00000000 ____D () C:\Windows\system32\sru
2015-05-27 23:42 - 2015-02-17 22:33 - 00002908 _____ () C:\Windows\System32\Tasks\AutoKMS
2015-05-27 23:42 - 2015-01-08 07:43 - 00000298 _____ () C:\Windows\Tasks\AutoKMS.job
2015-05-27 23:21 - 2015-04-17 17:11 - 00000944 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1926068397-2398490202-140176465-1002UA.job
2015-05-27 20:28 - 2015-04-20 17:38 - 00003598 _____ () C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-1926068397-2398490202-140176465-1002
2015-05-27 20:09 - 2015-01-08 18:53 - 00000000 ____D () C:\Users\Duc Hong\Desktop\Tools
2015-05-27 19:04 - 2015-01-08 23:41 - 00000000 ____D () C:\ProgramData\Oracle
2015-05-27 19:01 - 2015-04-02 16:59 - 00000000 ____D () C:\Program Files\Java
2015-05-27 19:00 - 2015-04-02 17:02 - 00111016 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge-64.dll
2015-05-27 17:25 - 2015-01-08 01:11 - 00000000 ____D () C:\Program Files (x86)\Notepad++
2015-05-27 17:19 - 2015-04-12 05:06 - 00000000 ____D () C:\Users\Duc Hong\Desktop\Docs
2015-05-27 17:05 - 2015-01-18 16:16 - 00136408 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-05-27 17:04 - 2015-01-18 16:16 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2015-05-27 17:04 - 2015-01-18 16:16 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2015-05-27 17:01 - 2015-01-08 16:58 - 00000000 ____D () C:\Program Files\Defraggler
2015-05-27 16:53 - 2015-01-18 12:20 - 00000000 ____D () C:\Users\Duc Hong\AppData\Roaming\TeamViewer
2015-05-27 16:53 - 2015-01-08 07:25 - 00000000 ____D () C:\Users\Duc Hong\AppData\Roaming\DAEMON Tools Lite
2015-05-27 16:53 - 2015-01-08 06:43 - 00000000 ____D () C:\Users\Duc Hong\AppData\Roaming\uTorrent
2015-05-27 16:53 - 2015-01-07 21:35 - 00000000 ____D () C:\Users\Duc Hong\AppData\Roaming\IDM
2015-05-27 16:52 - 2015-01-07 20:39 - 00000000 ____D () C:\Program Files\CCleaner
2015-05-27 05:51 - 2015-01-07 21:35 - 00000000 ____D () C:\Users\Duc Hong\AppData\Roaming\DMCache
2015-05-27 05:49 - 2015-01-07 20:14 - 00000074 _____ () C:\Users\Duc Hong\AppData\Roaming\sp_data.sys
2015-05-27 05:47 - 2015-01-08 16:51 - 00000926 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-05-27 03:21 - 2015-04-17 17:11 - 00000892 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1926068397-2398490202-140176465-1002Core.job
2015-05-26 18:12 - 2014-03-18 20:03 - 00885780 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-05-26 16:01 - 2015-01-07 20:13 - 00000000 ____D () C:\Users\Duc Hong
2015-05-25 23:42 - 2015-03-04 16:42 - 00000000 ____D () C:\ProgramData\VMware
2015-05-25 23:42 - 2015-01-14 15:54 - 00000000 ____D () C:\Program Files\SoftEther VPN Client
2015-05-25 23:41 - 2013-08-23 00:45 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-05-25 23:40 - 2013-08-23 01:36 - 00000000 ___RD () C:\Windows\ToastData
2015-05-25 23:38 - 2013-08-23 01:20 - 00000000 ____D () C:\Windows\CbsTemp
2015-05-25 23:11 - 2015-01-07 21:35 - 00000000 ____D () C:\Program Files (x86)\Internet Download Manager
2015-05-25 18:22 - 2015-03-16 17:17 - 00000000 ____D () C:\Users\Duc Hong\Desktop\Bluej
2015-05-25 03:35 - 2015-04-12 15:20 - 00000000 ____D () C:\ProgramData\Orbit
2015-05-23 05:11 - 2015-01-07 21:36 - 00000000 ____D () C:\Users\Duc Hong\Downloads\Video
2015-05-21 19:58 - 2015-02-22 16:22 - 00000000 ____D () C:\Users\Duc Hong\AppData\Roaming\CodeBlocks
2015-05-20 20:47 - 2015-01-14 13:01 - 00000000 ____D () C:\Users\Duc Hong\.VirtualBox
2015-05-19 19:09 - 2015-01-30 16:22 - 00000187 _____ () C:\Windows\wininit.ini
2015-05-19 18:03 - 2013-08-23 01:36 - 00000000 ____D () C:\Windows\rescache
2015-05-18 05:48 - 2015-01-23 14:11 - 00481120 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-05-18 05:47 - 2015-01-07 23:38 - 00000000 ____D () C:\Program Files\Microsoft Silverlight
2015-05-18 05:47 - 2015-01-07 23:38 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight
2015-05-18 05:45 - 2015-01-08 07:28 - 00000000 ____D () C:\ProgramData\Microsoft Help
2015-05-18 05:44 - 2015-04-05 04:10 - 00000039 _____ () C:\Windows\vbaddin.ini
2015-05-18 05:43 - 2015-01-08 08:40 - 00000000 ____D () C:\Windows\system32\MRT
2015-05-18 05:39 - 2015-01-08 08:40 - 140425016 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-05-18 05:39 - 2013-08-22 23:25 - 00262144 ___SH () C:\Windows\system32\config\ELAM
2015-05-18 05:38 - 2015-04-14 22:32 - 00000000 ___SD () C:\Windows\SysWOW64\GWX
2015-05-18 05:38 - 2015-04-14 22:32 - 00000000 ___SD () C:\Windows\system32\GWX
2015-05-18 05:38 - 2015-01-07 23:38 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2015-05-18 05:36 - 2014-03-18 19:45 - 00000000 ____D () C:\Program Files\Windows Journal
2015-05-17 20:00 - 2015-01-08 07:10 - 00000000 ____D () C:\Users\Duc Hong\AppData\Local\Unity
2015-05-17 19:17 - 2014-07-12 08:56 - 00000000 ____D () C:\ProgramData\Package Cache
2015-05-16 22:32 - 2015-03-04 16:45 - 00000000 ____D () C:\Users\Duc Hong\AppData\Roaming\VMware
2015-05-16 22:32 - 2015-03-04 16:45 - 00000000 ____D () C:\Users\Duc Hong\AppData\Local\VMware
2015-05-16 05:42 - 2013-08-22 23:25 - 00262144 ___SH () C:\Windows\system32\config\BBI
2015-05-16 03:16 - 2015-04-17 17:11 - 00003900 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1926068397-2398490202-140176465-1002UA
2015-05-16 03:16 - 2015-04-17 17:11 - 00003520 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1926068397-2398490202-140176465-1002Core
2015-05-16 03:12 - 2015-01-08 16:51 - 00003902 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2015-05-16 03:12 - 2015-01-08 16:51 - 00003666 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2015-05-16 03:12 - 2015-01-08 16:51 - 00000930 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-05-13 21:07 - 2015-01-19 23:50 - 00000000 ____D () C:\Users\Duc Hong\AppData\Roaming\HandBrake
2015-05-13 17:10 - 2015-03-02 14:18 - 00204264 _____ (Oracle Corporation) C:\Windows\system32\VBoxNetFltNobj.dll
2015-05-13 17:10 - 2015-03-02 14:18 - 00156360 _____ (Oracle Corporation) C:\Windows\system32\Drivers\VBoxNetFlt.sys
2015-05-12 17:42 - 2015-02-11 16:03 - 00000000 ____D () C:\Users\Duc Hong\Desktop\IMG
2015-05-12 14:06 - 2013-08-23 01:36 - 00000000 ____D () C:\Windows\system32\NDF
2015-05-11 17:26 - 2014-05-17 06:03 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ASUS
2015-05-11 17:26 - 2014-05-17 06:02 - 00000000 ____D () C:\Program Files (x86)\ASUS
2015-05-11 01:18 - 2015-01-07 20:13 - 00000000 ____D () C:\Users\Duc Hong\AppData\Local\Packages
2015-05-11 01:18 - 2013-08-23 01:36 - 00000000 ____D () C:\Windows\AppReadiness
2015-05-09 14:32 - 2015-04-08 21:25 - 00000000 ____D () C:\Users\Duc Hong\.bluefish
2015-05-09 14:31 - 2014-07-12 08:47 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2015-05-08 20:54 - 2015-01-22 16:51 - 00000000 ____D () C:\Users\Duc Hong\AppData\Roaming\iFunbox_UserCache
2015-05-06 03:59 - 2015-02-16 18:53 - 00792568 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-05-06 03:59 - 2015-02-16 18:53 - 00178168 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-05-05 06:44 - 2015-01-07 23:31 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Steam
2015-05-05 06:23 - 2015-01-08 19:56 - 00000000 ____D () C:\Users\Duc Hong\Documents\my games
2015-05-02 02:51 - 2015-04-26 23:22 - 01316184 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvspcap.dll
2015-05-02 02:51 - 2015-04-26 23:22 - 01316000 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvspbridge.dll
2015-05-02 02:50 - 2015-04-26 23:22 - 01756424 _____ (NVIDIA Corporation) C:\Windows\system32\nvspbridge64.dll
2015-05-02 02:50 - 2015-04-26 23:22 - 01570672 _____ (NVIDIA Corporation) C:\Windows\system32\nvspcap64.dll
2015-05-01 18:55 - 2013-08-23 01:36 - 00000000 ___RD () C:\Windows\ImmersiveControlPanel
2015-05-01 18:55 - 2013-08-22 23:36 - 00000000 ____D () C:\Windows\system32\AdvancedInstallers
2015-05-01 18:45 - 2013-08-22 23:25 - 00000199 _____ () C:\Windows\win.ini
2015-05-01 16:28 - 2015-01-07 21:13 - 00003924 _____ () C:\Windows\System32\Tasks\avast! Emergency Update
2015-05-01 16:28 - 2015-01-07 21:12 - 01047320 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswSnx.sys
2015-05-01 16:28 - 2015-01-07 21:12 - 00442264 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswSP.sys
2015-05-01 16:28 - 2015-01-07 21:12 - 00272248 _____ () C:\Windows\system32\Drivers\aswVmm.sys
2015-05-01 16:28 - 2015-01-07 21:12 - 00137288 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswStm.sys
2015-05-01 16:28 - 2015-01-07 21:12 - 00093528 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswRdr2.sys
2015-05-01 16:28 - 2015-01-07 21:12 - 00089944 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswMonFlt.sys
2015-05-01 16:28 - 2015-01-07 21:12 - 00065736 _____ () C:\Windows\system32\Drivers\aswRvrt.sys
2015-05-01 16:28 - 2015-01-07 21:12 - 00029168 _____ () C:\Windows\system32\Drivers\aswHwid.sys

==================== Files in the root of some directories =======

2015-01-23 17:37 - 2015-01-23 17:37 - 0000021 _____ () C:\Users\Duc Hong\AppData\Roaming\my_intel.sys
2015-01-07 20:14 - 2015-05-27 05:49 - 0000074 _____ () C:\Users\Duc Hong\AppData\Roaming\sp_data.sys
2015-01-07 21:37 - 2015-01-07 21:37 - 0000002 ____H () C:\Users\Duc Hong\AppData\Roaming\win.dat
2015-05-09 14:32 - 2015-05-09 14:32 - 0000218 _____ () C:\Users\Duc Hong\AppData\Local\recently-used.xbel
2015-01-22 00:28 - 2015-01-28 16:59 - 0007618 _____ () C:\Users\Duc Hong\AppData\Local\Resmon.ResmonCfg
2014-07-12 08:51 - 2014-07-12 08:51 - 0000000 ____H () C:\ProgramData\DP45977C.lfl
2015-03-26 23:11 - 2015-03-26 23:11 - 0000040 _____ () C:\ProgramData\ra3.ini
2014-05-17 06:02 - 2012-09-07 21:40 - 0000256 _____ () C:\ProgramData\SetStretch.cmd
2014-05-17 06:02 - 2009-07-22 20:04 - 0024576 _____ () C:\ProgramData\SetStretch.exe
2014-05-17 06:02 - 2012-09-07 21:37 - 0000103 _____ () C:\ProgramData\SetStretch.VBS

Files to move or delete:
====================
C:\ProgramData\SetStretch.exe
C:\ProgramData\SetStretch.VBS


Some files in TEMP:
====================
C:\Users\Duc Hong\AppData\Local\Temp\npp.6.7.8.2.Installer.exe
C:\Users\Duc Hong\AppData\Local\Temp\xmlUpdater.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-05-26 22:51

==================== End of log ============================

 

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 27-05-2015
Ran by Duc Hong at 2015-05-28 00:09:28
Running from C:\Users\Duc Hong\Downloads\Programs
Boot Mode: Normal
==========================================================


==================== Accounts: =============================

Administrator (S-1-5-21-1926068397-2398490202-140176465-500 - Administrator - Disabled)
Duc Hong (S-1-5-21-1926068397-2398490202-140176465-1002 - Administrator - Enabled) => C:\Users\Duc Hong
Guest (S-1-5-21-1926068397-2398490202-140176465-501 - Limited - Disabled)

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

µTorrent (HKLM-x32\...\uTorrent) (Version: 3.2.3.28705 - BitTorrent Inc.)
7-Zip 9.38 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0938-000001000000}) (Version: 9.38.00.0 - Igor Pavlov)
Adobe Flash Player 16 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 16.0.0.235 - Adobe Systems Incorporated)
Apple Application Support (32-bit) (HKLM-x32\...\{2FE00055-C4F3-4F7A-AEDD-E198D54CF12F}) (Version: 3.1.1 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{19DED56B-657D-41DA-9EB0-7C20DDF6A613}) (Version: 8.1.0.18 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
ASUS Console (HKLM\...\{6D989E08-8143-4AB8-B0A8-5B836235CAA4}) (Version: 1.0.5 - ASUS)
Asus FaceID (HKLM-x32\...\{C4071085-DDF0-403F-90F9-27582FC22C9B}) (Version: 7.7.6.1 - ASUS)
ASUS Instant Key (HKLM-x32\...\{D97A1B80-131F-4692-9543-E652956D8B99}) (Version: 1.1.7 - ASUS)
ASUS Live Update (HKLM-x32\...\{FA540E67-095C-4A1B-97BA-4D547DEC9AF4}) (Version: 3.3.4 - ASUS)
ASUS Power4Gear Hybrid (HKLM\...\{9B6239BF-4E85-4590-8D72-51E30DB1A9AA}) (Version: 3.0.8 - ASUS)
ASUS Smart Gesture (HKLM-x32\...\{4D3286A6-F6AB-498A-82A4-E4F040529F3D}) (Version: 2.2.10 - ASUS)
ASUS Splendid Video Enhancement Technology (HKLM-x32\...\{0969AF05-4FF6-4C00-9406-43599238DE0D}) (Version: 2.01.0021 - ASUS)
ATK Package (HKLM-x32\...\{AB5C933E-5C7D-4D30-B314-9C83A49B94BE}) (Version: 1.0.0031 - ASUS)
ATLAS Translation Standard V14.0 Trial Version (HKLM-x32\...\{6652750B-AA69-49B7-9D09-C0A28B6FFC9F}) (Version: 14.00.2000 - FUJITSU LIMITED)
Auslogics DiskDefrag (HKLM-x32\...\{DF6A13C0-77DF-41FE-BD05-6D5201EB0CE7}_is1) (Version: 5.4.0.0 - Auslogics Labs Pty Ltd)
Avast Free Antivirus (HKLM-x32\...\Avast) (Version: 10.2.2218 - AVAST Software)
Avidemux 2.6 - 64bits (HKLM-x32\...\Avidemux 2.6 - 64bits (64-bit)) (Version: 2.6.9.00 - )
BatteryBar (remove only) (HKLM\...\BatteryBar) (Version:  - )
Bluefish 2.2.7 (HKLM-x32\...\Bluefish) (Version: 2.2.7 - The Bluefish Developers)
BlueJ (HKLM-x32\...\{7D66971C-652B-4065-A6B1-B3EE313C254B}) (Version: 3.1.4 - BlueJ Team)
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
CCleaner (HKLM\...\CCleaner) (Version: 5.06 - Piriform)
CodeBlocks (HKU\S-1-5-21-1926068397-2398490202-140176465-1002\...\CodeBlocks) (Version: 13.12 - The Code::Blocks Team)
Color Cop 5.4.3 (HKLM-x32\...\Color Cop_is1) (Version:  - Jay Prall)
Command & Conquer™ Red Alert™ 3 (HKLM\...\{296D8550-CB06-48E4-9A8B-E5034FB64715}) (Version: 1.0.1.0 - Electronic Arts)
Command & Conquer™ Red Alert™ 3 (HKLM-x32\...\{296D8550-CB06-48E4-9A8B-E5034FB64715}) (Version: 1.0.1.0 - Electronic Arts)
Counter-Strike: Global Offensive (HKLM-x32\...\Steam App 730) (Version:  - Valve)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
DAEMON Tools Lite (HKLM-x32\...\DAEMON Tools Lite) (Version: 4.49.1.0356 - Disc Soft Ltd)
Defraggler (HKLM\...\Defraggler) (Version: 2.19 - Piriform)
Everything 1.3.4.686 (x64) (HKLM\...\Everything) (Version:  - )
Explorer Suite IV (HKLM\...\Explorer Suite_is1) (Version:  - )
FarCry 4 (HKLM-x32\...\Uplay Install 420) (Version:  - Ubisoft)
FileHippo App Manager (HKLM-x32\...\FileHippo.com) (Version:  - FileHippo.com)
Foxit PhantomPDF Business (HKLM-x32\...\{8A601904-4113-40FE-9DCC-7A38CE1A8032}) (Version: 7.0.6.1126 - Foxit Software Inc.)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 43.0.2357.81 - Google Inc.)
Google Talk Plugin (HKLM-x32\...\{CA3DD97D-1FD7-37A7-BD5C-FC4430C8B8E6}) (Version: 5.41.2.0 - Google)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.27.5 - Google Inc.) Hidden
HandBrake 0.10.1 (HKLM-x32\...\HandBrake) (Version: 0.10.1 - )
HD Tune Pro 5.50 (HKLM-x32\...\HD Tune Pro_is1) (Version:  - EFD Software)
Intel® Driver Update Utility 2.0 (x32 Version: 2.0.0.29 - Intel) Hidden
Intel® Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 9.5.14.1724 - Intel Corporation)
Intel® Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.3355 - Intel Corporation)
Intel® Wireless Bluetooth®(patch version 17.1.1449.356) (HKLM\...\{302600C1-6BDF-4FD1-1411-148929CC1385}) (Version: 17.1.1411.0506 - Intel Corporation)
Intel® Driver Update Utility (HKLM-x32\...\{8409c4f7-2340-4933-a304-5d37db4fb48b}) (Version: 2.0.0.29 - Intel)
Intel® PROSet/Wireless Software (HKLM-x32\...\{a9888f41-68ae-43df-bd7d-d93405a44106}) (Version: 17.13.11 - Intel Corporation)
Internet Download Manager (HKLM-x32\...\Internet Download Manager) (Version:  - Tonec Inc.)
IrfanView (remove only) (HKLM-x32\...\IrfanView) (Version: 4.38 - Irfan Skiljan)
iTunes (HKLM\...\{2EA80E9F-C811-41BB-ABAC-F270B4B39BC6}) (Version: 12.1.0.71 - Apple Inc.)
Java 8 Update 45 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86418045F0}) (Version: 8.0.450 - Oracle Corporation)
Java 8 Update 45 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218045F0}) (Version: 8.0.450 - Oracle Corporation)
Java SE Development Kit 8 Update 40 (64-bit) (HKLM\...\{64A3A4F4-B792-11D6-A78A-00B0D0180400}) (Version: 8.0.400.26 - Oracle Corporation)
Junk Mail filter update (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
K-Lite Codec Pack 11.0.8 Full (HKLM-x32\...\KLiteCodecPack_is1) (Version: 11.0.8 - )
Malwarebytes Anti-Malware version 2.1.6.1022 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.1.6.1022 - Malwarebytes Corporation)
MediaCoder x64 0.8.34.5716 (HKLM\...\MediaCoder x64) (Version: 0.8.34.5716 - Mediatronic)
Microsoft ASP.NET MVC 4 Runtime (HKLM-x32\...\{3FE312D5-B862-40CE-8E4E-A6D8ABF62736}) (Version: 4.0.40804.0 - Microsoft Corporation)
Microsoft Office Professional Plus 2010 (HKLM\...\Office14.PROPLUS) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft OneDrive (HKU\S-1-5-21-1926068397-2398490202-140176465-1002\...\OneDriveSetup.exe) (Version: 17.0.4035.0328 - Microsoft Corporation)
Microsoft Outlook Hotmail Connector 64-bit (HKLM\...\{95140000-007A-0409-1000-0000000FF1CE}) (Version: 14.0.5118.5000 - Microsoft Corporation)
Microsoft Outlook Social Connector Provider for Windows Live Messenger 64-bit (HKLM\...\{95140000-007D-0409-1000-0000000FF1CE}) (Version: 14.0.5120.5000 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.40416.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visio Professional 2010 (HKLM\...\Office14.VISIOR) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 Redistributable - x64 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 Redistributable - x86 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\...\{ce085a78-074e-4823-8dc1-8a721b94b76d}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
Movie Maker (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Mozilla Firefox 37.0.1 (x86 en-US) (HKLM-x32\...\Mozilla Firefox 37.0.1 (x86 en-US)) (Version: 37.0.1 - Mozilla)
Mozilla Firefox 38.0.1 (x86 en-US) (HKU\S-1-5-21-1926068397-2398490202-140176465-1002\...\Mozilla Firefox 38.0.1 (x86 en-US)) (Version: 38.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 36.0.3 - Mozilla)
MyDefrag v4.3.1 (HKLM\...\MyDefrag v4.3.1_is1) (Version: 4.0.0.0 - J.C. Kessels)
NEKOPARA vol.1 (HKU\S-1-5-21-1926068397-2398490202-140176465-1002\...\{64DC04AF-BD7C-4CF4-9CA4-938953224328}) (Version:  - NEKO WORKs)
Notepad++ (HKLM-x32\...\Notepad++) (Version: 6.7.8.2 - Notepad++ Team)
NVIDIA GeForce Experience 2.4.3.22 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 2.4.3.22 - NVIDIA Corporation)
NVIDIA Graphics Driver 350.05 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 350.05 - NVIDIA Corporation)
NVIDIA PhysX System Software 9.15.0324 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.15.0324 - NVIDIA Corporation)
Oracle VM VirtualBox 4.3.28 (HKLM\...\{E8BB81BC-E67C-4750-84EE-128DA5A7ADA5}) (Version: 4.3.28 - Oracle Corporation)
Potplayer (HKLM-x32\...\PotPlayer) (Version:  - Daum Kakao Corp.)
Rainmeter (HKLM-x32\...\Rainmeter) (Version: 3.2.1 r2386 - )
Realtek Card Reader (HKLM-x32\...\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}) (Version: 6.2.9200.39048 - Realtek Semiconductor Corp.)
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 8.20.815.2013 - Realtek)
Revo Uninstaller Pro 3.0.2 (HKLM\...\{67579783-0FB7-4F7B-B881-E5BE47C9DBE0}_is1) (Version: 3.0.2 - VS Revo Group, Ltd.)
RW-Everything v1.6.5.9 (HKLM\...\RW-Everything_is1) (Version:  - )
Service Pack 2 for Microsoft Office 2010 (KB2687455) 64-Bit Edition (HKLM\...\{90140000-0011-0000-1000-0000000FF1CE}_Office14.PROPLUS_{A3364707-2F53-4C83-8F68-C9877A9080C7}) (Version:  - Microsoft)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 64-Bit Edition (HKLM\...\{91140000-0057-0000-1000-0000000FF1CE}_Office14.VISIOR_{3C578F10-F74F-4655-B2A6-9F88A6C415E8}) (Version:  - Microsoft)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 64-Bit Edition (Version:  - Microsoft) Hidden
SHIELD Streaming (Version: 4.1.1000 - NVIDIA Corporation) Hidden
SHIELD Wireless Controller Driver (Version: 2.4.3.22 - NVIDIA Corporation) Hidden
Sid Meier's Civilization V (HKLM-x32\...\Steam App 8930) (Version:  - 2K Games, Inc.)
Skype Click to Call (HKLM-x32\...\{6D1221A9-17BF-4EC0-81F2-27D30EC30701}) (Version: 7.3.16540.9015 - Microsoft Corporation)
Skype™ 7.4 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.4.102 - Skype Technologies S.A.)
SoftEther VPN Client (HKLM\...\softether_sevpnclient) (Version: 4.12.9514 - SoftEther VPN Project)
Speccy (HKLM\...\Speccy) (Version: 1.28 - Piriform)
Spotify (HKU\S-1-5-21-1926068397-2398490202-140176465-1002\...\Spotify) (Version: 1.0.3.101.gbfa97dfe - Spotify AB)
Steam (HKLM-x32\...\Steam) (Version: 2.10.91.91 - Valve Corporation)
Synei System Utilities (HKLM-x32\...\{BFDC3B26-7DB0-43D3-BC84-7E9649C157EA}_is1) (Version: 2.25 - Synei)
System Requirements Lab (HKLM-x32\...\{0F659036-14C7-4622-9505-35A0DC93526A}) (Version: 6.1.3.0 - Husdawg, LLC)
Team Fortress 2 (HKLM-x32\...\Steam App 440) (Version:  - Valve)
TeraCopy 2.3 (HKLM\...\TeraCopy_is1) (Version:  - Code Sector)
The Elder Scrolls V: Skyrim (HKLM-x32\...\Steam App 72850) (Version:  - Bethesda Game Studios)
The Witcher 2: Assassins of Kings Enhanced Edition (HKLM-x32\...\Steam App 20920) (Version:  - CD PROJEKT RED)
Unity Web Player (HKU\S-1-5-21-1926068397-2398490202-140176465-1002\...\UnityWebPlayer) (Version: 5.0.2f1 - Unity Technologies ApS)
Unlocker 1.9.2 (HKLM\...\Unlocker) (Version: 1.9.2 - Cedrick Collomb)
Update for Japanese Microsoft IME Postal Code Dictionary (HKLM-x32\...\{15015752-9990-4516-A2B1-93823281FB8E}) (Version: 15.0.1759 - Microsoft Corporation)
Update for Japanese Microsoft IME Standard Dictionary (HKLM-x32\...\{7DB71278-9AD7-4480-AB08-8649C5010B17}) (Version: 15.0.1215 - Microsoft Corporation)
Update for Japanese Microsoft IME Standard Extended Dictionary (HKLM-x32\...\{78CE66A9-85AF-4BD8-8FB7-35B5F3846C00}) (Version: 15.0.1215 - Microsoft Corporation)
Uplay (HKLM-x32\...\Uplay) (Version: 4.8 - Ubisoft)
VMware Player (HKLM-x32\...\VMware_Player) (Version: 7.1.0 - VMware, Inc)
VMware Player (Version: 7.1.0 - VMware, Inc.) Hidden
Warframe (HKLM-x32\...\Steam App 230410) (Version:  - Digital Extremes)
WebStorage (HKLM-x32\...\WebStorage) (Version: 2.1.2.301 - ASUS Cloud Corporation)
Windows Driver Package - ASUS (ATP) Mouse  (01/07/2014 1.0.0.197) (HKLM\...\2BEE838DC3D664A0CAB23AEA0332BB3877ED0685) (Version: 01/07/2014 1.0.0.197 - ASUS)
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3528.0331 - Microsoft Corporation)
WinFlash (HKLM-x32\...\{8F21291E-0444-4B1D-B9F9-4370A73E346D}) (Version: 2.42.0 - ASUS)
WinPcap 4.1.3 (HKLM-x32\...\WinPcapInst) (Version: 4.1.0.2980 - Riverbed Technology, Inc.)
WinRAR 5.20 (64-bit) (HKLM\...\WinRAR archiver) (Version: 5.20.0 - win.rar GmbH)
Wireshark 1.12.5 (64-bit) (HKLM-x32\...\Wireshark) (Version: 1.12.5 - The Wireshark developer community, http://www.wireshark.org)

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

CustomCLSID: HKU\S-1-5-21-1926068397-2398490202-140176465-1002_Classes\CLSID\{1423F872-3F7F-4E57-B621-8B1A9D49B448}\InprocServer32 -> C:\Users\Duc Hong\AppData\Local\Google\Update\1.3.27.5\psuser_64.dll (Google Inc.)
CustomCLSID: HKU\S-1-5-21-1926068397-2398490202-140176465-1002_Classes\CLSID\{E8CF3E55-F919-49D9-ABC0-948E6CB34B9F}\InprocServer32 -> C:\Users\Duc Hong\AppData\Local\Google\Update\1.3.27.5\psuser_64.dll (Google Inc.)
CustomCLSID: HKU\S-1-5-21-1926068397-2398490202-140176465-1002_Classes\CLSID\{F8071786-1FD0-4A66-81A1-3CBE29274458}\InprocServer32 -> C:\Users\Duc Hong\AppData\Local\Microsoft\SkyDrive\17.0.4035.0328\amd64\FileSyncApi64.dll (Microsoft Corporation)

