Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 28-06-2016
Ran by JARXAN (administrator) on STARGENT (29-06-2016 11:46:42)
Running from J:\EXE\DRIVERS
Loaded Profiles: JARXAN (Available Profiles: JARXAN)
Platform: Windows 7 Ultimate Service Pack 1 (X64) Language: Русский (Россия)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(The Within Network, LLC) C:\Windows\UnsignedThemesSvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Adobe Systems, Incorporated) C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(BitTorrent Inc.) C:\Users\JARXAN\AppData\Roaming\uTorrent\uTorrent.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
() C:\Program Files\Rainmeter\Rainmeter.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamUserAgent.exe
(NVIDIA Corporation) C:\Users\JARXAN\AppData\Local\NVIDIA\NvBackend\ApplicationOntology\NvOAWrapperCache.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Microsoft Corporation) C:\Windows\System32\GWX\GWX.exe


==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2789248 2016-02-17] (NVIDIA Corporation)
HKLM\...\Run: [ShadowPlay] => "C:\Windows\system32\rundll32.exe" C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart
HKLM-x32\...\Run: [JMB36X IDE Setup] => C:\Windows\RaidTool\xInsIDE.exe
HKLM\...\Winlogon: [System] C:\Windows\system32\lsass.exe [31232 2015-09-15] (Microsoft Corporation)
HKU\S-1-5-19\...\Run: [Sidebar] => %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun
HKU\S-1-5-19\Control Panel\Desktop\\SCRNSAVE.EXE -> 
HKU\S-1-5-20\...\Run: [Sidebar] => %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun
HKU\S-1-5-20\Control Panel\Desktop\\SCRNSAVE.EXE -> 
HKU\S-1-5-21-3342368325-3632019662-4143609904-1000\...\Run: [uTorrent] => C:\Users\JARXAN\AppData\Roaming\uTorrent\uTorrent.exe [1316688 2014-06-08] (BitTorrent Inc.)
HKU\S-1-5-21-3342368325-3632019662-4143609904-1000\...\Run: [Firefox] => C:\Program Files\Mozilla Firefox\firefox.exe [399816 2016-06-11] (Mozilla Corporation)
HKU\S-1-5-21-3342368325-3632019662-4143609904-1000\...\Winlogon: [Shell] C:\Windows\explorer.exe [2871808 2011-02-25] (Microsoft Corporation) <==== ATTENTION
HKU\S-1-5-21-3342368325-3632019662-4143609904-1000\Control Panel\Desktop\\SCRNSAVE.EXE -> 
HKU\S-1-5-18\Control Panel\Desktop\\SCRNSAVE.EXE -> 
Startup: C:\Users\JARXAN\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Rainmeter.lnk [2014-05-26]
ShortcutTarget: Rainmeter.lnk -> C:\Program Files\Rainmeter\Rainmeter.exe ()

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{30AACAD9-3C08-47B4-BD98-4F771E51F28B}: [DhcpNameServer] 192.168.1.1

Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = 
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = 
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = 
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = 
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = 
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = 
HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = 
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Local Page = 
HKU\S-1-5-21-3342368325-3632019662-4143609904-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.yandex.ru/?win=117&clid=1976616
SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f URL = 
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_91\bin\ssv.dll [2016-04-29] (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2011-03-28] (Microsoft Corp.)
BHO: Визуальные закладки -> {D5FEC983-01DB-414a-9456-AF95AC9ED7B5} -> No File
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_91\bin\jp2ssv.dll [2016-04-29] (Oracle Corporation)
BHO-x32: Помощник по входу с помощью идентификатора Windows Live ID -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2011-03-28] (Microsoft Corp.)
BHO-x32: Визуальные закладки -> {D5FEC983-01DB-414a-9456-AF95AC9ED7B5} -> No File

