Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 25.02.2019 01 Ran by Mariu (administrator) on MARIU-PC (27-02-2019 13:36:50) Running from C:\Users\Mariu\Downloads Loaded Profiles: Mariu (Available Profiles: Mariu) Platform: Windows 7 Ultimate Service Pack 1 (X64) Language: Español (España, internacional) Internet Explorer Version 11 (Default browser: Chrome) Boot Mode: Normal Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (Advanced Micro Devices, Inc. -> AMD) C:\Windows\System32\atiesrxx.exe (Advanced Micro Devices, Inc. -> AMD) C:\Windows\System32\atieclxx.exe (AVAST Software s.r.o. -> AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe (Adobe Systems, Incorporated -> Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated -> Adobe Systems, Incorporated) C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGMService.exe (Adobe Systems Incorporated -> Adobe Systems, Incorporated) C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exe (ASUSTeK Computer Inc. -> ) C:\Program Files (x86)\ASUS\AXSP\1.02.00\atkexComSvc.exe (ASUSTeK Computer Inc. -> ) [File not signed] C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.22\AsSysCtrlService.exe (Intel(R) Intel Network Drivers -> Intel Corporation) C:\Windows\System32\IPROSetMonitor.exe (Malwarebytes Corporation -> Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe (Realtek Semiconductor Corp -> Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe (AVAST Software s.r.o. -> AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe (Advanced Micro Devices, Inc. -> Advanced Micro Devices, Inc.) C:\Program Files\AMD\CNext\CNext\RadeonSettings.exe (Adobe Systems, Incorporated -> Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe (Adobe Systems, Incorporated -> Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe (Disc Soft Ltd -> Disc Soft Ltd) C:\Program Files\DAEMON Tools Lite\DiscSoftBusServiceLite.exe (Hewlett-Packard Company -> Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe (Adobe Systems, Incorporated -> Adobe Systems Inc.) C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\acrotray.exe (Oracle America, Inc. -> Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe (AVAST Software s.r.o. -> AVAST Software) C:\Program Files\AVAST Software\Avast\aswEngSrv.exe (Malwarebytes Corporation -> Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe (Advanced Micro Devices, Inc. -> Advanced Micro Devices, Inc.) C:\Program Files\AMD\CNext\CNext\amddvr.exe (Advanced Micro Devices, Inc. -> Advanced Micro Devices, Inc.) C:\Program Files\AMD\CNext\CNext\amdow.exe (Oracle America, Inc. -> Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe (Google LLC -> Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google LLC -> Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google LLC -> Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google LLC -> Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google LLC -> Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google LLC -> Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google LLC -> Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Disc Soft Ltd -> Disc Soft Ltd) C:\Program Files\DAEMON Tools Lite\DTShellHlp.exe (Microsoft Corporation -> Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE (Microsoft Corporation -> Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE (Microsoft Windows -> Microsoft Corporation) C:\Windows\splwow64.exe (AVAST Software s.r.o. -> AVAST Software) C:\Program Files\AVAST Software\Avast\aswidsagent.exe (Google LLC -> Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Adobe Systems, Incorporated -> Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\Acrobat.exe (Adobe Systems, Incorporated -> Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\AcroCEF\AcroCEF.exe (Adobe Systems, Incorporated -> Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\AcroCEF\AcroCEF.exe (Adobe Systems, Incorporated -> Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\AcroCEF\AcroCEF.exe (Google LLC -> Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google LLC -> Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google LLC -> Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google LLC -> Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google LLC -> Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\dllhost.exe ==================== Registry (Whitelisted) =========================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [8783608 2015-12-17] (Realtek Semiconductor Corp -> Realtek Semiconductor) HKLM\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvLaunch.exe [259976 2019-02-19] (AVAST Software s.r.o. -> AVAST Software) HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [509936 2018-04-11] (Adobe Systems Incorporated -> Adobe Systems Incorporated) HKLM\...\Run: [AdobeGCInvoker-1.0] => C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGCInvokerUtility.exe [2675176 2018-12-13] (Adobe Systems Incorporated -> Adobe Systems, Incorporated) HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [96056 2013-05-30] (Hewlett-Packard Company -> Hewlett-Packard) HKLM-x32\...\Run: [] => [X] HKLM-x32\...\Run: [BCSSync] => C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [91520 2010-03-13] (Microsoft Corporation -> Microsoft Corporation) HKLM-x32\...\Run: [Acrobat Assistant 8.0] => C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\Acrotray.exe [4810224 2019-02-01] (Adobe Systems, Incorporated -> Adobe Systems Inc.) HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [601424 2018-07-07] (Oracle America, Inc. -> Oracle Corporation) HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvLaunch.exe [259976 2019-02-19] (AVAST Software s.r.o. -> AVAST Software) HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Restriction <==== ATTENTION HKU\S-1-5-21-870212850-2612754496-3096352495-1000\...\Run: [DAEMON Tools Lite Automount] => C:\Program Files\DAEMON Tools Lite\DTAgent.exe [5263040 2018-01-30] (Disc Soft Ltd -> Disc Soft Ltd) HKU\S-1-5-21-870212850-2612754496-3096352495-1000\...\Run: [Adobe Acrobat Synchronizer] => C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe [5933552 2019-02-01] (Adobe Systems, Incorporated -> Adobe Systems Incorporated) HKU\S-1-5-21-870212850-2612754496-3096352495-1000\...\Run: [Spotify] => C:\Users\Mariu\AppData\Roaming\Spotify\Spotify.exe [26118888 2019-02-16] (Spotify AB -> Spotify Ltd) HKU\S-1-5-21-870212850-2612754496-3096352495-1000\...\MountPoints2: F - F:\setup.exe HKLM\Software\Microsoft\Active Setup\Installed Components: [{8A69D345-D564-463c-AFF1-A69D9E530F96}] -> C:\Program Files (x86)\Google\Chrome\Application\72.0.3626.119\Installer\chrmstp.exe [2019-02-26] (Google LLC -> Google Inc.) HKLM\Software\Wow6432Node\Microsoft\Active Setup\Installed Components: [{AC76BA86-0000-0000-7760-7E8A45000000}] -> C:\Program Files (x86)\Adobe\Acrobat DC\Esl\Aiod.dll [2018-09-20] (Adobe Systems, Incorporated -> Adobe Systems, Inc.) ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) Tcpip\Parameters: [DhcpNameServer] 212.231.6.7 8.8.8.8 192.168.1.1 Tcpip\..