Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:05-03-2016 01
Ran by [removed] (administrator) on ENIGMA-SECRET (03-05-2016 23:07:28)
Running from D:\Tools\FRST
[removed]
Platform: Windows 7 Home Premium Service Pack 1 (X64) Language: English (United States)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Microsoft Corporation) C:\Windows\System32\inetsrv\inetinfo.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae-svc.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae64.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.29.5\GoogleCrashHandler.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.29.5\GoogleCrashHandler64.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae.exe
(Microsoft Corporation) C:\Windows\System32\GWX\GWX.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 16.0.0\avp.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 16.0.0\avpui.exe
(Malwarebytes) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe
(Malwarebytes) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe
(Malwarebytes) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe
(Tonec Inc.) C:\Program Files (x86)\Internet Download Manager\IEMonitor.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe


==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [SmartAudio] => C:\Program Files\CONEXANT\SAII\SAIICpl.exe [316032 2010-12-14] (Conexant systems, Inc.)
HKLM-x32\...\Run: [Malwarebytes Anti-Exploit] => C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae.exe [2623456 2016-04-15] (Malwarebytes Corporation)
HKU\S-1-5-19\...\Run: [Sidebar] => %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun
HKU\S-1-5-20\...\Run: [Sidebar] => %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun
HKU\S-1-5-21-1008662736-466817434-3957789414-1001\...\Run: [Sidebar] => %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun
ShellIconOverlayIdentifiers: [   IDM Shell Extension] -> {CDC95B92-E27C-4745-A8C5-64A52A78855D} => C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll [2015-08-14] (Tonec Inc.)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Winsock: Catalog5 01 C:\Windows\SysWOW64\NLAapi.dll [52224 2014-12-06] (Microsoft Corporation)ATTENTION: LibraryPath should be "%SystemRoot%\system32\NLAapi.dll"
Winsock: Catalog5 02 C:\Windows\SysWOW64\napinsp.dll [52224 2009-07-14] (Microsoft Corporation)ATTENTION: LibraryPath should be "%SystemRoot%\system32\napinsp.dll"
Winsock: Catalog5 03 C:\Windows\SysWOW64\pnrpnsp.dll [65024 2009-07-14] (Microsoft Corporation)ATTENTION: LibraryPath should be "%SystemRoot%\system32\pnrpnsp.dll"
Winsock: Catalog5 04 C:\Windows\SysWOW64\pnrpnsp.dll [65024 2009-07-14] (Microsoft Corporation)ATTENTION: LibraryPath should be "%SystemRoot%\system32\pnrpnsp.dll"
Winsock: Catalog5 05 C:\Windows\SysWOW64\mswsock.dll [231424 2013-09-08] (Microsoft Corporation)ATTENTION: LibraryPath should be "%SystemRoot%\System32\mswsock.dll"
Winsock: Catalog5 06 C:\Windows\SysWOW64\winrnr.dll [20992 2009-07-14] (Microsoft Corporation)ATTENTION: LibraryPath should be "%SystemRoot%\System32\winrnr.dll"
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 192.168.1.1
Tcpip\..\Interfaces\{CE3A35AD-5C48-4E31-A42F-FD767F0B1712}: [NameServer] 8.8.8.8,8.8.4.4
Tcpip\..\Interfaces\{CE3A35AD-5C48-4E31-A42F-FD767F0B1712}: [DhcpNameServer] 192.168.1.1 192.168.1.1
ManualProxies: 

Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = 
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = 
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = 
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = 
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = 
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = 
HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = 
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Local Page = 
BHO: IDM integration (IDMIEHlprObj Class) -> {0055C089-8582-441B-A0BF-17B458C2A3A8} -> C:\Program Files (x86)\Internet Download Manager\IDMIECC64.dll [2015-12-08] (Internet Download Manager, Tonec Inc.)
BHO: ExplorerWnd Helper -> {10921475-03CE-4E04-90CE-E2E7EF20C814} -> C:\Program Files (x86)\IObit\IObit Uninstaller\UninstallExplorer.dll [2015-12-23] (IObit)
BHO: Kaspersky Protection plugin -> {C66D064F-82FE-4E1A-B06A-B2490BA48B18} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 16.0.0\x64\IEExt\ie_plugin.dll [2015-12-06] (AO Kaspersky Lab)
BHO-x32: IDM integration (IDMIEHlprObj Class) -> {0055C089-8582-441B-A0BF-17B458C2A3A8} -> C:\Program Files (x86)\Internet Download Manager\IDMIECC.dll [2015-12-08] (Internet Download Manager, Tonec Inc.)
BHO-x32: Kaspersky Protection plugin -> {C66D064F-82FE-4E1A-B06A-B2490BA48B18} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 16.0.0\IEExt\ie_plugin.dll [2015-12-06] (AO Kaspersky Lab)
Toolbar: HKLM - Kaspersky Protection toolbar - {3507FA00-ADA2-4A02-99B9-51AD26CA9120} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 16.0.0\x64\IEExt\ie_plugin.dll [2015-12-06] (AO Kaspersky Lab)
Toolbar: HKLM-x32 - Kaspersky Protection toolbar - {3507FA00-ADA2-4A02-99B9-51AD26CA9120} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 16.0.0\IEExt\ie_plugin.dll [2015-12-06] (AO Kaspersky Lab)
Handler: cardisabled - No CLSID Value