==================== Restore Points =========================

26-05-2015 15:59:24 Windows Live Essentials
26-05-2015 16:01:59 WLSetup

==================== Hosts content: ===============================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2013-08-22 23:25 - 2015-02-11 01:00 - 00000793 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {0672CE47-9AF2-49B5-BA4A-D987C76AF085} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1926068397-2398490202-140176465-1002UA => C:\Users\Duc Hong\AppData\Local\Google\Update\GoogleUpdate.exe [2015-04-17] (Google Inc.)
Task: {0B01FB0E-B462-46B8-816C-2444A6441DB3} - System32\Tasks\ASUS Smart Gesture Launcher => C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPLauncher.exe [2014-02-14] (AsusTek)
Task: {1BAF89D5-B76F-48CA-B114-034B69480F29} - System32\Tasks\ASUS Splendid ColorU => C:\Program Files (x86)\ASUS\Splendid\ColorUService.exe [2013-10-08] (ASUSTeK Computer Inc.)
Task: {1EB54610-9F30-42C5-93C1-9B6CBD358D7E} - System32\Tasks\RTKCPL => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [2014-05-20] (Realtek Semiconductor)
Task: {31E03131-2908-43E9-AE6D-CD1AC82DAD2F} - System32\Tasks\ASUS Console => C:\Program Files\ASUS\ASUS Console\ASUS Console Starter.exe [2014-02-07] (ASUSTek Computer Inc.)
Task: {4E3FDD62-EABC-414B-8FBD-DBA444C5CA8A} - System32\Tasks\Microsoft\Windows\Setup\gwx\refreshgwxconfig => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-05-06] (Microsoft Corporation)
Task: {760AE585-4971-4AD2-AFC4-DEA14F01B495} - System32\Tasks\Microsoft\Windows\Setup\gwx\launchtrayprocess => C:\Windows\system32\GWX\GWX.exe [2015-05-06] (Microsoft Corporation)
Task: {766E80C1-FFF8-4F47-8FC3-4E533BAE0AC1} - System32\Tasks\Update Checker => C:\Program Files (x86)\ASUS\ASUS Live Update\UpdateChecker.exe [2015-02-12] ()
Task: {82F04444-7113-4278-B8C4-51A59E6C29E4} - System32\Tasks\RtHDVBg => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [2014-05-13] (Realtek Semiconductor)
Task: {9D746130-D7A9-4BB8-8E96-05093DEF9977} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1926068397-2398490202-140176465-1002Core => C:\Users\Duc Hong\AppData\Local\Google\Update\GoogleUpdate.exe [2015-04-17] (Google Inc.)
Task: {A508D830-687E-41AA-AF60-8916D26EAEBF} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2015-05-09] (Piriform Ltd)
Task: {B0F0CAF5-E8BC-45C2-B67C-9C12294AF136} - System32\Tasks\AutoKMS => C:\Windows\AutoKMS\AutoKMS.exe [2015-01-08] ()
Task: {B905D56A-7E45-4939-90F9-416CB290E620} - System32\Tasks\AsusVibeSchedule => C:\Program Files (x86)\Asus\AsusVibe\AsusVibeLauncher.exe
Task: {BFBCA901-B92C-49C8-A07C-57F94EC4BD4A} - System32\Tasks\ASUS Live Update1 => C:\Program Files (x86)\ASUS\ASUS Live Update\LiveUpdate.exe [2015-03-23] (ASUSTeK Computer Inc.)
Task: {CB4E97FF-DC08-4AE9-B101-6EC041501D17} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\Windows\system32\MRT.exe [2015-05-18] (Microsoft Corporation)
Task: {CE71F3E1-DE1E-4B42-A816-09F806D6EAFE} - System32\Tasks\Microsoft OneDrive Auto Update Task-S-1-5-21-1926068397-2398490202-140176465-1002 => %localappdata%\Microsoft\SkyDrive\SkyDrive.exe
Task: {D54DEED3-1E09-43DD-A0D7-2534D4F95BFB} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-01-08] (Google Inc.)
Task: {EA345886-3FBF-4930-8FE1-DEAE05BA0372} - System32\Tasks\ASUS Splendid ACMON => C:\Program Files (x86)\ASUS\Splendid\ACMON.exe [2013-10-08] (ASUS)
Task: {F6441995-B4CF-4A06-BBE6-5BE2EE55D8EA} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2015-05-01] (Avast Software s.r.o.)
Task: {F87A5893-944C-45F8-AF4F-42245D864FF7} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-01-08] (Google Inc.)
Task: C:\Windows\Tasks\AutoKMS.job => C:\Windows\AutoKMS\AutoKMS.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1926068397-2398490202-140176465-1002Core.job => C:\Users\Duc Hong\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1926068397-2398490202-140176465-1002UA.job => C:\Users\Duc Hong\AppData\Local\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (Whitelisted) ==============

2015-02-20 08:01 - 2015-02-20 08:01 - 00022528 _____ () C:\Windows\System32\us001lm.dll
2014-07-12 09:01 - 2013-08-27 09:29 - 00755728 _____ () C:\Windows\SYSTEM32\sqlite3.dll
2015-04-26 23:21 - 2015-04-02 17:19 - 00117392 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2013-09-04 23:17 - 2013-09-04 23:17 - 04300456 _____ () C:\Program Files\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF
2010-10-20 14:23 - 2010-10-20 14:23 - 08801632 _____ () C:\Program Files\Microsoft Office\Office14\1033\GrooveIntlResource.dll
2015-03-24 23:28 - 2015-03-24 23:28 - 00036544 _____ () C:\Program Files\Rainmeter\Rainmeter.exe
2015-03-24 23:28 - 2015-03-24 23:28 - 00775872 _____ () C:\Program Files\Rainmeter\Rainmeter.dll
2015-03-24 23:28 - 2015-03-24 23:28 - 00022528 _____ () C:\Program Files\Rainmeter\Plugins\InputText.dll
2015-03-24 23:27 - 2015-03-24 23:27 - 00011776 _____ () C:\Program Files\Rainmeter\Plugins\PowerPlugin.DLL
2015-03-24 23:27 - 2015-03-24 23:27 - 00022016 _____ () C:\Program Files\Rainmeter\Plugins\WifiStatus.DLL
2015-03-24 23:27 - 2015-03-24 23:27 - 00020992 _____ () C:\Program Files\Rainmeter\Plugins\SysInfo.DLL
2015-03-24 23:27 - 2015-03-24 23:27 - 00058368 _____ () C:\Program Files\Rainmeter\Plugins\WebParser.DLL
2015-03-24 23:27 - 2015-03-24 23:27 - 00023040 _____ () C:\Program Files\Rainmeter\Plugins\Win7AudioPlugin.DLL
2010-07-15 14:44 - 2010-07-15 14:44 - 00020032 _____ () C:\Program Files\Unlocker\UnlockerCOM.dll
2015-04-16 06:13 - 2015-04-16 06:13 - 00222720 _____ () C:\Program Files (x86)\Notepad++\NppShell_06.dll
2015-05-01 16:28 - 2015-05-01 16:28 - 00104400 _____ () C:\Program Files\AVAST Software\Avast\log.dll
2015-05-01 16:28 - 2015-05-01 16:28 - 00081728 _____ () C:\Program Files\AVAST Software\Avast\JsonRpcServer.dll
2015-05-26 23:07 - 2015-05-26 23:07 - 02948096 _____ () C:\Program Files\AVAST Software\Avast\defs\15052600\algo.dll
2015-01-20 21:35 - 2015-01-20 21:35 - 00073544 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2015-01-20 21:35 - 2015-01-20 21:35 - 01044776 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2015-02-06 17:40 - 2015-02-06 17:40 - 01301696 _____ () C:\Program Files (x86)\VMware\VMware Player\libxml2.dll
2014-07-12 08:47 - 2013-09-04 09:52 - 01242584 _____ () C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\ACE.dll
2013-09-10 11:23 - 2013-09-10 11:23 - 00162816 _____ () C:\Program Files (x86)\ASUS\Splendid\CCTAdjust.dll
2013-10-09 13:41 - 2013-10-09 13:41 - 00037968 _____ () C:\Program Files (x86)\ASUS\Splendid\DetectDisplayDC.dll
2015-04-26 23:22 - 2015-05-02 02:52 - 00011920 _____ () C:\Program Files (x86)\NVIDIA Corporation\Update Core\detoured.dll
2015-03-20 15:31 - 2015-03-20 15:31 - 40540672 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll
2013-04-27 10:24 - 2013-04-27 10:24 - 00071680 _____ () C:\Program Files (x86)\ASUS\ASUS Live Update\checkmetro.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)


==================== Safe Mode (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcpltsvc => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcpltsvc => ""=""

==================== EXE Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)


==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-1926068397-2398490202-140176465-1002\Control Panel\Desktop\\Wallpaper -> C:\Users\Duc Hong\AppData\Roaming\IrfanView\IrfanView_Wallpaper.bmp
DNS Servers: 192.168.1.1

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

HKLM\...\StartupApproved\StartupFolder: => "SoftEther VPN Client Manager Startup.lnk"
HKLM\...\StartupApproved\Run: => "ShadowPlay"
HKLM\...\StartupApproved\Run32: => "ASUSPRP"
HKLM\...\StartupApproved\Run32: => "WebStorage"
HKU\S-1-5-21-1926068397-2398490202-140176465-1002\...\StartupApproved\Run: => "FlashPlayerUpdate"
HKU\S-1-5-21-1926068397-2398490202-140176465-1002\...\StartupApproved\Run: => "Google Update"
HKU\S-1-5-21-1926068397-2398490202-140176465-1002\...\StartupApproved\Run: => "DevidAgent"

==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139
FirewallRules: [Daum PotPlayer(PotPlayerMini.exe)] => (Allow) C:\Program Files (x86)\DAUM\PotPlayer\PotPlayerMini.exe
FirewallRules: [{6AD7A4C1-520C-4938-83E9-8C3D4AF4470B}] => (Allow) C:\Program Files (x86)\DAUM\PotPlayer\PotPlayerMini.exe
FirewallRules: [TCP Query User{B408D18C-6D03-4CC8-9E8F-41FF22643530}C:\windows\microsoft.net\framework\v2.0.50727\vbc.exe] => (Allow) C:\windows\microsoft.net\framework\v2.0.50727\vbc.exe
FirewallRules: [UDP Query User{A1BDE586-1E5F-4E70-83A1-C3724D86FBEA}C:\windows\microsoft.net\framework\v2.0.50727\vbc.exe] => (Allow) C:\windows\microsoft.net\framework\v2.0.50727\vbc.exe
FirewallRules: [{46831999-F626-41E8-A1AB-F3130E61A535}] => (Allow) E:\Temp\Steam\Steam.exe
FirewallRules: [{24C0EBEB-6AAB-4281-B843-FC830B4FEB52}] => (Allow) E:\Temp\Steam\Steam.exe
FirewallRules: [{AED3302F-B17D-4701-9390-ED277A47C947}] => (Allow) E:\Temp\Steam\steamapps\common\Skyrim\SkyrimLauncher.exe
FirewallRules: [{259FAB07-4841-4498-8702-1C73EE758BF7}] => (Allow) E:\Temp\Steam\steamapps\common\Skyrim\SkyrimLauncher.exe
FirewallRules: [{F2D50447-ADCB-4ACF-A732-83AA56A4E7A9}] => (Allow) C:\Program Files\SoftEther VPN Client\vpnclient_x64.exe
FirewallRules: [{332E3FF6-209A-48A4-A6EC-7423A11D35B6}] => (Allow) C:\Program Files\SoftEther VPN Client\vpncmgr.exe
FirewallRules: [{8284D947-F7E8-4B89-A26F-A0AD5FD80F82}] => (Allow) C:\Program Files\SoftEther VPN Client\vpncmd_x64.exe
FirewallRules: [{A44E3BA8-FD16-4235-9303-E17CA8FF8D6D}] => (Allow) C:\Program Files\SoftEther VPN Client\vpncmgr_x64.exe
FirewallRules: [{5647D39A-F124-4953-ACEC-254F04260C4D}] => (Allow) C:\Program Files\SoftEther VPN Client\vpnclient.exe
FirewallRules: [{BB5EAF98-68DC-4481-BDA2-0F92653D1BE9}] => (Allow) C:\Program Files\SoftEther VPN Client\vpncmd.exe
FirewallRules: [SPPSVC-In-TCP] => (Allow) %SystemRoot%\system32\sppextcomobj.exe
FirewallRules: [SPPSVC-In-TCP-NoScope] => (Allow) %SystemRoot%\system32\sppextcomobj.exe
FirewallRules: [{2BFDCA10-D873-4098-A023-AF8A8D52659D}] => (Allow) C:\Users\Duc Hong\AppData\Roaming\Spotify\spotify.exe
FirewallRules: [{95AFAF81-213D-48BB-9D2E-9FC489C69485}] => (Allow) C:\Users\Duc Hong\AppData\Roaming\Spotify\spotify.exe
FirewallRules: [{E419D7CD-9FEB-40AD-8036-CEF8EE2A3E58}] => (Allow) C:\Program Files (x86)\uTorrent\uTorrent.exe
FirewallRules: [{7EB67D77-8A9B-425E-8A9D-556828BD9F2A}] => (Allow) C:\Program Files (x86)\uTorrent\uTorrent.exe
FirewallRules: [{E7314D54-19FD-4376-952A-C283F866565A}] => (Allow) E:\Temp\Steam\steamapps\common\Team Fortress 2\hl2.exe
FirewallRules: [{A9537D58-5E28-443C-9DF3-773B75BE8B9C}] => (Allow) E:\Temp\Steam\steamapps\common\Team Fortress 2\hl2.exe
FirewallRules: [{5405FDE4-13D9-46A4-BA72-2C3D637A820A}] => (Allow) E:\Temp\Steam\steamapps\common\Sid Meier's Civilization V\Launcher.exe
FirewallRules: [{4D112B3C-965E-4D2B-8A4C-A3BC7790EB24}] => (Allow) E:\Temp\Steam\steamapps\common\Sid Meier's Civilization V\Launcher.exe
FirewallRules: [{57563CA2-4C58-4DB6-A9D8-63CCEE8D3D58}] => (Allow) C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe
FirewallRules: [{EECB906E-0A72-4349-ABC2-51F722808688}] => (Allow) C:\Program Files (x86)\VMware\VMware Player\vmware-authd.exe
FirewallRules: [{E113D9E6-3F09-4DFD-9AE0-63C1DDFBFF5F}] => (Allow) C:\Program Files (x86)\VMware\VMware Player\vmware-authd.exe
FirewallRules: [TCP Query User{D2BD56E1-FECA-4760-BFF6-7B483CFCD029}C:\program files (x86)\mozilla firefox\firefox.exe] => (Allow) C:\program files (x86)\mozilla firefox\firefox.exe
FirewallRules: [UDP Query User{31909EE8-B773-4D7F-8A9B-F43C433277C1}C:\program files (x86)\mozilla firefox\firefox.exe] => (Allow) C:\program files (x86)\mozilla firefox\firefox.exe
FirewallRules: [{D584DDB2-8E7C-45B2-828F-ACE4C55E5EEF}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{0E7DD122-51EE-4061-BA2E-AC6519ACC2AD}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{55B30F08-3CE8-40C4-A149-EC7C5462450F}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{6A093041-DBDC-47C2-A540-CFBC73668DB9}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{2E92677B-4DF7-48B8-A955-03BC56D592A8}] => (Allow) C:\Program Files (x86)\iTunes\iTunes.exe
FirewallRules: [{C61C7218-4C30-48CF-A3C2-6D208730DCEE}] => (Allow) C:\Users\Duc Hong\AppData\Roaming\Spotify\spotify.exe
FirewallRules: [{0CB55171-3C48-4165-B73A-D3D703E0BF74}] => (Allow) C:\Users\Duc Hong\AppData\Roaming\Spotify\spotify.exe
FirewallRules: [{62290C84-E203-48CD-96FE-25F287B35C58}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{CF008ED2-2D02-4F90-9DE1-AF2683AC3A75}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{4A2F08C8-3C2D-4E62-AB32-9E6F21033E5D}] => (Allow) E:\Temp\Steam\steamapps\common\Counter-Strike Global Offensive\csgo.exe
FirewallRules: [{5A10E92E-14BC-4EA2-87C5-DFA76406A1B6}] => (Allow) E:\Temp\Steam\steamapps\common\Counter-Strike Global Offensive\csgo.exe
FirewallRules: [{450E7EC7-2C50-4F23-96AB-7ECDB5C88FFC}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
FirewallRules: [{32706039-9609-4992-BEEB-8ED8864C4607}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
FirewallRules: [{F739246A-3A2D-4765-808B-7BB1F4458A55}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe
FirewallRules: [{B1667E06-E235-41E6-B974-A2480A44B3EA}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe
FirewallRules: [{C902004C-0182-4F8A-92B3-90CDD0848EEE}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{CA9C0864-93C5-4403-A96A-481A312E25AB}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{FB800EB4-BE51-4D8C-8E4F-CFC1270DB18B}] => (Allow) E:\Temp\Steam\steamapps\common\Warframe\Tools\Launcher.exe
FirewallRules: [{C72A1B67-D93C-43AC-BE28-B0ACE3FE8839}] => (Allow) E:\Temp\Steam\steamapps\common\Warframe\Tools\Launcher.exe
FirewallRules: [TCP Query User{EB9F9A8C-6653-487F-B17B-9F501F2579C1}C:\program files (x86)\skype\phone\skype.exe] => (Allow) C:\program files (x86)\skype\phone\skype.exe
FirewallRules: [UDP Query User{56B69EA0-F89E-4E3A-86A9-17B0A681F65D}C:\program files (x86)\skype\phone\skype.exe] => (Allow) C:\program files (x86)\skype\phone\skype.exe
FirewallRules: [{8D865167-D700-4BE4-9F4A-CA556B393C38}] => (Allow) E:\Temp\Steam\steamapps\common\the witcher 2\Launcher.exe
FirewallRules: [{E0ABD53F-A995-438C-9AF4-7F12976B664F}] => (Allow) E:\Temp\Steam\steamapps\common\the witcher 2\Launcher.exe
FirewallRules: [{70336664-A8F7-4643-8DE1-888C970ADC52}] => (Allow) E:\Temp\Test\FarCry 4\bin\FarCry4.exe
FirewallRules: [{72959202-F7E2-4BC0-9E68-D9CE43FA28F0}] => (Allow) E:\Temp\Test\FarCry 4\bin\FarCry4.exe
FirewallRules: [{A5616C7D-29F6-4A47-BCBB-F7E60F43C9E9}] => (Allow) E:\Temp\Test\FarCry 4\bin\IGE_WPF64.exe
FirewallRules: [{5A969598-A826-47D0-ADB8-1F16B5161795}] => (Allow) E:\Temp\Test\FarCry 4\bin\IGE_WPF64.exe
FirewallRules: [{6B564610-4D4B-4514-8E99-BA30320C8C45}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
FirewallRules: [{8275C44B-588A-44A8-AA31-5CA246C843D7}] => (Allow) C:\Users\Duc Hong\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe
FirewallRules: [{341B590C-72BE-41C1-8D3B-81B7B97F31C4}] => (Allow) C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe
FirewallRules: [{9C62EFEB-4763-4789-983E-C443E1323C56}] => (Allow) LPort=2869
FirewallRules: [{A0BBA649-A813-4E72-B461-002ADF599BB2}] => (Allow) LPort=1900
FirewallRules: [{7A1895A9-2842-4905-B03D-7FE4C9AE9DF0}] => (Allow) C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (05/27/2015 08:28:22 PM) (Source: NvStreamSvc) (EventID: 2001) (User: )
Description: NvStreamSvcFailed continue stopping. [5]

Error: (05/27/2015 07:04:24 PM) (Source: NvStreamSvc) (EventID: 2001) (User: )
Description: NvStreamSvcFailed continue stopping. [6]

Error: (05/27/2015 06:55:22 PM) (Source: NvStreamSvc) (EventID: 2001) (User: )
Description: NvStreamSvcFailed continue stopping. [0]

Error: (05/27/2015 05:01:26 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: defraggler64.exe, version: 2.18.0.945, time stamp: 0x534528ea
Faulting module name: dbghelp.dll_unloaded, version: 6.3.9600.17787, time stamp: 0x551b69ca
Exception code: 0xc0000005
Fault offset: 0x0000000000113a70
Faulting process id: 0x1714
Faulting application start time: 0xdefraggler64.exe0
Faulting application path: defraggler64.exe1
Faulting module path: defraggler64.exe2
Report Id: defraggler64.exe3
Faulting package full name: defraggler64.exe4
Faulting package-relative application ID: defraggler64.exe5

Error: (05/27/2015 04:17:57 PM) (Source: NvStreamSvc) (EventID: 2001) (User: )
Description: NvStreamSvcFailed continue stopping. [0]

Error: (05/27/2015 05:48:26 AM) (Source: NvStreamSvc) (EventID: 2001) (User: )
Description: NvStreamSvcFailed continue stopping. [0]

Error: (05/26/2015 08:22:37 PM) (Source: NvStreamSvc) (EventID: 2001) (User: )
Description: NvStreamSvcFailed continue stopping. [5]

Error: (05/26/2015 08:03:08 PM) (Source: NvStreamSvc) (EventID: 2001) (User: )
Description: NvStreamSvcFailed continue stopping. [6]

Error: (05/26/2015 07:40:12 PM) (Source: NvStreamSvc) (EventID: 2001) (User: )
Description: NvStreamSvcFailed continue stopping. [6]

Error: (05/26/2015 06:35:40 PM) (Source: VSS) (EventID: 8193) (User: )
Description: Volume Shadow Copy Service error: Unexpected error calling routine CoCreateInstance.  hr = 0x80040154, Class not registered
.


Operation:
   Instantiating VSS server


System errors:
=============
Error: (05/28/2015 00:07:30 AM) (Source: DCOM) (EventID: 10010) (User: HongHoangPC)
Description: {1B1F472E-3221-4826-97DB-2C2324D389AE}

Error: (05/28/2015 00:07:00 AM) (Source: DCOM) (EventID: 10010) (User: HongHoangPC)
Description: {BF6C1E47-86EC-4194-9CE5-13C15DCB2001}

Error: (05/28/2015 00:01:25 AM) (Source: DCOM) (EventID: 10010) (User: HongHoangPC)
Description: {1B1F472E-3221-4826-97DB-2C2324D389AE}

Error: (05/28/2015 00:00:46 AM) (Source: DCOM) (EventID: 10010) (User: HongHoangPC)
Description: {BF6C1E47-86EC-4194-9CE5-13C15DCB2001}

Error: (05/27/2015 11:56:16 PM) (Source: DCOM) (EventID: 10010) (User: HongHoangPC)
Description: {1B1F472E-3221-4826-97DB-2C2324D389AE}

Error: (05/27/2015 11:55:37 PM) (Source: DCOM) (EventID: 10010) (User: HongHoangPC)
Description: {BF6C1E47-86EC-4194-9CE5-13C15DCB2001}

Error: (05/27/2015 11:48:16 PM) (Source: DCOM) (EventID: 10010) (User: HongHoangPC)
Description: {1B1F472E-3221-4826-97DB-2C2324D389AE}

Error: (05/27/2015 11:47:36 PM) (Source: DCOM) (EventID: 10010) (User: HongHoangPC)
Description: {BF6C1E47-86EC-4194-9CE5-13C15DCB2001}

Error: (05/27/2015 11:10:25 PM) (Source: DCOM) (EventID: 10010) (User: HongHoangPC)
Description: {1B1F472E-3221-4826-97DB-2C2324D389AE}

Error: (05/27/2015 11:09:44 PM) (Source: DCOM) (EventID: 10010) (User: HongHoangPC)
Description: {BF6C1E47-86EC-4194-9CE5-13C15DCB2001}


Microsoft Office:
=========================
Error: (05/27/2015 08:28:22 PM) (Source: NvStreamSvc) (EventID: 2001) (User: )
Description: NvStreamSvcFailed continue stopping. [5]

Error: (05/27/2015 07:04:24 PM) (Source: NvStreamSvc) (EventID: 2001) (User: )
Description: NvStreamSvcFailed continue stopping. [6]

Error: (05/27/2015 06:55:22 PM) (Source: NvStreamSvc) (EventID: 2001) (User: )
Description: NvStreamSvcFailed continue stopping. [0]

Error: (05/27/2015 05:01:26 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: defraggler64.exe2.18.0.945534528eadbghelp.dll_unloaded6.3.9600.17787551b69cac00000050000000000113a70171401d0984af3376023C:\Program Files\Defraggler\defraggler64.exedbghelp.dll30e64e57-043e-11e5-82d4-7824afb1d22b

Error: (05/27/2015 04:17:57 PM) (Source: NvStreamSvc) (EventID: 2001) (User: )
Description: NvStreamSvcFailed continue stopping. [0]

Error: (05/27/2015 05:48:26 AM) (Source: NvStreamSvc) (EventID: 2001) (User: )
Description: NvStreamSvcFailed continue stopping. [0]

Error: (05/26/2015 08:22:37 PM) (Source: NvStreamSvc) (EventID: 2001) (User: )
Description: NvStreamSvcFailed continue stopping. [5]

Error: (05/26/2015 08:03:08 PM) (Source: NvStreamSvc) (EventID: 2001) (User: )
Description: NvStreamSvcFailed continue stopping. [6]

Error: (05/26/2015 07:40:12 PM) (Source: NvStreamSvc) (EventID: 2001) (User: )
Description: NvStreamSvcFailed continue stopping. [6]

Error: (05/26/2015 06:35:40 PM) (Source: VSS) (EventID: 8193) (User: )
Description: CoCreateInstance0x80040154, Class not registered


Operation:
   Instantiating VSS server


CodeIntegrity Errors:
===================================
  Date: 2015-05-17 02:43:02.789
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\SysWOW64\drivers\DrvAgent64.SYS because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2015-05-17 02:43:02.723
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\SysWOW64\drivers\DrvAgent64.SYS because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2015-05-17 02:43:02.658
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\SysWOW64\drivers\DrvAgent64.SYS because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2015-05-17 02:43:02.595
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\SysWOW64\drivers\DrvAgent64.SYS because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2015-05-17 02:43:02.527
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\SysWOW64\drivers\DrvAgent64.SYS because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2015-05-17 02:43:02.462
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\SysWOW64\drivers\DrvAgent64.SYS because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2015-05-17 02:43:02.397
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\SysWOW64\drivers\DrvAgent64.SYS because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2015-05-17 02:43:02.333
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\SysWOW64\drivers\DrvAgent64.SYS because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2015-05-17 02:42:58.259
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\SysWOW64\drivers\DrvAgent64.SYS because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2015-05-17 02:42:58.195
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\SysWOW64\drivers\DrvAgent64.SYS because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.


==================== Memory info ===========================

Processor: Intel® Core™ i7-4710HQ CPU @ 2.50GHz
Percentage of memory in use: 28%
Total physical RAM: 8075.06 MB
Available physical RAM: 5808.31 MB
Total Pagefile: 8587.06 MB
Available Pagefile: 6043.32 MB
Total Virtual: 131072 MB
Available Virtual: 131071.78 MB

==================== Drives ================================

Drive c: (OS) (Fixed) (Total:72.6 GB) (Free:22.92 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive d: (DucHong) (Fixed) (Total:418.9 GB) (Free:298.56 GB) NTFS
Drive e: (Miscellaneous) (Fixed) (Total:300 GB) (Free:80.84 GB) NTFS
Drive f: (Misc.2) (Fixed) (Total:118.9 GB) (Free:96.35 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 931.5 GB) (Disk ID: EE7E28CB)

Partition: GPT Partition Type.

==================== End of log ============================

 

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 27-05-2015
Ran by Duc Hong at 2015-05-28 00:09:28
Running from C:\Users\Duc Hong\Downloads\Programs
Boot Mode: Normal
==========================================================
 
 
==================== Accounts: =============================
 
Administrator (S-1-5-21-1926068397-2398490202-140176465-500 - Administrator - Disabled)
Duc Hong (S-1-5-21-1926068397-2398490202-140176465-1002 - Administrator - Enabled) => C:\Users\Duc Hong
Guest (S-1-5-21-1926068397-2398490202-140176465-501 - Limited - Disabled)
 
==================== Security Center ========================
 
(If an entry is included in the fixlist, it will be removed.)
 