\Interfaces\{E392D9B1-CFB7-4ED4-A80F-08B514CC1016}: [DhcpNameServer] 212.231.6.7 8.8.8.8 192.168.1.1 Internet Explorer: ================== SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-21-870212850-2612754496-3096352495-1000 -> DefaultScope {518b33ae-375d-712d-6742-d1fe0400268d} URL = BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL [2010-03-25] (Microsoft Corporation -> Microsoft Corporation) BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_181\bin\ssv.dll [2018-08-18] (Oracle America, Inc. -> Oracle Corporation) BHO: Adobe Acrobat Create PDF Helper -> {AE7CD045-E861-484f-8273-0445EE161910} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\DC\x64\AcroIEFavStub.dll [2018-02-02] (Adobe Systems, Incorporated -> Adobe Systems Incorporated) BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2010-02-28] (Microsoft Corporation -> Microsoft Corporation) BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_181\bin\jp2ssv.dll [2018-08-18] (Oracle America, Inc. -> Oracle Corporation) BHO: Adobe Acrobat Create PDF from Selection -> {F4971EE7-DAA0-4053-9964-665D8EE6A077} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\DC\x64\AcroIEFavStub.dll [2018-02-02] (Adobe Systems, Incorporated -> Adobe Systems Incorporated) BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL [2010-03-25] (Microsoft Corporation -> Microsoft Corporation) BHO-x32: Adobe Acrobat Create PDF Helper -> {AE7CD045-E861-484f-8273-0445EE161910} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\DC\AcroIEFavStub.dll [2018-02-02] (Adobe Systems, Incorporated -> Adobe Systems Incorporated) BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL [2010-02-28] (Microsoft Corporation -> Microsoft Corporation) BHO-x32: Adobe Acrobat Create PDF from Selection -> {F4971EE7-DAA0-4053-9964-665D8EE6A077} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\DC\AcroIEFavStub.dll [2018-02-02] (Adobe Systems, Incorporated -> Adobe Systems Incorporated) Toolbar: HKLM - Adobe Acrobat Create PDF Toolbar - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\DC\x64\AcroIEFavStub.dll [2018-02-02] (Adobe Systems, Incorporated -> Adobe Systems Incorporated) Toolbar: HKLM-x32 - Adobe Acrobat Create PDF Toolbar - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\DC\AcroIEFavStub.dll [2018-02-02] (Adobe Systems, Incorporated -> Adobe Systems Incorporated) FireFox: ======== FF HKLM\...\Firefox\Extensions: [web2pdfextension.17@acrobat.adobe.com] - C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\Browser\WCFirefoxExtn\WebExtn\signed_extn\adobe_acrobat-1.0-windows.xpi FF Extension: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\Browser\WCFirefoxExtn\WebExtn\signed_extn\adobe_acrobat-1.0-windows.xpi [2018-09-20] FF HKLM-x32\...\Firefox\Extensions: [web2pdfextension.17@acrobat.adobe.com] - C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\Browser\WCFirefoxExtn\WebExtn\signed_extn\adobe_acrobat-1.0-windows.xpi FF Plugin: @java.com/DTPlugin,version=11.181.2 -> C:\Program Files\Java\jre1.8.0_181\bin\dtplugin\npDeployJava1.dll [2018-08-18] (Oracle America, Inc. -> Oracle Corporation) FF Plugin: @java.com/JavaPlugin,version=11.181.2 -> C:\Program Files\Java\jre1.8.0_181\bin\plugin2\npjp2.dll [2018-08-18] (Oracle America, Inc. -> Oracle Corporation) FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation -> Microsoft Corporation) FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~2\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation -> Microsoft