FireFox:
========
FF ProfilePath: C:\Users\JARXAN\AppData\Roaming\Mozilla\Firefox\Profiles\cvridqcc.default
FF DefaultSearchEngine: КиноПоиск.ru
FF Session Restore: -> is enabled.
FF NetworkProxy: "autoconfig_url", "https://antizapret.prostovpn.org/proxy.pac"
FF NetworkProxy: "type", 2
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_20_0_0_306.dll [2016-02-11] ()
FF Plugin: @java.com/DTPlugin,version=11.91.2 -> C:\Program Files\Java\jre1.8.0_91\bin\dtplugin\npDeployJava1.dll [2016-04-29] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.91.2 -> C:\Program Files\Java\jre1.8.0_91\bin\plugin2\npjp2.dll [2016-04-29] (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.40728.0\npctrl.dll [2015-07-28] ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_20_0_0_306.dll [2016-02-11] ()
FF Plugin-x32: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.40728.0\npctrl.dll [2015-07-28] ( Microsoft Corporation)
FF Plugin HKU\S-1-5-21-3342368325-3632019662-4143609904-1000: @mail.ru/GameCenter -> C:\Users\JARXAN\AppData\Local\Mail.Ru\GameCenter\NPDetector.dll [No File]
FF user.js: detected! => C:\Users\JARXAN\AppData\Roaming\Mozilla\Firefox\Profiles\cvridqcc.default\user.js [2014-09-20]
FF SearchPlugin: C:\Users\JARXAN\AppData\Roaming\Mozilla\Firefox\Profiles\cvridqcc.default\searchplugins\ru.xml [2014-11-08]
FF SearchPlugin: C:\Users\JARXAN\AppData\Roaming\Mozilla\Firefox\Profiles\cvridqcc.default\searchplugins\rutororg----.xml [2015-12-31]
FF SearchPlugin: C:\Users\JARXAN\AppData\Roaming\Mozilla\Firefox\Profiles\cvridqcc.default\searchplugins\rutrackerorg.xml [2014-11-08]
FF SearchPlugin: C:\Users\JARXAN\AppData\Roaming\Mozilla\Firefox\Profiles\cvridqcc.default\searchplugins\youtube.xml [2014-11-08]
FF Extension: Context Search X - C:\Users\JARXAN\AppData\Roaming\Mozilla\Firefox\Profiles\cvridqcc.default\extensions\contextsearch2@lwz.addons.mozilla.org.xpi [2016-01-04]
FF Extension: NewsFox - C:\Users\JARXAN\AppData\Roaming\Mozilla\Firefox\Profiles\cvridqcc.default\extensions\{899DF1F8-2F43-4394-8315-37F6744E6319}.xpi [2016-02-29]
FF Extension: SmoothWheel (mozdev.org) - C:\Users\JARXAN\AppData\Roaming\Mozilla\Firefox\Profiles\cvridqcc.default\extensions\{5F590AA2-1221-4113-A6F4-A4BB62414FAC}.xpi [2016-04-28]
FF Extension: Menu Wizard - C:\Users\JARXAN\AppData\Roaming\Mozilla\Firefox\Profiles\cvridqcc.default\extensions\s3menu@wizard.xpi [2016-05-08]
FF Extension: FireGestures - C:\Users\JARXAN\AppData\Roaming\Mozilla\Firefox\Profiles\cvridqcc.default\extensions\firegestures@xuldev.org.xpi [2016-05-19]
FF Extension: Classic Theme Restorer - C:\Users\JARXAN\AppData\Roaming\Mozilla\Firefox\Profiles\cvridqcc.default\extensions\ClassicThemeRestorer@ArisT2Noia4dev.xpi [2016-06-11]
FF Extension: NewScrollbars (aka NoiaScrollbars) - C:\Users\JARXAN\AppData\Roaming\Mozilla\Firefox\Profiles\cvridqcc.default\extensions\NoiaScrollbars@ArisT2_Noia4dev.xpi [2016-06-18]
FF Extension: Yandex.Mail notifier - C:\Users\JARXAN\AppData\Roaming\Mozilla\Firefox\Profiles\cvridqcc.default\Extensions\jid0-vsitoD18LSTi4VQGGLCVmIoJSsU@jetpack.xpi [2016-04-15]
FF Extension: NASA Night Launch - C:\Users\JARXAN\AppData\Roaming\Mozilla\Firefox\Profiles\cvridqcc.default\Extensions\nasanightlaunch@example.com.xpi [2016-04-07]
FF Extension: Доступ к Рутрекеру - C:\Users\JARXAN\AppData\Roaming\Mozilla\Firefox\Profiles\cvridqcc.default\Extensions\public.proartex@gmail.com.xpi [2016-06-28]
FF Extension: Tab Counter - C:\Users\JARXAN\AppData\Roaming\Mozilla\Firefox\Profiles\cvridqcc.default\Extensions\tabcounter@morac.xpi [2016-03-10]
FF Extension: FT DeepDark - C:\Users\JARXAN\AppData\Roaming\Mozilla\Firefox\Profiles\cvridqcc.default\Extensions\{77d2ed30-4cd2-11e0-b8af-0800200c9a66} [2016-06-27]
FF Extension: Adblock Plus - C:\Users\JARXAN\AppData\Roaming\Mozilla\Firefox\Profiles\cvridqcc.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2016-04-28]

Chrome: 
=======
CHR Profile: C:\Users\JARXAN\AppData\Local\Google\Chrome\User Data\Default

Opera: 
=======
OPR Extension: (No Name) - C:\Users\JARXAN\AppData\Roaming\Opera Software\Opera Stable\Extensions\jkkngokdooagpeidijbihiofdalckjmh [2015-11-14]
OPR Extension: (Adblock Plus) - C:\Users\JARXAN\AppData\Roaming\Opera Software\Opera Stable\Extensions\oidhhegpmlfpoeialbgcdocjalghfpkp [2013-07-06]

==================== Services (Whitelisted) ========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 AGSService; C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exe [2021592 2016-04-05] (Adobe Systems, Incorporated)
S3 defragsvc; C:\Windows\System32\defragsvc.dll [291328 2009-07-14] (Корпорация Майкрософт)
R2 ftpsvc; C:\Windows\system32\inetsrv\ftpsvc.dll [350720 2012-06-01] (Microsoft Corporation)
R2 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [1164672 2016-02-17] (NVIDIA Corporation)
S4 nlsX86cc; C:\Windows\SysWOW64\nlssrv32.exe [66560 2011-03-30] (Nalpeiron Ltd.) [File not signed]
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1880960 2016-02-17] (NVIDIA Corporation)
R3 NvStreamNetworkSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe [6474112 2016-02-17] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe [2609024 2016-02-17] (NVIDIA Corporation)
S4 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76888 2013-01-02] ()
R2 Themes; C:\Windows\system32\themeservice.dll [44544 2012-08-01] (Microsoft Corporation) [File not signed]
R2 UnsignedThemes; C:\Windows\UnsignedThemesSvc.exe [24168 2009-07-13] (The Within Network, LLC)
S4 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
S3 WPCSvc; C:\Windows\System32\wpcsvc.dll [12288 2009-07-14] (Корпорация Майкрософт)
S3 WPCSvc; C:\Windows\SysWOW64\wpcsvc.dll [10752 2009-07-14] (Корпорация Майкрософт)