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
 
==================== Installed Programs ======================
 
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
 
µTorrent (HKLM-x32\...\uTorrent) (Version: 3.2.3.28705 - BitTorrent Inc.)
7-Zip 9.38 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0938-000001000000}) (Version: 9.38.00.0 - Igor Pavlov)
Adobe Flash Player 16 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 16.0.0.235 - Adobe Systems Incorporated)
Apple Application Support (32-bit) (HKLM-x32\...\{2FE00055-C4F3-4F7A-AEDD-E198D54CF12F}) (Version: 3.1.1 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{19DED56B-657D-41DA-9EB0-7C20DDF6A613}) (Version: 8.1.0.18 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
ASUS Console (HKLM\...\{6D989E08-8143-4AB8-B0A8-5B836235CAA4}) (Version: 1.0.5 - ASUS)
Asus FaceID (HKLM-x32\...\{C4071085-DDF0-403F-90F9-27582FC22C9B}) (Version: 7.7.6.1 - ASUS)
ASUS Instant Key (HKLM-x32\...\{D97A1B80-131F-4692-9543-E652956D8B99}) (Version: 1.1.7 - ASUS)
ASUS Live Update (HKLM-x32\...\{FA540E67-095C-4A1B-97BA-4D547DEC9AF4}) (Version: 3.3.4 - ASUS)
ASUS Power4Gear Hybrid (HKLM\...\{9B6239BF-4E85-4590-8D72-51E30DB1A9AA}) (Version: 3.0.8 - ASUS)
ASUS Smart Gesture (HKLM-x32\...\{4D3286A6-F6AB-498A-82A4-E4F040529F3D}) (Version: 2.2.10 - ASUS)
ASUS Splendid Video Enhancement Technology (HKLM-x32\...\{0969AF05-4FF6-4C00-9406-43599238DE0D}) (Version: 2.01.0021 - ASUS)
ATK Package (HKLM-x32\...\{AB5C933E-5C7D-4D30-B314-9C83A49B94BE}) (Version: 1.0.0031 - ASUS)
ATLAS Translation Standard V14.0 Trial Version (HKLM-x32\...\{6652750B-AA69-49B7-9D09-C0A28B6FFC9F}) (Version: 14.00.2000 - FUJITSU LIMITED)
Auslogics DiskDefrag (HKLM-x32\...\{DF6A13C0-77DF-41FE-BD05-6D5201EB0CE7}_is1) (Version: 5.4.0.0 - Auslogics Labs Pty Ltd)
Avast Free Antivirus (HKLM-x32\...\Avast) (Version: 10.2.2218 - AVAST Software)
Avidemux 2.6 - 64bits (HKLM-x32\...\Avidemux 2.6 - 64bits (64-bit)) (Version: 2.6.9.00 - )
BatteryBar (remove only) (HKLM\...\BatteryBar) (Version:  - )
Bluefish 2.2.7 (HKLM-x32\...\Bluefish) (Version: 2.2.7 - The Bluefish Developers)
BlueJ (HKLM-x32\...\{7D66971C-652B-4065-A6B1-B3EE313C254B}) (Version: 3.1.4 - BlueJ Team)
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
CCleaner (HKLM\...\CCleaner) (Version: 5.06 - Piriform)
CodeBlocks (HKU\S-1-5-21-1926068397-2398490202-140176465-1002\...\CodeBlocks) (Version: 13.12 - The Code::Blocks Team)
Color Cop 5.4.3 (HKLM-x32\...\Color Cop_is1) (Version:  - Jay Prall)
Command & Conquer™ Red Alert™ 3 (HKLM\...\{296D8550-CB06-48E4-9A8B-E5034FB64715}) (Version: 1.0.1.0 - Electronic Arts)
Command & Conquer™ Red Alert™ 3 (HKLM-x32\...\{296D8550-CB06-48E4-9A8B-E5034FB64715}) (Version: 1.0.1.0 - Electronic Arts)
Counter-Strike: Global Offensive (HKLM-x32\...\Steam App 730) (Version:  - Valve)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
DAEMON Tools Lite (HKLM-x32\...\DAEMON Tools Lite) (Version: 4.49.1.0356 - Disc Soft Ltd)
Defraggler (HKLM\...\Defraggler) (Version: 2.19 - Piriform)
Everything 1.3.4.686 (x64) (HKLM\...\Everything) (Version:  - )
Explorer Suite IV (HKLM\...\Explorer Suite_is1) (Version:  - )
FarCry 4 (HKLM-x32\...\Uplay Install 420) (Version:  - Ubisoft)
FileHippo App Manager (HKLM-x32\...\FileHippo.com) (Version:  - FileHippo.com)
Foxit PhantomPDF Business (HKLM-x32\...\{8A601904-4113-40FE-9DCC-7A38CE1A8032}) (Version: 7.0.6.1126 - Foxit Software Inc.)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 43.0.2357.81 - Google Inc.)
Google Talk Plugin (HKLM-x32\...\{CA3DD97D-1FD7-37A7-BD5C-FC4430C8B8E6}) (Version: 5.41.2.0 - Google)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.27.5 - Google Inc.) Hidden
HandBrake 0.10.1 (HKLM-x32\...\HandBrake) (Version: 0.10.1 - )
HD Tune Pro 5.50 (HKLM-x32\...\HD Tune Pro_is1) (Version:  - EFD Software)
Intel® Driver Update Utility 2.0 (x32 Version: 2.0.0.29 - Intel) Hidden
Intel® Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 9.5.14.1724 - Intel Corporation)
Intel® Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.3355 - Intel Corporation)
Intel® Wireless Bluetooth®(patch version 17.1.1449.356) (HKLM\...\{302600C1-6BDF-4FD1-1411-148929CC1385}) (Version: 17.1.1411.0506 - Intel Corporation)
Intel® Driver Update Utility (HKLM-x32\...\{8409c4f7-2340-4933-a304-5d37db4fb48b}) (Version: 2.0.0.29 - Intel)
Intel® PROSet/Wireless Software (HKLM-x32\...\{a9888f41-68ae-43df-bd7d-d93405a44106}) (Version: 17.13.11 - Intel Corporation)
Internet Download Manager (HKLM-x32\...\Internet Download Manager) (Version:  - Tonec Inc.)
IrfanView (remove only) (HKLM-x32\...\IrfanView) (Version: 4.38 - Irfan Skiljan)
iTunes (HKLM\...\{2EA80E9F-C811-41BB-ABAC-F270B4B39BC6}) (Version: 12.1.0.71 - Apple Inc.)
Java 8 Update 45 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86418045F0}) (Version: 8.0.450 - Oracle Corporation)
Java 8 Update 45 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218045F0}) (Version: 8.0.450 - Oracle Corporation)
Java SE Development Kit 8 Update 40 (64-bit) (HKLM\...\{64A3A4F4-B792-11D6-A78A-00B0D0180400}) (Version: 8.0.400.26 - Oracle Corporation)
Junk Mail filter update (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
K-Lite Codec Pack 11.0.8 Full (HKLM-x32\...\KLiteCodecPack_is1) (Version: 11.0.8 - )
Malwarebytes Anti-Malware version 2.1.6.1022 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.1.6.1022 - Malwarebytes Corporation)
MediaCoder x64 0.8.34.5716 (HKLM\...\MediaCoder x64) (Version: 0.8.34.5716 - Mediatronic)
Microsoft ASP.NET MVC 4 Runtime (HKLM-x32\...\{3FE312D5-B862-40CE-8E4E-A6D8ABF62736}) (Version: 4.0.40804.0 - Microsoft Corporation)
Microsoft Office Professional Plus 2010 (HKLM\...\Office14.PROPLUS) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft OneDrive (HKU\S-1-5-21-1926068397-2398490202-140176465-1002\...\OneDriveSetup.exe) (Version: 17.0.4035.0328 - Microsoft Corporation)
Microsoft Outlook Hotmail Connector 64-bit (HKLM\...\{95140000-007A-0409-1000-0000000FF1CE}) (Version: 14.0.5118.5000 - Microsoft Corporation)
Microsoft Outlook Social Connector Provider for Windows Live Messenger 64-bit (HKLM\...\{95140000-007D-0409-1000-0000000FF1CE}) (Version: 14.0.5120.5000 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.40416.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visio Professional 2010 (HKLM\...\Office14.VISIOR) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 Redistributable - x64 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 Redistributable - x86 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\...\{ce085a78-074e-4823-8dc1-8a721b94b76d}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
Movie Maker (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Mozilla Firefox 37.0.1 (x86 en-US) (HKLM-x32\...\Mozilla Firefox 37.0.1 (x86 en-US)) (Version: 37.0.1 - Mozilla)
Mozilla Firefox 38.0.1 (x86 en-US) (HKU\S-1-5-21-1926068397-2398490202-140176465-1002\...\Mozilla Firefox 38.0.1 (x86 en-US)) (Version: 38.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 36.0.3 - Mozilla)
MyDefrag v4.3.1 (HKLM\...\MyDefrag v4.3.1_is1) (Version: 4.0.0.0 - J.C. Kessels)
NEKOPARA vol.1 (HKU\S-1-5-21-1926068397-2398490202-140176465-1002\...\{64DC04AF-BD7C-4CF4-9CA4-938953224328}) (Version:  - NEKO WORKs)
Notepad++ (HKLM-x32\...\Notepad++) (Version: 6.7.8.2 - Notepad++ Team)
NVIDIA GeForce Experience 2.4.3.22 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 2.4.3.22 - NVIDIA Corporation)
NVIDIA Graphics Driver 350.05 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 350.05 - NVIDIA Corporation)
NVIDIA PhysX System Software 9.15.0324 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.15.0324 - NVIDIA Corporation)
Oracle VM VirtualBox 4.3.28 (HKLM\...\{E8BB81BC-E67C-4750-84EE-128DA5A7ADA5}) (Version: 4.3.28 - Oracle Corporation)
Potplayer (HKLM-x32\...\PotPlayer) (Version:  - Daum Kakao Corp.)
Rainmeter (HKLM-x32\...\Rainmeter) (Version: 3.2.1 r2386 - )
Realtek Card Reader (HKLM-x32\...\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}) (Version: 6.2.9200.39048 - Realtek Semiconductor Corp.)
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 8.20.815.2013 - Realtek)
Revo Uninstaller Pro 3.0.2 (HKLM\...\{67579783-0FB7-4F7B-B881-E5BE47C9DBE0}_is1) (Version: 3.0.2 - VS Revo Group, Ltd.)
RW-Everything v1.6.5.9 (HKLM\...\RW-Everything_is1) (Version:  - )
Service Pack 2 for Microsoft Office 2010 (KB2687455) 64-Bit Edition (HKLM\...\{90140000-0011-0000-1000-0000000FF1CE}_Office14.PROPLUS_{A3364707-2F53-4C83-8F68-C9877A9080C7}) (Version:  - Microsoft)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 64-Bit Edition (HKLM\...\{91140000-0057-0000-1000-0000000FF1CE}_Office14.VISIOR_{3C578F10-F74F-4655-B2A6-9F88A6C415E8}) (Version:  - Microsoft)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 64-Bit Edition (Version:  - Microsoft) Hidden
SHIELD Streaming (Version: 4.1.1000 - NVIDIA Corporation) Hidden
SHIELD Wireless Controller Driver (Version: 2.4.3.22 - NVIDIA Corporation) Hidden
Sid Meier's Civilization V (HKLM-x32\...\Steam App 8930) (Version:  - 2K Games, Inc.)
Skype Click to Call (HKLM-x32\...\{6D1221A9-17BF-4EC0-81F2-27D30EC30701}) (Version: 7.3.16540.9015 - Microsoft Corporation)
Skype™ 7.4 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.4.102 - Skype Technologies S.A.)
SoftEther VPN Client (HKLM\...\softether_sevpnclient) (Version: 4.12.9514 - SoftEther VPN Project)
Speccy (HKLM\...\Speccy) (Version: 1.28 - Piriform)
Spotify (HKU\S-1-5-21-1926068397-2398490202-140176465-1002\...\Spotify) (Version: 1.0.3.101.gbfa97dfe - Spotify AB)
Steam (HKLM-x32\...\Steam) (Version: 2.10.91.91 - Valve Corporation)
Synei System Utilities (HKLM-x32\...\{BFDC3B26-7DB0-43D3-BC84-7E9649C157EA}_is1) (Version: 2.25 - Synei)
System Requirements Lab (HKLM-x32\...\{0F659036-14C7-4622-9505-35A0DC93526A}) (Version: 6.1.3.0 - Husdawg, LLC)
Team Fortress 2 (HKLM-x32\...\Steam App 440) (Version:  - Valve)
TeraCopy 2.3 (HKLM\...\TeraCopy_is1) (Version:  - Code Sector)
The Elder Scrolls V: Skyrim (HKLM-x32\...\Steam App 72850) (Version:  - Bethesda Game Studios)
The Witcher 2: Assassins of Kings Enhanced Edition (HKLM-x32\...\Steam App 20920) (Version:  - CD PROJEKT RED)
Unity Web Player (HKU\S-1-5-21-1926068397-2398490202-140176465-1002\...\UnityWebPlayer) (Version: 5.0.2f1 - Unity Technologies ApS)
Unlocker 1.9.2 (HKLM\...\Unlocker) (Version: 1.9.2 - Cedrick Collomb)
Update for Japanese Microsoft IME Postal Code Dictionary (HKLM-x32\...\{15015752-9990-4516-A2B1-93823281FB8E}) (Version: 15.0.1759 - Microsoft Corporation)
Update for Japanese Microsoft IME Standard Dictionary (HKLM-x32\...\{7DB71278-9AD7-4480-AB08-8649C5010B17}) (Version: 15.0.1215 - Microsoft Corporation)
Update for Japanese Microsoft IME Standard Extended Dictionary (HKLM-x32\...\{78CE66A9-85AF-4BD8-8FB7-35B5F3846C00}) (Version: 15.0.1215 - Microsoft Corporation)
Uplay (HKLM-x32\...\Uplay) (Version: 4.8 - Ubisoft)
VMware Player (HKLM-x32\...\VMware_Player) (Version: 7.1.0 - VMware, Inc)
VMware Player (Version: 7.1.0 - VMware, Inc.) Hidden
Warframe (HKLM-x32\...\Steam App 230410) (Version:  - Digital Extremes)
WebStorage (HKLM-x32\...\WebStorage) (Version: 2.1.2.301 - ASUS Cloud Corporation)
Windows Driver Package - ASUS (ATP) Mouse  (01/07/2014 1.0.0.197) (HKLM\...\2BEE838DC3D664A0CAB23AEA0332BB3877ED0685) (Version: 01/07/2014 1.0.0.197 - ASUS)
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3528.0331 - Microsoft Corporation)
WinFlash (HKLM-x32\...\{8F21291E-0444-4B1D-B9F9-4370A73E346D}) (Version: 2.42.0 - ASUS)
WinPcap 4.1.3 (HKLM-x32\...\WinPcapInst) (Version: 4.1.0.2980 - Riverbed Technology, Inc.)
WinRAR 5.20 (64-bit) (HKLM\...\WinRAR archiver) (Version: 5.20.0 - win.rar GmbH)
Wireshark 1.12.5 (64-bit) (HKLM-x32\...\Wireshark) (Version: 1.12.5 - The Wireshark developer community, http://www.wireshark.org)
 
==================== Custom CLSID (Whitelisted): ==========================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
CustomCLSID: HKU\S-1-5-21-1926068397-2398490202-140176465-1002_Classes\CLSID\{1423F872-3F7F-4E57-B621-8B1A9D49B448}\InprocServer32 -> C:\Users\Duc Hong\AppData\Local\Google\Update\1.3.27.5\psuser_64.dll (Google Inc.)
CustomCLSID: HKU\S-1-5-21-1926068397-2398490202-140176465-1002_Classes\CLSID\{E8CF3E55-F919-49D9-ABC0-948E6CB34B9F}\InprocServer32 -> C:\Users\Duc Hong\AppData\Local\Google\Update\1.3.27.5\psuser_64.dll (Google Inc.)
CustomCLSID: HKU\S-1-5-21-1926068397-2398490202-140176465-1002_Classes\CLSID\{F8071786-1FD0-4A66-81A1-3CBE29274458}\InprocServer32 -> C:\Users\Duc Hong\AppData\Local\Microsoft\SkyDrive\17.0.4035.0328\amd64\FileSyncApi64.dll (Microsoft Corporation)
 
==================== Restore Points =========================
 
26-05-2015 15:59:24 Windows Live Essentials
26-05-2015 16:01:59 WLSetup
 
==================== Hosts content: ===============================
 
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
 
2013-08-22 23:25 - 2015-02-11 01:00 - 00000793 ____A C:\Windows\system32\Drivers\etc\hosts
 
==================== Scheduled Tasks (Whitelisted) =============
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
Task: {0672CE47-9AF2-49B5-BA4A-D987C76AF085} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1926068397-2398490202-140176465-1002UA => C:\Users\Duc Hong\AppData\Local\Google\Update\GoogleUpdate.exe [2015-04-17] (Google Inc.)
Task: {0B01FB0E-B462-46B8-816C-2444A6441DB3} - System32\Tasks\ASUS Smart Gesture Launcher => C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPLauncher.exe [2014-02-14] (AsusTek)
Task: {1BAF89D5-B76F-48CA-B114-034B69480F29} - System32\Tasks\ASUS Splendid ColorU => C:\Program Files (x86)\ASUS\Splendid\ColorUService.exe [2013-10-08] (ASUSTeK Computer Inc.)
Task: {1EB54610-9F30-42C5-93C1-9B6CBD358D7E} - System32\Tasks\RTKCPL => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [2014-05-20] (Realtek Semiconductor)
Task: {31E03131-2908-43E9-AE6D-CD1AC82DAD2F} - System32\Tasks\ASUS Console => C:\Program Files\ASUS\ASUS Console\ASUS Console Starter.exe [2014-02-07] (ASUSTek Computer Inc.)
Task: {4E3FDD62-EABC-414B-8FBD-DBA444C5CA8A} - System32\Tasks\Microsoft\Windows\Setup\gwx\refreshgwxconfig => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-05-06] (Microsoft Corporation)
Task: {760AE585-4971-4AD2-AFC4-DEA14F01B495} - System32\Tasks\Microsoft\Windows\Setup\gwx\launchtrayprocess => C:\Windows\system32\GWX\GWX.exe [2015-05-06] (Microsoft Corporation)
Task: {766E80C1-FFF8-4F47-8FC3-4E533BAE0AC1} - System32\Tasks\Update Checker => C:\Program Files (x86)\ASUS\ASUS Live Update\UpdateChecker.exe [2015-02-12] ()
Task: {82F04444-7113-4278-B8C4-51A59E6C29E4} - System32\Tasks\RtHDVBg => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [2014-05-13] (Realtek Semiconductor)
Task: {9D746130-D7A9-4BB8-8E96-05093DEF9977} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1926068397-2398490202-140176465-1002Core => C:\Users\Duc Hong\AppData\Local\Google\Update\GoogleUpdate.exe [2015-04-17] (Google Inc.)
Task: {A508D830-687E-41AA-AF60-8916D26EAEBF} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2015-05-09] (Piriform Ltd)
Task: {B0F0CAF5-E8BC-45C2-B67C-9C12294AF136} - System32\Tasks\AutoKMS => C:\Windows\AutoKMS\AutoKMS.exe [2015-01-08] ()
Task: {B905D56A-7E45-4939-90F9-416CB290E620} - System32\Tasks\AsusVibeSchedule => C:\Program Files (x86)\Asus\AsusVibe\AsusVibeLauncher.exe
Task: {BFBCA901-B92C-49C8-A07C-57F94EC4BD4A} - System32\Tasks\ASUS Live Update1 => C:\Program Files (x86)\ASUS\ASUS Live Update\LiveUpdate.exe [2015-03-23] (ASUSTeK Computer Inc.)
Task: {CB4E97FF-DC08-4AE9-B101-6EC041501D17} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\Windows\system32\MRT.exe [2015-05-18] (Microsoft Corporation)
Task: {CE71F3E1-DE1E-4B42-A816-09F806D6EAFE} - System32\Tasks\Microsoft OneDrive Auto Update Task-S-1-5-21-1926068397-2398490202-140176465-1002 => %localappdata%\Microsoft\SkyDrive\SkyDrive.exe
Task: {D54DEED3-1E09-43DD-A0D7-2534D4F95BFB} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-01-08] (Google Inc.)
Task: {EA345886-3FBF-4930-8FE1-DEAE05BA0372} - System32\Tasks\ASUS Splendid ACMON => C:\Program Files (x86)\ASUS\Splendid\ACMON.exe [2013-10-08] (ASUS)
Task: {F6441995-B4CF-4A06-BBE6-5BE2EE55D8EA} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2015-05-01] (Avast Software s.r.o.)
Task: {F87A5893-944C-45F8-AF4F-42245D864FF7} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-01-08] (Google Inc.)
Task: C:\Windows\Tasks\AutoKMS.job => C:\Windows\AutoKMS\AutoKMS.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1926068397-2398490202-140176465-1002Core.job => C:\Users\Duc Hong\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1926068397-2398490202-140176465-1002UA.job => C:\Users\Duc Hong\AppData\Local\Google\Update\GoogleUpdate.exe
 
==================== Loaded Modules (Whitelisted) ==============
 
2015-02-20 08:01 - 2015-02-20 08:01 - 00022528 _____ () C:\Windows\System32\us001lm.dll
2014-07-12 09:01 - 2013-08-27 09:29 - 00755728 _____ () C:\Windows\SYSTEM32\sqlite3.dll
2015-04-26 23:21 - 2015-04-02 17:19 - 00117392 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2013-09-04 23:17 - 2013-09-04 23:17 - 04300456 _____ () C:\Program Files\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF
2010-10-20 14:23 - 2010-10-20 14:23 - 08801632 _____ () C:\Program Files\Microsoft Office\Office14\1033\GrooveIntlResource.dll
2015-03-24 23:28 - 2015-03-24 23:28 - 00036544 _____ () C:\Program Files\Rainmeter\Rainmeter.exe
2015-03-24 23:28 - 2015-03-24 23:28 - 00775872 _____ () C:\Program Files\Rainmeter\Rainmeter.dll
2015-03-24 23:28 - 2015-03-24 23:28 - 00022528 _____ () C:\Program Files\Rainmeter\Plugins\InputText.dll
2015-03-24 23:27 - 2015-03-24 23:27 - 00011776 _____ () C:\Program Files\Rainmeter\Plugins\PowerPlugin.DLL
2015-03-24 23:27 - 2015-03-24 23:27 - 00022016 _____ () C:\Program Files\Rainmeter\Plugins\WifiStatus.DLL
2015-03-24 23:27 - 2015-03-24 23:27 - 00020992 _____ () C:\Program Files\Rainmeter\Plugins\SysInfo.DLL
2015-03-24 23:27 - 2015-03-24 23:27 - 00058368 _____ () C:\Program Files\Rainmeter\Plugins\WebParser.DLL
2015-03-24 23:27 - 2015-03-24 23:27 - 00023040 _____ () C:\Program Files\Rainmeter\Plugins\Win7AudioPlugin.DLL
2010-07-15 14:44 - 2010-07-15 14:44 - 00020032 _____ () C:\Program Files\Unlocker\UnlockerCOM.dll
2015-04-16 06:13 - 2015-04-16 06:13 - 00222720 _____ () C:\Program Files (x86)\Notepad++\NppShell_06.dll
2015-05-01 16:28 - 2015-05-01 16:28 - 00104400 _____ () C:\Program Files\AVAST Software\Avast\log.dll
2015-05-01 16:28 - 2015-05-01 16:28 - 00081728 _____ () C:\Program Files\AVAST Software\Avast\JsonRpcServer.dll
2015-05-26 23:07 - 2015-05-26 23:07 - 02948096 _____ () C:\Program Files\AVAST Software\Avast\defs\15052600\algo.dll
2015-01-20 21:35 - 2015-01-20 21:35 - 00073544 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2015-01-20 21:35 - 2015-01-20 21:35 - 01044776 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2015-02-06 17:40 - 2015-02-06 17:40 - 01301696 _____ () C:\Program Files (x86)\VMware\VMware Player\libxml2.dll
2014-07-12 08:47 - 2013-09-04 09:52 - 01242584 _____ () C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\ACE.dll
2013-09-10 11:23 - 2013-09-10 11:23 - 00162816 _____ () C:\Program Files (x86)\ASUS\Splendid\CCTAdjust.dll
2013-10-09 13:41 - 2013-10-09 13:41 - 00037968 _____ () C:\Program Files (x86)\ASUS\Splendid\DetectDisplayDC.dll
2015-04-26 23:22 - 2015-05-02 02:52 - 00011920 _____ () C:\Program Files (x86)\NVIDIA Corporation\Update Core\detoured.dll
2015-03-20 15:31 - 2015-03-20 15:31 - 40540672 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll
2013-04-27 10:24 - 2013-04-27 10:24 - 00071680 _____ () C:\Program Files (x86)\ASUS\ASUS Live Update\checkmetro.dll
 
==================== Alternate Data Streams (Whitelisted) =========
 
(If an entry is included in the fixlist, only the ADS will be removed.)
 
 
==================== Safe Mode (Whitelisted) ===================
 
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
 
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcpltsvc => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcpltsvc => ""=""
 
==================== EXE Association (Whitelisted) ===============
 
(If an entry is included in the fixlist, the registry item will be restored to default or removed.)
 
 
==================== Internet Explorer trusted/restricted ===============
 
(If an entry is included in the fixlist, it will be removed from the registry.)
 
 
==================== Other Areas ============================
 
(Currently there is no automatic fix for this section.)
 
HKU\S-1-5-21-1926068397-2398490202-140176465-1002\Control Panel\Desktop\\Wallpaper -> C:\Users\Duc Hong\AppData\Roaming\IrfanView\IrfanView_Wallpaper.bmp
DNS Servers: 192.168.1.1
 
==================== MSCONFIG/TASK MANAGER disabled items ==
 
(Currently there is no automatic fix for this section.)
 
HKLM\...\StartupApproved\StartupFolder: => "SoftEther VPN Client Manager Startup.lnk"
HKLM\...\StartupApproved\Run: => "ShadowPlay"
HKLM\...\StartupApproved\Run32: => "ASUSPRP"
HKLM\...\StartupApproved\Run32: => "WebStorage"
HKU\S-1-5-21-1926068397-2398490202-140176465-1002\...\StartupApproved\Run: => "FlashPlayerUpdate"
HKU\S-1-5-21-1926068397-2398490202-140176465-1002\...\StartupApproved\Run: => "Google Update"
HKU\S-1-5-21-1926068397-2398490202-140176465-1002\...\StartupApproved\Run: => "DevidAgent"
 
==================== FirewallRules (Whitelisted) ===============
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139
FirewallRules: [Daum PotPlayer(PotPlayerMini.exe)] => (Allow) C:\Program Files (x86)\DAUM\PotPlayer\PotPlayerMini.exe
FirewallRules: [{6AD7A4C1-520C-4938-83E9-8C3D4AF4470B}] => (Allow) C:\Program Files (x86)\DAUM\PotPlayer\PotPlayerMini.exe
FirewallRules: [TCP Query User{B408D18C-6D03-4CC8-9E8F-41FF22643530}C:\windows\microsoft.net\framework\v2.0.50727\vbc.exe] => (Allow) C:\windows\microsoft.net\framework\v2.0.50727\vbc.exe
FirewallRules: [UDP Query User{A1BDE586-1E5F-4E70-83A1-C3724D86FBEA}C:\windows\microsoft.net\framework\v2.0.50727\vbc.exe] => (Allow) C:\windows\microsoft.net\framework\v2.0.50727\vbc.exe
FirewallRules: [{46831999-F626-41E8-A1AB-F3130E61A535}] => (Allow) E:\Temp\Steam\Steam.exe
FirewallRules: [{24C0EBEB-6AAB-4281-B843-FC830B4FEB52}] => (Allow) E:\Temp\Steam\Steam.exe
FirewallRules: [{AED3302F-B17D-4701-9390-ED277A47C947}] => (Allow) E:\Temp\Steam\steamapps\common\Skyrim\SkyrimLauncher.exe
FirewallRules: [{259FAB07-4841-4498-8702-1C73EE758BF7}] => (Allow) E:\Temp\Steam\steamapps\common\Skyrim\SkyrimLauncher.exe
FirewallRules: [{F2D50447-ADCB-4ACF-A732-83AA56A4E7A9}] => (Allow) C:\Program Files\SoftEther VPN Client\vpnclient_x64.exe
FirewallRules: [{332E3FF6-209A-48A4-A6EC-7423A11D35B6}] => (Allow) C:\Program Files\SoftEther VPN Client\vpncmgr.exe
FirewallRules: [{8284D947-F7E8-4B89-A26F-A0AD5FD80F82}] => (Allow) C:\Program Files\SoftEther VPN Client\vpncmd_x64.exe
FirewallRules: [{A44E3BA8-FD16-4235-9303-E17CA8FF8D6D}] => (Allow) C:\Program Files\SoftEther VPN Client\vpncmgr_x64.exe
FirewallRules: [{5647D39A-F124-4953-ACEC-254F04260C4D}] => (Allow) C:\Program Files\SoftEther VPN Client\vpnclient.exe
FirewallRules: [{BB5EAF98-68DC-4481-BDA2-0F92653D1BE9}] => (Allow) C:\Program Files\SoftEther VPN Client\vpncmd.exe
FirewallRules: [SPPSVC-In-TCP] => (Allow) %SystemRoot%\system32\sppextcomobj.exe
FirewallRules: [SPPSVC-In-TCP-NoScope] => (Allow) %SystemRoot%\system32\sppextcomobj.exe
FirewallRules: [{2BFDCA10-D873-4098-A023-AF8A8D52659D}] => (Allow) C:\Users\Duc Hong\AppData\Roaming\Spotify\spotify.exe
FirewallRules: [{95AFAF81-213D-48BB-9D2E-9FC489C69485}] => (Allow) C:\Users\Duc Hong\AppData\Roaming\Spotify\spotify.exe
FirewallRules: [{E419D7CD-9FEB-40AD-8036-CEF8EE2A3E58}] => (Allow) C:\Program Files (x86)\uTorrent\uTorrent.exe
FirewallRules: [{7EB67D77-8A9B-425E-8A9D-556828BD9F2A}] => (Allow) C:\Program Files (x86)\uTorrent\uTorrent.exe
FirewallRules: [{E7314D54-19FD-4376-952A-C283F866565A}] => (Allow) E:\Temp\Steam\steamapps\common\Team Fortress 2\hl2.exe
FirewallRules: [{A9537D58-5E28-443C-9DF3-773B75BE8B9C}] => (Allow) E:\Temp\Steam\steamapps\common\Team Fortress 2\hl2.exe
FirewallRules: [{5405FDE4-13D9-46A4-BA72-2C3D637A820A}] => (Allow) E:\Temp\Steam\steamapps\common\Sid Meier's Civilization V\Launcher.exe
FirewallRules: [{4D112B3C-965E-4D2B-8A4C-A3BC7790EB24}] => (Allow) E:\Temp\Steam\steamapps\common\Sid Meier's Civilization V\Launcher.exe
FirewallRules: [{57563CA2-4C58-4DB6-A9D8-63CCEE8D3D58}] => (Allow) C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe
FirewallRules: [{EECB906E-0A72-4349-ABC2-51F722808688}] => (Allow) C:\Program Files (x86)\VMware\VMware Player\vmware-authd.exe
FirewallRules: [{E113D9E6-3F09-4DFD-9AE0-63C1DDFBFF5F}] => (Allow) C:\Program Files (x86)\VMware\VMware Player\vmware-authd.exe
FirewallRules: [TCP Query User{D2BD56E1-FECA-4760-BFF6-7B483CFCD029}C:\program files (x86)\mozilla firefox\firefox.exe] => (Allow) C:\program files (x86)\mozilla firefox\firefox.exe
FirewallRules: [UDP Query User{31909EE8-B773-4D7F-8A9B-F43C433277C1}C:\program files (x86)\mozilla firefox\firefox.exe] => (Allow) C:\program files (x86)\mozilla firefox\firefox.exe
FirewallRules: [{D584DDB2-8E7C-45B2-828F-ACE4C55E5EEF}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{0E7DD122-51EE-4061-BA2E-AC6519ACC2AD}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{55B30F08-3CE8-40C4-A149-EC7C5462450F}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{6A093041-DBDC-47C2-A540-CFBC73668DB9}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{2E92677B-4DF7-48B8-A955-03BC56D592A8}] => (Allow) C:\Program Files (x86)\iTunes\iTunes.exe
FirewallRules: [{C61C7218-4C30-48CF-A3C2-6D208730DCEE}] => (Allow) C:\Users\Duc Hong\AppData\Roaming\Spotify\spotify.exe
FirewallRules: [{0CB55171-3C48-4165-B73A-D3D703E0BF74}] => (Allow) C:\Users\Duc Hong\AppData\Roaming\Spotify\spotify.exe
FirewallRules: [{62290C84-E203-48CD-96FE-25F287B35C58}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{CF008ED2-2D02-4F90-9DE1-AF2683AC3A75}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{4A2F08C8-3C2D-4E62-AB32-9E6F21033E5D}] => (Allow) E:\Temp\Steam\steamapps\common\Counter-Strike Global Offensive\csgo.exe
FirewallRules: [{5A10E92E-14BC-4EA2-87C5-DFA76406A1B6}] => (Allow) E:\Temp\Steam\steamapps\common\Counter-Strike Global Offensive\csgo.exe
FirewallRules: [{450E7EC7-2C50-4F23-96AB-7ECDB5C88FFC}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
FirewallRules: [{32706039-9609-4992-BEEB-8ED8864C4607}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
FirewallRules: [{F739246A-3A2D-4765-808B-7BB1F4458A55}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe
FirewallRules: [{B1667E06-E235-41E6-B974-A2480A44B3EA}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe
FirewallRules: [{C902004C-0182-4F8A-92B3-90CDD0848EEE}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{CA9C0864-93C5-4403-A96A-481A312E25AB}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{FB800EB4-BE51-4D8C-8E4F-CFC1270DB18B}] => (Allow) E:\Temp\Steam\steamapps\common\Warframe\Tools\Launcher.exe
FirewallRules: [{C72A1B67-D93C-43AC-BE28-B0ACE3FE8839}] => (Allow) E:\Temp\Steam\steamapps\common\Warframe\Tools\Launcher.exe
FirewallRules: [TCP Query User{EB9F9A8C-6653-487F-B17B-9F501F2579C1}C:\program files (x86)\skype\phone\skype.exe] => (Allow) C:\program files (x86)\skype\phone\skype.exe
FirewallRules: [UDP Query User{56B69EA0-F89E-4E3A-86A9-17B0A681F65D}C:\program files (x86)\skype\phone\skype.exe] => (Allow) C:\program files (x86)\skype\phone\skype.exe
FirewallRules: [{8D865167-D700-4BE4-9F4A-CA556B393C38}] => (Allow) E:\Temp\Steam\steamapps\common\the witcher 2\Launcher.exe
FirewallRules: [{E0ABD53F-A995-438C-9AF4-7F12976B664F}] => (Allow) E:\Temp\Steam\steamapps\common\the witcher 2\Launcher.exe
FirewallRules: [{70336664-A8F7-4643-8DE1-888C970ADC52}] => (Allow) E:\Temp\Test\FarCry 4\bin\FarCry4.exe
FirewallRules: [{72959202-F7E2-4BC0-9E68-D9CE43FA28F0}] => (Allow) E:\Temp\Test\FarCry 4\bin\FarCry4.exe
FirewallRules: [{A5616C7D-29F6-4A47-BCBB-F7E60F43C9E9}] => (Allow) E:\Temp\Test\FarCry 4\bin\IGE_WPF64.exe
FirewallRules: [{5A969598-A826-47D0-ADB8-1F16B5161795}] => (Allow) E:\Temp\Test\FarCry 4\bin\IGE_WPF64.exe
FirewallRules: [{6B564610-4D4B-4514-8E99-BA30320C8C45}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
FirewallRules: [{8275C44B-588A-44A8-AA31-5CA246C843D7}] => (Allow) C:\Users\Duc Hong\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe
FirewallRules: [{341B590C-72BE-41C1-8D3B-81B7B97F31C4}] => (Allow) C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe
FirewallRules: [{9C62EFEB-4763-4789-983E-C443E1323C56}] => (Allow) LPort=2869
FirewallRules: [{A0BBA649-A813-4E72-B461-002ADF599BB2}] => (Allow) LPort=1900
FirewallRules: [{7A1895A9-2842-4905-B03D-7FE4C9AE9DF0}] => (Allow) C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe
 
==================== Faulty Device Manager Devices =============
 
 
==================== Event log errors: =========================
 
Application errors:
==================
Error: (05/27/2015 08:28:22 PM) (Source: NvStreamSvc) (EventID: 2001) (User: )
Description: NvStreamSvcFailed continue stopping. [5]
 
Error: (05/27/2015 07:04:24 PM) (Source: NvStreamSvc) (EventID: 2001) (User: )
Description: NvStreamSvcFailed continue stopping. [6]
 
Error: (05/27/2015 06:55:22 PM) (Source: NvStreamSvc) (EventID: 2001) (User: )
Description: NvStreamSvcFailed continue stopping. [0]
 
Error: (05/27/2015 05:01:26 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: defraggler64.exe, version: 2.18.0.945, time stamp: 0x534528ea
Faulting module name: dbghelp.dll_unloaded, version: 6.3.9600.17787, time stamp: 0x551b69ca
Exception code: 0xc0000005
Fault offset: 0x0000000000113a70
Faulting process id: 0x1714
Faulting application start time: 0xdefraggler64.exe0
Faulting application path: defraggler64.exe1
Faulting module path: defraggler64.exe2
Report Id: defraggler64.exe3
Faulting package full name: defraggler64.exe4
Faulting package-relative application ID: defraggler64.exe5
 
Error: (05/27/2015 04:17:57 PM) (Source: NvStreamSvc) (EventID: 2001) (User: )
Description: NvStreamSvcFailed continue stopping. [0]
 
Error: (05/27/2015 05:48:26 AM) (Source: NvStreamSvc) (EventID: 2001) (User: )
Description: NvStreamSvcFailed continue stopping. [0]
 
Error: (05/26/2015 08:22:37 PM) (Source: NvStreamSvc) (EventID: 2001) (User: )
Description: NvStreamSvcFailed continue stopping. [5]
 
Error: (05/26/2015 08:03:08 PM) (Source: NvStreamSvc) (EventID: 2001) (User: )
Description: NvStreamSvcFailed continue stopping. [6]
 
Error: (05/26/2015 07:40:12 PM) (Source: NvStreamSvc) (EventID: 2001) (User: )
Description: NvStreamSvcFailed continue stopping. [6]
 
Error: (05/26/2015 06:35:40 PM) (Source: VSS) (EventID: 8193) (User: )
Description: Volume Shadow Copy Service error: Unexpected error calling routine CoCreateInstance.  hr = 0x80040154, Class not registered
.
 