Corporation) FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~2\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation -> Microsoft Corporation) FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.33.23\npGoogleUpdate3.dll [2018-12-19] (Google Inc -> Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.33.23\npGoogleUpdate3.dll [2018-12-19] (Google Inc -> Google Inc.) FF Plugin-x32: @videolan.org/vlc,version=2.2.8 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2018-08-09] (VideoLAN -> VideoLAN) FF Plugin-x32: @videolan.org/vlc,version=3.0.3 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2018-08-09] (VideoLAN -> VideoLAN) FF Plugin-x32: @videolan.org/vlc,version=3.0.4 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2018-08-09] (VideoLAN -> VideoLAN) FF Plugin-x32: Adobe Acrobat -> C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\Air\nppdf32.dll [2019-02-01] (Adobe Systems, Incorporated -> Adobe Systems Inc.) FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2019-02-01] (Adobe Systems, Incorporated -> Adobe Systems Inc.) Chrome: ======= CHR Profile: C:\Users\Mariu\AppData\Local\Google\Chrome\User Data\Default [2019-02-27] CHR Extension: (Presentaciones) - C:\Users\Mariu\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2018-01-30] CHR Extension: (Documentos) - C:\Users\Mariu\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2018-01-30] CHR Extension: (Google Drive) - C:\Users\Mariu\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2018-01-30] CHR Extension: (YouTube) - C:\Users\Mariu\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2018-01-30] CHR Extension: (Adobe Acrobat) - C:\Users\Mariu\AppData\Local\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj [2018-01-31] CHR Extension: (Hojas de cálculo) - C:\Users\Mariu\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2018-01-30] CHR Extension: (Documentos de Google sin conexión) - C:\Users\Mariu\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2018-08-26] CHR Extension: (AdBlock) - C:\Users\Mariu\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2019-02-24] CHR Extension: (Botón de Google Académico) - C:\Users\Mariu\AppData\Local\Google\Chrome\User Data\Default\Extensions\ldipcbpaocekfooobnbcddclnhejkcpn [2018-02-01] CHR Extension: (Sistema de pagos de Chrome Web Store) - C:\Users\Mariu\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2018-04-03] CHR Extension: (Gmail) - C:\Users\Mariu\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2018-01-30] CHR Extension: (Chrome Media Router) - C:\Users\Mariu\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2019-02-15] CHR HKLM-x32\...\Chrome\Extension: [efaidnbmnnnibpcajpcglclefindmkaj] - hxxps://clients2.google.com/service/update2/crx CHR HKLM-x32\...\Chrome\Extension: [eofcbnmajmjmplflapaojjnihcjkigck] - hxxps://clients2.google.com/service/update2/crx CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - hxxps://clients2.google.com/service/update2/crx ==================== Services (Whitelisted) ==================== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) R2 AGMService; C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGMService.exe [2917864 2018-12-13] (Adobe Systems Incorporated -> Adobe Systems, Incorporated) R2 AGSService; C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exe [2709480 2018-12-13] (Adobe Systems Incorporated -> Adobe Systems, Incorporated) R2 AMD External Events Utility; C:\Windows\system32\atiesrxx.exe [472456 2018-01-12] (Advanced Micro Devices, Inc. -> AMD) R2 asComSvc; C:\Program Files (x86)\ASUS\AXSP\1.02.00\atkexComSvc.exe [936728 2015-05-08] (ASUSTeK Computer Inc. -> ) R2 AsSysCtrlService; C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.22\AsSysCtrlService.exe [1360016 2014-04-24] (ASUSTeK Computer Inc. -> ) [File not signed] R3 aswbIDSAgent; C:\Program Files\AVAST Software\Avast\aswidsagent.exe [6758976 2019-02-19] (AVAST Software s.r.o. -> AVAST Software) R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [357304 2019-02-19] (AVAST Software s.r.o. -> AVAST Software) R3 Disc Soft Lite Bus Service; C:\Program Files\DAEMON Tools Lite\DiscSoftBusServiceLite.exe [3480256 2018-01-30] (Disc Soft Ltd -> Disc Soft Ltd) S3 EasyAntiCheat; C:\Program Files (x86)\EasyAntiCheat\EasyAntiCheat.exe [775296 2018-10-30] (EasyAntiCheat Oy -> EasyAntiCheat Ltd) S2 KMService; C:\Windows\SysWOW64\srvany.exe [8192 2018-02-12] () [File not signed] R2 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe [6562472 2019-02-01] (Malwarebytes Corporation -> Malwarebytes) S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Windows -> Microsoft Corporation) ===================== Drivers (Whitelisted) ====================== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) R3 amdkmdag; C:\Windows\System32\DRIVERS\atikmdag.sys [41694600 2018-01-12] (Advanced Micro Devices, Inc. -> Advanced Micro Devices, Inc.) R3 amdkmdap; C:\Windows\System32\DRIVERS\atikmpag.sys [536968 2018-01-12] (Advanced Micro Devices, Inc. -> Advanced Micro Devices, Inc.) R0 amd_sata; C:\Windows\System32\DRIVERS\amd_sata.sys [82560 2012-04-11] (Advanced Micro Devices, Inc. -> Advanced Micro Devices) R0 amd_xata; C:\Windows\System32\DRIVERS\amd_xata.sys [42624 2012-04-11] (Advanced Micro Devices, Inc. -> Advanced Micro Devices) R1 AsIO; C:\Windows\SysWow64\drivers\AsIO.sys [15232 2015-05-08] (ASUSTeK Computer Inc. -> ) R0 aswArDisk; C:\Windows\System32\drivers\aswArDisk.sys [37104 2019-02-19] (AVAST Software s.r.o. -> AVAST Software) R1 aswArPot; C:\Windows\System32\drivers\aswArPot.sys [205400 2019-02-19] (AVAST Software s.r.o. -> AVAST Software) R1 aswbidsdriver; C:\Windows\System32\drivers\aswbidsdriver.sys [225680 2019-02-19] (AVAST Software s.r.o. -> AVAST Software) R0 aswbidsh; C:\Windows\System32\drivers\aswbidsh.sys [196072 2019-02-19] (AVAST Software s.r.o. -> AVAST Software) R0 aswblog; C:\Windows\System32\drivers\aswblog.sys [320696 2019-02-19] (AVAST Software s.r.o. -> AVAST Software) R0 aswbuniv; C:\Windows\System32\drivers\aswbuniv.sys [57960 2019-02-19] (AVAST Software s.r.o. -> AVAST Software) R1 aswHdsKe; C:\Windows\System32\drivers\aswHdsKe.sys [249672 2019-02-19] (AVAST Software s.r.o. -> AVAST Software) R1 aswKbd; C:\Windows\System32\drivers\aswKbd.sys [42288 2019-02-19] (AVAST Software s.r.o. -> AVAST Software) R2 aswMonFlt; C:\Windows\System32\drivers\aswMonFlt.sys [167304 2019-02-19] (AVAST Software s.r.o. -> AVAST Software) R1 aswRdr; C:\Windows\System32\drivers\aswRdr2.sys [112312 2019-02-19] (AVAST Software s.r.o. -> AVAST Software) R0 aswRvrt; C:\Windows\System32\drivers\aswRvrt.sys [87944 2019-02-19] (AVAST Software s.r.o. -> AVAST Software) R1 aswSnx; C:\Windows\System32\drivers\aswSnx.sys [1034432 2019-02-19] (AVAST Software s.r.o. -> AVAST Software) R1 aswSP; C:\Windows\System32\drivers\aswSP.sys [474456 2019-02-19] (AVAST Software s.r.o. -> AVAST Software) R2 aswStm; C:\Windows\System32\drivers\aswStm.sys [216784 2019-02-19] (AVAST Software s.r.o. -> AVAST Software) R0 aswVmm; C:\Windows\System32\drivers\aswVmm.sys [379952 2019-02-19] (AVAST Software s.r.o. -> AVAST Software) R3 