===================== Drivers (Whitelisted) ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R3 Abyssus; C:\Windows\System32\drivers\Abyssus.sys [10880 2009-10-30] (Razer (Asia-Pacific) Pte Ltd)
S3 CisUtMonitor; C:\Windows\System32\DRIVERS\CisUtMonitor.sys [33360 2011-10-30] (CrystalIdea Software)
S3 ebdrv; C:\Windows\system32\drivers\evbda.sys [3286016 2009-06-10] (Broadcom Corporation)
R0 iaStorF; C:\Windows\System32\DRIVERS\iaStorF.sys [28008 2013-11-21] (Intel Corporation)
R0 mountmgr; C:\Windows\System32\drivers\mountmgr.sys [94656 2015-07-15] (Корпорация Майкрософт)
R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [28032 2016-02-17] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [47760 2015-12-18] (NVIDIA Corporation)
S3 pwdrvio; C:\Windows\system32\pwdrvio.sys [19936 2011-05-06] ()
S3 pwdspio; C:\Windows\system32\pwdspio.sys [13280 2011-05-06] ()
R3 SmbDrvI; C:\Windows\System32\DRIVERS\Smb_driver_Intel.sys [44344 2013-02-24] (Synaptics Incorporated)
R0 sptd; C:\Windows\System32\Drivers\sptd.sys [564824 2013-01-03] (Duplex Secure Ltd.)
R2 uxpatch; C:\Windows\system32\drivers\uxpatch.sys [30568 2009-07-13] ()
R0 volmgrx; C:\Windows\System32\drivers\volmgrx.sys [363392 2010-11-21] (Корпорация Майкрософт)
S4 NVHDA; system32\drivers\nvhda64v.sys [X]