 
Operation:
   Instantiating VSS server
 
 
System errors:
=============
Error: (05/28/2015 00:07:30 AM) (Source: DCOM) (EventID: 10010) (User: HongHoangPC)
Description: {1B1F472E-3221-4826-97DB-2C2324D389AE}
 
Error: (05/28/2015 00:07:00 AM) (Source: DCOM) (EventID: 10010) (User: HongHoangPC)
Description: {BF6C1E47-86EC-4194-9CE5-13C15DCB2001}
 
Error: (05/28/2015 00:01:25 AM) (Source: DCOM) (EventID: 10010) (User: HongHoangPC)
Description: {1B1F472E-3221-4826-97DB-2C2324D389AE}
 
Error: (05/28/2015 00:00:46 AM) (Source: DCOM) (EventID: 10010) (User: HongHoangPC)
Description: {BF6C1E47-86EC-4194-9CE5-13C15DCB2001}
 
Error: (05/27/2015 11:56:16 PM) (Source: DCOM) (EventID: 10010) (User: HongHoangPC)
Description: {1B1F472E-3221-4826-97DB-2C2324D389AE}
 
Error: (05/27/2015 11:55:37 PM) (Source: DCOM) (EventID: 10010) (User: HongHoangPC)
Description: {BF6C1E47-86EC-4194-9CE5-13C15DCB2001}
 
Error: (05/27/2015 11:48:16 PM) (Source: DCOM) (EventID: 10010) (User: HongHoangPC)
Description: {1B1F472E-3221-4826-97DB-2C2324D389AE}
 
Error: (05/27/2015 11:47:36 PM) (Source: DCOM) (EventID: 10010) (User: HongHoangPC)
Description: {BF6C1E47-86EC-4194-9CE5-13C15DCB2001}
 
Error: (05/27/2015 11:10:25 PM) (Source: DCOM) (EventID: 10010) (User: HongHoangPC)
Description: {1B1F472E-3221-4826-97DB-2C2324D389AE}
 
Error: (05/27/2015 11:09:44 PM) (Source: DCOM) (EventID: 10010) (User: HongHoangPC)
Description: {BF6C1E47-86EC-4194-9CE5-13C15DCB2001}
 
 
Microsoft Office:
=========================
Error: (05/27/2015 08:28:22 PM) (Source: NvStreamSvc) (EventID: 2001) (User: )
Description: NvStreamSvcFailed continue stopping. [5]
 
Error: (05/27/2015 07:04:24 PM) (Source: NvStreamSvc) (EventID: 2001) (User: )
Description: NvStreamSvcFailed continue stopping. [6]
 
Error: (05/27/2015 06:55:22 PM) (Source: NvStreamSvc) (EventID: 2001) (User: )
Description: NvStreamSvcFailed continue stopping. [0]
 
Error: (05/27/2015 05:01:26 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: defraggler64.exe2.18.0.945534528eadbghelp.dll_unloaded6.3.9600.17787551b69cac00000050000000000113a70171401d0984af3376023C:\Program Files\Defraggler\defraggler64.exedbghelp.dll30e64e57-043e-11e5-82d4-7824afb1d22b
 
Error: (05/27/2015 04:17:57 PM) (Source: NvStreamSvc) (EventID: 2001) (User: )
Description: NvStreamSvcFailed continue stopping. [0]
 
Error: (05/27/2015 05:48:26 AM) (Source: NvStreamSvc) (EventID: 2001) (User: )
Description: NvStreamSvcFailed continue stopping. [0]
 
Error: (05/26/2015 08:22:37 PM) (Source: NvStreamSvc) (EventID: 2001) (User: )
Description: NvStreamSvcFailed continue stopping. [5]
 
Error: (05/26/2015 08:03:08 PM) (Source: NvStreamSvc) (EventID: 2001) (User: )
Description: NvStreamSvcFailed continue stopping. [6]
 
Error: (05/26/2015 07:40:12 PM) (Source: NvStreamSvc) (EventID: 2001) (User: )
Description: NvStreamSvcFailed continue stopping. [6]
 
Error: (05/26/2015 06:35:40 PM) (Source: VSS) (EventID: 8193) (User: )
Description: CoCreateInstance0x80040154, Class not registered
 
 
Operation:
   Instantiating VSS server
 
 
CodeIntegrity Errors:
===================================
  Date: 2015-05-17 02:43:02.789
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\SysWOW64\drivers\DrvAgent64.SYS because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
 
  Date: 2015-05-17 02:43:02.723
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\SysWOW64\drivers\DrvAgent64.SYS because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
 
  Date: 2015-05-17 02:43:02.658
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\SysWOW64\drivers\DrvAgent64.SYS because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
 
  Date: 2015-05-17 02:43:02.595
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\SysWOW64\drivers\DrvAgent64.SYS because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
 
  Date: 2015-05-17 02:43:02.527
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\SysWOW64\drivers\DrvAgent64.SYS because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
 
  Date: 2015-05-17 02:43:02.462
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\SysWOW64\drivers\DrvAgent64.SYS because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
 
  Date: 2015-05-17 02:43:02.397
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\SysWOW64\drivers\DrvAgent64.SYS because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
 
  Date: 2015-05-17 02:43:02.333
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\SysWOW64\drivers\DrvAgent64.SYS because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
 
  Date: 2015-05-17 02:42:58.259
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\SysWOW64\drivers\DrvAgent64.SYS because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
 
  Date: 2015-05-17 02:42:58.195
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\SysWOW64\drivers\DrvAgent64.SYS because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
 
 
==================== Memory info =========================== 
 
Processor: Intel® Core™ i7-4710HQ CPU @ 2.50GHz
Percentage of memory in use: 28%
Total physical RAM: 8075.06 MB
Available physical RAM: 5808.31 MB
Total Pagefile: 8587.06 MB
Available Pagefile: 6043.32 MB
Total Virtual: 131072 MB
Available Virtual: 131071.78 MB
 
==================== Drives ================================
 
Drive c: (OS) (Fixed) (Total:72.6 GB) (Free:22.92 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive d: (DucHong) (Fixed) (Total:418.9 GB) (Free:298.56 GB) NTFS
Drive e: (Miscellaneous) (Fixed) (Total:300 GB) (Free:80.84 GB) NTFS
Drive f: (Misc.2) (Fixed) (Total:118.9 GB) (Free:96.35 GB) NTFS
 
==================== MBR & Partition Table ==================
 
========================================================
Disk: 0 (Size: 931.5 GB) (Disk ID: EE7E28CB)
 
Partition: GPT Partition Type.
 
==================== End of log ============================

 

I also attached them below.

Attached Files


Edited by xXToffeeXx, 27 May 2015 - 02:06 PM.


#4 xXToffeeXx

xXToffeeXx

    Bleepin' Polar Bear


  • Malware Response Instructor
  • 6,015 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:The Arctic Circle
  • Local time:10:25 AM

Posted 27 May 2015 - 02:19 PM

Hi User1412,
 
We need to run a fix with FRST:

  • Press the windows key Windows_Logo_key.gif + r on your keyboard at the same time. Type in notepad and press Enter.
  • Copy and paste the script below in the notepad document:​
HKLM\...\Winlogon: [Userinit] C:\Windows\system32\userinit.exe,C:\Windows\taskhost.exe /boot
C:\Windows\taskhost.exe
HKU\S-1-5-21-1926068397-2398490202-140176465-1002\Software\Microsoft\Internet Explorer\Main,Start Page =
SearchScopes: HKU\S-1-5-21-1926068397-2398490202-140176465-1002 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-1926068397-2398490202-140176465-1002 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
  • Save the file to your desktop and name it as fixlist.txt

Note: It's important that both files, FRST.exe/FRST64.exe and fixlist.txt are in the same location or the fix will not work
NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

  • Run FRST.exe/FRST64.exe and press the Fix button just once and wait
  • If for some reason the tool needs a restart, please make sure you let the system restart normally, then let the tool complete its run
  • When finished, FRST will generate a log (Fixlog.txt) in the same location the tool was run.
  • Please copy and paste the log in your next reply.

xXToffeeXx~


~If I am helping you and you have not had a reply from me in two days, please send me a PM~

~Currently in my last year of school, so replies might be more delayed~

 

logo-25.pngID Ransomware - Identify What Ransomware Encrypted Your Files [Support Topic] - If we have helped you out and you want to support what we do, you can do so here

 

 ~Twitter~ | ~Malware Analyst at Emsisoft~


#5 User1412

User1412
  • Topic Starter

  • Members
  • 19 posts
  • OFFLINE
  •  
  • Local time:09:25 PM

Posted 27 May 2015 - 03:57 PM

Here you are:

 

Fix result of Farbar Recovery Scan Tool (x64) Version: 27-05-2015
Ran by Duc Hong at 2015-05-28 06:55:51 Run:1
Running from C:\Users\Duc Hong\Desktop
Loaded Profiles: Duc Hong (Available Profiles: Duc Hong)
Boot Mode: Normal
==============================================

fixlist content:
*****************
HKLM\...\Winlogon: [Userinit] C:\Windows\system32\userinit.exe,C:\Windows\taskhost.exe /boot
C:\Windows\taskhost.exe
HKU\S-1-5-21-1926068397-2398490202-140176465-1002\Software\Microsoft\Internet Explorer\Main,Start Page =
SearchScopes: HKU\S-1-5-21-1926068397-2398490202-140176465-1002 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-1926068397-2398490202-140176465-1002 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
*****************

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\\Userinit => value restored successfully
C:\Windows\taskhost.exe => Moved successfully.
HKU\S-1-5-21-1926068397-2398490202-140176465-1002\Software\Microsoft\Internet Explorer\Main\\Start Page => value restored successfully
HKU\S-1-5-21-1926068397-2398490202-140176465-1002\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value Removed successfully
"HKU\S-1-5-21-1926068397-2398490202-140176465-1002\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}" => key Removed successfully
HKCR\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} => key not found.

==== End of Fixlog 06:55:52 ====



#6 xXToffeeXx

xXToffeeXx

    Bleepin' Polar Bear


  • Malware Response Instructor
  • 6,015 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:The Arctic Circle
  • Local time:10:25 AM

Posted 28 May 2015 - 10:14 AM

Hi User1412,
 
Download Emsisoft Emergency Kit and save it to your desktop. Double click on EmsisoftEmergencyKit.exe to extract its contents and create a shortcut on the desktop. Leave all settings as they are and click  Accept & Extract. A folder named EEK will be created in the root of the drive (usually c:\). .

  • After extraction an Emsisoft Emergency Kit window will open. Under "Run Directly:" click Emergency Kit Scanner.
  • When asked to run an online update, click Yes.
  • When the update is finished, click the Back to Security Status link in the left corner. On the main screen click the Scan Now button.
  • Select the Full Scan option and click the SCAN button.
  • When the scan is finished click the Quarantine selected objects button. Note, this option is only available if malicious objects were detected during the scan.
  • Click the View Report button and in the Reports window double-click on the most recent log. Note, logs are named as follows: a2scan_<date>-<time>.txt.
  • Copy/paste the report contents in your next reply.

--------------
 
This scan can take a long time, so it is best done overnight or when you do not need the computer
 
I'd like us to scan your machine with ESET OnlineScan

  • Hold down Control and click on this link to open ESET OnlineScan in a new window.
  • Click the esetonlinebtn.png button.
  • For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
    • Click on esetsmartinstaller_enu.exe to download the ESET Smart Installer. Save it to your desktop.
    • Double click on the esetsmartinstaller_enu.png icon on your desktop.
  • Check "YES, I accept the Terms of Use."
  • Click the Start button.
  • Accept any security warnings from your browser.
  • Under scan settings, check "Scan Archives" and "Remove found threats"
  • Click Advanced settings and select the following:
    • Scan potentially unwanted applications
    • Scan for potentially unsafe applications
    • Enable Anti-Stealth technology
  • ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
  • When the scan completes, click List Threats
  • Click Export, and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
  • Click the Back button.
  • Click the Finish button.

--------------
 
To recap, in your next reply I would like to see the following. Make sure to copy & paste them unless I ask otherwise:

  • Emsisoft log
  • ESET log

xXToffeeXx~


~If I am helping you and you have not had a reply from me in two days, please send me a PM~

~Currently in my last year of school, so replies might be more delayed~

 

logo-25.pngID Ransomware - Identify What Ransomware Encrypted Your Files [Support Topic] - If we have helped you out and you want to support what we do, you can do so here

 

 ~Twitter~ | ~Malware Analyst at Emsisoft~


#7 User1412

User1412
  • Topic Starter

  • Members
  • 19 posts
  • OFFLINE
  •  
  • Local time:09:25 PM

Posted 29 May 2015 - 06:04 AM

ESET:

C:\Documents and Settings\Duc Hong\Downloads\Programs\ccsetup506.exe    Win32/Bundled.Toolbar.Google.D potentially unsafe application
C:\Documents and Settings\Duc Hong\Downloads\Programs\dfsetup219.exe    Win32/Bundled.Toolbar.Google.D potentially unsafe application
C:\Documents and Settings\Duc Hong\Downloads\Programs\spsetup128.exe    Win32/Bundled.Toolbar.Google.D potentially unsafe application
C:\Users\Duc Hong\Downloads\Programs\spsetup128.exe    Win32/Bundled.Toolbar.Google.D potentially unsafe application
E:\file from mediafire\IDM files\mailpv\mailpv.exe    Win32/PSWTool.MailPassView.E potentially unsafe application
E:\file from mediafire\IDM files\Wondershare.Video.Converter.Ultimate.6.x.Patch-XenoCoder\wondershare.video.converter.ultimate.6.x-patch.exe    a variant of Win32/HackTool.Patcher.AD potentially unsafe application
E:\Software\Compressed\[Celestia]VnSharing_Diskeeper.2011.Pro.Premier.v15.0.951\Diskeeper.2011.Pro.Premier.v15.0.951.Incl.Patch.And.Keymaker-AGAiN\Keygen.exe    a variant of Win32/Keygen.AF potentially unsafe application
E:\Software\Programs\ccsetup506.exe    Win32/Bundled.Toolbar.Google.D potentially unsafe application
E:\Software\Programs\dfsetup219.exe    Win32/Bundled.Toolbar.Google.D potentially unsafe application
E:\Software\Programs\FoxitReader510.1021_enu_Setup.exe    a variant of Win32/Bundled.Toolbar.Ask potentially unsafe application
E:\Software\Programs\light_image_resizer4_setup_4.2.0.0_bunndle.exe    a variant of Win32/Bunndle potentially unsafe application
E:\Software\Programs\rcsetup151.exe    Win32/Bundled.Toolbar.Google.D potentially unsafe application
E:\Software\Programs 2\CrystalDiskInfo5_4_2-en.exe    Win32/OpenCandy potentially unsafe application
E:\Software\Programs 2\driverfusionsetup.exe    Win32/OpenCandy potentially unsafe application
E:\Software\Programs 2\DTLite4491-0356.exe    Win32/DownWare.L potentially unwanted application
E:\Software\Programs 2\FFCoder_v1.3.0.3_Setup_Full.exe    Win32/PrcView potentially unsafe application
E:\Software\Programs 2\FFSetup300.exe    a variant of Win32/Hao123.A potentially unwanted application
E:\Software\Programs 2\FreemakeVideoConverter_4.0.4.3.exe    Win32/OpenCandy potentially unsafe application
E:\Software\Programs 2\MediaCoder-0.8.20.5380.exe    Win32/OpenCandy potentially unsafe application
E:\Software\Programs 2\networx_setup.exe    a variant of Win32/NetFilter.A potentially unsafe application
E:\Software\Programs 2\SetupImgBurn_2.5.8.0.exe    Win32/OpenCandy potentially unsafe application
E:\Software\Programs 2\SIWPortable_2011.10.29.paf.exe    a variant of Win32/RemoteAdmin.RemoteExec.AA potentially unsafe application
E:\Software\Programs 2\spsetup120.exe    Win32/Bundled.Toolbar.Google.E potentially unsafe application
E:\Software\Programs 2\Unlocker1.9.2.exe    Win32/DownWare.L potentially unwanted application
E:\Software\Programs 2\visionssetup.exe    a variant of Win32/Toolbar.Conduit.AI potentially unwanted application
E:\Software\Test\SevenQFInstall.exe    Win32/DownWare.W potentially unwanted application
E:\Software\Test\System Utilities\3DP_Chip_v1208.exe    Win32/OpenCandy potentially unsafe application
E:\Software\Test\System Utilities\ASC\asc-setup.exe    a variant of Win32/Toolbar.Widgi.B potentially unwanted application
E:\Software\Test\Wondershare\Wondershare Video Converter Ultimate 6.x-patch\wondershare.video.converter.ultimate.6.x-patch.exe    a variant of Win32/HackTool.Patcher.AD potentially unsafe application
E:\Software\Test\[Celestia]VnSharing_Diskeeper.2011.Pro.Premier.v15.0.951\Diskeeper.2011.Pro.Premier.v15.0.951.Incl.Patch.And.Keymaker-AGAiN\Keygen.exe    a variant of Win32/Keygen.AF potentially unsafe application
E:\Software\Tools\Mipony-Installer.exe    Win32/InstallCore.HQ potentially unwanted application
E:\Software\Utilities\3DP_Chip_v1408.exe    a variant of Win32/OpenCandy.C potentially unsafe application
E:\Temp\BKUP\backup from usb 8g\disk-defrag-setup.exe    a variant of Win32/Toolbar.Widgi.N potentially unwanted application
E:\Temp\BKUP\bkup\Old Firefox Data 2\dy5tzm1j.default-1371212508919\prefs.js    JS/SecurityDisabler.A.Gen potentially unwanted application

Emsisoft:

Emsisoft Emergency Kit - Version 9.0
Last update: 29-May-15 3:02:56 PM
User account: HongHoangPC\Duc Hong

Scan settings:

Scan type: Full Scan
Objects: Rootkits, Memory, Traces, C:\, D:\, E:\, F:\

Detect PUPs: Off
Scan archives: On
ADS Scan: On
File extension filter: Off
Advanced caching: On
Direct disk access: Off

Scan start:    29-May-15 3:26:00 PM
C:\FRST\Quarantine\C\Windows\taskhost.exe.xBAD     detected: Trojan.GenericKD.1841162 (B)
C:\Users\Duc Hong\Downloads\Programs\Steam Unchained__9273_il588.exe     detected: Gen:Variant.Adware.Strictor.83379 (B)
E:\file from mediafire\IDM files\VSO-ConvertXtoDVD-5.2.0.5-Final-Multilingual.rar -> vso.convertxtodvd.5.x-patch.exe     detected: Gen:Trojan.Heur.FU.euW@a0Q59To (B)
E:\Software\Compressed\[Cattleya][VnSharing.net] Trillian Astra 5.0.0.34.rar -> [Cattleya][VnSharing.net] Trillian Astra 5.0.0.34\patch.exe     detected: Backdoor.Generic.580467 (B)
E:\Software\Compressed\[vnsharing.net]Perfect Resize 7.0.6 Professional Edition.rar -> [vnsharing.net]Perfect Resize 7.0.6 Professional Edition\keygen\KeyGen.exe     detected: Trojan.Generic.KD.118597 (B)
E:\Software\Compressed\[VnSharing.net]RAR Repair Tool 4.0.1.rar -> RAR Repair Tool 4.0.1 Incl.Serial\Rar Repair Tool 4.0.1.exe     detected: Win32.Polip.A (B)
E:\Software\Compressed\ConvertXtoDVD5\convertxtodvd.5.x.patch.v2.8-Cerberus.exe     detected: Dropped:Trojan.Generic.14524712 (B)
E:\Software\Compressed\ConvertXtoDVD5\convertxtodvd.5.x.patch.v2.8-Cerberus.rar -> convertxtodvd.5.x.patch.v2.8-Cerberus.exe     detected: Dropped:Trojan.Generic.14524712 (B)
E:\Software\Compressed\ConvertXtoDVD5\VSO ConvertxtoDVD 5.x.Patch.zip -> vso.convertxtodvd.5.x-patch.exe     detected: Gen:Trojan.Heur.FU.euW@a0Q59To (B)
E:\Software\Compressed\ConvertXtoDVD5\vso.convertxtodvd.5.x-patch.exe     detected: Gen:Trojan.Heur.FU.euW@a0Q59To (B)
E:\Software\Compressed\InternetDownloadManager\[shoptinhoc.com]IDM All version patch by z0mbie.rar -> [shoptinhoc.com]IDM All version patch by z0mbie\IDM All version patch by z0mbie.exe     detected: Trojan.Generic.7567038 (B)
E:\Software\Compressed\InternetDownloadManager\[shoptinhoc.com]IDM All version patch by z0mbie\IDM All version patch by z0mbie.exe     detected: Trojan.Generic.7567038 (B)
E:\Software\Compressed\xplr2.P.v2.2.0.1.rar -> ZABKAT.xplorer2.Pro.v2.2.0.1.x64.Multilingual.Incl.Keymaker-ZWT.rar -> ZABKAT.xplorer2.Pro.v2.2.0.1.x64.Multilingual.Incl.Keymaker-ZWT\zm614xvk.zip -> zwt.rar -> keygen.exe     detected: Trojan.Generic.7518365 (B)
E:\Software\Compressed\xplr2.P.v2.2.0.1.rar -> ZABKAT.xplorer2.Pro.v2.2.0.1.Multilingual.Incl.Keymaker-ZWT.rar -> ZABKAT.xplorer2.Pro.v2.2.0.1.Multilingual.Incl.Keymaker-ZWT\z2qc26le.zip -> zwt.rar -> keygen.exe     detected: Trojan.Generic.7518365 (B)
E:\Software\Test\System Utilities\ASC\Advanced.SystemCare.PRO.v6.0.8.170.Patch.Only-OCJ.7z -> Patch.exe     detected: Gen:Variant.Kazy.345 (B)
E:\Software\Test\System Utilities\ASC\djkute151092_Patch.Only-OCJ.7z -> Patch.exe     detected: Gen:Variant.Kazy.345 (B)
E:\Software\Test\System Utilities\ASC\Patch.exe     detected: Gen:Variant.Kazy.345 (B)
E:\Software\Test\System Utilities\Driver Reviver\reviversoft-patch.exe     detected: Gen:Trojan.Heur.FU.euW@aS5BYTm (B)
E:\Software\Test\System Utilities\Driver Reviver\reviversoft-patch.rar -> reviversoft-patch.exe     detected: Gen:Trojan.Heur.FU.euW@aS5BYTm (B)
E:\Software\Test\Xilisoft\Keygen\Keygen.exe     detected: HackTool.Win32.Keygen (A)
E:\Software\Test\Xilisoft\Xilisoft DVD Ripper Platinum 7.x patch&keygen\Lz0.rar -> Lz0\Keygen.exe     detected: Gen:Variant.Kazy.2529 (B)
E:\Software\Test\Xilisoft\Xilisoft DVD Ripper Platinum 7.x patch&keygen\Lz0\Keygen.exe     detected: Gen:Variant.Kazy.2529 (B)
E:\Software\Test\Xilisoft\Xilisoft DVD Ripper Platinum 7.x patch&keygen\Xilisoft.ImTOO.4Media.Multipatch.v0.5-BBB.zip -> Patch.exe     detected: Gen:Variant.Minggy.2 (B)
E:\Software\Test\Xilisoft\Xilisoft Multi Keygen 18 in 1 (2012)_qg128_CiN1TeAm.biZ.exe     detected: Trojan.Generic.8220808 (B)
E:\Software\Test\Xilisoft\Xilisoft Patcher All Products 2012_Patch_cin1\Xilisoft Patcher All Products 2012_Patch_cin1.exe     detected: Backdoor.Generic.826044 (B)
E:\Software\Test\Xilisoft\Xilisoft_Video_Converter_Ultimate-7.5.0.20120822.rar -> xilisoft.video.converter.ultimate-SND.rar -> xilisoft.video.converter.ultimate.exe     detected: Gen:Trojan.Heur.VP2.jmKfaa6nIZji (B)
E:\Software\Tools\PE explorer full\ABRE ESTO\crack\keygen.exe     detected: Trojan.Generic.7582513 (B)

Scanned    488956
Found    27

Scan end:    29-May-15 5:11:49 PM
Scan time:    1:45:49

E:\Software\Tools\PE explorer full\ABRE ESTO\crack\keygen.exe    Quarantined Trojan.Generic.7582513 (B)
E:\Software\Test\Xilisoft\Xilisoft_Video_Converter_Ultimate-7.5.0.20120822.rar    Quarantined Gen:Trojan.Heur.VP2.jmKfaa6nIZji (B)
E:\Software\Test\Xilisoft\Xilisoft Patcher All Products 2012_Patch_cin1\Xilisoft Patcher All Products 2012_Patch_cin1.exe    Quarantined Backdoor.Generic.826044 (B)
E:\Software\Test\Xilisoft\Xilisoft Multi Keygen 18 in 1 (2012)_qg128_CiN1TeAm.biZ.exe    Quarantined Trojan.Generic.8220808 (B)
E:\Software\Test\Xilisoft\Xilisoft DVD Ripper Platinum 7.x patch&keygen\Xilisoft.ImTOO.4Media.Multipatch.v0.5-BBB.zip    Quarantined Gen:Variant.Minggy.2 (B)
E:\Software\Test\Xilisoft\Xilisoft DVD Ripper Platinum 7.x patch&keygen\Lz0\Keygen.exe    Quarantined Gen:Variant.Kazy.2529 (B)
E:\Software\Test\Xilisoft\Xilisoft DVD Ripper Platinum 7.x patch&keygen\Lz0.rar    Quarantined Gen:Variant.Kazy.2529 (B)
E:\Software\Test\Xilisoft\Keygen\Keygen.exe    Quarantined HackTool.Win32.Keygen (A)
E:\Software\Test\System Utilities\Driver Reviver\reviversoft-patch.rar    Quarantined Gen:Trojan.Heur.FU.euW@aS5BYTm (B)
E:\Software\Test\System Utilities\Driver Reviver\reviversoft-patch.exe    Quarantined Gen:Trojan.Heur.FU.euW@aS5BYTm (B)
E:\Software\Test\System Utilities\ASC\Patch.exe    Quarantined Gen:Variant.Kazy.345 (B)
E:\Software\Test\System Utilities\ASC\djkute151092_Patch.Only-OCJ.7z    Quarantined Gen:Variant.Kazy.345 (B)
E:\Software\Test\System Utilities\ASC\Advanced.SystemCare.PRO.v6.0.8.170.Patch.Only-OCJ.7z    Quarantined Gen:Variant.Kazy.345 (B)
E:\Software\Compressed\xplr2.P.v2.2.0.1.rar    Quarantined Trojan.Generic.7518365 (B)
E:\Software\Compressed\InternetDownloadManager\[shoptinhoc.com]IDM All version patch by z0mbie\IDM All version patch by z0mbie.exe    Quarantined Trojan.Generic.7567038 (B)
E:\Software\Compressed\InternetDownloadManager\[shoptinhoc.com]IDM All version patch by z0mbie.rar    Quarantined Trojan.Generic.7567038 (B)
E:\Software\Compressed\ConvertXtoDVD5\vso.convertxtodvd.5.x-patch.exe    Quarantined Gen:Trojan.Heur.FU.euW@a0Q59To (B)
E:\Software\Compressed\ConvertXtoDVD5\VSO ConvertxtoDVD 5.x.Patch.zip    Quarantined Gen:Trojan.Heur.FU.euW@a0Q59To (B)
E:\Software\Compressed\ConvertXtoDVD5\convertxtodvd.5.x.patch.v2.8-Cerberus.rar    Quarantined Dropped:Trojan.Generic.14524712 (B)
E:\Software\Compressed\ConvertXtoDVD5\convertxtodvd.5.x.patch.v2.8-Cerberus.exe    Quarantined Dropped:Trojan.Generic.14524712 (B)
E:\Software\Compressed\[VnSharing.net]RAR Repair Tool 4.0.1.rar    Quarantined Win32.Polip.A (B)
E:\Software\Compressed\[vnsharing.net]Perfect Resize 7.0.6 Professional Edition.rar    Quarantined Trojan.Generic.KD.118597 (B)
E:\Software\Compressed\[Cattleya][VnSharing.net] Trillian Astra 5.0.0.34.rar    Quarantined Backdoor.Generic.580467 (B)
E:\file from mediafire\IDM files\VSO-ConvertXtoDVD-5.2.0.5-Final-Multilingual.rar    Quarantined Gen:Trojan.Heur.FU.euW@a0Q59To (B)
C:\Users\Duc Hong\Downloads\Programs\Steam Unchained__9273_il588.exe    Quarantined Gen:Variant.Adware.Strictor.83379 (B)
C:\FRST\Quarantine\C\Windows\taskhost.exe.xBAD    Quarantined Trojan.GenericKD.1841162 (B)

Quarantined    26

Edited by User1412, 29 May 2015 - 06:06 AM.