AtiHDAudioService; C:\Windows\System32\drivers\AtihdW76.sys [96256 2017-09-02] (Microsoft Windows Hardware Compatibility Publisher -> Advanced Micro Devices) R3 dtlitescsibus; C:\Windows\System32\DRIVERS\dtlitescsibus.sys [30264 2018-02-08] (Disc Soft Ltd -> Disc Soft Ltd) R3 dtliteusbbus; C:\Windows\System32\DRIVERS\dtliteusbbus.sys [47672 2018-02-08] (Disc Soft Ltd -> Disc Soft Ltd) R3 e1rexpress; C:\Windows\System32\DRIVERS\e1r62x64.sys [499184 2015-06-04] (Intel(R) Intel Network Drivers -> Intel Corporation) R1 ESProtectionDriver; C:\Windows\system32\drivers\mbae64.sys [153328 2019-01-08] (Malwarebytes Corporation -> Malwarebytes) R2 MBAMChameleon; C:\Windows\System32\Drivers\MbamChameleon.sys [198512 2019-02-24] (Malwarebytes Corporation -> Malwarebytes) R3 MBAMFarflt; C:\Windows\System32\DRIVERS\farflt.sys [127136 2019-02-27] (Malwarebytes Corporation -> Malwarebytes) R3 MBAMProtection; C:\Windows\system32\DRIVERS\mbam.sys [72864 2019-02-27] (Malwarebytes Corporation -> Malwarebytes) R3 MBAMSwissArmy; C:\Windows\System32\Drivers\mbamswissarmy.sys [274416 2019-02-27] (Malwarebytes Corporation -> Malwarebytes) R3 MBAMWebProtection; C:\Windows\System32\DRIVERS\mwac.sys [104784 2019-02-27] (Malwarebytes Corporation -> Malwarebytes) R3 ScpVBus; C:\Windows\System32\DRIVERS\ScpVBus.sys [39168 2013-05-05] (Bruce James -> Scarlet.Crush Productions) R3 usbfilter; C:\Windows\System32\DRIVERS\usbfilter.sys [58536 2012-08-28] (Advanced Micro Devices, Inc. -> Advanced Micro Devices) S3 VGPU; System32\drivers\rdvgkmd.sys [X] ==================== NetSvcs (Whitelisted) =================== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) ==================== One month (created) ======== (If an entry is included in the fixlist, the file/folder will be moved.) 2019-02-27 13:15 - 2019-02-27 13:15 - 000127136 _____ (Malwarebytes) C:\Windows\system32\Drivers\farflt.sys 2019-02-27 13:15 - 2019-02-27 13:15 - 000104784 _____ (Malwarebytes) C:\Windows\system32\Drivers\mwac.sys 2019-02-27 13:15 - 2019-02-27 13:15 - 000072864 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbam.sys 2019-02-27 13:08 - 2019-02-27 13:09 - 000038354 _____ C:\Users\Mariu\Downloads\Addition.txt 2019-02-27 13:07 - 2019-02-27 13:37 - 000022886 _____ C:\Users\Mariu\Downloads\FRST.txt 2019-02-27 13:06 - 2019-02-27 13:36 - 000000000 ____D C:\FRST 2019-02-27 13:04 - 2019-02-27 13:04 - 002433536 _____ (Farbar) C:\Users\Mariu\Downloads\FRST64.exe 2019-02-27 12:43 - 2019-02-27 12:43 - 000274416 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbamswissarmy.sys 2019-02-24 19:57 - 2019-02-24 19:58 - 000000000 ____D C:\AdwCleaner 2019-02-24 19:42 - 2019-02-24 19:42 - 000198512 _____ (Malwarebytes) C:\Windows\system32\Drivers\MbamChameleon.sys 2019-02-24 19:42 - 2019-02-24 19:42 - 000000000 ____D C:\Users\Mariu\AppData\Local\mbamtray 2019-02-24 19:42 - 2019-02-24 19:42 - 000000000 ____D C:\Users\Mariu\AppData\Local\mbam 2019-02-24 19:42 - 2019-02-24 19:42 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes 2019-02-24 19:42 - 2019-02-24 19:42 - 000000000 ____D C:\ProgramData\Malwarebytes 2019-02-24 19:42 - 2019-02-24 19:42 - 000000000 ____D C:\Program Files\Malwarebytes 2019-02-24 19:42 - 2019-01-08 15:32 - 000153328 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbae64.sys 2019-02-19 11:31 - 2019-02-19 11:31 - 000249672 _____ (AVAST Software) C:\Windows\system32\Drivers\aswHdsKe.sys 2019-02-19 11:30 - 2019-02-19 11:30 - 000362888 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe 2019-02-17 12:49 - 2019-02-17 12:49 - 000158508 _____ C:\Users\Mariu\Desktop\Horas extras.pdf 2019-02-02 13:06 - 2019-02-17 12:50 - 000013998 _____ C:\Users\Mariu\Desktop\Horas extras.xlsx ==================== One month (modified) ======== (If an entry is included in the fixlist, the file/folder will be moved.) 