========================== Drivers MD5 =======================

C:\Windows\System32\DRIVERS\1394ohci.sys ==> MD5 is legit
C:\Windows\System32\drivers\Abyssus.sys CDF91E688D456B9702B2EA72C85F840C
C:\Windows\System32\drivers\ACPI.sys ==> MD5 is legit
C:\Windows\system32\drivers\acpipmi.sys ==> MD5 is legit
C:\Windows\system32\drivers\adp94xx.sys ==> MD5 is legit
C:\Windows\system32\drivers\adpahci.sys ==> MD5 is legit
C:\Windows\system32\drivers\adpu320.sys ==> MD5 is legit
C:\Windows\system32\drivers\afd.sys FA886682CFC5D36718D3E436AACF10B9
C:\Windows\system32\drivers\agp440.sys ==> MD5 is legit
C:\Windows\system32\drivers\aliide.sys ==> MD5 is legit
C:\Windows\system32\drivers\amdide.sys ==> MD5 is legit
C:\Windows\system32\drivers\amdk8.sys ==> MD5 is legit
C:\Windows\system32\drivers\amdppm.sys ==> MD5 is legit
C:\Windows\system32\drivers\amdsata.sys D4121AE6D0C0E7E13AA221AA57EF2D49
C:\Windows\system32\drivers\amdsbs.sys ==> MD5 is legit
C:\Windows\System32\drivers\amdxata.sys 540DAF1CEA6094886D72126FD7C33048
C:\Windows\system32\drivers\appid.sys 27DABFB4A6B0140C34DBEC713469592B
C:\Windows\system32\drivers\arc.sys ==> MD5 is legit
C:\Windows\system32\drivers\arcsas.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\asmthub3.sys 10920CCB66203D7EF48F024B1B35AE6F
C:\Windows\System32\DRIVERS\asmtxhci.sys C479BFAF73CF726E01AA0A487B268A5E
C:\Windows\System32\DRIVERS\asyncmac.sys ==> MD5 is legit
C:\Windows\System32\drivers\atapi.sys ==> MD5 is legit
C:\Windows\system32\drivers\bxvbda.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\b57nd60a.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Beep.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\blbdrive.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\bowser.sys ==> MD5 is legit
C:\Windows\system32\drivers\BrFiltLo.sys ==> MD5 is legit
C:\Windows\system32\drivers\BrFiltUp.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Brserid.sys ==> MD5 is legit
C:\Windows\System32\Drivers\BrSerWdm.sys ==> MD5 is legit
C:\Windows\System32\Drivers\BrUsbMdm.sys ==> MD5 is legit
C:\Windows\System32\Drivers\BrUsbSer.sys ==> MD5 is legit
C:\Windows\system32\drivers\BthEnum.sys CF98190A94F62E405C8CB255018B2315
C:\Windows\System32\DRIVERS\bthmodem.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\bthpan.sys 02DD601B708DD0667E1331FA8518E9FF
C:\Windows\System32\Drivers\BTHport.sys 738D0E9272F59EB7A1449C3EC118E6C4
C:\Windows\System32\Drivers\BTHUSB.sys F188B7394D81010767B6DF3178519A37
C:\Windows\System32\DRIVERS\cdfs.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\cdrom.sys ==> MD5 is legit
C:\Windows\system32\drivers\circlass.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\CisUtMonitor.sys 887A9970E711232E2C93F0FD343A1C9D
C:\Windows\System32\CLFS.sys 404B7DF9CA4D1CB675045AF220FF3285
C:\Windows\system32\drivers\CmBatt.sys ==> MD5 is legit
C:\Windows\system32\drivers\cmdide.sys ==> MD5 is legit
C:\Windows\System32\Drivers\cng.sys 27667A788130A7F7A5858DE27572E6D7
C:\Windows\system32\drivers\compbatt.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\CompositeBus.sys ==> MD5 is legit
C:\Windows\system32\drivers\crcdisk.sys ==> MD5 is legit
C:\Windows\System32\drivers\csc.sys ==> MD5 is legit
C:\Windows\System32\Drivers\dfsc.sys ==> MD5 is legit
C:\Windows\System32\drivers\discache.sys ==> MD5 is legit
C:\Windows\System32\drivers\disk.sys ==> MD5 is legit
C:\Windows\system32\drivers\dmvsc.sys 5DB085A8A6600BE6401F2B24EECB5415
C:\Windows\system32\drivers\drmkaud.sys ==> MD5 is legit
C:\Windows\System32\drivers\dxgkrnl.sys 87CE5C8965E101CCCED1F4675557E868
C:\Windows\system32\drivers\evbda.sys ==> MD5 is legit
C:\Windows\system32\drivers\elxstor.sys ==> MD5 is legit
C:\Windows\system32\drivers\errdev.sys ==> MD5 is legit
C:\Windows\System32\Drivers\exfat.sys ==> MD5 is legit
C:\Windows\System32\Drivers\fastfat.sys ==> MD5 is legit
C:\Windows\system32\drivers\fdc.sys ==> MD5 is legit
C:\Windows\System32\drivers\fileinfo.sys ==> MD5 is legit
C:\Windows\System32\drivers\filetrace.sys ==> MD5 is legit
C:\Windows\system32\drivers\flpydisk.sys ==> MD5 is legit
C:\Windows\System32\drivers\fltmgr.sys ==> MD5 is legit
C:\Windows\System32\drivers\FsDepends.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Fs_Rec.sys 6BD9295CC032DD3077C671FCCF579A7B
C:\Windows\System32\DRIVERS\fvevol.sys 8F6322049018354F45F05A2FD2D4E5E0
C:\Windows\system32\drivers\gagp30kx.sys ==> MD5 is legit
C:\Windows\system32\drivers\hcw85cir.sys ==> MD5 is legit
C:\Windows\System32\drivers\HdAudio.sys 975761C778E33CD22498059B91E7373A
C:\Windows\System32\DRIVERS\HDAudBus.sys ==> MD5 is legit
C:\Windows\system32\drivers\HidBatt.sys ==> MD5 is legit
C:\Windows\system32\drivers\hidbth.sys ==> MD5 is legit
C:\Windows\system32\drivers\hidir.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\hidusb.sys ==> MD5 is legit
C:\Windows\system32\drivers\HpSAMD.sys ==> MD5 is legit
C:\Windows\System32\drivers\HTTP.sys F61634BEC53F73702A10DE69F6DCAF57
C:\Windows\System32\drivers\hwpolicy.sys ==> MD5 is legit
C:\Windows\system32\drivers\i8042prt.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\iaStor.sys D1753C06EE17E29352B065EACF3F10D0
C:\Windows\System32\DRIVERS\iaStorA.sys 25555186E4FBDF0E30A5DBFC9B9A73F9
C:\Windows\System32\DRIVERS\iaStorF.sys 10E79E366FA255318F5D1D0ED07F947D
C:\Windows\system32\drivers\iaStorV.sys AAAF44DB3BD0B9D1FB6969B23ECC8366
C:\Windows\system32\drivers\iirsp.sys ==> MD5 is legit
C:\Windows\System32\drivers\RTKVHD64.sys 39246F2CFBF1D32C3A12E242661EC039
C:\Windows\system32\drivers\intelide.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\intelppm.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ipfltdrv.sys ==> MD5 is legit
C:\Windows\system32\drivers\IPMIDrv.sys ==> MD5 is legit
C:\Windows\System32\drivers\ipnat.sys ==> MD5 is legit
C:\Windows\System32\drivers\irenum.sys ==> MD5 is legit
C:\Windows\system32\drivers\isapnp.sys ==> MD5 is legit
C:\Windows\system32\drivers\msiscsi.sys 96BB922A0981BC7432C8CF52B5410FE6
C:\Windows\System32\DRIVERS\iusb3hcs.sys 75779002A6084C1A011E195E421A9C75
C:\Windows\System32\DRIVERS\jraid.sys 73A968D4A85BB2552DDCF72CB15F06D2
C:\Windows\System32\DRIVERS\kbdclass.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\kbdhid.sys ==> MD5 is legit
C:\Windows\System32\Drivers\ksecdd.sys 3A8C03156C3E31E70EF84E48CA179B46
C:\Windows\System32\Drivers\ksecpkg.sys C6330F7C2E92A00E6773E82F79078AFC
C:\Windows\system32\drivers\ksthunk.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\lltdio.sys ==> MD5 is legit
C:\Windows\system32\drivers\lsi_fc.sys ==> MD5 is legit
C:\Windows\system32\drivers\lsi_sas.sys ==> MD5 is legit
C:\Windows\system32\drivers\lsi_sas2.sys ==> MD5 is legit
C:\Windows\system32\drivers\lsi_scsi.sys ==> MD5 is legit
C:\Windows\system32\drivers\luafv.sys ==> MD5 is legit
C:\Windows\system32\drivers\megasas.sys ==> MD5 is legit
C:\Windows\system32\drivers\MegaSR.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\HECIx64.sys A6518DCC42F7A6E999BB3BEA8FD87567
C:\Windows\System32\drivers\modem.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\monitor.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\mouclass.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\mouhid.sys ==> MD5 is legit
C:\Windows\System32\drivers\mountmgr.sys 67050452C0118BAF2883928E6FCCFE47
C:\Windows\system32\drivers\mpio.sys ==> MD5 is legit
C:\Windows\System32\drivers\mpsdrv.sys ==> MD5 is legit
C:\Windows\system32\drivers\mrxdav.sys AE3334958D8F631FF14A0AEB3D7EFB3A
C:\Windows\System32\DRIVERS\mrxsmb.sys ACB6782973BD93760D597FC7BB37E692
C:\Windows\System32\DRIVERS\mrxsmb10.sys 262BF7BB7D0E44CFAA9B12A1E0A6EDF1
C:\Windows\System32\DRIVERS\mrxsmb20.sys 8C0376974AA28398FF501E78C04ACB30
C:\Windows\System32\drivers\msahci.sys ==> MD5 is legit
C:\Windows\system32\drivers\msdsm.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Msfs.sys ==> MD5 is legit
C:\Windows\System32\drivers\mshidkmdf.sys ==> MD5 is legit
C:\Windows\System32\drivers\msisadrv.sys ==> MD5 is legit
C:\Windows\System32\drivers\MSKSSRV.sys ==> MD5 is legit
C:\Windows\System32\drivers\MSPCLOCK.sys ==> MD5 is legit
C:\Windows\System32\drivers\MSPQM.sys ==> MD5 is legit
C:\Windows\System32\Drivers\MsRPC.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\mssmbios.sys ==> MD5 is legit
C:\Windows\System32\drivers\MSTEE.sys ==> MD5 is legit
C:\Windows\system32\drivers\MTConfig.sys ==> MD5 is legit
C:\Windows\System32\Drivers\mup.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\nwifi.sys ==> MD5 is legit
C:\Windows\System32\drivers\ndis.sys 760E38053BF56E501D562B70AD796B88
C:\Windows\System32\DRIVERS\ndiscap.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ndistapi.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ndisuio.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ndiswan.sys ==> MD5 is legit
C:\Windows\System32\Drivers\NDProxy.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\netbios.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\netbt.sys ==> MD5 is legit
C:\Windows\system32\drivers\nfrd960.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Npfs.sys ==> MD5 is legit
C:\Windows\System32\drivers\nsiproxy.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Ntfs.sys 1A29A59A4C5BA6F8C85062A613B7E2B2
C:\Windows\System32\Drivers\Null.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\nvlddmkm.sys 616D9A6F59FA604612E4B25AAF36BFCA
C:\Windows\system32\drivers\nvraid.sys 0A92CB65770442ED0DC44834632F66AD
C:\Windows\system32\drivers\nvstor.sys DAB0E87525C10052BF65F06152F37E4A
C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys 27DF221148B9C1A3EA8900D87ABC30F5
C:\Windows\System32\drivers\nvvad64v.sys 64E8275CEAD43D3CA8E3A311B2F4B64A
C:\Windows\system32\drivers\nv_agp.sys ==> MD5 is legit
C:\Windows\system32\drivers\ohci1394.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\parport.sys ==> MD5 is legit
C:\Windows\System32\drivers\partmgr.sys E9766131EEADE40A27DC27D2D68FBA9C
C:\Windows\System32\drivers\pci.sys ==> MD5 is legit
C:\Windows\System32\drivers\pciide.sys ==> MD5 is legit
C:\Windows\system32\drivers\pcmcia.sys ==> MD5 is legit
C:\Windows\System32\drivers\pcw.sys ==> MD5 is legit
C:\Windows\System32\drivers\peauth.sys ED6E75158D28D33A2E2A020AC5B2B59D
C:\Windows\System32\DRIVERS\raspptp.sys ==> MD5 is legit
C:\Windows\system32\drivers\processr.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\pacer.sys ==> MD5 is legit
C:\Windows\system32\pwdrvio.sys DA3964D8FB8798DC741ABACA9ED1B99D
C:\Windows\system32\pwdspio.sys A55ED5A63D0178A41EA05AC50A60F89A
C:\Windows\system32\drivers\ql2300.sys ==> MD5 is legit
C:\Windows\system32\drivers\ql40xx.sys ==> MD5 is legit
C:\Windows\system32\drivers\qwavedrv.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rasacd.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\AgileVpn.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rasl2tp.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\raspppoe.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rassstp.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rdbss.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rdpbus.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\RDPCDD.sys ==> MD5 is legit
C:\Windows\System32\drivers\rdpdr.sys ==> MD5 is legit
C:\Windows\System32\drivers\rdpencdd.sys ==> MD5 is legit
C:\Windows\System32\drivers\rdprefmp.sys ==> MD5 is legit
C:\Windows\System32\drivers\rdpvideominiport.sys 313F68E1A3E6345A4F47A36B07062F34
C:\Windows\System32\Drivers\RDPWD.sys FE571E088C2D83619D2D48D4E961BF41
C:\Windows\System32\drivers\rdyboost.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rfcomm.sys 3DD798846E2C28102B922C56E71B7932
C:\Windows\System32\DRIVERS\rspndr.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\Rt64win7.sys D787F86566F6EA23053D9C5F401E33B7
C:\Windows\system32\drivers\vms3cap.sys ==> MD5 is legit
C:\Windows\system32\drivers\sbp2port.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\scfilter.sys ==> MD5 is legit
C:\Windows\System32\Drivers\secdrv.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\serenum.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\serial.sys ==> MD5 is legit
C:\Windows\system32\drivers\sermouse.sys ==> MD5 is legit
C:\Windows\system32\drivers\sffdisk.sys ==> MD5 is legit
C:\Windows\system32\drivers\sffp_mmc.sys ==> MD5 is legit
C:\Windows\system32\drivers\sffp_sd.sys ==> MD5 is legit
C:\Windows\system32\drivers\sfloppy.sys ==> MD5 is legit
C:\Windows\system32\drivers\SiSRaid2.sys ==> MD5 is legit
C:\Windows\system32\drivers\sisraid4.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\smb.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\Smb_driver_Intel.sys 0C66ADD5C164CE0451C24B45CFDBE102
C:\Windows\System32\Drivers\spldr.sys ==> MD5 is legit
C:\Windows\System32\Drivers\sptd.sys D6AB7C13FCDD2E4CAC35244D2C172D9A
C:\Windows\System32\DRIVERS\srv.sys 441FBA48BFF01FDB9D5969EBC1838F0B
C:\Windows\System32\DRIVERS\srv2.sys B4ADEBBF5E3677CCE9651E0F01F7CC28
C:\Windows\System32\DRIVERS\srvnet.sys 27E461F0BE5BFF5FC737328F749538C3
C:\Windows\system32\drivers\stexstor.sys ==> MD5 is legit
C:\Windows\System32\drivers\vmstorfl.sys ==> MD5 is legit
C:\Windows\system32\drivers\storvsc.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\swenum.sys ==> MD5 is legit
C:\Windows\System32\drivers\synth3dvsc.sys C3A39C4079305480972D29C44B868C78
C:\Windows\System32\drivers\tcpip.sys 04ADD18EE5CC9FBEDAEC1DD1CD0CB45E
C:\Windows\System32\DRIVERS\tcpip.sys 04ADD18EE5CC9FBEDAEC1DD1CD0CB45E
C:\Windows\System32\drivers\tcpipreg.sys 1B16D0BD9841794A6E0CDE0CEF744ABC
C:\Windows\System32\drivers\tdpipe.sys ==> MD5 is legit
C:\Windows\System32\drivers\tdtcp.sys 51C5ECEB1CDEE2468A1748BE550CFBC8
C:\Windows\System32\DRIVERS\tdx.sys 70988118145F5F10EF24720B97F35F65
C:\Windows\System32\DRIVERS\termdd.sys ==> MD5 is legit
C:\Windows\system32\drivers\terminpt.sys EF4469AB69EB15E5D3754E6AEAFBCD3D
C:\Windows\System32\Drivers\TFsExDisk.sys 48D9D00C2E0E72C3D4F52772C80355F6
C:\Windows\SysWOW64\Drivers\TFsExDisk.sys 48D9D00C2E0E72C3D4F52772C80355F6
C:\Windows\System32\DRIVERS\tssecsrv.sys 19BEDA57F3E0A06B8D5EB6D619BD5624
C:\Windows\System32\drivers\tsusbflt.sys E9981ECE8D894CEF7038FD1D040EB426
C:\Windows\system32\drivers\TsUsbGD.sys AD64450A4ABE076F5CB34CC08EEACB07
C:\Windows\System32\drivers\tsusbhub.sys E1748D04AE40118B62BC18AC86032192
C:\Windows\System32\DRIVERS\tunnel.sys ==> MD5 is legit
C:\Windows\system32\drivers\uagp35.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\udfs.sys ==> MD5 is legit
C:\Windows\system32\drivers\uliagpkx.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\umbus.sys ==> MD5 is legit
C:\Windows\system32\drivers\umpass.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\usbccgp.sys DCA68B0943D6FA415F0C56C92158A83A
C:\Windows\system32\drivers\usbcir.sys 80B0F7D5CCF86CEB5D402EAAF61FEC31
C:\Windows\system32\drivers\usbehci.sys 18A85013A3E0F7E1755365D287443965
C:\Windows\System32\DRIVERS\usbhub.sys 8D1196CFBB223621F2C67D45710F25BA
C:\Windows\system32\drivers\usbohci.sys 765A92D428A8DB88B960DA5A8D6089DC
C:\Windows\system32\drivers\usbprint.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\USBSTOR.SYS FED648B01349A3C8395A5169DB5FB7D6
C:\Windows\system32\drivers\usbuhci.sys DD253AFC3BC6CBA412342DE60C3647F3
C:\Windows\system32\drivers\uxpatch.sys 297EE9C666FC8BB96A232DB0DDBA1E49
C:\Windows\System32\drivers\vdrvroot.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\vgapnp.sys ==> MD5 is legit
C:\Windows\System32\drivers\vga.sys ==> MD5 is legit
C:\Windows\system32\drivers\vhdmp.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\vHidDev.sys 1161ACFF728D97F75D74D2F1465F8A46
C:\Windows\system32\drivers\viaide.sys ==> MD5 is legit
C:\Windows\system32\drivers\vmbus.sys ==> MD5 is legit
C:\Windows\system32\drivers\VMBusHID.sys ==> MD5 is legit
C:\Windows\System32\drivers\volmgr.sys ==> MD5 is legit
C:\Windows\System32\drivers\volmgrx.sys ==> MD5 is legit
C:\Windows\System32\drivers\volsnap.sys ==> MD5 is legit
C:\Windows\system32\drivers\vsmraid.sys ==> MD5 is legit
C:\Windows\System32\drivers\vwifibus.sys ==> MD5 is legit
C:\Windows\system32\drivers\wacompen.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\wanarp.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\wanarp.sys ==> MD5 is legit
C:\Windows\system32\drivers\wd.sys ==> MD5 is legit
C:\Windows\System32\drivers\Wdf01000.sys E2C933EDBC389386EBE6D2BA953F43D8
C:\Windows\System32\DRIVERS\wfplwf.sys ==> MD5 is legit
C:\Windows\System32\drivers\wimmount.sys ==> MD5 is legit
C:\Windows\SysWOW64\drivers\wimmount.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\WinUsb.sys FE88B288356E7B47B74B13372ADD906D
C:\Windows\System32\DRIVERS\wmiacpi.sys ==> MD5 is legit
C:\Windows\system32\drivers\ws2ifsl.sys ==> MD5 is legit
C:\Windows\System32\drivers\WudfPf.sys AB886378EEB55C6C75B4F2D14B6C869F
C:\Windows\System32\DRIVERS\WUDFRd.sys DDA4CAF29D8C0A297F886BFE561E6659