#8 xXToffeeXx

xXToffeeXx

    Bleepin' Polar Bear


  • Malware Response Instructor
  • 6,015 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:The Arctic Circle
  • Local time:10:25 AM

Posted 29 May 2015 - 02:24 PM

Hi User1412,
 
A lot of your cracks seem to be malicious, this is probably where your infection came from.
 
I see a number of lines in your log which are related to cracks, torrents and keygens. I shall provide this warning:
 
The practice of using keygenshacking toolscracking toolswareztorrents or any pirated software is not only considered illegal activity, but it is a serious security risk which can turn a computer into a virus honeypot or zombie.
 
When you use these kind of programs, be forewarned that some of the worst types of malware infections can be contracted and spread by visiting crack, keygen, warez and other pirated software sites. In many cases, those sites are infested with a smörgåsbord of malware and an increasing source of system infection. Those who attempt to get software for free can end up with a computer system so badly damaged that recovery is not possible, and it cannot be repaired. When that happens there is nothing you can do besides reformatting and reinstalling the OS.
 
If you want to read on then the full post is here.
 
--------------
 
Please re-run FRST from the desktop (like you did before) and press the scan button. It will produce a FRST.txt log located on the desktop. Please copy and paste the log into your next reply.
 
xXToffeeXx~


~If I am helping you and you have not had a reply from me in two days, please send me a PM~

~Currently in my last year of school, so replies might be more delayed~

 

logo-25.pngID Ransomware - Identify What Ransomware Encrypted Your Files [Support Topic] - If we have helped you out and you want to support what we do, you can do so here

 

 ~Twitter~ | ~Malware Analyst at Emsisoft~


#9 User1412

User1412
  • Topic Starter

  • Members
  • 19 posts
  • OFFLINE
  •  
  • Local time:09:25 PM

Posted 30 May 2015 - 02:24 AM

I used to do some exploits with software and read them from online materials so there's lots of cracks and keygens there ;b

 

Here's the log:

 

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 27-05-2015
Ran by Duc Hong (administrator) on HONGHOANGPC on 30-05-2015 17:19:05
Running from C:\Users\Duc Hong\Desktop\FRST
Loaded Profiles: Duc Hong (Available Profiles: Duc Hong)
Platform: Windows 8.1 Pro with Media Center (X64) OS Language: English (United States)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\AsLdrSrv.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe
(Avast Software s.r.o.) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Hanwang Technology Co.,Ltd. ) C:\Program Files\ASUS\ASUS FaceID\HWFaceKeyService.exe
(ASUS Cloud Corporation) C:\Program Files (x86)\ASUS\WebStorage\2.1.2.301\AsusWSWinService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\ibtsiva.exe
(Intel® Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Intel® Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(SoftEther VPN Project at University of Tsukuba, Japan.) C:\Program Files\SoftEther VPN Client\vpnclient_x64.exe
(VMware, Inc.) C:\Windows\SysWOW64\vmnat.exe
(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe
(VMware, Inc.) C:\Program Files (x86)\VMware\VMware Player\vmware-authd.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe
(VMware, Inc.) C:\Windows\SysWOW64\vmnetdhcp.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
(Motorola Solutions, Inc.) C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe
(Motorola Solutions, Inc.) C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\FWService\IntelMeFWService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\Splendid\ColorUService.exe
(ASUSTek Computer Inc.) C:\Program Files\ASUS\ASUS Console\ASUS Console Starter.exe
(ASUS) C:\Program Files (x86)\ASUS\Splendid\ACMON.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe
(Microsoft Corporation) C:\Windows\System32\InputMethod\JPN\JpnIME.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(AsusTek) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPLoader.exe
(AsusTek) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPCenter.exe
(AsusTek) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPHelper.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Tonec Inc.) C:\Program Files (x86)\Internet Download Manager\IDMan.exe
(Microsoft Corporation) C:\Windows\System32\StikyNot.exe
(Internet Download Manager, Tonec Inc.) C:\Program Files (x86)\Internet Download Manager\IDMIntegrator64.exe
(Tonec Inc.) C:\Program Files (x86)\Internet Download Manager\IEMonitor.exe
() C:\Program Files\Rainmeter\Rainmeter.exe
(Avast Software s.r.o.) C:\Program Files\AVAST Software\Avast\avastui.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
(Microsoft Corporation) C:\Windows\splwow64.exe
(Foxit Software Inc.) C:\Program Files (x86)\Foxit Software\Foxit PhantomPDF\FoxitPhantomPDF.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(MPC-HC Team) C:\Program Files (x86)\K-Lite Codec Pack\MPC-HC\mpc-hc.exe
(Google) C:\Users\Duc Hong\AppData\Local\Google\Google Talk Plugin\googletalkplugin.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [SoftEther VPN Client UI Helper] => C:\Program Files\SoftEther VPN Client\vpnclient_x64.exe [4374072 2015-01-21] (SoftEther VPN Project at University of Tsukuba, Japan.)
HKLM\...\Run: [BTMTrayAgent] => rundll32.exe "C:\Program Files (x86)\Intel\Bluetooth\btmshellex.dll",TrayApp
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2685072 2015-05-02] (NVIDIA Corporation)
HKLM-x32\...\Run: [ASUSPRP] => C:\Program Files (x86)\ASUS\APRP\APRP.EXE [1080992 2014-05-17] (ASUSTek Computer Inc.)
HKLM-x32\...\Run: [ASUS InstantKey] => C:\Program Files (x86)\ASUS\ASUS Instant Key\Ikey_start.exe [14448 2014-01-29] (ASUS)
HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [5515496 2015-05-13] (Avast Software s.r.o.)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [334896 2015-04-30] (Oracle Corporation)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-1926068397-2398490202-140176465-1002\...\Run: [Google Update] => C:\Users\Duc Hong\AppData\Local\Google\Update\GoogleUpdate.exe [107848 2015-04-17] (Google Inc.)
HKU\S-1-5-21-1926068397-2398490202-140176465-1002\...\Run: [IDM Helper] => C:\Program Files (x86)\Internet Download Manager\IDMGrHlp.exe [513560 2015-02-04] (Tonec Inc.)
HKU\S-1-5-21-1926068397-2398490202-140176465-1002\...\Run: [IDMan] => C:\Program Files (x86)\Internet Download Manager\IDMan.exe [3903056 2015-05-20] (Tonec Inc.)
HKU\S-1-5-21-1926068397-2398490202-140176465-1002\...\Run: [BingSvc] => C:\Users\Duc Hong\AppData\Local\Microsoft\BingSvc\BingSvc.exe [144008 2015-04-07] (© 2015 Microsoft Corporation)
HKU\S-1-5-21-1926068397-2398490202-140176465-1002\...\Run: [RESTART_STICKY_NOTES] => C:\Windows\System32\StikyNot.exe [479744 2014-10-29] (Microsoft Corporation)
HKU\S-1-5-21-1926068397-2398490202-140176465-1002\...\Policies\Explorer: [NoLowDiskSpaceChecks] 1
HKU\S-1-5-21-1926068397-2398490202-140176465-1002\...\Policies\Explorer: [LinkResolveIgnoreLinkInfo] 1
HKU\S-1-5-21-1926068397-2398490202-140176465-1002\...\Policies\Explorer: [NoResolveSearch] 1
HKU\S-1-5-21-1926068397-2398490202-140176465-1002\...\Policies\Explorer: [NoInternetOpenWith] 1
HKU\S-1-5-21-1926068397-2398490202-140176465-1002\Control Panel\Desktop\\SCRNSAVE.EXE ->
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\SoftEther VPN Client Manager Startup.lnk [2015-01-21]
ShortcutTarget: SoftEther VPN Client Manager Startup.lnk -> C:\Program Files\SoftEther VPN Client\vpncmgr_x64.exe (SoftEther VPN Project at University of Tsukuba, Japan.)
Startup: C:\Users\Duc Hong\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Rainmeter.lnk [2015-01-07]
ShortcutTarget: Rainmeter.lnk -> C:\Program Files\Rainmeter\Rainmeter.exe ()
ShellIconOverlayIdentifiers: [!AsusWSShellExt_B] -> {6D4133E5-0742-4ADC-8A8C-9303440F7191} => C:\Program Files (x86)\Common Files\AWS\2.1.2.301\ASUSWSShellExt64.dll [2013-06-26] (ASUS Cloud Corporation.)
ShellIconOverlayIdentifiers: [!AsusWSShellExt_O] -> {64174815-8D98-4CE6-8646-4C039977D809} => C:\Program Files (x86)\Common Files\AWS\2.1.2.301\ASUSWSShellExt64.dll [2013-06-26] (ASUS Cloud Corporation.)
ShellIconOverlayIdentifiers: [!AsusWSShellExt_U] -> {1C5AB7B1-0B38-4EC4-9093-7FD277E2AF4E} => C:\Program Files (x86)\Common Files\AWS\2.1.2.301\ASUSWSShellExt64.dll [2013-06-26] (ASUS Cloud Corporation.)
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll [2015-05-01] (Avast Software s.r.o.)
ShellIconOverlayIdentifiers: [IDM Shell Extension] -> {CDC95B92-E27C-4745-A8C5-64A52A78855D} => C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll [2014-04-21] (Tonec Inc.)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-1926068397-2398490202-140176465-1002\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://asus13.msn.com/?pc=ASJB
HKU\S-1-5-21-1926068397-2398490202-140176465-1002\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/en-au/?ocid=iehp
BHO: IDM integration (IDMIEHlprObj Class) -> {0055C089-8582-441B-A0BF-17B458C2A3A8} -> C:\Program Files (x86)\Internet Download Manager\IDMIECC64.dll [2015-05-20] (Internet Download Manager, Tonec Inc.)
BHO: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_45\bin\ssv.dll [2015-05-27] (Oracle Corporation)
BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2014-07-14] (Microsoft Corporation)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
BHO: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_45\bin\jp2ssv.dll [2015-05-27] (Oracle Corporation)
BHO-x32: ATLAS Toolbar -> {3C6301ED-0F78-4AF2-8150-D9C052361A8E} -> C:\Program Files (x86)\ATLAS V14\ATLIECP.DLL [2011-07-06] (FUJITSU LIMITED)
BHO-x32: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\ssv.dll [2015-05-27] (Oracle Corporation)
BHO-x32: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2014-07-14] (Microsoft Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
BHO-x32: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\jp2ssv.dll [2015-05-27] (Oracle Corporation)
Toolbar: HKLM-x32 - ATLAS Toolbar - {3C6301ED-0F78-4AF2-8150-D9C052361A8E} - C:\Program Files (x86)\ATLAS V14\ATLIECP.DLL [2011-07-06] (FUJITSU LIMITED)
Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2014-07-14] (Microsoft Corporation)
Handler-x32: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2014-07-14] (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

FireFox:
========
FF ProfilePath: C:\Users\Duc Hong\AppData\Roaming\Mozilla\Firefox\Profiles\62c9k4xd.default-1422598942125
FF Homepage: www.google.com.au
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_16_0_0_235.dll [2015-01-12] ()
FF Plugin: @java.com/DTPlugin,version=11.45.2 -> C:\Program Files\Java\jre1.8.0_45\bin\dtplugin\npDeployJava1.dll [2015-05-27] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.45.2 -> C:\Program Files\Java\jre1.8.0_45\bin\plugin2\npjp2.dll [2015-05-27] (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-16] ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_235.dll [2015-01-12] ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2014-10-30] ()
FF Plugin-x32: @foxitsoftware.com/Foxit PhantomPDF Plugin,version=1.0,application/pdf -> C:\Program Files (x86)\Foxit Software\Foxit PhantomPDF\plugins\npFoxitPhantomPDFPlugin.dll [2014-10-20] (Foxit Corporation)
FF Plugin-x32: @foxitsoftware.com/Foxit PhantomPDF Plugin,version=1.0,application/vnd.fdf -> C:\Program Files (x86)\Foxit Software\Foxit PhantomPDF\plugins\npFoxitPhantomPDFPlugin.dll [2014-10-20] (Foxit Corporation)
FF Plugin-x32: @foxitsoftware.com/Foxit PhantomPDF Plugin,version=1.0,application/vnd.xdp -> C:\Program Files (x86)\Foxit Software\Foxit PhantomPDF\plugins\npFoxitPhantomPDFPlugin.dll [2014-10-20] (Foxit Corporation)
FF Plugin-x32: @foxitsoftware.com/Foxit PhantomPDF Plugin,version=1.0,application/vnd.xfdf -> C:\Program Files (x86)\Foxit Software\Foxit PhantomPDF\plugins\npFoxitPhantomPDFPlugin.dll [2014-10-20] (Foxit Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5 -> C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIIPT.dll [2013-09-04] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2013-09-04] (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=11.45.2 -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\dtplugin\npDeployJava1.dll [2015-05-27] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.45.2 -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\plugin2\npjp2.dll [2015-05-27] (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-15] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2014-03-31] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-05-16] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-05-16] (Google Inc.)
FF Plugin HKU\S-1-5-21-1926068397-2398490202-140176465-1002: @talk.google.com/GoogleTalkPlugin -> C:\Users\Duc Hong\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll [2015-04-17] (Google)
FF Plugin HKU\S-1-5-21-1926068397-2398490202-140176465-1002: @talk.google.com/O1DPlugin -> C:\Users\Duc Hong\AppData\Roaming\Mozilla\plugins\npo1d.dll [2015-04-17] (Google)
FF Plugin HKU\S-1-5-21-1926068397-2398490202-140176465-1002: @tools.google.com/Google Update;version=3 -> C:\Users\Duc Hong\AppData\Local\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-05-16] (Google Inc.)
FF Plugin HKU\S-1-5-21-1926068397-2398490202-140176465-1002: @tools.google.com/Google Update;version=9 -> C:\Users\Duc Hong\AppData\Local\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-05-16] (Google Inc.)
FF Plugin HKU\S-1-5-21-1926068397-2398490202-140176465-1002: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\Duc Hong\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll [2015-05-12] (Unity Technologies ApS)
FF Plugin ProgramFiles/Appdata: C:\Users\Duc Hong\AppData\Roaming\mozilla\plugins\npgoogletalk.dll [2015-04-17] (Google)
FF Plugin ProgramFiles/Appdata: C:\Users\Duc Hong\AppData\Roaming\mozilla\plugins\npo1d.dll [2015-04-17] (Google)
FF Extension: FT DeepDark - C:\Users\Duc Hong\AppData\Roaming\Mozilla\Firefox\Profiles\62c9k4xd.default-1422598942125\Extensions\{77d2ed30-4cd2-11e0-b8af-0800200c9a66} [2015-04-15]
FF Extension: Ank Pixiv Tool - C:\Users\Duc Hong\AppData\Roaming\Mozilla\Firefox\Profiles\62c9k4xd.default-1422598942125\Extensions\ankpixiv@snca.net.xpi [2015-01-30]
FF Extension: MEGA - C:\Users\Duc Hong\AppData\Roaming\Mozilla\Firefox\Profiles\62c9k4xd.default-1422598942125\Extensions\firefox@mega.co.nz.xpi [2015-01-30]
FF Extension: NicoFox - C:\Users\Duc Hong\AppData\Roaming\Mozilla\Firefox\Profiles\62c9k4xd.default-1422598942125\Extensions\nicofox@littlebtc.xpi [2015-01-30]
FF Extension: Restart Button - C:\Users\Duc Hong\AppData\Roaming\Mozilla\Firefox\Profiles\62c9k4xd.default-1422598942125\Extensions\restartbutton@strk.jp.xpi [2015-01-30]
FF Extension: Download Status Bar - C:\Users\Duc Hong\AppData\Roaming\Mozilla\Firefox\Profiles\62c9k4xd.default-1422598942125\Extensions\{6c28e999-e900-4635-a39d-b1ec90ba0c0f}.xpi [2015-01-30]
FF Extension: Search by Image for Google - C:\Users\Duc Hong\AppData\Roaming\Mozilla\Firefox\Profiles\62c9k4xd.default-1422598942125\Extensions\{ab4b5718-3998-4a2c-91ae-18a7c2db513e}.xpi [2015-01-30]
FF Extension: Adblock Plus - C:\Users\Duc Hong\AppData\Roaming\Mozilla\Firefox\Profiles\62c9k4xd.default-1422598942125\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2015-01-30]
FF Extension: Greasemonkey - C:\Users\Duc Hong\AppData\Roaming\Mozilla\Firefox\Profiles\62c9k4xd.default-1422598942125\Extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}.xpi [2015-01-30]
FF Extension: No Name - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi [2015-05-18]
FF HKU\S-1-5-21-1926068397-2398490202-140176465-1002\...\Firefox\Extensions: [mozilla_cc@internetdownloadmanager.com] - C:\Users\Duc Hong\AppData\Roaming\IDM\idmmzcc5
FF Extension: IDM CC - C:\Users\Duc Hong\AppData\Roaming\IDM\idmmzcc5 [2015-05-30]
FF HKU\S-1-5-21-1926068397-2398490202-140176465-1002\...\SeaMonkey\Extensions: [mozilla_cc@internetdownloadmanager.com] - C:\Users\Duc Hong\AppData\Roaming\IDM\idmmzcc5