2019-02-27 13:07 - 2018-11-15 17:33 - 000000000 ____D C:\Users\Mariu\AppData\Local\Spotify 2019-02-27 12:54 - 2018-01-30 22:57 - 000000000 ____D C:\Users\Mariu\AppData\Local\Adobe 2019-02-27 12:44 - 2018-11-15 17:32 - 000000000 ____D C:\Users\Mariu\AppData\Roaming\Spotify 2019-02-27 12:42 - 2009-07-14 06:08 - 000000006 ____H C:\Windows\Tasks\SA.DAT 2019-02-26 18:31 - 2018-01-31 00:00 - 000065536 _____ C:\Windows\system32\spu_storage.bin 2019-02-26 18:30 - 2009-07-14 05:45 - 000025936 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2019-02-26 18:30 - 2009-07-14 05:45 - 000025936 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2019-02-26 11:11 - 2018-02-16 11:20 - 000002222 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk 2019-02-25 11:50 - 2011-04-12 10:10 - 000747396 _____ C:\Windows\system32\perfh00A.dat 2019-02-25 11:50 - 2011-04-12 10:10 - 000158868 _____ C:\Windows\system32\perfc00A.dat 2019-02-25 11:50 - 2009-07-14 06:13 - 001676890 _____ C:\Windows\system32\PerfStringBackup.INI 2019-02-25 11:50 - 2009-07-14 04:20 - 000000000 ____D C:\Windows\inf 2019-02-24 23:10 - 2018-06-13 18:44 - 000003502 _____ C:\Windows\System32\Tasks\AdobeAAMUpdater-1.0-Mariu-PC-Mariu 2019-02-24 23:10 - 2018-03-23 19:45 - 000003550 _____ C:\Windows\System32\Tasks\AdobeGCInvoker-1.0-Mariu-PC-Mariu 2019-02-24 23:10 - 2018-02-16 11:19 - 000003534 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA 2019-02-24 23:10 - 2018-02-16 11:19 - 000003406 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore 2019-02-24 23:10 - 2018-01-31 19:04 - 000004476 _____ C:\Windows\System32\Tasks\Adobe Acrobat Update Task 2019-02-24 23:10 - 2018-01-30 23:44 - 000003152 _____ C:\Windows\System32\Tasks\StartCN 2019-02-24 23:10 - 2018-01-30 23:44 - 000003066 _____ C:\Windows\System32\Tasks\StartDVR 2019-02-24 23:10 - 2018-01-30 22:58 - 000004500 _____ C:\Windows\System32\Tasks\Adobe Flash Player PPAPI Notifier 2019-02-24 23:10 - 2018-01-30 22:58 - 000004332 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater 2019-02-24 20:32 - 2018-01-31 18:36 - 000000000 ____D C:\Windows\System32\Tasks\Avast Software 2019-02-24 19:53 - 2018-02-12 21:52 - 000000000 ___HD C:\MARIU-PC 2019-02-24 19:43 - 2018-01-31 19:04 - 000002441 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk 2019-02-24 11:50 - 2018-03-23 19:41 - 000002453 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Acrobat DC.lnk 2019-02-19 11:31 - 2018-01-31 18:36 - 000474456 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSP.sys 2019-02-19 11:31 - 2018-01-31 18:36 - 000003910 _____ C:\Windows\System32\Tasks\Avast Emergency Update 2019-02-19 11:30 - 2019-01-17 13:06 - 000225680 _____ (AVAST Software) C:\Windows\system32\Drivers\aswbidsdriver.sys 2019-02-19 11:30 - 2019-01-16 11:39 - 000320696 _____ (AVAST Software) C:\Windows\system32\Drivers\aswblog.sys 2019-02-19 11:30 - 2019-01-16 11:39 - 000196072 _____ (AVAST Software) C:\Windows\system32\Drivers\aswbidsh.sys 2019-02-19 11:30 - 2019-01-16 11:39 - 000057960 _____ (AVAST Software) C:\Windows\system32\Drivers\aswbuniv.sys 2019-02-19 11:30 - 2019-01-16 11:39 - 000037104 _____ (AVAST Software) C:\Windows\system32\Drivers\aswArDisk.sys 2019-02-19 11:30 - 2018-10-22 11:00 - 000042288 _____ (AVAST Software) C:\Windows\system32\Drivers\aswKbd.sys 