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-06-29 11:39 - 2016-06-29 11:39 - 03703360 _____ C:\Users\JARXAN\Desktop\adwcleaner_5.200.exe
2016-06-29 11:08 - 2016-06-29 11:18 - 00192216 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2016-06-29 11:08 - 2016-06-29 11:08 - 00001073 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2016-06-29 11:08 - 2016-06-29 11:08 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2016-06-29 11:08 - 2016-06-29 11:08 - 00000000 ____D C:\Program Files (x86)\Malwarebytes Anti-Malware
2016-06-29 11:08 - 2016-03-10 14:09 - 00064896 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2016-06-29 11:08 - 2016-03-10 14:08 - 00140672 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbamchameleon.sys
2016-06-29 11:08 - 2016-03-10 14:08 - 00027008 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbam.sys
2016-06-27 14:12 - 2016-06-29 11:43 - 00000000 ____D C:\AdwCleaner
2016-06-26 12:22 - 2016-06-29 11:46 - 00000000 ____D C:\FRST
2016-06-26 11:58 - 2016-06-29 11:08 - 00000000 ____D C:\Users\Все пользователи\Malwarebytes
2016-06-26 11:58 - 2016-06-29 11:08 - 00000000 ____D C:\ProgramData\Malwarebytes
2016-06-24 22:59 - 2016-06-24 22:59 - 00002869 _____ C:\Windows\SysWOW64\servers.def.vpx
2016-06-24 22:59 - 2016-06-24 22:59 - 00000446 _____ C:\Windows\SysWOW64\prod-pgm.vpx
2016-06-24 22:19 - 2016-06-24 22:19 - 00000000 ____D C:\Windows\System32\Tasks\AVAST Software
2016-06-24 22:19 - 2016-06-24 22:19 - 00000000 ____D C:\Program Files\Common Files\AV
2016-06-24 19:32 - 2016-06-24 19:32 - 00000104 _____ C:\Users\JARXAN\Desktop\Warface.url
2016-06-24 19:16 - 2016-06-24 19:16 - 00002190 _____ C:\Users\JARXAN\Desktop\Игровой центр@Mail.Ru.lnk
2016-06-22 23:17 - 2016-06-22 23:19 - 00000000 ____D C:\Users\JARXAN\AppData\Roaming\.minecraft
2016-06-21 11:06 - 2016-06-21 11:07 - 05022048 _____ C:\Windows\system32\FNTCACHE.DAT
2016-06-21 09:19 - 2016-06-21 09:19 - 00000000 ____D C:\Users\JARXAN\AppData\Roaming\Steam
2016-06-21 09:17 - 2016-06-21 09:17 - 00000844 _____ C:\Users\JARXAN\Desktop\Cities Skylines - Deluxe Edition.lnk
2016-06-21 09:17 - 2016-06-21 09:17 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\by.xatab
2016-06-20 20:35 - 2016-06-28 14:49 - 00000000 ____D C:\Users\JARXAN\Documents\Euro Truck Simulator 2
2016-06-20 18:24 - 2016-06-20 18:24 - 00001909 _____ C:\Users\JARXAN\Desktop\Euro Truck Simulator 2 (x64).lnk
2016-06-20 18:24 - 2016-06-20 18:24 - 00001899 _____ C:\Users\JARXAN\Desktop\Euro Truck Simulator 2 (x32).lnk
2016-06-20 18:24 - 2016-06-20 18:24 - 00000000 ____D C:\Users\JARXAN\AppData\Roaming\Euro Truck Simulator 2_Uninstall
2016-06-20 18:24 - 2016-06-20 18:24 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\R.G. Mechanics
2016-06-19 20:35 - 2016-06-19 20:35 - 00001466 _____ C:\Users\JARXAN\Desktop\Colossal Order - Ярлык.lnk
2016-06-18 11:48 - 2016-06-18 11:48 - 00000000 ____D C:\Users\JARXAN\Downloads\Yefimov Serif
2016-06-13 20:51 - 2016-06-13 20:51 - 00000000 ____D C:\Users\JARXAN\Tracing
2016-06-13 20:50 - 2016-06-15 12:35 - 00000000 ____D C:\Users\Все пользователи\Skype
2016-06-13 20:50 - 2016-06-15 12:35 - 00000000 ____D C:\ProgramData\Skype
2016-06-11 12:46 - 2016-06-29 09:46 - 00000000 ____D C:\Program Files\Mozilla Firefox