Chrome:
=======
CHR Profile: C:\Users\Duc Hong\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Docs) - C:\Users\Duc Hong\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-01-08]
CHR Extension: (Google Drive) - C:\Users\Duc Hong\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-01-08]
CHR Extension: (YouTube) - C:\Users\Duc Hong\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-01-08]
CHR Extension: (Bing) - C:\Users\Duc Hong\AppData\Local\Google\Chrome\User Data\Default\Extensions\bmkckgpgekmanipelfidlhmkfcjicion [2015-05-27]
CHR Extension: (Adblock Plus) - C:\Users\Duc Hong\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2015-03-25]
CHR Extension: (Google Search) - C:\Users\Duc Hong\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-01-08]
CHR Extension: (Bookmark Manager) - C:\Users\Duc Hong\AppData\Local\Google\Chrome\User Data\Default\Extensions\gmlllbghnfkpflemihljekbapjopfjik [2015-04-24]
CHR Extension: (Chrome Hotword Shared Module) - C:\Users\Duc Hong\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-03-18]
CHR Extension: (Skype Click to Call) - C:\Users\Duc Hong\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl [2015-05-27]
CHR Extension: (IDM Integration Module) - C:\Users\Duc Hong\AppData\Local\Google\Chrome\User Data\Default\Extensions\ngpampappnmepgilojfohadhhmbhlaek [2015-04-24]
CHR Extension: (Google Wallet) - C:\Users\Duc Hong\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-01-08]
CHR Extension: (Gmail) - C:\Users\Duc Hong\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-01-08]
CHR HKLM\...\Chrome\Extension: [ngpampappnmepgilojfohadhhmbhlaek] - C:\Program Files (x86)\Internet Download Manager\IDMGCExt.crx [2015-05-20]
CHR HKU\S-1-5-21-1926068397-2398490202-140176465-1002\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [bmkckgpgekmanipelfidlhmkfcjicion] - https://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\ChromeExtension\skype_chrome_extension.crx [2014-07-14]
CHR HKLM-x32\...\Chrome\Extension: [ngpampappnmepgilojfohadhhmbhlaek] - C:\Program Files (x86)\Internet Download Manager\IDMGCExt.crx [2015-05-20]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 ASUS FaceID Service; C:\Program Files\ASUS\ASUS FaceID\HWFaceKeyService.exe [261648 2013-10-25] (Hanwang Technology Co.,Ltd. )
R2 Asus WebStorage Windows Service; C:\Program Files (x86)\ASUS\WebStorage\2.1.2.301\AsusWSWinService.exe [71680 2014-02-25] (ASUS Cloud Corporation) [File not signed]
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [343336 2015-05-01] (Avast Software s.r.o.)
S3 BthHFSrv; C:\Windows\System32\BthHFSrv.dll [324608 2014-10-29] (Microsoft Corporation)
R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1390176 2014-07-14] (Microsoft Corporation)
R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1767520 2014-07-14] (Microsoft Corporation)
R2 DiagTrack; C:\Windows\system32\diagtrack.dll [1429504 2015-03-05] (Microsoft Corporation)
R2 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [1152656 2015-05-02] (NVIDIA Corporation)
R2 iBtSiva; C:\Program Files (x86)\Intel\Bluetooth\ibtsiva.exe [125168 2014-12-04] (Intel Corporation)
R2 Intel® Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [733696 2013-05-12] (Intel® Corporation) [File not signed]
S3 Intel® Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [822232 2013-05-12] (Intel® Corporation)
R2 Intel® ME Service; C:\Program Files (x86)\Intel\Intel® Management Engine Components\FWService\IntelMeFWService.exe [131544 2013-09-04] (Intel Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe [169432 2013-09-04] (Intel Corporation)
S2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [1080120 2015-04-14] (Malwarebytes Corporation)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [268192 2014-12-04] ()
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1884304 2015-05-02] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [22997648 2015-05-02] (NVIDIA Corporation)
S3 rpcapd; C:\Program Files (x86)\WinPcap\rpcapd.exe [118520 2013-03-01] (Riverbed Technology, Inc.)
R2 SEVPNCLIENT; C:\Program Files\SoftEther VPN Client\vpnclient_x64.exe [4374072 2015-01-21] (SoftEther VPN Project at University of Tsukuba, Japan.)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [366520 2015-02-04] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2015-02-04] (Microsoft Corporation)
R2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [3820960 2014-12-04] (Intel® Corporation)
S3 AvastVBoxSvc; C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe [X]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29168 2015-05-01] ()
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [89944 2015-05-01] (Avast Software s.r.o.)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93528 2015-05-01] (Avast Software s.r.o.)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65736 2015-05-01] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1047320 2015-05-01] (Avast Software s.r.o.)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [442264 2015-05-01] (Avast Software s.r.o.)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [137288 2015-05-01] (Avast Software s.r.o.)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [272248 2015-05-01] ()
R3 ATP; C:\Windows\System32\drivers\AsusTP.sys [70928 2014-02-14] (ASUS Corporation)
S3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [226304 2014-03-18] (Microsoft Corporation)
S3 btmaux; C:\Windows\system32\DRIVERS\btmaux.sys [141624 2014-10-28] (Motorola Solutions, Inc.)
R3 btmhsf; C:\Windows\system32\DRIVERS\btmhsf.sys [1448248 2014-11-26] (Motorola Solutions, Inc.)
S3 cleanhlp; C:\EEK\bin\cleanhlp64.sys [57024 2015-05-29] (Emsisoft GmbH)
S3 DrvAgent64; C:\Windows\SysWOW64\Drivers\DrvAgent64.SYS [13824 2015-05-17] (Phoenix Technologies) [File not signed]
R1 dtsoftbus01; C:\Windows\System32\drivers\dtsoftbus01.sys [283064 2015-01-08] (Disc Soft Ltd)
R3 ibtusb; C:\Windows\system32\DRIVERS\ibtusb.sys [230128 2014-12-04] (Intel Corporation)
R3 kbfiltr; C:\Windows\System32\drivers\kbfiltr.sys [17280 2012-08-06] ( )
S3 ManyCam; C:\Windows\system32\DRIVERS\mcvidrv.sys [49272 2014-12-29] (Visicom Media Inc.)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-04-14] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [64216 2015-04-14] (Malwarebytes Corporation)
S3 mcaudrv_simple; C:\Windows\system32\drivers\mcaudrv_x64.sys [35960 2014-12-29] (Visicom Media Inc.)
R3 MEIx64; C:\Windows\system32\DRIVERS\TeeDriverx64.sys [99288 2013-09-04] (Intel Corporation)
R3 Neo_VPN2; C:\Windows\system32\DRIVERS\Neo_VPN2.sys [28768 2015-01-14] (SoftEther VPN Project at University of Tsukuba, Japan.)
R3 NETwNb64; C:\Windows\system32\DRIVERS\Netwbw02.sys [3494680 2014-12-08] (Intel Corporation)
S3 NETwNe64; C:\Windows\system32\DRIVERS\NETwew02.sys [4649440 2013-06-19] (Intel Corporation)
R2 NPF; C:\Windows\System32\drivers\npf.sys [36600 2013-03-01] (Riverbed Technology, Inc.)
R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [19600 2015-05-02] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\Windows\system32\drivers\nvvad64v.sys [38032 2014-11-22] (NVIDIA Corporation)
R2 plctrl; C:\Program Files\ASUS\P4G\plctrl.sys [14136 2014-02-12] (Windows ® Win 7 DDK provider)
R1 SeLow; C:\Windows\system32\DRIVERS\SeLow_x64.sys [38368 2015-01-21] (SoftEther VPN Project at University of Tsukuba, Japan.)
U5 UnlockerDriver5; C:\Program Files\Unlocker\UnlockerDriver5.sys [12352 2010-07-02] ()
R3 vmkbd2; C:\Windows\system32\drivers\VMkbd.sys [33472 2015-02-06] (VMware, Inc.)
R0 vsock; C:\Windows\System32\drivers\vsock.sys [76480 2015-01-07] (VMware, Inc.)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2015-02-04] (Microsoft Corporation)
U0 msahci; system32\drivers\msahci.sys
S2 VBoxAswDrv; \??\C:\Program Files\AVAST Software\Avast\ng\vbox\VBoxAswDrv.sys [X]
S3 WinRing0_1_2_0; \??\C:\Program Files (x86)\BatteryCare\WinRing0x64.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-05-30 14:16 - 2015-05-30 14:49 - 00092773 _____ () C:\Windows\WindowsUpdate.log
2015-05-30 14:15 - 2015-05-30 14:16 - 00000348 _____ () C:\Windows\setupact.log
2015-05-30 14:15 - 2015-05-30 14:15 - 00000354 _____ () C:\Windows\PFRO.log
2015-05-30 14:15 - 2015-05-30 14:15 - 00000000 _____ () C:\Windows\setuperr.log
2015-05-29 17:17 - 2015-05-29 17:17 - 00000000 ____D () C:\Program Files (x86)\ESET
2015-05-29 14:59 - 2015-05-29 15:01 - 00000000 ____D () C:\EEK
2015-05-28 07:02 - 2015-05-30 14:16 - 00002908 _____ () C:\Windows\System32\Tasks\AutoKMS
2015-05-28 06:58 - 2015-05-30 17:19 - 00000000 ____D () C:\Users\Duc Hong\Desktop\FRST
2015-05-28 01:11 - 2015-05-29 23:10 - 00000000 ____D () C:\Program Files (x86)\Secunia
2015-05-28 00:08 - 2015-05-30 17:19 - 00000000 ____D () C:\FRST
2015-05-27 19:03 - 2015-05-27 19:03 - 00097888 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2015-05-27 19:03 - 2015-05-27 19:03 - 00000000 ____D () C:\Program Files (x86)\Java
2015-05-27 17:25 - 2015-05-27 17:25 - 00001073 _____ () C:\Users\Duc Hong\Desktop\Notepad++.lnk
2015-05-27 16:52 - 2015-05-27 16:52 - 00002062 _____ () C:\Users\Duc Hong\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\FileHippo App Manager.lnk
2015-05-27 16:52 - 2015-05-27 16:52 - 00000000 ____D () C:\ProgramData\IsolatedStorage
2015-05-27 16:52 - 2015-05-27 16:52 - 00000000 ____D () C:\Program Files (x86)\FileHippo.com
2015-05-26 17:00 - 2015-05-26 17:07 - 00010620 _____ () C:\Users\Duc Hong\Documents\My Movie.wlmp
2015-05-26 16:04 - 2015-05-26 16:04 - 00000000 ____D () C:\Windows\en
2015-05-26 16:03 - 2015-05-26 16:03 - 00002504 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live Messenger.lnk
2015-05-26 16:03 - 2015-05-26 16:03 - 00001476 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live Mail.lnk
2015-05-26 16:03 - 2015-05-26 16:03 - 00001392 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Photo Gallery.lnk
2015-05-26 16:03 - 2015-05-26 16:03 - 00001323 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Movie Maker.lnk
2015-05-26 16:03 - 2015-05-26 16:03 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live
2015-05-26 16:03 - 2015-05-26 16:03 - 00000000 ____D () C:\Program Files\Windows Live
2015-05-26 16:03 - 2015-05-26 16:03 - 00000000 ____D () C:\Program Files (x86)\Microsoft SQL Server Compact Edition
2015-05-26 16:01 - 2015-05-26 16:03 - 00000000 ____D () C:\Program Files (x86)\Windows Live
2015-05-26 16:01 - 2015-05-26 16:01 - 00003108 _____ () C:\Windows\System32\Tasks\Microsoft OneDrive Auto Update Task-S-1-5-21-1926068397-2398490202-140176465-1002
2015-05-26 16:01 - 2015-05-26 16:01 - 00000000 ___RD () C:\Users\Duc Hong\OneDrive
2015-05-26 16:00 - 2015-05-26 16:00 - 00000000 ____D () C:\ProgramData\Microsoft OneDrive
2015-05-26 15:59 - 2015-05-26 16:56 - 00000000 ____D () C:\Users\Duc Hong\AppData\Local\Windows Live
2015-05-26 15:56 - 2015-05-26 16:56 - 00000000 ____D () C:\Users\Duc Hong\AppData\Roaming\avidemux
2015-05-26 15:56 - 2015-05-26 15:56 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avidemux (64bits)
2015-05-25 23:37 - 2015-04-16 16:17 - 00325464 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\USBXHCI.SYS
2015-05-25 23:37 - 2015-04-14 08:37 - 00275968 _____ (Microsoft Corporation) C:\Windows\system32\authz.dll
2015-05-25 23:37 - 2015-04-14 08:34 - 00180224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authz.dll
2015-05-25 23:37 - 2015-04-10 10:40 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\UIAutomationCore.dll
2015-05-25 23:37 - 2015-04-10 10:17 - 01018880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\UIAutomationCore.dll
2015-05-25 23:37 - 2015-04-09 08:41 - 00158720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rgb9rast.dll
2015-05-25 23:37 - 2015-04-02 08:42 - 03097600 _____ (Microsoft Corporation) C:\Windows\system32\msftedit.dll
2015-05-25 23:37 - 2015-04-02 08:30 - 02483712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msftedit.dll
2015-05-25 23:37 - 2015-04-01 14:21 - 00337408 _____ (Microsoft Corporation) C:\Windows\system32\SearchProtocolHost.exe
2015-05-25 23:37 - 2015-04-01 14:18 - 00468480 _____ (Microsoft Corporation) C:\Windows\system32\mssph.dll
2015-05-25 23:37 - 2015-04-01 14:17 - 00248832 _____ (Microsoft Corporation) C:\Windows\system32\mssphtb.dll
2015-05-25 23:37 - 2015-04-01 14:08 - 00774144 _____ (Microsoft Corporation) C:\Windows\system32\mssvp.dll
2015-05-25 23:37 - 2015-04-01 13:46 - 03633664 _____ (Microsoft Corporation) C:\Windows\system32\tquery.dll
2015-05-25 23:37 - 2015-04-01 13:17 - 02551808 _____ (Microsoft Corporation) C:\Windows\system32\mssrch.dll
2015-05-25 23:37 - 2015-04-01 13:17 - 00903168 _____ (Microsoft Corporation) C:\Windows\system32\SearchIndexer.exe
2015-05-25 23:37 - 2015-04-01 12:53 - 00391680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mssph.dll
2015-05-25 23:37 - 2015-04-01 12:53 - 00272896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SearchProtocolHost.exe
2015-05-25 23:37 - 2015-04-01 12:45 - 02749952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tquery.dll
2015-05-25 23:37 - 2015-04-01 12:45 - 00699392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mssvp.dll
2015-05-25 23:37 - 2015-04-01 12:14 - 01920000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mssrch.dll
2015-05-25 23:37 - 2015-04-01 12:12 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SearchIndexer.exe
2015-05-25 23:37 - 2015-03-20 13:49 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\compstui.dll
2015-05-25 23:37 - 2015-03-20 13:08 - 00477184 _____ (Microsoft Corporation) C:\Windows\system32\puiobj.dll
2015-05-25 23:37 - 2015-03-20 12:37 - 00367104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\puiobj.dll
2015-05-25 23:37 - 2015-03-20 12:07 - 01091072 _____ (Microsoft Corporation) C:\Windows\system32\localspl.dll
2015-05-25 23:37 - 2015-03-02 11:43 - 00222208 _____ (Microsoft Corporation) C:\Windows\system32\rastapi.dll
2015-05-25 23:37 - 2015-03-02 11:21 - 00207872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rastapi.dll
2015-05-25 03:29 - 2015-05-25 03:29 - 00000000 ____D () C:\Users\Duc Hong\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Ubisoft
2015-05-25 03:29 - 2015-05-25 03:29 - 00000000 ____D () C:\Users\Duc Hong\AppData\Local\Ubisoft Game Launcher
2015-05-25 03:29 - 2015-05-25 03:29 - 00000000 ____D () C:\Program Files (x86)\Ubisoft
2015-05-23 15:12 - 2015-05-23 15:12 - 00000000 ____D () C:\Users\Duc Hong\AppData\Roaming\Aegisub
2015-05-20 23:57 - 2015-05-20 22:55 - 00197616 _____ (Tonec Inc.) C:\Windows\system32\Drivers\idmwfp.sys
2015-05-20 18:18 - 2015-05-20 18:53 - 00001004 _____ () C:\Users\Duc Hong\Desktop\Logic and stuffs.java
2015-05-19 04:49 - 2015-05-19 09:21 - 00000000 ____D () C:\Users\Duc Hong\Documents\Witcher 2
2015-05-19 04:49 - 2015-05-19 04:49 - 00000000 ____D () C:\Users\Duc Hong\AppData\Local\The Witcher 2
2015-05-19 04:46 - 2015-05-19 04:46 - 00000000 ____D () C:\Users\Duc Hong\Documents\Rockstar Games
2015-05-19 04:46 - 2015-05-19 04:46 - 00000000 ____D () C:\Users\Duc Hong\AppData\Local\Rockstar Games
2015-05-19 04:45 - 2015-05-19 04:45 - 00000000 ____D () C:\ProgramData\Socialclub
2015-05-18 18:21 - 2015-05-18 18:21 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-05-18 17:10 - 2015-05-18 17:10 - 00000000 ____D () C:\Users\Default\AppData\Local\NVIDIA Corporation
2015-05-18 17:10 - 2015-05-18 17:10 - 00000000 ____D () C:\Users\Default\AppData\Local\NVIDIA
2015-05-18 17:10 - 2015-05-18 17:10 - 00000000 ____D () C:\Users\Default User\AppData\Local\NVIDIA Corporation
2015-05-18 17:10 - 2015-05-18 17:10 - 00000000 ____D () C:\Users\Default User\AppData\Local\NVIDIA
2015-05-18 05:43 - 2015-05-01 06:35 - 00124112 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll
2015-05-18 05:43 - 2015-05-01 06:35 - 00102608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PresentationCFFRasterizerNative_v0300.dll
2015-05-18 05:36 - 2015-04-10 10:34 - 02256896 _____ (Microsoft Corporation) C:\Windows\system32\dwmcore.dll
2015-05-18 05:36 - 2015-04-10 10:11 - 01943040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dwmcore.dll
2015-05-18 05:35 - 2015-05-01 09:05 - 00429568 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-05-18 05:35 - 2015-05-01 08:48 - 00358912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2015-05-18 05:35 - 2015-04-25 07:32 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\UtcResources.dll
2015-05-18 05:35 - 2015-04-22 03:14 - 24971776 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-05-18 05:35 - 2015-04-22 02:50 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-05-18 05:35 - 2015-04-22 02:50 - 00417792 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2015-05-18 05:35 - 2015-04-22 02:49 - 02885120 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-05-18 05:35 - 2015-04-22 02:37 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-05-18 05:35 - 2015-04-22 02:35 - 00816640 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-05-18 05:35 - 2015-04-22 02:31 - 06025728 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-05-18 05:35 - 2015-04-22 02:24 - 19691008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-05-18 05:35 - 2015-04-22 02:13 - 00107520 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
2015-05-18 05:35 - 2015-04-22 02:11 - 00504320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-05-18 05:35 - 2015-04-22 02:09 - 00341504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2015-05-18 05:35 - 2015-04-22 02:08 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-05-18 05:35 - 2015-04-22 02:07 - 00145408 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll
2015-05-18 05:35 - 2015-04-22 02:05 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-05-18 05:35 - 2015-04-22 02:04 - 02278400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-05-18 05:35 - 2015-04-22 01:59 - 01032704 _____ (Microsoft Corporation) C:\Windows\system32\inetcomm.dll
2015-05-18 05:35 - 2015-04-22 01:58 - 00664576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2015-05-18 05:35 - 2015-04-22 01:52 - 00262144 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2015-05-18 05:35 - 2015-04-22 01:49 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-05-18 05:35 - 2015-04-22 01:49 - 00720384 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-05-18 05:35 - 2015-04-22 01:49 - 00374272 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-05-18 05:35 - 2015-04-22 01:46 - 02125824 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-05-18 05:35 - 2015-04-22 01:40 - 14401536 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-05-18 05:35 - 2015-04-22 01:38 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2015-05-18 05:35 - 2015-04-22 01:37 - 00128000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll
2015-05-18 05:35 - 2015-04-22 01:36 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2015-05-18 05:35 - 2015-04-22 01:32 - 00880128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcomm.dll
2015-05-18 05:35 - 2015-04-22 01:31 - 04305920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-05-18 05:35 - 2015-04-22 01:28 - 00230400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2015-05-18 05:35 - 2015-04-22 01:27 - 02352128 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-05-18 05:35 - 2015-04-22 01:26 - 00688640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-05-18 05:35 - 2015-04-22 01:26 - 00327168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2015-05-18 05:35 - 2015-04-22 01:25 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-05-18 05:35 - 2015-04-22 01:17 - 12828672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-05-18 05:35 - 2015-04-22 01:15 - 01547264 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-05-18 05:35 - 2015-04-22 01:03 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-05-18 05:35 - 2015-04-22 01:02 - 01882112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-05-18 05:35 - 2015-04-22 00:58 - 01310208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-05-18 05:35 - 2015-04-22 00:56 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2015-05-18 05:35 - 2015-04-14 08:48 - 04180480 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-05-18 05:35 - 2015-04-10 11:00 - 01996800 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2015-05-18 05:35 - 2015-04-10 10:50 - 01387008 _____ (Microsoft Corporation) C:\Windows\system32\FntCache.dll
2015-05-18 05:35 - 2015-04-10 10:26 - 01560576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll
2015-05-18 05:35 - 2015-04-09 08:55 - 00410128 _____ (Microsoft Corporation) C:\Windows\system32\services.exe
2015-05-18 05:35 - 2015-03-30 15:47 - 00561928 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2015-05-18 05:35 - 2015-03-27 13:27 - 00445440 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll
2015-05-18 05:35 - 2015-03-27 12:50 - 00324096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certcli.dll
2015-05-18 05:35 - 2015-03-27 12:48 - 01441792 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-05-18 05:35 - 2015-03-20 11:56 - 00080384 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ahcache.sys
2015-05-18 05:35 - 2015-03-13 11:11 - 02162176 _____ (Microsoft Corporation) C:\Windows\system32\SRH.dll
2015-05-18 05:35 - 2015-03-13 10:39 - 01812992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SRH.dll
2015-05-18 05:35 - 2015-03-13 10:29 - 00410017 _____ () C:\Windows\system32\ApnDatabase.xml
2015-05-18 05:35 - 2015-03-05 09:09 - 01429504 _____ (Microsoft Corporation) C:\Windows\system32\diagtrack.dll
2015-05-17 19:44 - 2015-05-17 19:44 - 00000000 ____H () C:\Users\Duc Hong\Documents\Default.rdp
2015-05-17 02:42 - 2015-05-17 07:57 - 00000000 ____D () C:\Program Files (x86)\eSupport.com
2015-05-17 02:42 - 2015-05-17 02:42 - 00013824 _____ (Phoenix Technologies) C:\Windows\SysWOW64\Drivers\DrvAgent64.SYS
2015-05-17 02:42 - 2015-05-17 02:42 - 00000000 ____D () C:\Users\Duc Hong\AppData\Local\eSupport.com
2015-05-16 22:44 - 2015-05-16 22:44 - 00014480 _____ () C:\Windows\system32\Drivers\nvflash.sys
2015-05-16 22:34 - 2015-05-16 22:34 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Oracle VM VirtualBox
2015-05-16 22:34 - 2015-05-13 17:11 - 00922704 _____ (Oracle Corporation) C:\Windows\system32\Drivers\VBoxDrv.sys
2015-05-16 22:34 - 2015-05-13 17:10 - 00128592 _____ (Oracle Corporation) C:\Windows\system32\Drivers\VBoxUSBMon.sys
2015-05-13 21:21 - 2015-05-13 21:21 - 00000000 ____D () C:\Users\Duc Hong\AppData\Roaming\Mediatronic
2015-05-13 21:17 - 2015-05-26 17:27 - 00000000 ____D () C:\Users\Duc Hong\Desktop\New folder
2015-05-13 17:10 - 2015-05-13 17:10 - 00141440 _____ (Oracle Corporation) C:\Windows\system32\Drivers\VBoxNetAdp.sys
2015-05-11 18:25 - 2015-05-11 18:25 - 00019851 _____ () C:\Users\Duc Hong\Desktop\ListOf4V2.java
2015-05-11 17:26 - 2015-05-29 14:18 - 00003474 _____ () C:\Windows\System32\Tasks\ASUS Live Update1
2015-05-11 17:26 - 2015-05-11 17:26 - 00003382 _____ () C:\Windows\System32\Tasks\Update Checker
2015-05-09 14:32 - 2015-05-09 14:32 - 00000218 _____ () C:\Users\Duc Hong\AppData\Local\recently-used.xbel
2015-05-09 14:31 - 2015-05-09 14:31 - 00000000 ____D () C:\ProgramData\InstallShield
2015-05-09 14:30 - 2015-05-09 14:33 - 00000000 ____D () C:\Users\Duc Hong\AppData\Roaming\driveridentifier
2015-05-07 20:59 - 2015-05-07 21:00 - 00022659 _____ () C:\Users\Duc Hong\Desktop\ListofNV.java
2015-05-06 20:19 - 2015-05-06 20:19 - 00012476 _____ () C:\Users\Duc Hong\Downloads\Smartphone-OS-rundown.odt
2015-05-06 18:14 - 2015-05-06 18:14 - 00000000 ____D () C:\Users\Duc Hong\Documents\OneNote Notebooks
2015-05-05 06:18 - 2015-05-05 06:18 - 00000000 ____D () C:\Users\Duc Hong\AppData\Local\ali213GameLauncher
2015-05-04 18:52 - 2015-05-26 16:39 - 00000000 ____D () C:\Users\Duc Hong\Tracing
2015-05-04 18:47 - 2015-05-29 16:10 - 00000000 ____D () C:\Users\Duc Hong\AppData\Roaming\Skype
2015-05-04 18:47 - 2015-05-04 18:47 - 00000000 ___RD () C:\Program Files (x86)\Skype
2015-05-04 18:47 - 2015-05-04 18:47 - 00000000 ____D () C:\Users\Duc Hong\AppData\Local\Skype
2015-05-04 18:47 - 2015-05-04 18:47 - 00000000 ____D () C:\ProgramData\Skype
2015-05-04 18:47 - 2015-05-04 18:47 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2015-05-04 18:47 - 2015-05-04 18:47 - 00000000 ____D () C:\extensions
2015-05-02 21:29 - 2010-06-02 04:55 - 00527192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_7.dll
2015-05-02 21:29 - 2010-06-02 04:55 - 00239960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_7.dll
2015-05-02 21:29 - 2010-06-02 04:55 - 00074072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_5.dll
2015-05-02 21:29 - 2010-05-26 11:41 - 02106216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_43.dll
2015-05-02 21:29 - 2010-05-26 11:41 - 01998168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_43.dll
2015-05-02 21:29 - 2010-05-26 11:41 - 01868128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dcsx_43.dll
2015-05-02 21:29 - 2010-05-26 11:41 - 00470880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_43.dll
2015-05-02 21:29 - 2010-05-26 11:41 - 00248672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx11_43.dll
2015-05-02 21:29 - 2010-02-04 10:01 - 00528216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_6.dll
2015-05-02 21:29 - 2010-02-04 10:01 - 00238936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_6.dll
2015-05-02 21:29 - 2010-02-04 10:01 - 00074072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_4.dll
2015-05-02 21:29 - 2010-02-04 10:01 - 00022360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\X3DAudio1_7.dll
2015-05-02 21:29 - 2009-09-04 17:44 - 00515416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_5.dll
2015-05-02 21:29 - 2009-09-04 17:44 - 00238936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_5.dll
2015-05-02 21:29 - 2009-09-04 17:29 - 05501792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dcsx_42.dll
2015-05-02 21:29 - 2009-09-04 17:29 - 01974616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_42.dll
2015-05-02 21:29 - 2009-09-04 17:29 - 01892184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_42.dll
2015-05-02 21:29 - 2009-09-04 17:29 - 00453456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_42.dll
2015-05-02 21:29 - 2009-09-04 17:29 - 00235344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx11_42.dll
2015-05-02 21:28 - 2009-09-04 17:44 - 00069464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_3.dll
2015-05-02 21:28 - 2009-03-16 14:18 - 00517448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_4.dll
2015-05-02 21:28 - 2009-03-16 14:18 - 00235352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_4.dll
2015-05-02 21:28 - 2009-03-16 14:18 - 00022360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\X3DAudio1_6.dll
2015-05-02 21:28 - 2009-03-09 15:27 - 04178264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_41.dll
2015-05-02 21:28 - 2009-03-09 15:27 - 01846632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_41.dll
2015-05-02 21:28 - 2009-03-09 15:27 - 00453456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_41.dll
2015-05-02 21:28 - 2008-10-27 10:04 - 00514384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_3.dll
2015-05-02 21:28 - 2008-10-27 10:04 - 00235856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_3.dll
2015-05-02 21:28 - 2008-10-27 10:04 - 00070992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_2.dll
2015-05-02 21:28 - 2008-10-27 10:04 - 00023376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\X3DAudio1_5.dll
2015-05-02 21:28 - 2008-10-15 06:22 - 04379984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_40.dll
2015-05-02 21:28 - 2008-10-15 06:22 - 02036576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_40.dll
2015-05-02 21:28 - 2008-10-15 06:22 - 00452440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_40.dll
2015-05-02 21:28 - 2008-07-31 10:41 - 00238088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_2.dll
2015-05-02 21:28 - 2008-07-31 10:41 - 00068616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_1.dll
2015-05-02 21:28 - 2008-07-31 10:40 - 00509448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_2.dll
2015-05-02 21:28 - 2008-07-10 11:01 - 00467984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_39.dll
2015-05-02 21:28 - 2008-07-10 11:00 - 03851784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_39.dll
2015-05-02 21:28 - 2008-07-10 11:00 - 01493528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_39.dll
2015-05-02 21:28 - 2008-05-30 14:19 - 00507400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_1.dll
2015-05-02 21:28 - 2008-05-30 14:18 - 00238088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_1.dll
2015-05-02 21:28 - 2008-05-30 14:17 - 00065032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_0.dll
2015-05-02 21:28 - 2008-05-30 14:17 - 00025608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\X3DAudio1_4.dll
2015-05-02 21:28 - 2008-05-30 14:11 - 03850760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_38.dll
2015-05-02 21:28 - 2008-05-30 14:11 - 01491992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_38.dll
2015-05-02 21:28 - 2008-05-30 14:11 - 00467984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_38.dll
2015-05-02 21:28 - 2008-03-05 16:03 - 00479752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_0.dll
2015-05-02 21:28 - 2008-03-05 16:03 - 00238088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_0.dll
2015-05-02 21:28 - 2008-03-05 16:00 - 00025608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\X3DAudio1_3.dll
2015-05-02 21:28 - 2008-03-05 15:56 - 03786760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_37.dll
2015-05-02 21:28 - 2008-03-05 15:56 - 01420824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_37.dll
2015-05-02 21:28 - 2008-02-05 23:07 - 00462864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_37.dll
2015-05-02 21:28 - 2007-10-22 03:39 - 00267272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_10.dll
2015-05-02 21:28 - 2007-10-22 03:37 - 00017928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\X3DAudio1_2.dll
2015-05-02 21:28 - 2007-10-12 15:14 - 03734536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_36.dll
2015-05-02 21:28 - 2007-10-12 15:14 - 01374232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_36.dll
2015-05-02 21:28 - 2007-10-02 09:56 - 00444776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_36.dll
2015-05-02 21:28 - 2007-07-20 00:57 - 00267112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_9.dll
2015-05-02 21:28 - 2007-07-19 18:14 - 03727720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_35.dll
2015-05-02 21:28 - 2007-07-19 18:14 - 01358192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_35.dll
2015-05-02 21:28 - 2007-07-19 18:14 - 00444776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_35.dll
2015-05-02 21:28 - 2007-06-20 20:46 - 00266088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_8.dll
2015-05-02 21:28 - 2007-05-16 16:45 - 03497832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_34.dll
2015-05-02 21:28 - 2007-05-16 16:45 - 01124720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_34.dll
2015-05-02 21:28 - 2007-05-16 16:45 - 00443752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_34.dll
2015-05-02 21:28 - 2007-04-04 18:55 - 00261480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_7.dll
2015-05-02 21:28 - 2007-04-04 18:53 - 00081768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xinput1_3.dll
2015-05-02 21:28 - 2007-03-15 16:57 - 00443752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_33.dll
2015-05-02 21:28 - 2007-03-12 16:42 - 03495784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_33.dll
2015-05-02 21:28 - 2007-03-12 16:42 - 01123696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_33.dll
2015-05-02 21:28 - 2007-03-05 12:42 - 00015128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\x3daudio1_1.dll
2015-05-02 21:28 - 2007-01-24 15:27 - 00255848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_6.dll
2015-05-02 21:28 - 2006-12-08 12:02 - 00251672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_5.dll
2015-05-02 21:28 - 2006-11-29 13:06 - 03426072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_32.dll
2015-05-02 21:28 - 2006-11-29 13:06 - 00440080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10.dll
2015-05-02 21:28 - 2006-09-28 16:05 - 02414360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_31.dll
2015-05-02 21:28 - 2006-09-28 16:05 - 00237848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_4.dll
2015-05-02 21:28 - 2006-07-28 09:30 - 00236824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_3.dll
2015-05-02 21:28 - 2006-07-28 09:30 - 00062744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xinput1_2.dll
2015-05-02 21:28 - 2006-05-31 07:24 - 00230168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_2.dll
2015-05-02 21:28 - 2006-03-31 12:40 - 02388176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_30.dll
2015-05-02 21:28 - 2006-03-31 12:39 - 00229584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_1.dll
2015-05-02 21:28 - 2006-03-31 12:39 - 00062672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xinput1_1.dll
2015-05-02 21:28 - 2006-02-03 08:43 - 02332368 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_29.dll
2015-05-02 21:28 - 2006-02-03 08:42 - 00230096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_0.dll
2015-05-02 21:28 - 2006-02-03 08:41 - 00014032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\x3daudio1_0.dll
2015-05-02 21:28 - 2005-12-05 18:09 - 02323664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_28.dll
2015-05-02 21:28 - 2005-07-22 19:59 - 02319568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_27.dll
2015-05-02 21:28 - 2005-05-26 15:34 - 02297552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_26.dll
2015-05-02 21:28 - 2005-03-18 17:19 - 02337488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_25.dll
2015-05-02 21:28 - 2005-02-05 19:45 - 02222800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_24.dll
2015-05-01 18:45 - 2015-03-18 03:26 - 00467776 ____C (Microsoft Corporation) C:\Windows\system32\Drivers\USBHUB3.SYS
2015-05-01 18:45 - 2015-03-09 12:02 - 00057856 ____C (Microsoft Corporation) C:\Windows\system32\Drivers\bthhfenum.sys
2015-05-01 18:45 - 2015-01-06 13:01 - 00072192 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ndproxy.sys
2015-05-01 18:45 - 2015-01-06 12:59 - 00080896 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\wanarp.sys
2015-05-01 18:45 - 2015-01-06 11:12 - 00185856 _____ (Microsoft Corporation) C:\Windows\system32\rascfg.dll
2015-05-01 18:45 - 2015-01-06 11:02 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rascfg.dll
2015-05-01 18:44 - 2015-04-03 10:35 - 00445440 _____ (Microsoft Corporation) C:\Windows\system32\PhotoMetadataHandler.dll
2015-05-01 18:44 - 2015-04-03 10:14 - 00364544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PhotoMetadataHandler.dll
2015-05-01 18:44 - 2015-04-02 08:22 - 02985984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dbgeng.dll
2015-05-01 18:44 - 2015-04-02 08:20 - 04417536 _____ (Microsoft Corporation) C:\Windows\system32\dbgeng.dll
2015-05-01 18:44 - 2015-04-01 13:45 - 01491456 _____ (Microsoft Corporation) C:\Windows\system32\dbghelp.dll
2015-05-01 18:44 - 2015-04-01 12:31 - 01207296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dbghelp.dll
2015-05-01 18:44 - 2015-03-24 07:59 - 07476032 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-05-01 18:44 - 2015-03-24 07:59 - 01733952 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2015-05-01 18:44 - 2015-03-24 07:59 - 00360480 _____ (Microsoft Corporation) C:\Windows\system32\sechost.dll
2015-05-01 18:44 - 2015-03-24 07:58 - 01498872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2015-05-01 18:44 - 2015-03-24 07:45 - 00257216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sechost.dll
2015-05-01 18:44 - 2015-03-20 14:12 - 00246272 _____ (Microsoft Corporation) C:\Windows\system32\microsoft-windows-system-events.dll
2015-05-01 18:44 - 2015-03-20 14:10 - 00285184 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2015-05-01 18:44 - 2015-03-20 14:10 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2015-05-01 18:44 - 2015-03-20 13:17 - 00411648 _____ (Microsoft Corporation) C:\Windows\system32\tracerpt.exe
2015-05-01 18:44 - 2015-03-20 12:41 - 00369152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tracerpt.exe
2015-05-01 18:44 - 2015-03-20 12:40 - 00950784 _____ (Microsoft Corporation) C:\Windows\system32\tdh.dll
2015-05-01 18:44 - 2015-03-20 12:16 - 00749568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdh.dll
2015-05-01 18:44 - 2015-03-13 12:58 - 00259072 _____ (Microsoft Corporation) C:\Windows\system32\pku2u.dll
2015-05-01 18:44 - 2015-03-13 12:37 - 00208896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pku2u.dll
2015-05-01 18:44 - 2015-03-06 12:47 - 01696256 _____ (Microsoft Corporation) C:\Windows\system32\wevtsvc.dll
2015-05-01 18:44 - 2015-03-04 11:32 - 00172544 _____ (Microsoft Corporation) C:\Windows\system32\Windows.UI.Input.Inking.dll
2015-05-01 18:44 - 2015-03-04 11:12 - 00141824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.UI.Input.Inking.dll
2015-05-01 18:44 - 2015-01-30 10:53 - 02819584 _____ (Microsoft Corporation) C:\Windows\system32\SettingsHandlers.dll
2015-05-01 18:44 - 2014-11-18 06:17 - 00672984 _____ (Microsoft Corporation) C:\Windows\system32\MDMAgent.exe
2015-05-01 18:44 - 2014-11-18 06:17 - 00273240 _____ (Microsoft Corporation) C:\Windows\system32\SystemSettingsAdminFlows.exe
2015-05-01 18:44 - 2014-11-14 16:58 - 00116736 _____ (Microsoft Corporation) C:\Windows\system32\SystemSettingsDatabase.dll
2015-05-01 18:44 - 2014-11-14 16:54 - 00463872 _____ (Microsoft Corporation) C:\Windows\system32\SystemSettings.Handlers.dll
2015-05-01 18:44 - 2014-11-14 16:46 - 02171904 _____ (Microsoft Corporation) C:\Windows\system32\SystemSettingsAdminFlowUI.dll
2015-05-01 18:43 - 2015-03-11 11:49 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\sdbinst.exe
2015-05-01 18:43 - 2015-03-11 11:09 - 00021504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sdbinst.exe
2015-05-01 18:42 - 2015-03-13 14:03 - 00239424 ____C (Microsoft Corporation) C:\Windows\system32\Drivers\sdbus.sys
2015-05-01 18:42 - 2015-03-13 14:03 - 00154432 ____C (Microsoft Corporation) C:\Windows\system32\Drivers\dumpsd.sys
2015-05-01 18:42 - 2015-03-06 13:08 - 02067968 _____ (Microsoft Corporation) C:\Windows\system32\wpdshext.dll
2015-05-01 18:42 - 2015-03-06 12:43 - 01969664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wpdshext.dll
2015-05-01 18:42 - 2015-03-04 20:25 - 00377152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\clfs.sys
2015-05-01 18:42 - 2015-03-04 13:04 - 00075264 _____ (Microsoft Corporation) C:\Windows\system32\clfsw32.dll
2015-05-01 18:42 - 2015-03-04 12:19 - 00058880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\clfsw32.dll
2015-05-01 18:42 - 2015-02-24 18:32 - 00991552 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\http.sys
2015-05-01 18:39 - 2015-02-18 09:19 - 00186368 _____ (Microsoft Corporation) C:\Windows\system32\dpapisrv.dll
2015-05-01 18:20 - 2015-03-13 12:02 - 00316416 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\udfs.sys
2015-05-01 16:28 - 2015-05-01 16:28 - 00364472 _____ (Avast Software s.r.o.) C:\Windows\system32\aswBoot.exe
2015-05-01 16:28 - 2015-05-01 16:28 - 00043112 _____ (Avast Software s.r.o.) C:\Windows\avastSS.scr
2015-04-30 23:17 - 2015-02-06 17:40 - 00066752 _____ (VMware, Inc.) C:\Windows\system32\Drivers\vmx86.sys
2015-04-30 23:16 - 2015-02-06 17:39 - 00033472 _____ (VMware, Inc.) C:\Windows\system32\Drivers\VMkbd.sys
2015-04-30 23:15 - 2015-02-06 17:40 - 00438464 _____ (VMware, Inc.) C:\Windows\SysWOW64\vmnat.exe
2015-04-30 23:15 - 2015-02-06 17:40 - 00359104 _____ (VMware, Inc.) C:\Windows\SysWOW64\vmnetdhcp.exe
2015-04-30 23:15 - 2015-02-06 17:40 - 00026816 _____ (VMware, Inc.) C:\Windows\system32\Drivers\vmnetuserif.sys
2015-04-30 23:15 - 2015-02-06 17:39 - 00931008 _____ (VMware, Inc.) C:\Windows\system32\vnetlib64.dll
2015-04-30 17:21 - 2015-04-30 17:21 - 00003939 _____ () C:\Users\Duc Hong\Desktop\bubblesortsolution.java