2019-02-19 11:30 - 2018-01-31 18:36 - 001034432 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSnx.sys 2019-02-19 11:30 - 2018-01-31 18:36 - 000379952 _____ (AVAST Software) C:\Windows\system32\Drivers\aswVmm.sys 2019-02-19 11:30 - 2018-01-31 18:36 - 000216784 _____ (AVAST Software) C:\Windows\system32\Drivers\aswStm.sys 2019-02-19 11:30 - 2018-01-31 18:36 - 000205400 _____ (AVAST Software) C:\Windows\system32\Drivers\aswArPot.sys 2019-02-19 11:30 - 2018-01-31 18:36 - 000167304 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys 2019-02-19 11:30 - 2018-01-31 18:36 - 000112312 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys 2019-02-19 11:30 - 2018-01-31 18:36 - 000087944 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRvrt.sys 2019-02-17 18:42 - 2018-01-31 20:40 - 000000000 ___RD C:\Users\Mariu\Desktop\Series 2019-02-17 18:42 - 2018-01-30 23:40 - 000000000 ____D C:\Users\Mariu\AppData\Roaming\vlc 2019-02-16 18:25 - 2018-02-17 21:23 - 000000000 ____D C:\Users\Mariu\AppData\Roaming\uTorrent 2019-02-14 11:40 - 2018-06-06 18:37 - 000000000 ____D C:\Users\Mariu\.afirma 2019-02-13 13:09 - 2018-03-23 19:41 - 000002037 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Acrobat Distiller DC.lnk 2019-02-12 11:47 - 2018-01-30 22:58 - 000842240 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2019-02-12 11:47 - 2018-01-30 22:58 - 000175104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2019-02-12 11:46 - 2018-01-30 22:58 - 000000000 ____D C:\Windows\SysWOW64\Macromed 2019-02-12 11:46 - 2018-01-30 22:58 - 000000000 ____D C:\Windows\system32\Macromed ==================== Files in the root of some directories ======= 2018-02-16 11:07 - 2018-02-16 11:09 - 007649280 _____ () C:\Program Files (x86)\GUT7DC7.tmp 2018-09-28 11:21 - 2018-09-28 11:21 - 000000000 _____ () C:\Users\Mariu\AppData\Local\oobelibMkey.log 2018-09-17 17:20 - 2018-09-17 17:20 - 000001031 _____ () C:\Users\Mariu\AppData\Local\recently-used.xbel Some files in TEMP: ==================== 2018-08-18 17:57 - 2018-08-18 17:57 - 001906040 _____ (Oracle Corporation) C:\Users\Mariu\AppData\Local\Temp\jre-8u181-windows-au.exe 2018-12-25 18:04 - 2018-12-25 18:05 - 040210008 _____ () C:\Users\Mariu\AppData\Local\Temp\vlc-3.0.4-win32.exe ==================== Bamital & volsnap ====================== (There is no automatic fix for files that do not pass verification.) C:\Windows\system32\winlogon.exe => File is digitally signed C:\Windows\system32\wininit.exe => File is digitally signed C:\Windows\SysWOW64\wininit.exe => File is digitally signed C:\Windows\explorer.exe => File is digitally signed C:\Windows\SysWOW64\explorer.exe => File is digitally signed C:\Windows\system32\svchost.exe => File is digitally signed C:\Windows\SysWOW64\svchost.exe => File is digitally signed C:\Windows\system32\services.exe => File is digitally signed C:\Windows\system32\User32.dll => File is digitally signed C:\Windows\SysWOW64\User32.dll => File is digitally signed C:\Windows\system32\userinit.exe => File is digitally signed C:\Windows\SysWOW64\userinit.exe => File is digitally signed C:\Windows\system32\rpcss.dll => File is digitally signed C:\Windows\system32\dnsapi.dll => File is digitally signed C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed C:\Windows\system32\dllhost.exe => File is digitally signed C:\Windows\SysWOW64\dllhost.exe => File is digitally signed C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2019-02-13 20:18 ==================== End of FRST.txt ============================