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-06-29 11:46 - 2011-04-01 23:06 - 00000000 ____D C:\Users\JARXAN\AppData\Roaming\uTorrent
2016-06-29 11:44 - 2009-07-14 08:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2016-06-29 11:25 - 2009-07-14 07:45 - 00026576 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2016-06-29 11:25 - 2009-07-14 07:45 - 00026576 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2016-06-29 11:23 - 2010-11-21 15:28 - 00725718 _____ C:\Windows\system32\perfh019.dat
2016-06-29 11:23 - 2010-11-21 15:28 - 00151532 _____ C:\Windows\system32\perfc019.dat
2016-06-29 11:23 - 2009-07-14 08:13 - 01653224 _____ C:\Windows\system32\PerfStringBackup.INI
2016-06-29 11:23 - 2009-07-14 06:20 - 00000000 ____D C:\Windows\inf
2016-06-29 00:14 - 2011-10-16 15:06 - 00003944 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{24B3FCC2-0314-42C9-8944-36250DF5A0EC}
2016-06-26 21:12 - 2015-02-09 17:25 - 00000000 ____D C:\Users\JARXAN\AppData\Roaming\AIMP3
2016-06-25 12:29 - 2011-10-17 17:04 - 00000000 ____D C:\Users\Все пользователи\AVAST Software
2016-06-25 12:29 - 2011-10-17 17:04 - 00000000 ____D C:\ProgramData\AVAST Software
2016-06-24 22:40 - 2016-02-16 20:12 - 00000000 ____D C:\MSI
2016-06-22 20:02 - 2014-04-04 08:45 - 00000000 ____D C:\Games
2016-06-21 11:04 - 2009-07-14 06:20 - 00000000 ____D C:\Windows\Help
2016-06-21 11:02 - 2015-11-21 22:06 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Image-Line
2016-06-21 11:02 - 2014-01-25 00:07 - 00000000 ____D C:\Windows\Minidump
2016-06-21 11:02 - 2011-04-02 01:50 - 00000000 ____D C:\Windows\Panther
2016-06-21 11:02 - 2011-04-02 00:18 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Daum PotPlayer
2016-06-19 13:38 - 2011-10-16 19:25 - 00000000 ____D C:\Windows\pss
2016-06-13 20:51 - 2011-04-01 21:55 - 00000000 ____D C:\Users\JARXAN