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-05-30 17:00 - 2013-08-23 01:36 - 00000000 ____D () C:\Windows\system32\sru
2015-05-30 16:21 - 2015-04-17 17:11 - 00000944 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1926068397-2398490202-140176465-1002UA.job
2015-05-30 14:26 - 2015-04-20 17:38 - 00003598 _____ () C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-1926068397-2398490202-140176465-1002
2015-05-30 14:22 - 2015-01-07 20:14 - 00000074 _____ () C:\Users\Duc Hong\AppData\Roaming\sp_data.sys
2015-05-30 14:21 - 2015-01-08 16:51 - 00000926 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-05-30 14:16 - 2015-03-04 16:42 - 00000000 ____D () C:\ProgramData\VMware
2015-05-30 14:16 - 2015-01-14 15:54 - 00000000 ____D () C:\Program Files\SoftEther VPN Client
2015-05-30 14:16 - 2015-01-08 07:43 - 00000298 _____ () C:\Windows\Tasks\AutoKMS.job
2015-05-30 14:15 - 2013-08-23 00:45 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-05-30 06:10 - 2015-01-07 21:35 - 00000000 ____D () C:\Users\Duc Hong\AppData\Roaming\DMCache
2015-05-30 03:23 - 2015-01-07 21:35 - 00000000 ____D () C:\Users\Duc Hong\AppData\Roaming\IDM
2015-05-30 03:21 - 2015-04-17 17:11 - 00000892 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1926068397-2398490202-140176465-1002Core.job
2015-05-29 22:29 - 2015-01-08 18:53 - 00000000 ____D () C:\Users\Duc Hong\Desktop\Tools
2015-05-29 20:59 - 2015-04-12 05:06 - 00000000 ____D () C:\Users\Duc Hong\Desktop\Docs
2015-05-28 22:25 - 2015-01-14 13:01 - 00000000 ____D () C:\Users\Duc Hong\.VirtualBox
2015-05-28 21:34 - 2015-01-07 21:36 - 00000000 ____D () C:\Users\Duc Hong\Downloads\Video
2015-05-28 17:58 - 2013-08-23 01:36 - 00000000 ____D () C:\Windows\addins
2015-05-28 07:17 - 2015-01-07 21:35 - 00000000 ____D () C:\Program Files (x86)\Internet Download Manager
2015-05-28 07:03 - 2015-01-18 16:16 - 00136408 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-05-27 19:04 - 2015-01-08 23:41 - 00000000 ____D () C:\ProgramData\Oracle
2015-05-27 19:01 - 2015-04-02 16:59 - 00000000 ____D () C:\Program Files\Java
2015-05-27 19:00 - 2015-04-02 17:02 - 00111016 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge-64.dll
2015-05-27 17:25 - 2015-01-08 01:11 - 00000000 ____D () C:\Program Files (x86)\Notepad++
2015-05-27 17:04 - 2015-01-18 16:16 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2015-05-27 17:04 - 2015-01-18 16:16 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2015-05-27 17:01 - 2015-01-08 16:58 - 00000000 ____D () C:\Program Files\Defraggler
2015-05-27 16:53 - 2015-01-18 12:20 - 00000000 ____D () C:\Users\Duc Hong\AppData\Roaming\TeamViewer
2015-05-27 16:53 - 2015-01-08 07:25 - 00000000 ____D () C:\Users\Duc Hong\AppData\Roaming\DAEMON Tools Lite
2015-05-27 16:53 - 2015-01-08 06:43 - 00000000 ____D () C:\Users\Duc Hong\AppData\Roaming\uTorrent
2015-05-27 16:52 - 2015-01-07 20:39 - 00000000 ____D () C:\Program Files\CCleaner
2015-05-26 18:12 - 2014-03-18 20:03 - 00885780 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-05-26 16:01 - 2015-01-07 20:13 - 00000000 ____D () C:\Users\Duc Hong
2015-05-25 23:40 - 2013-08-23 01:36 - 00000000 ___RD () C:\Windows\ToastData
2015-05-25 23:38 - 2013-08-23 01:20 - 00000000 ____D () C:\Windows\CbsTemp
2015-05-25 18:22 - 2015-03-16 17:17 - 00000000 ____D () C:\Users\Duc Hong\Desktop\Bluej
2015-05-25 03:35 - 2015-04-12 15:20 - 00000000 ____D () C:\ProgramData\Orbit
2015-05-21 19:58 - 2015-02-22 16:22 - 00000000 ____D () C:\Users\Duc Hong\AppData\Roaming\CodeBlocks
2015-05-19 19:09 - 2015-01-30 16:22 - 00000187 _____ () C:\Windows\wininit.ini
2015-05-19 18:03 - 2013-08-23 01:36 - 00000000 ____D () C:\Windows\rescache
2015-05-18 05:48 - 2015-01-23 14:11 - 00481120 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-05-18 05:47 - 2015-01-07 23:38 - 00000000 ____D () C:\Program Files\Microsoft Silverlight
2015-05-18 05:47 - 2015-01-07 23:38 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight
2015-05-18 05:45 - 2015-01-08 07:28 - 00000000 ____D () C:\ProgramData\Microsoft Help
2015-05-18 05:44 - 2015-04-05 04:10 - 00000039 _____ () C:\Windows\vbaddin.ini
2015-05-18 05:43 - 2015-01-08 08:40 - 00000000 ____D () C:\Windows\system32\MRT
2015-05-18 05:39 - 2015-01-08 08:40 - 140425016 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-05-18 05:39 - 2013-08-22 23:25 - 00262144 ___SH () C:\Windows\system32\config\ELAM
2015-05-18 05:38 - 2015-04-14 22:32 - 00000000 ___SD () C:\Windows\SysWOW64\GWX
2015-05-18 05:38 - 2015-04-14 22:32 - 00000000 ___SD () C:\Windows\system32\GWX
2015-05-18 05:38 - 2015-01-07 23:38 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2015-05-18 05:36 - 2014-03-18 19:45 - 00000000 ____D () C:\Program Files\Windows Journal
2015-05-17 20:00 - 2015-01-08 07:10 - 00000000 ____D () C:\Users\Duc Hong\AppData\Local\Unity
2015-05-17 19:17 - 2014-07-12 08:56 - 00000000 ____D () C:\ProgramData\Package Cache
2015-05-16 22:32 - 2015-03-04 16:45 - 00000000 ____D () C:\Users\Duc Hong\AppData\Roaming\VMware
2015-05-16 22:32 - 2015-03-04 16:45 - 00000000 ____D () C:\Users\Duc Hong\AppData\Local\VMware
2015-05-16 05:42 - 2013-08-22 23:25 - 00262144 ___SH () C:\Windows\system32\config\BBI
2015-05-16 03:16 - 2015-04-17 17:11 - 00003900 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1926068397-2398490202-140176465-1002UA
2015-05-16 03:16 - 2015-04-17 17:11 - 00003520 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1926068397-2398490202-140176465-1002Core
2015-05-16 03:12 - 2015-01-08 16:51 - 00003902 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2015-05-16 03:12 - 2015-01-08 16:51 - 00003666 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2015-05-16 03:12 - 2015-01-08 16:51 - 00000930 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-05-13 21:07 - 2015-01-19 23:50 - 00000000 ____D () C:\Users\Duc Hong\AppData\Roaming\HandBrake
2015-05-13 17:10 - 2015-03-02 14:18 - 00204264 _____ (Oracle Corporation) C:\Windows\system32\VBoxNetFltNobj.dll
2015-05-13 17:10 - 2015-03-02 14:18 - 00156360 _____ (Oracle Corporation) C:\Windows\system32\Drivers\VBoxNetFlt.sys
2015-05-12 17:42 - 2015-02-11 16:03 - 00000000 ____D () C:\Users\Duc Hong\Desktop\IMG
2015-05-12 14:06 - 2013-08-23 01:36 - 00000000 ____D () C:\Windows\system32\NDF
2015-05-11 17:26 - 2014-05-17 06:03 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ASUS
2015-05-11 17:26 - 2014-05-17 06:02 - 00000000 ____D () C:\Program Files (x86)\ASUS
2015-05-11 01:18 - 2015-01-07 20:13 - 00000000 ____D () C:\Users\Duc Hong\AppData\Local\Packages
2015-05-11 01:18 - 2013-08-23 01:36 - 00000000 ____D () C:\Windows\AppReadiness
2015-05-09 14:32 - 2015-04-08 21:25 - 00000000 ____D () C:\Users\Duc Hong\.bluefish
2015-05-09 14:31 - 2014-07-12 08:47 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2015-05-08 20:54 - 2015-01-22 16:51 - 00000000 ____D () C:\Users\Duc Hong\AppData\Roaming\iFunbox_UserCache
2015-05-06 03:59 - 2015-02-16 18:53 - 00792568 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-05-06 03:59 - 2015-02-16 18:53 - 00178168 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-05-05 06:44 - 2015-01-07 23:31 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Steam
2015-05-05 06:23 - 2015-01-08 19:56 - 00000000 ____D () C:\Users\Duc Hong\Documents\my games
2015-05-02 02:51 - 2015-04-26 23:22 - 01316184 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvspcap.dll
2015-05-02 02:51 - 2015-04-26 23:22 - 01316000 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvspbridge.dll
2015-05-02 02:50 - 2015-04-26 23:22 - 01756424 _____ (NVIDIA Corporation) C:\Windows\system32\nvspbridge64.dll
2015-05-02 02:50 - 2015-04-26 23:22 - 01570672 _____ (NVIDIA Corporation) C:\Windows\system32\nvspcap64.dll
2015-05-01 18:55 - 2013-08-23 01:36 - 00000000 ___RD () C:\Windows\ImmersiveControlPanel
2015-05-01 18:55 - 2013-08-22 23:36 - 00000000 ____D () C:\Windows\system32\AdvancedInstallers
2015-05-01 18:45 - 2013-08-22 23:25 - 00000199 _____ () C:\Windows\win.ini
2015-05-01 16:28 - 2015-01-07 21:13 - 00003924 _____ () C:\Windows\System32\Tasks\avast! Emergency Update
2015-05-01 16:28 - 2015-01-07 21:12 - 01047320 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswSnx.sys
2015-05-01 16:28 - 2015-01-07 21:12 - 00442264 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswSP.sys
2015-05-01 16:28 - 2015-01-07 21:12 - 00272248 _____ () C:\Windows\system32\Drivers\aswVmm.sys
2015-05-01 16:28 - 2015-01-07 21:12 - 00137288 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswStm.sys
2015-05-01 16:28 - 2015-01-07 21:12 - 00093528 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswRdr2.sys
2015-05-01 16:28 - 2015-01-07 21:12 - 00089944 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswMonFlt.sys
2015-05-01 16:28 - 2015-01-07 21:12 - 00065736 _____ () C:\Windows\system32\Drivers\aswRvrt.sys
2015-05-01 16:28 - 2015-01-07 21:12 - 00029168 _____ () C:\Windows\system32\Drivers\aswHwid.sys

==================== Files in the root of some directories =======

2015-01-23 17:37 - 2015-01-23 17:37 - 0000021 _____ () C:\Users\Duc Hong\AppData\Roaming\my_intel.sys
2015-01-07 20:14 - 2015-05-30 14:22 - 0000074 _____ () C:\Users\Duc Hong\AppData\Roaming\sp_data.sys
2015-01-07 21:37 - 2015-01-07 21:37 - 0000002 ____H () C:\Users\Duc Hong\AppData\Roaming\win.dat
2015-05-09 14:32 - 2015-05-09 14:32 - 0000218 _____ () C:\Users\Duc Hong\AppData\Local\recently-used.xbel
2015-01-22 00:28 - 2015-01-28 16:59 - 0007618 _____ () C:\Users\Duc Hong\AppData\Local\Resmon.ResmonCfg
2014-07-12 08:51 - 2014-07-12 08:51 - 0000000 ____H () C:\ProgramData\DP45977C.lfl
2015-03-26 23:11 - 2015-03-26 23:11 - 0000040 _____ () C:\ProgramData\ra3.ini
2014-05-17 06:02 - 2012-09-07 21:40 - 0000256 _____ () C:\ProgramData\SetStretch.cmd
2014-05-17 06:02 - 2009-07-22 20:04 - 0024576 _____ () C:\ProgramData\SetStretch.exe
2014-05-17 06:02 - 2012-09-07 21:37 - 0000103 _____ () C:\ProgramData\SetStretch.VBS

Files to move or delete:
====================
C:\ProgramData\SetStretch.exe
C:\ProgramData\SetStretch.VBS


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-05-26 22:51

==================== End of log ============================

 

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 27-05-2015
Ran by Duc Hong at 2015-05-30 17:19:55
Running from C:\Users\Duc Hong\Desktop\FRST
Boot Mode: Normal
==========================================================


==================== Accounts: =============================

Administrator (S-1-5-21-1926068397-2398490202-140176465-500 - Administrator - Disabled)
Duc Hong (S-1-5-21-1926068397-2398490202-140176465-1002 - Administrator - Enabled) => C:\Users\Duc Hong
Guest (S-1-5-21-1926068397-2398490202-140176465-501 - Limited - Disabled)

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

µTorrent (HKLM-x32\...\uTorrent) (Version: 3.2.3.28705 - BitTorrent Inc.)
7-Zip 9.38 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0938-000001000000}) (Version: 9.38.00.0 - Igor Pavlov)
Adobe Flash Player 16 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 16.0.0.235 - Adobe Systems Incorporated)
Apple Application Support (32-bit) (HKLM-x32\...\{2FE00055-C4F3-4F7A-AEDD-E198D54CF12F}) (Version: 3.1.1 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{19DED56B-657D-41DA-9EB0-7C20DDF6A613}) (Version: 8.1.0.18 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
ASUS Console (HKLM\...\{6D989E08-8143-4AB8-B0A8-5B836235CAA4}) (Version: 1.0.5 - ASUS)
Asus FaceID (HKLM-x32\...\{C4071085-DDF0-403F-90F9-27582FC22C9B}) (Version: 7.7.6.1 - ASUS)
ASUS Instant Key (HKLM-x32\...\{D97A1B80-131F-4692-9543-E652956D8B99}) (Version: 1.1.7 - ASUS)
ASUS Live Update (HKLM-x32\...\{FA540E67-095C-4A1B-97BA-4D547DEC9AF4}) (Version: 3.3.4 - ASUS)
ASUS Power4Gear Hybrid (HKLM\...\{9B6239BF-4E85-4590-8D72-51E30DB1A9AA}) (Version: 3.0.8 - ASUS)
ASUS Smart Gesture (HKLM-x32\...\{4D3286A6-F6AB-498A-82A4-E4F040529F3D}) (Version: 2.2.10 - ASUS)
ASUS Splendid Video Enhancement Technology (HKLM-x32\...\{0969AF05-4FF6-4C00-9406-43599238DE0D}) (Version: 2.01.0021 - ASUS)
ATK Package (HKLM-x32\...\{AB5C933E-5C7D-4D30-B314-9C83A49B94BE}) (Version: 1.0.0031 - ASUS)
ATLAS Translation Standard V14.0 Trial Version (HKLM-x32\...\{6652750B-AA69-49B7-9D09-C0A28B6FFC9F}) (Version: 14.00.2000 - FUJITSU LIMITED)
Auslogics DiskDefrag (HKLM-x32\...\{DF6A13C0-77DF-41FE-BD05-6D5201EB0CE7}_is1) (Version: 5.4.0.0 - Auslogics Labs Pty Ltd)
Avast Free Antivirus (HKLM-x32\...\Avast) (Version: 10.2.2218 - AVAST Software)
Avidemux 2.6 - 64bits (HKLM-x32\...\Avidemux 2.6 - 64bits (64-bit)) (Version: 2.6.9.00 - )
BatteryBar (remove only) (HKLM\...\BatteryBar) (Version:  - )
Bluefish 2.2.7 (HKLM-x32\...\Bluefish) (Version: 2.2.7 - The Bluefish Developers)
BlueJ (HKLM-x32\...\{7D66971C-652B-4065-A6B1-B3EE313C254B}) (Version: 3.1.4 - BlueJ Team)
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
CCleaner (HKLM\...\CCleaner) (Version: 5.06 - Piriform)
CodeBlocks (HKU\S-1-5-21-1926068397-2398490202-140176465-1002\...\CodeBlocks) (Version: 13.12 - The Code::Blocks Team)
Color Cop 5.4.3 (HKLM-x32\...\Color Cop_is1) (Version:  - Jay Prall)
Command & Conquer™ Red Alert™ 3 (HKLM\...\{296D8550-CB06-48E4-9A8B-E5034FB64715}) (Version: 1.0.1.0 - Electronic Arts)
Command & Conquer™ Red Alert™ 3 (HKLM-x32\...\{296D8550-CB06-48E4-9A8B-E5034FB64715}) (Version: 1.0.1.0 - Electronic Arts)
Counter-Strike: Global Offensive (HKLM-x32\...\Steam App 730) (Version:  - Valve)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
DAEMON Tools Lite (HKLM-x32\...\DAEMON Tools Lite) (Version: 4.49.1.0356 - Disc Soft Ltd)
Defraggler (HKLM\...\Defraggler) (Version: 2.19 - Piriform)
ESET Online Scanner v3 (HKLM-x32\...\ESET Online Scanner) (Version:  - )
Everything 1.3.4.686 (x64) (HKLM\...\Everything) (Version:  - )
Explorer Suite IV (HKLM\...\Explorer Suite_is1) (Version:  - )
FarCry 4 (HKLM-x32\...\Uplay Install 420) (Version:  - Ubisoft)
FileHippo App Manager (HKLM-x32\...\FileHippo.com) (Version:  - FileHippo.com)
Foxit PhantomPDF Business (HKLM-x32\...\{8A601904-4113-40FE-9DCC-7A38CE1A8032}) (Version: 7.0.6.1126 - Foxit Software Inc.)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 43.0.2357.81 - Google Inc.)
Google Talk Plugin (HKLM-x32\...\{CA3DD97D-1FD7-37A7-BD5C-FC4430C8B8E6}) (Version: 5.41.2.0 - Google)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.27.5 - Google Inc.) Hidden
HandBrake 0.10.1 (HKLM-x32\...\HandBrake) (Version: 0.10.1 - )
HD Tune Pro 5.50 (HKLM-x32\...\HD Tune Pro_is1) (Version:  - EFD Software)
Intel® Driver Update Utility 2.0 (x32 Version: 2.0.0.29 - Intel) Hidden
Intel® Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 9.5.14.1724 - Intel Corporation)
Intel® Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.3355 - Intel Corporation)
Intel® Wireless Bluetooth®(patch version 17.1.1449.356) (HKLM\...\{302600C1-6BDF-4FD1-1411-148929CC1385}) (Version: 17.1.1411.0506 - Intel Corporation)
Intel® Driver Update Utility (HKLM-x32\...\{8409c4f7-2340-4933-a304-5d37db4fb48b}) (Version: 2.0.0.29 - Intel)
Intel® PROSet/Wireless Software (HKLM-x32\...\{a9888f41-68ae-43df-bd7d-d93405a44106}) (Version: 17.13.11 - Intel Corporation)
Internet Download Manager (HKLM-x32\...\Internet Download Manager) (Version:  - Tonec Inc.)
IrfanView (remove only) (HKLM-x32\...\IrfanView) (Version: 4.38 - Irfan Skiljan)
iTunes (HKLM\...\{2EA80E9F-C811-41BB-ABAC-F270B4B39BC6}) (Version: 12.1.0.71 - Apple Inc.)
Java 8 Update 45 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86418045F0}) (Version: 8.0.450 - Oracle Corporation)
Java 8 Update 45 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218045F0}) (Version: 8.0.450 - Oracle Corporation)
Java SE Development Kit 8 Update 40 (64-bit) (HKLM\...\{64A3A4F4-B792-11D6-A78A-00B0D0180400}) (Version: 8.0.400.26 - Oracle Corporation)
Junk Mail filter update (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
K-Lite Codec Pack 11.0.8 Full (HKLM-x32\...\KLiteCodecPack_is1) (Version: 11.0.8 - )
Malwarebytes Anti-Malware version 2.1.6.1022 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.1.6.1022 - Malwarebytes Corporation)
MediaCoder x64 0.8.34.5716 (HKLM\...\MediaCoder x64) (Version: 0.8.34.5716 - Mediatronic)
Microsoft ASP.NET MVC 4 Runtime (HKLM-x32\...\{3FE312D5-B862-40CE-8E4E-A6D8ABF62736}) (Version: 4.0.40804.0 - Microsoft Corporation)
Microsoft Office Professional Plus 2010 (HKLM\...\Office14.PROPLUS) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft OneDrive (HKU\S-1-5-21-1926068397-2398490202-140176465-1002\...\OneDriveSetup.exe) (Version: 17.0.4035.0328 - Microsoft Corporation)
Microsoft Outlook Hotmail Connector 64-bit (HKLM\...\{95140000-007A-0409-1000-0000000FF1CE}) (Version: 14.0.5118.5000 - Microsoft Corporation)
Microsoft Outlook Social Connector Provider for Windows Live Messenger 64-bit (HKLM\...\{95140000-007D-0409-1000-0000000FF1CE}) (Version: 14.0.5120.5000 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.40416.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visio Professional 2010 (HKLM\...\Office14.VISIOR) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 Redistributable - x64 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 Redistributable - x86 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\...\{ce085a78-074e-4823-8dc1-8a721b94b76d}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
Movie Maker (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Mozilla Firefox 37.0.1 (x86 en-US) (HKLM-x32\...\Mozilla Firefox 37.0.1 (x86 en-US)) (Version: 37.0.1 - Mozilla)
Mozilla Firefox 38.0.1 (x86 en-US) (HKU\S-1-5-21-1926068397-2398490202-140176465-1002\...\Mozilla Firefox 38.0.1 (x86 en-US)) (Version: 38.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 36.0.3 - Mozilla)
MyDefrag v4.3.1 (HKLM\...\MyDefrag v4.3.1_is1) (Version: 4.0.0.0 - J.C. Kessels)
NEKOPARA vol.1 (HKU\S-1-5-21-1926068397-2398490202-140176465-1002\...\{64DC04AF-BD7C-4CF4-9CA4-938953224328}) (Version:  - NEKO WORKs)
Notepad++ (HKLM-x32\...\Notepad++) (Version: 6.7.8.2 - Notepad++ Team)
NVIDIA GeForce Experience 2.4.3.22 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 2.4.3.22 - NVIDIA Corporation)
NVIDIA Graphics Driver 350.05 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 350.05 - NVIDIA Corporation)
NVIDIA PhysX System Software 9.15.0324 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.15.0324 - NVIDIA Corporation)
Oracle VM VirtualBox 4.3.28 (HKLM\...\{E8BB81BC-E67C-4750-84EE-128DA5A7ADA5}) (Version: 4.3.28 - Oracle Corporation)
Potplayer (HKLM-x32\...\PotPlayer) (Version:  - Daum Kakao Corp.)
Rainmeter (HKLM-x32\...\Rainmeter) (Version: 3.2.1 r2386 - )
Realtek Card Reader (HKLM-x32\...\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}) (Version: 6.2.9200.39048 - Realtek Semiconductor Corp.)
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 8.20.815.2013 - Realtek)
Revo Uninstaller Pro 3.0.2 (HKLM\...\{67579783-0FB7-4F7B-B881-E5BE47C9DBE0}_is1) (Version: 3.0.2 - VS Revo Group, Ltd.)
RW-Everything v1.6.5.9 (HKLM\...\RW-Everything_is1) (Version:  - )
Service Pack 2 for Microsoft Office 2010 (KB2687455) 64-Bit Edition (HKLM\...\{90140000-0011-0000-1000-0000000FF1CE}_Office14.PROPLUS_{A3364707-2F53-4C83-8F68-C9877A9080C7}) (Version:  - Microsoft)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 64-Bit Edition (HKLM\...\{91140000-0057-0000-1000-0000000FF1CE}_Office14.VISIOR_{3C578F10-F74F-4655-B2A6-9F88A6C415E8}) (Version:  - Microsoft)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 64-Bit Edition (Version:  - Microsoft) Hidden
SHIELD Streaming (Version: 4.1.1000 - NVIDIA Corporation) Hidden
SHIELD Wireless Controller Driver (Version: 2.4.3.22 - NVIDIA Corporation) Hidden
Sid Meier's Civilization V (HKLM-x32\...\Steam App 8930) (Version:  - 2K Games, Inc.)
Skype Click to Call (HKLM-x32\...\{6D1221A9-17BF-4EC0-81F2-27D30EC30701}) (Version: 7.3.16540.9015 - Microsoft Corporation)
Skype™ 7.5 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.5.101 - Skype Technologies S.A.)
SoftEther VPN Client (HKLM\...\softether_sevpnclient) (Version: 4.12.9514 - SoftEther VPN Project)
Speccy (HKLM\...\Speccy) (Version: 1.28 - Piriform)
Spotify (HKU\S-1-5-21-1926068397-2398490202-140176465-1002\...\Spotify) (Version: 1.0.3.101.gbfa97dfe - Spotify AB)
Steam (HKLM-x32\...\Steam) (Version: 2.10.91.91 - Valve Corporation)
Synei System Utilities (HKLM-x32\...\{BFDC3B26-7DB0-43D3-BC84-7E9649C157EA}_is1) (Version: 2.25 - Synei)
System Requirements Lab (HKLM-x32\...\{0F659036-14C7-4622-9505-35A0DC93526A}) (Version: 6.1.3.0 - Husdawg, LLC)
Team Fortress 2 (HKLM-x32\...\Steam App 440) (Version:  - Valve)
TeraCopy 2.3 (HKLM\...\TeraCopy_is1) (Version:  - Code Sector)
The Elder Scrolls V: Skyrim (HKLM-x32\...\Steam App 72850) (Version:  - Bethesda Game Studios)
The Witcher 2: Assassins of Kings Enhanced Edition (HKLM-x32\...\Steam App 20920) (Version:  - CD PROJEKT RED)
Unity Web Player (HKU\S-1-5-21-1926068397-2398490202-140176465-1002\...\UnityWebPlayer) (Version: 5.0.2f1 - Unity Technologies ApS)
Unlocker 1.9.2 (HKLM\...\Unlocker) (Version: 1.9.2 - Cedrick Collomb)
Update for Japanese Microsoft IME Postal Code Dictionary (HKLM-x32\...\{15015752-9990-4516-A2B1-93823281FB8E}) (Version: 15.0.1759 - Microsoft Corporation)
Update for Japanese Microsoft IME Standard Dictionary (HKLM-x32\...\{7DB71278-9AD7-4480-AB08-8649C5010B17}) (Version: 15.0.1215 - Microsoft Corporation)
Update for Japanese Microsoft IME Standard Extended Dictionary (HKLM-x32\...\{78CE66A9-85AF-4BD8-8FB7-35B5F3846C00}) (Version: 15.0.1215 - Microsoft Corporation)
Uplay (HKLM-x32\...\Uplay) (Version: 4.8 - Ubisoft)
VMware Player (HKLM-x32\...\VMware_Player) (Version: 7.1.0 - VMware, Inc)
VMware Player (Version: 7.1.0 - VMware, Inc.) Hidden
Warframe (HKLM-x32\...\Steam App 230410) (Version:  - Digital Extremes)
WebStorage (HKLM-x32\...\WebStorage) (Version: 2.1.2.301 - ASUS Cloud Corporation)
Windows Driver Package - ASUS (ATP) Mouse  (01/07/2014 1.0.0.197) (HKLM\...\2BEE838DC3D664A0CAB23AEA0332BB3877ED0685) (Version: 01/07/2014 1.0.0.197 - ASUS)
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3528.0331 - Microsoft Corporation)
WinFlash (HKLM-x32\...\{8F21291E-0444-4B1D-B9F9-4370A73E346D}) (Version: 2.42.0 - ASUS)
WinPcap 4.1.3 (HKLM-x32\...\WinPcapInst) (Version: 4.1.0.2980 - Riverbed Technology, Inc.)
WinRAR 5.20 (64-bit) (HKLM\...\WinRAR archiver) (Version: 5.20.0 - win.rar GmbH)
Wireshark 1.12.5 (64-bit) (HKLM-x32\...\Wireshark) (Version: 1.12.5 - The Wireshark developer community, http://www.wireshark.org)

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

CustomCLSID: HKU\S-1-5-21-1926068397-2398490202-140176465-1002_Classes\CLSID\{1423F872-3F7F-4E57-B621-8B1A9D49B448}\InprocServer32 -> C:\Users\Duc Hong\AppData\Local\Google\Update\1.3.27.5\psuser_64.dll (Google Inc.)
CustomCLSID: HKU\S-1-5-21-1926068397-2398490202-140176465-1002_Classes\CLSID\{E8CF3E55-F919-49D9-ABC0-948E6CB34B9F}\InprocServer32 -> C:\Users\Duc Hong\AppData\Local\Google\Update\1.3.27.5\psuser_64.dll (Google Inc.)
CustomCLSID: HKU\S-1-5-21-1926068397-2398490202-140176465-1002_Classes\CLSID\{F8071786-1FD0-4A66-81A1-3CBE29274458}\InprocServer32 -> C:\Users\Duc Hong\AppData\Local\Microsoft\SkyDrive\17.0.4035.0328\amd64\FileSyncApi64.dll (Microsoft Corporation)

==================== Restore Points =========================


==================== Hosts content: ===============================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2013-08-22 23:25 - 2015-02-11 01:00 - 00000793 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {0672CE47-9AF2-49B5-BA4A-D987C76AF085} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1926068397-2398490202-140176465-1002UA => C:\Users\Duc Hong\AppData\Local\Google\Update\GoogleUpdate.exe [2015-04-17] (Google Inc.)
Task: {0B01FB0E-B462-46B8-816C-2444A6441DB3} - System32\Tasks\ASUS Smart Gesture Launcher => C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPLauncher.exe [2014-02-14] (AsusTek)
Task: {1BAF89D5-B76F-48CA-B114-034B69480F29} - System32\Tasks\ASUS Splendid ColorU => C:\Program Files (x86)\ASUS\Splendid\ColorUService.exe [2013-10-08] (ASUSTeK Computer Inc.)
Task: {1EB54610-9F30-42C5-93C1-9B6CBD358D7E} - System32\Tasks\RTKCPL => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [2014-05-20] (Realtek Semiconductor)
Task: {31E03131-2908-43E9-AE6D-CD1AC82DAD2F} - System32\Tasks\ASUS Console => C:\Program Files\ASUS\ASUS Console\ASUS Console Starter.exe [2014-02-07] (ASUSTek Computer Inc.)
Task: {4E3FDD62-EABC-414B-8FBD-DBA444C5CA8A} - System32\Tasks\Microsoft\Windows\Setup\gwx\refreshgwxconfig => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-05-06] (Microsoft Corporation)
Task: {760AE585-4971-4AD2-AFC4-DEA14F01B495} - System32\Tasks\Microsoft\Windows\Setup\gwx\launchtrayprocess => C:\Windows\system32\GWX\GWX.exe [2015-05-06] (Microsoft Corporation)
Task: {766E80C1-FFF8-4F47-8FC3-4E533BAE0AC1} - System32\Tasks\Update Checker => C:\Program Files (x86)\ASUS\ASUS Live Update\UpdateChecker.exe [2015-02-12] ()
Task: {82F04444-7113-4278-B8C4-51A59E6C29E4} - System32\Tasks\RtHDVBg => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [2014-05-13] (Realtek Semiconductor)
Task: {9D746130-D7A9-4BB8-8E96-05093DEF9977} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1926068397-2398490202-140176465-1002Core => C:\Users\Duc Hong\AppData\Local\Google\Update\GoogleUpdate.exe [2015-04-17] (Google Inc.)
Task: {A508D830-687E-41AA-AF60-8916D26EAEBF} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2015-05-09] (Piriform Ltd)
Task: {B15A7A20-383B-47EB-A029-E30292516E17} - System32\Tasks\ASUS Live Update1 => C:\Program Files (x86)\ASUS\ASUS Live Update\LiveUpdate.exe [2015-03-23] (ASUSTeK Computer Inc.)
Task: {B905D56A-7E45-4939-90F9-416CB290E620} - System32\Tasks\AsusVibeSchedule => C:\Program Files (x86)\Asus\AsusVibe\AsusVibeLauncher.exe
Task: {CB4E97FF-DC08-4AE9-B101-6EC041501D17} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\Windows\system32\MRT.exe [2015-05-18] (Microsoft Corporation)
Task: {CE71F3E1-DE1E-4B42-A816-09F806D6EAFE} - System32\Tasks\Microsoft OneDrive Auto Update Task-S-1-5-21-1926068397-2398490202-140176465-1002 => %localappdata%\Microsoft\SkyDrive\SkyDrive.exe
Task: {D54DEED3-1E09-43DD-A0D7-2534D4F95BFB} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-01-08] (Google Inc.)
Task: {EA345886-3FBF-4930-8FE1-DEAE05BA0372} - System32\Tasks\ASUS Splendid ACMON => C:\Program Files (x86)\ASUS\Splendid\ACMON.exe [2013-10-08] (ASUS)
Task: {F160855D-2EAD-405F-A8EF-A15DF3A90A7E} - System32\Tasks\AutoKMS => C:\Windows\AutoKMS\AutoKMS.exe [2015-01-08] ()
Task: {F6441995-B4CF-4A06-BBE6-5BE2EE55D8EA} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2015-05-01] (Avast Software s.r.o.)
Task: {F87A5893-944C-45F8-AF4F-42245D864FF7} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-01-08] (Google Inc.)
Task: C:\Windows\Tasks\AutoKMS.job => C:\Windows\AutoKMS\AutoKMS.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1926068397-2398490202-140176465-1002Core.job => C:\Users\Duc Hong\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1926068397-2398490202-140176465-1002UA.job => C:\Users\Duc Hong\AppData\Local\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (Whitelisted) ==============

2015-04-26 23:21 - 2015-04-02 17:19 - 00117392 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2015-02-20 08:01 - 2015-02-20 08:01 - 00022528 _____ () C:\Windows\System32\us001lm.dll
2014-07-12 09:01 - 2013-08-27 09:29 - 00755728 _____ () C:\Windows\SYSTEM32\sqlite3.dll
2013-09-04 23:17 - 2013-09-04 23:17 - 04300456 _____ () C:\Program Files\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF
2010-10-20 14:23 - 2010-10-20 14:23 - 08801632 _____ () C:\Program Files\Microsoft Office\Office14\1033\GrooveIntlResource.dll
2010-07-15 14:44 - 2010-07-15 14:44 - 00020032 _____ () C:\Program Files\Unlocker\UnlockerCOM.dll
2015-04-16 06:13 - 2015-04-16 06:13 - 00222720 _____ () C:\Program Files (x86)\Notepad++\NppShell_06.dll
2015-03-24 23:28 - 2015-03-24 23:28 - 00036544 _____ () C:\Program Files\Rainmeter\Rainmeter.exe
2015-03-24 23:28 - 2015-03-24 23:28 - 00775872 _____ () C:\Program Files\Rainmeter\Rainmeter.dll
2015-03-24 23:28 - 2015-03-24 23:28 - 00022528 _____ () C:\Program Files\Rainmeter\Plugins\InputText.dll
2015-03-24 23:27 - 2015-03-24 23:27 - 00011776 _____ () C:\Program Files\Rainmeter\Plugins\PowerPlugin.DLL
2015-03-24 23:27 - 2015-03-24 23:27 - 00022016 _____ () C:\Program Files\Rainmeter\Plugins\WifiStatus.DLL
2015-03-24 23:27 - 2015-03-24 23:27 - 00020992 _____ () C:\Program Files\Rainmeter\Plugins\SysInfo.DLL
2015-03-24 23:27 - 2015-03-24 23:27 - 00058368 _____ () C:\Program Files\Rainmeter\Plugins\WebParser.DLL
2015-03-24 23:27 - 2015-03-24 23:27 - 00023040 _____ () C:\Program Files\Rainmeter\Plugins\Win7AudioPlugin.DLL
2013-09-04 23:17 - 2013-09-04 23:17 - 04300456 _____ () C:\Program Files\Common Files\Microsoft Shared\office14\Cultures\office.odf
2015-02-20 08:01 - 2015-02-20 08:01 - 01603584 _____ () C:\Windows\system32\spool\DRIVERS\x64\3\us001du.dll
2015-05-01 16:28 - 2015-05-01 16:28 - 00104400 _____ () C:\Program Files\AVAST Software\Avast\log.dll
2015-05-01 16:28 - 2015-05-01 16:28 - 00081728 _____ () C:\Program Files\AVAST Software\Avast\JsonRpcServer.dll
2015-05-30 14:30 - 2015-05-30 14:30 - 02950656 _____ () C:\Program Files\AVAST Software\Avast\defs\15052901\algo.dll
2015-01-20 21:35 - 2015-01-20 21:35 - 00073544 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2015-01-20 21:35 - 2015-01-20 21:35 - 01044776 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2015-02-06 17:40 - 2015-02-06 17:40 - 01301696 _____ () C:\Program Files (x86)\VMware\VMware Player\libxml2.dll
2014-07-12 08:47 - 2013-09-04 09:52 - 01242584 _____ () C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\ACE.dll
2013-09-10 11:23 - 2013-09-10 11:23 - 00162816 _____ () C:\Program Files (x86)\ASUS\Splendid\CCTAdjust.dll
2013-10-09 13:41 - 2013-10-09 13:41 - 00037968 _____ () C:\Program Files (x86)\ASUS\Splendid\DetectDisplayDC.dll
2015-04-26 23:22 - 2015-05-02 02:52 - 00011920 _____ () C:\Program Files (x86)\NVIDIA Corporation\Update Core\detoured.dll
2015-03-20 15:31 - 2015-03-20 15:31 - 40540672 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll
2013-09-04 23:14 - 2013-09-04 23:14 - 04300456 _____ () C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\Cultures\OFFICE.ODF
2010-10-20 14:45 - 2010-10-20 14:45 - 08801120 _____ () C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveIntlResource.dll
2015-04-09 05:33 - 2015-03-31 04:00 - 00236544 _____ () C:\Program Files (x86)\K-Lite Codec Pack\Filters\LAV\libbluray.dll
2015-04-09 05:33 - 2015-03-25 04:00 - 03502080 _____ () C:\Program Files (x86)\K-Lite Codec Pack\Filters\ffdshow\ffdshow.ax
2015-04-09 05:33 - 2015-03-25 04:00 - 04015616 _____ () C:\Program Files (x86)\K-Lite Codec Pack\Filters\ffdshow\ffmpeg.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)


==================== Safe Mode (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\CleanHlp => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\CleanHlp.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcpltsvc => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\CleanHlp => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\CleanHlp.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcpltsvc => ""=""

==================== EXE Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)


==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-1926068397-2398490202-140176465-1002\Control Panel\Desktop\\Wallpaper -> C:\Users\Duc Hong\AppData\Roaming\IrfanView\IrfanView_Wallpaper.bmp
DNS Servers: 192.168.1.1

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

HKLM\...\StartupApproved\StartupFolder: => "SoftEther VPN Client Manager Startup.lnk"
HKLM\...\StartupApproved\Run: => "SoftEther VPN Client UI Helper"
HKLM\...\StartupApproved\Run32: => "ASUSPRP"
HKU\S-1-5-21-1926068397-2398490202-140176465-1002\...\StartupApproved\Run: => "FlashPlayerUpdate"
HKU\S-1-5-21-1926068397-2398490202-140176465-1002\...\StartupApproved\Run: => "Google Update"
HKU\S-1-5-21-1926068397-2398490202-140176465-1002\...\StartupApproved\Run: => "DevidAgent"
HKU\S-1-5-21-1926068397-2398490202-140176465-1002\...\StartupApproved\Run: => "BingSvc"

==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139
FirewallRules: [Daum PotPlayer(PotPlayerMini.exe)] => (Allow) C:\Program Files (x86)\DAUM\PotPlayer\PotPlayerMini.exe
FirewallRules: [{6AD7A4C1-520C-4938-83E9-8C3D4AF4470B}] => (Allow) C:\Program Files (x86)\DAUM\PotPlayer\PotPlayerMini.exe
FirewallRules: [TCP Query User{B408D18C-6D03-4CC8-9E8F-41FF22643530}C:\windows\microsoft.net\framework\v2.0.50727\vbc.exe] => (Allow) C:\windows\microsoft.net\framework\v2.0.50727\vbc.exe
FirewallRules: [UDP Query User{A1BDE586-1E5F-4E70-83A1-C3724D86FBEA}C:\windows\microsoft.net\framework\v2.0.50727\vbc.exe] => (Allow) C:\windows\microsoft.net\framework\v2.0.50727\vbc.exe
FirewallRules: [{46831999-F626-41E8-A1AB-F3130E61A535}] => (Allow) E:\Temp\Steam\Steam.exe
FirewallRules: [{24C0EBEB-6AAB-4281-B843-FC830B4FEB52}] => (Allow) E:\Temp\Steam\Steam.exe
FirewallRules: [{AED3302F-B17D-4701-9390-ED277A47C947}] => (Allow) E:\Temp\Steam\steamapps\common\Skyrim\SkyrimLauncher.exe
FirewallRules: [{259FAB07-4841-4498-8702-1C73EE758BF7}] => (Allow) E:\Temp\Steam\steamapps\common\Skyrim\SkyrimLauncher.exe
FirewallRules: [{F2D50447-ADCB-4ACF-A732-83AA56A4E7A9}] => (Allow) C:\Program Files\SoftEther VPN Client\vpnclient_x64.exe
FirewallRules: [{332E3FF6-209A-48A4-A6EC-7423A11D35B6}] => (Allow) C:\Program Files\SoftEther VPN Client\vpncmgr.exe
FirewallRules: [{8284D947-F7E8-4B89-A26F-A0AD5FD80F82}] => (Allow) C:\Program Files\SoftEther VPN Client\vpncmd_x64.exe
FirewallRules: [{A44E3BA8-FD16-4235-9303-E17CA8FF8D6D}] => (Allow) C:\Program Files\SoftEther VPN Client\vpncmgr_x64.exe
FirewallRules: [{5647D39A-F124-4953-ACEC-254F04260C4D}] => (Allow) C:\Program Files\SoftEther VPN Client\vpnclient.exe
FirewallRules: [{BB5EAF98-68DC-4481-BDA2-0F92653D1BE9}] => (Allow) C:\Program Files\SoftEther VPN Client\vpncmd.exe
FirewallRules: [SPPSVC-In-TCP] => (Allow) %SystemRoot%\system32\sppextcomobj.exe
FirewallRules: [SPPSVC-In-TCP-NoScope] => (Allow) %SystemRoot%\system32\sppextcomobj.exe
FirewallRules: [{2BFDCA10-D873-4098-A023-AF8A8D52659D}] => (Allow) C:\Users\Duc Hong\AppData\Roaming\Spotify\spotify.exe
FirewallRules: [{95AFAF81-213D-48BB-9D2E-9FC489C69485}] => (Allow) C:\Users\Duc Hong\AppData\Roaming\Spotify\spotify.exe
FirewallRules: [{E419D7CD-9FEB-40AD-8036-CEF8EE2A3E58}] => (Allow) C:\Program Files (x86)\uTorrent\uTorrent.exe
FirewallRules: [{7EB67D77-8A9B-425E-8A9D-556828BD9F2A}] => (Allow) C:\Program Files (x86)\uTorrent\uTorrent.exe
FirewallRules: [{E7314D54-19FD-4376-952A-C283F866565A}] => (Allow) E:\Temp\Steam\steamapps\common\Team Fortress 2\hl2.exe
FirewallRules: [{A9537D58-5E28-443C-9DF3-773B75BE8B9C}] => (Allow) E:\Temp\Steam\steamapps\common\Team Fortress 2\hl2.exe
FirewallRules: [{5405FDE4-13D9-46A4-BA72-2C3D637A820A}] => (Allow) E:\Temp\Steam\steamapps\common\Sid Meier's Civilization V\Launcher.exe
FirewallRules: [{4D112B3C-965E-4D2B-8A4C-A3BC7790EB24}] => (Allow) E:\Temp\Steam\steamapps\common\Sid Meier's Civilization V\Launcher.exe
FirewallRules: [{57563CA2-4C58-4DB6-A9D8-63CCEE8D3D58}] => (Allow) C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe
FirewallRules: [{EECB906E-0A72-4349-ABC2-51F722808688}] => (Allow) C:\Program Files (x86)\VMware\VMware Player\vmware-authd.exe
FirewallRules: [{E113D9E6-3F09-4DFD-9AE0-63C1DDFBFF5F}] => (Allow) C:\Program Files (x86)\VMware\VMware Player\vmware-authd.exe
FirewallRules: [TCP Query User{D2BD56E1-FECA-4760-BFF6-7B483CFCD029}C:\program files (x86)\mozilla firefox\firefox.exe] => (Allow) C:\program files (x86)\mozilla firefox\firefox.exe
FirewallRules: [UDP Query User{31909EE8-B773-4D7F-8A9B-F43C433277C1}C:\program files (x86)\mozilla firefox\firefox.exe] => (Allow) C:\program files (x86)\mozilla firefox\firefox.exe
FirewallRules: [{D584DDB2-8E7C-45B2-828F-ACE4C55E5EEF}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{0E7DD122-51EE-4061-BA2E-AC6519ACC2AD}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{55B30F08-3CE8-40C4-A149-EC7C5462450F}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{6A093041-DBDC-47C2-A540-CFBC73668DB9}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{2E92677B-4DF7-48B8-A955-03BC56D592A8}] => (Allow) C:\Program Files (x86)\iTunes\iTunes.exe
FirewallRules: [{C61C7218-4C30-48CF-A3C2-6D208730DCEE}] => (Allow) C:\Users\Duc Hong\AppData\Roaming\Spotify\spotify.exe
FirewallRules: [{0CB55171-3C48-4165-B73A-D3D703E0BF74}] => (Allow) C:\Users\Duc Hong\AppData\Roaming\Spotify\spotify.exe
FirewallRules: [{62290C84-E203-48CD-96FE-25F287B35C58}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{CF008ED2-2D02-4F90-9DE1-AF2683AC3A75}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{4A2F08C8-3C2D-4E62-AB32-9E6F21033E5D}] => (Allow) E:\Temp\Steam\steamapps\common\Counter-Strike Global Offensive\csgo.exe
FirewallRules: [{5A10E92E-14BC-4EA2-87C5-DFA76406A1B6}] => (Allow) E:\Temp\Steam\steamapps\common\Counter-Strike Global Offensive\csgo.exe
FirewallRules: [{450E7EC7-2C50-4F23-96AB-7ECDB5C88FFC}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
FirewallRules: [{32706039-9609-4992-BEEB-8ED8864C4607}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
FirewallRules: [{F739246A-3A2D-4765-808B-7BB1F4458A55}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe
FirewallRules: [{B1667E06-E235-41E6-B974-A2480A44B3EA}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe
FirewallRules: [{C902004C-0182-4F8A-92B3-90CDD0848EEE}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{CA9C0864-93C5-4403-A96A-481A312E25AB}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{FB800EB4-BE51-4D8C-8E4F-CFC1270DB18B}] => (Allow) E:\Temp\Steam\steamapps\common\Warframe\Tools\Launcher.exe
FirewallRules: [{C72A1B67-D93C-43AC-BE28-B0ACE3FE8839}] => (Allow) E:\Temp\Steam\steamapps\common\Warframe\Tools\Launcher.exe
FirewallRules: [TCP Query User{EB9F9A8C-6653-487F-B17B-9F501F2579C1}C:\program files (x86)\skype\phone\skype.exe] => (Allow) C:\program files (x86)\skype\phone\skype.exe
FirewallRules: [UDP Query User{56B69EA0-F89E-4E3A-86A9-17B0A681F65D}C:\program files (x86)\skype\phone\skype.exe] => (Allow) C:\program files (x86)\skype\phone\skype.exe
FirewallRules: [{8D865167-D700-4BE4-9F4A-CA556B393C38}] => (Allow) E:\Temp\Steam\steamapps\common\the witcher 2\Launcher.exe
FirewallRules: [{E0ABD53F-A995-438C-9AF4-7F12976B664F}] => (Allow) E:\Temp\Steam\steamapps\common\the witcher 2\Launcher.exe
FirewallRules: [{70336664-A8F7-4643-8DE1-888C970ADC52}] => (Allow) E:\Temp\Test\FarCry 4\bin\FarCry4.exe
FirewallRules: [{72959202-F7E2-4BC0-9E68-D9CE43FA28F0}] => (Allow) E:\Temp\Test\FarCry 4\bin\FarCry4.exe
FirewallRules: [{A5616C7D-29F6-4A47-BCBB-F7E60F43C9E9}] => (Allow) E:\Temp\Test\FarCry 4\bin\IGE_WPF64.exe
FirewallRules: [{5A969598-A826-47D0-ADB8-1F16B5161795}] => (Allow) E:\Temp\Test\FarCry 4\bin\IGE_WPF64.exe
FirewallRules: [{6B564610-4D4B-4514-8E99-BA30320C8C45}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
FirewallRules: [{8275C44B-588A-44A8-AA31-5CA246C843D7}] => (Allow) C:\Users\Duc Hong\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe
FirewallRules: [{341B590C-72BE-41C1-8D3B-81B7B97F31C4}] => (Allow) C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe
FirewallRules: [{9C62EFEB-4763-4789-983E-C443E1323C56}] => (Allow) LPort=2869
FirewallRules: [{A0BBA649-A813-4E72-B461-002ADF599BB2}] => (Allow) LPort=1900
FirewallRules: [{7A1895A9-2842-4905-B03D-7FE4C9AE9DF0}] => (Allow) C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (05/30/2015 06:10:44 AM) (Source: NvStreamSvc) (EventID: 2001) (User: )
Description: NvStreamSvcFailed continue stopping. [6]

Error: (05/29/2015 05:49:16 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Activation context generation failed for "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_624760d1ecb7236e.manifest1".Error in manifest or policy file "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_624760d1ecb7236e.manifest2" on line C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_624760d1ecb7236e.manifest3.
A component version required by the application conflicts with another component version already active.
Conflicting components are:.
Component 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_624760d1ecb7236e.manifest.
Component 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_a9f497a901334c74.manifest.

Error: (05/29/2015 05:17:42 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Activation context generation failed for "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_624760d1ecb7236e.manifest1".Error in manifest or policy file "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_624760d1ecb7236e.manifest2" on line C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_624760d1ecb7236e.manifest3.
A component version required by the application conflicts with another component version already active.
Conflicting components are:.
Component 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_624760d1ecb7236e.manifest.
Component 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_a9f497a901334c74.manifest.

Error: (05/29/2015 05:17:41 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Activation context generation failed for "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_624760d1ecb7236e.manifest1".Error in manifest or policy file "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_624760d1ecb7236e.manifest2" on line C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_624760d1ecb7236e.manifest3.
A component version required by the application conflicts with another component version already active.
Conflicting components are:.
Component 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_624760d1ecb7236e.manifest.
Component 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_a9f497a901334c74.manifest.

Error: (05/29/2015 05:17:31 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Activation context generation failed for "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_624760d1ecb7236e.manifest1".Error in manifest or policy file "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_624760d1ecb7236e.manifest2" on line C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_624760d1ecb7236e.manifest3.
A component version required by the application conflicts with another component version already active.
Conflicting components are:.
Component 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_624760d1ecb7236e.manifest.
Component 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_a9f497a901334c74.manifest.

Error: (05/29/2015 05:17:31 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Activation context generation failed for "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_624760d1ecb7236e.manifest1".Error in manifest or policy file "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_624760d1ecb7236e.manifest2" on line C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_624760d1ecb7236e.manifest3.
A component version required by the application conflicts with another component version already active.
Conflicting components are:.
Component 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_624760d1ecb7236e.manifest.
Component 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_a9f497a901334c74.manifest.

Error: (05/29/2015 05:15:57 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Activation context generation failed for "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_624760d1ecb7236e.manifest1".Error in manifest or policy file "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_624760d1ecb7236e.manifest2" on line C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_624760d1ecb7236e.manifest3.
A component version required by the application conflicts with another component version already active.
Conflicting components are:.
Component 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_624760d1ecb7236e.manifest.
Component 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_a9f497a901334c74.manifest.

Error: (05/28/2015 05:58:33 PM) (Source: NvStreamSvc) (EventID: 2001) (User: )
Description: NvStreamSvcFailed continue stopping. [6]

Error: (05/28/2015 07:09:30 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: UpdateChecker.exe, version: 0.0.0.0, time stamp: 0x54dc4378
Faulting module name: alvupdt.dll, version: 1.0.0.10, time stamp: 0x5510b8fc
Exception code: 0xc0000005
Fault offset: 0x00016eb6
Faulting process id: 0x1af8
Faulting application start time: 0xUpdateChecker.exe0
Faulting application path: UpdateChecker.exe1
Faulting module path: UpdateChecker.exe2
Report Id: UpdateChecker.exe3
Faulting package full name: UpdateChecker.exe4
Faulting package-relative application ID: UpdateChecker.exe5

Error: (05/28/2015 06:54:04 AM) (Source: SideBySide) (EventID: 78) (User: )
Description: Activation context generation failed for "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_624760d1ecb7236e.manifest1".Error in manifest or policy file "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_624760d1ecb7236e.manifest2" on line C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_624760d1ecb7236e.manifest3.
A component version required by the application conflicts with another component version already active.
Conflicting components are:.
Component 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_624760d1ecb7236e.manifest.
Component 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_a9f497a901334c74.manifest.


System errors:
=============
Error: (05/30/2015 02:16:07 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The VBoxAsw Support Driver service failed to start due to the following error:
%%2

Error: (05/30/2015 03:53:18 AM) (Source: Schannel) (EventID: 4120) (User: NT AUTHORITY)
Description: A fatal alert was generated and sent to the remote endpoint. This may result in termination of the connection. The TLS protocol defined fatal error code is 20. The Windows SChannel error state is 960.

Error: (05/30/2015 03:28:05 AM) (Source: Schannel) (EventID: 4120) (User: NT AUTHORITY)
Description: A fatal alert was generated and sent to the remote endpoint. This may result in termination of the connection. The TLS protocol defined fatal error code is 20. The Windows SChannel error state is 960.

Error: (05/28/2015 06:00:21 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The Software Protection service failed to start due to the following error:
%%1053

Error: (05/28/2015 06:00:21 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: A timeout was reached (30000 milliseconds) while waiting for the Software Protection service to connect.

Error: (05/28/2015 05:59:37 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The VBoxAsw Support Driver service failed to start due to the following error:
%%2

Error: (05/28/2015 05:35:52 PM) (Source: volsnap) (EventID: 36) (User: )
Description: The shadow copies of volume C: were aborted because the shadow copy storage could not grow due to a user imposed limit.

Error: (05/28/2015 07:00:39 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The VBoxAsw Support Driver service failed to start due to the following error:
%%2

Error: (05/28/2015 06:51:52 AM) (Source: DCOM) (EventID: 10010) (User: HongHoangPC)
Description: {BF6C1E47-86EC-4194-9CE5-13C15DCB2001}

Error: (05/28/2015 06:51:22 AM) (Source: DCOM) (EventID: 10010) (User: HongHoangPC)
Description: {1B1F472E-3221-4826-97DB-2C2324D389AE}


Microsoft Office:
=========================
Error: (05/30/2015 06:10:44 AM) (Source: NvStreamSvc) (EventID: 2001) (User: )
Description: NvStreamSvcFailed continue stopping. [6]

Error: (05/29/2015 05:49:16 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_624760d1ecb7236e.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_a9f497a901334c74.manifestE:\Software\Programs\esetsmartinstaller_enu.exe

Error: (05/29/2015 05:17:42 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_624760d1ecb7236e.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_a9f497a901334c74.manifestC:\Users\Duc Hong\Downloads\Programs\esetsmartinstaller_enu.exe

Error: (05/29/2015 05:17:41 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_624760d1ecb7236e.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_a9f497a901334c74.manifestC:\Users\Duc Hong\Downloads\Programs\esetsmartinstaller_enu.exe

Error: (05/29/2015 05:17:31 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_624760d1ecb7236e.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_a9f497a901334c74.manifestC:\Users\Duc Hong\Downloads\Programs\esetsmartinstaller_enu.exe

Error: (05/29/2015 05:17:31 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_624760d1ecb7236e.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_a9f497a901334c74.manifestC:\Users\Duc Hong\Downloads\Programs\esetsmartinstaller_enu.exe

Error: (05/29/2015 05:15:57 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_624760d1ecb7236e.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_a9f497a901334c74.manifestC:\Users\Duc Hong\Downloads\Programs\esetsmartinstaller_enu.exe

Error: (05/28/2015 05:58:33 PM) (Source: NvStreamSvc) (EventID: 2001) (User: )
Description: NvStreamSvcFailed continue stopping. [6]

Error: (05/28/2015 07:09:30 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: UpdateChecker.exe0.0.0.054dc4378alvupdt.dll1.0.0.105510b8fcc000000500016eb61af801d098c110704a4cC:\Program Files (x86)\ASUS\ASUS Live Update\UpdateChecker.exeC:\Program Files (x86)\ASUS\ASUS Live Update\alvupdt.dlla99ff224-04b4-11e5-82d5-7824afb1d22b

Error: (05/28/2015 06:54:04 AM) (Source: SideBySide) (EventID: 78) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_624760d1ecb7236e.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_a9f497a901334c74.manifestE:\Software\Tools\Security (update regularly pls)\esetsmartinstaller_enu.exe


CodeIntegrity Errors:
===================================
  Date: 2015-05-17 02:43:02.789
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\SysWOW64\drivers\DrvAgent64.SYS because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2015-05-17 02:43:02.723
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\SysWOW64\drivers\DrvAgent64.SYS because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2015-05-17 02:43:02.658
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\SysWOW64\drivers\DrvAgent64.SYS because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2015-05-17 02:43:02.595
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\SysWOW64\drivers\DrvAgent64.SYS because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2015-05-17 02:43:02.527
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\SysWOW64\drivers\DrvAgent64.SYS because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2015-05-17 02:43:02.462
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\SysWOW64\drivers\DrvAgent64.SYS because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2015-05-17 02:43:02.397
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\SysWOW64\drivers\DrvAgent64.SYS because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2015-05-17 02:43:02.333
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\SysWOW64\drivers\DrvAgent64.SYS because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2015-05-17 02:42:58.259
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\SysWOW64\drivers\DrvAgent64.SYS because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2015-05-17 02:42:58.195
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\SysWOW64\drivers\DrvAgent64.SYS because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.


==================== Memory info ===========================

Processor: Intel® Core™ i7-4710HQ CPU @ 2.50GHz
Percentage of memory in use: 33%
Total physical RAM: 8075.06 MB
Available physical RAM: 5405.47 MB
Total Pagefile: 16267.06 MB
Available Pagefile: 13560.92 MB
Total Virtual: 131072 MB
Available Virtual: 131071.83 MB

==================== Drives ================================

Drive c: (OS) (Fixed) (Total:72.6 GB) (Free:25.4 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive d: (DucHong) (Fixed) (Total:418.9 GB) (Free:290.49 GB) NTFS
Drive e: (Miscellaneous) (Fixed) (Total:300 GB) (Free:80.13 GB) NTFS
Drive f: (Misc.2) (Fixed) (Total:118.9 GB) (Free:95.63 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 931.5 GB) (Disk ID: EE7E28CB)

Partition: GPT Partition Type.

==================== End of log ============================



#10 xXToffeeXx

xXToffeeXx

    Bleepin' Polar Bear


  • Malware Response Instructor
  • 6,015 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:The Arctic Circle
  • Local time:10:25 AM

Posted 30 May 2015 - 01:28 PM

Hi User1412,
 

I used to do some exploits with software and read them from online materials so there's lots of cracks and keygens there ;b

Ah yes, that would make sense.
 
How is your computer running?
 
xXToffeeXx~


~If I am helping you and you have not had a reply from me in two days, please send me a PM~

~Currently in my last year of school, so replies might be more delayed~

 

logo-25.pngID Ransomware - Identify What Ransomware Encrypted Your Files [Support Topic] - If we have helped you out and you want to support what we do, you can do so here

 

 ~Twitter~ | ~Malware Analyst at Emsisoft~


#11 User1412

User1412
  • Topic Starter

  • Members
  • 19 posts
  • OFFLINE
  •  
  • Local time:09:25 PM

Posted 31 May 2015 - 02:04 AM

My computer is running good now. Thanks for your help, Toffee.



#12 xXToffeeXx

xXToffeeXx

    Bleepin' Polar Bear


  • Malware Response Instructor
  • 6,015 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:The Arctic Circle
  • Local time:10:25 AM

Posted 31 May 2015 - 12:43 PM

Hi User1412,
 
You are welcome :)
 
Your machine is clean! Feel free to enjoy the use of your cleaned computer. Please take the time to follow this last post which tells you how to remove the tools we have used and how to keep your computer clean :thumbsup:
 
---------------
 
Download 51a5ce45263de-delfix.pngDelfix by Xplode to your desktop. Delfix will delete all the used tools and logfiles.
 
Double-click Delfix.exe to start the tool.
Make sure the following items are checked:

  • Activate UAC
  • Remove disinfection tools
  • Create registry backup
  • Purge System Restore
  • Reset system settings

Now click "Run" and wait patiently.
Once finished a logfile will be created. You don't need to copy and paste it into your next reply.
 
--------------
 
Also, feel free to delete any leftover desktop icons and other various files which have been created throughout the process.
 
---------------
 
I have also compiled a list of links which you may be interested in:

This topic will be left open for 3 days in case you have any problems, otherwise it will closed after that time.
 
xXToffeeXx~


~If I am helping you and you have not had a reply from me in two days, please send me a PM~

~Currently in my last year of school, so replies might be more delayed~

 

logo-25.pngID Ransomware - Identify What Ransomware Encrypted Your Files [Support Topic] - If we have helped you out and you want to support what we do, you can do so here

 

 ~Twitter~ | ~Malware Analyst at Emsisoft~


#13 xXToffeeXx

xXToffeeXx

    Bleepin' Polar Bear


  • Malware Response Instructor
  • 6,015 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:The Arctic Circle
  • Local time:10:25 AM

Posted 07 June 2015 - 08:07 AM

It appears that this issue is resolved, therefore I am closing the topic. If that is not the case and you need or wish to continue with this topic, please send me or any Moderator a Personal Message (PM) that you would like this topic re-opened.

~If I am helping you and you have not had a reply from me in two days, please send me a PM~

~Currently in my last year of school, so replies might be more delayed~

 

logo-25.pngID Ransomware - Identify What Ransomware Encrypted Your Files [Support Topic] - If we have helped you out and you want to support what we do, you can do so here

 

 ~Twitter~ | ~Malware Analyst at Emsisoft~





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users