==================== Files in the root of some directories =======

2012-11-01 13:41 - 2012-11-06 01:59 - 20337478 _____ () C:\Users\JARXAN\AppData\Roaming\15BA8E34a
2012-11-01 13:41 - 2012-11-06 01:59 - 0000037 _____ () C:\Users\JARXAN\AppData\Roaming\15ba8ef6a
2011-07-11 16:00 - 2011-07-16 09:01 - 0001832 _____ () C:\Users\JARXAN\AppData\Roaming\ImperatorProfile0.dat
2014-07-23 16:31 - 2014-07-23 16:40 - 0000660 _____ () C:\Users\JARXAN\AppData\Roaming\tlauncher.rmo.cfg
2011-11-27 13:21 - 2011-11-27 13:21 - 0000054 _____ () C:\Users\JARXAN\AppData\Roaming\updater.cfg
2013-07-04 22:32 - 2014-02-04 20:13 - 0008704 _____ () C:\Users\JARXAN\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2011-05-31 22:00 - 2011-05-31 22:00 - 0000017 _____ () C:\Users\JARXAN\AppData\Local\resmon.resmoncfg
2015-10-04 20:40 - 2016-06-21 09:18 - 100385792 _____ () C:\Users\JARXAN\AppData\Local\SageThumbs.db3
2014-11-30 13:15 - 2014-11-30 13:15 - 0000000 ____H () C:\ProgramData\DP45977C.lfl

==================== Bamital & volsnap =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe
[2014-09-20 12:51] - [2011-02-25 09:19] - 2871808 ____A (Microsoft Corporation) A7237F2B220CDD8FED32E265C20DC96A

C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed

==================== BCD ================================

„ЁбЇҐвзҐа § Јаг§ЄЁ Windows
--------------------
Ё¤Ґ­вЁдЁЄ в®а           {bootmgr}
device                  partition=C:
path                    \bootmgr
description             Windows Boot Manager
locale                  en-US
inherit                 {globalsettings}
default                 {current}
resumeobject            {1f8184a2-14de-11df-9734-f08c6d8c50b0}
displayorder            {current}
toolsdisplayorder       {memdiag}
timeout                 10

‡ Јаг§Є  Windows
-------------------
Ё¤Ґ­вЁдЁЄ в®а           {current}
device                  partition=C:
path                    \Windows\system32\winload.exe
description             Windows 7 Ultimate (ў®ббв ­®ў«Ґ­®) 
locale                  ru-RU
recoverysequence        {7385f13e-6358-11e0-8aa3-a70d61dcbe45}
recoveryenabled         Yes
osdevice                partition=C:
systemroot              \Windows
resumeobject            {284c37d9-6350-11e0-a7a9-806e6f6e6963}
usefirmwarepcisettings  No

‡ Јаг§Є  Windows
-------------------
Ё¤Ґ­вЁдЁЄ в®а           {7385f13e-6358-11e0-8aa3-a70d61dcbe45}
device                  ramdisk=[C:]\Recovery\a36b8d24-ce10-11df-8d84-cfb3295a0b26\Winre.wim,{7385f13f-6358-11e0-8aa3-a70d61dcbe45}
path                    \windows\system32\winload.exe
description             Windows Recovery Environment (ў®ббв ­®ў«Ґ­®) 
locale                  
osdevice                ramdisk=[C:]\Recovery\a36b8d24-ce10-11df-8d84-cfb3295a0b26\Winre.wim,{7385f13f-6358-11e0-8aa3-a70d61dcbe45}
systemroot              \windows
winpe                   Yes

‚ле®¤ Ё§ аҐ¦Ё¬  ЈЁЎҐа­ жЁЁ
--------------------------
Ё¤Ґ­вЁдЁЄ в®а           {284c37d9-6350-11e0-a7a9-806e6f6e6963}
device                  partition=C:
path                    \Windows\system32\winresume.exe
description             Windows 7 Ultimate (ў®ббв ­®ў«Ґ­®) 
locale                  ru-RU
inherit                 {resumeloadersettings}
filedevice              partition=C:
filepath                \hiberfil.sys
debugoptionenabled      No

Џа®ўҐаЄ  Ї ¬пвЁ Windows
---------------------
Ё¤Ґ­вЁдЁЄ в®а           {memdiag}
device                  partition=C:
path                    \boot\memtest.exe
description             Windows Memory Diagnostic
locale                  en-US
inherit                 {globalsettings}
badmemoryaccess         Yes

Џ а ¬Ґвал EMS
-------------
Ё¤Ґ­вЁдЁЄ в®а           {emssettings}
bootems                 Yes

Џ а ¬Ґвал ®в« ¤зЁЄ 
-------------------
Ё¤Ґ­вЁдЁЄ в®а           {dbgsettings}
debugtype               Serial
debugport               1
baudrate                115200

„ҐдҐЄвл Ћ‡“
-----------
Ё¤Ґ­вЁдЁЄ в®а           {badmemory}

ѓ«®Ў «м­лҐ Ї а ¬Ґвал
--------------------
Ё¤Ґ­вЁдЁЄ в®а           {globalsettings}
inherit                 {dbgsettings}
                        {emssettings}
                        {badmemory}

Џ а ¬Ґвал § Јаг§зЁЄ 
--------------------
Ё¤Ґ­вЁдЁЄ в®а           {bootloadersettings}
inherit                 {globalsettings}
                        {hypervisorsettings}

Џ а ¬Ґвал ЈЁЇҐаўЁ§®а 
-------------------
Ё¤Ґ­вЁдЁЄ в®а           {hypervisorsettings}
hypervisordebugtype     Serial
hypervisordebugport     1
hypervisorbaudrate      115200

Џ а ¬Ґвал § Јаг§зЁЄ  ў®ббв ­®ў«Ґ­Ёп
-----------------------------------
Ё¤Ґ­вЁдЁЄ в®а           {resumeloadersettings}
inherit                 {globalsettings}

Џ а ¬Ґвал гбва®©бвў
-------------------
Ё¤Ґ­вЁдЁЄ в®а           {1f8184a5-14de-11df-9734-f08c6d8c50b0}
description             Ramdisk Options
ramdisksdidevice        unknown
ramdisksdipath          \Recovery\1f8184a4-14de-11df-9734-f08c6d8c50b0\boot.sdi

Џ а ¬Ґвал гбва®©бвў
-------------------
Ё¤Ґ­вЁдЁЄ в®а           {7385f13f-6358-11e0-8aa3-a70d61dcbe45}
ramdisksdidevice        partition=C:
ramdisksdipath          \Recovery\a36b8d24-ce10-11df-8d84-cfb3295a0b26\boot.sdi



LastRegBack: 2016-06-28 15:34

==================== End of FRST.txt ============================