FireFox:
========
FF Plugin: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.41212.0\npctrl.dll [2015-12-11] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.41212.0\npctrl.dll [2015-12-11] ( Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.29.5\npGoogleUpdate3.dll [2016-03-22] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.29.5\npGoogleUpdate3.dll [2016-03-22] (Google Inc.)
FF HKLM-x32\...\Firefox\Extensions: [[removed]] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 16.0.0\FFExt\light_plugin_firefox
FF Extension: Kaspersky Protection - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 16.0.0\FFExt\light_plugin_firefox [2016-03-26]
FF HKU\S-1-5-21-1008662736-466817434-3957789414-1000\...\SeaMonkey\Extensions: [[removed]] - C:\Program Files (x86)\Internet Download Manager\idmmzcc2.xpi
FF Extension: IDM integration - C:\Program Files (x86)\Internet Download Manager\idmmzcc2.xpi [2016-03-10]
FF HKU\S-1-5-21-1008662736-466817434-3957789414-1000\...\SeaMonkey\Extensions: [[removed]] - C:\Users\Enigma\AppData\Roaming\IDM\idmmzcc5
FF Extension: IDM CC - C:\Users\Enigma\AppData\Roaming\IDM\idmmzcc5 [2016-05-03] [not signed]

Chrome: 
=======
CHR StartupUrls: Default -> "hxxps://www.google.com/"
CHR Profile: C:\Users\Enigma\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Drive) - C:\Users\Enigma\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2016-03-22]
CHR Extension: (Adguard AdBlocker) - C:\Users\Enigma\AppData\Local\Google\Chrome\User Data\Default\Extensions\bgnkhhnnamicmpeenaelnjfhikgbkllg [2016-04-11]
CHR Extension: (YouTube) - C:\Users\Enigma\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2016-03-22]
CHR Extension: (Kaspersky Protection) - C:\Users\Enigma\AppData\Local\Google\Chrome\User Data\Default\Extensions\eahebamiopdhefndnmappcihfajigkka [2016-03-27]
CHR Extension: (IDM Integration Module) - C:\Users\Enigma\AppData\Local\Google\Chrome\User Data\Default\Extensions\ngpampappnmepgilojfohadhhmbhlaek [2016-04-19]
CHR Extension: (Chrome Web Store Payments) - C:\Users\Enigma\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2016-04-02]
CHR Extension: (Gmail) - C:\Users\Enigma\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2016-03-22]
CHR HKLM\...\Chrome\Extension: [eahebamiopdhefndnmappcihfajigkka] - hxxps://chrome.google.com/webstore/detail/eahebamiopdhefndnmappcihfajigkka
CHR HKLM\...\Chrome\Extension: [ngpampappnmepgilojfohadhhmbhlaek] - C:\Program Files (x86)\Internet Download Manager\IDMGCExt.crx [2016-03-11]
CHR HKLM-x32\...\Chrome\Extension: [eahebamiopdhefndnmappcihfajigkka] - hxxps://chrome.google.com/webstore/detail/eahebamiopdhefndnmappcihfajigkka

==================== Services (Whitelisted) ========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 AVP16.0.0; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 16.0.0\avp.exe [194000 2015-12-06] (Kaspersky Lab ZAO)
R2 IISADMIN; C:\Windows\system32\inetsrv\inetinfo.exe [15872 2010-11-21] (Microsoft Corporation)
S4 LiveUpdateSvc; C:\Program Files (x86)\IObit\LiveUpdate\LiveUpdate.exe [2945312 2016-01-15] (IObit)
R2 MbaeSvc; C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae-svc.exe [742368 2016-04-15] (Malwarebytes Corporation)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1514464 2016-03-10] (Malwarebytes)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [1136608 2016-03-10] (Malwarebytes)
S3 vssbrigde64; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 16.0.0\x64\vssbridge64.exe [144640 2015-07-09] (AO Kaspersky Lab)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
S2 ZAMSvc; "C:\Program Files (x86)\Zemana AntiMalware\ZAM.exe" /service [X]

===================== Drivers (Whitelisted) ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R0 cm_km; C:\Windows\System32\DRIVERS\cm_km.sys [389816 2015-07-06] (Kaspersky Lab ZAO)
S3 dg_ssudbus; C:\Windows\System32\DRIVERS\ssudbus.sys [129152 2016-04-25] (Samsung Electronics Co., Ltd.)
S3 ebdrv; C:\Windows\system32\drivers\evbda.sys [3286016 2009-06-11] (Broadcom Corporation)
R1 ESProtectionDriver; C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae64.sys [66080 2016-04-15] ()
R0 kl1; C:\Windows\System32\DRIVERS\kl1.sys [478392 2015-06-22] (Kaspersky Lab ZAO)
R0 klbackupdisk; C:\Windows\System32\DRIVERS\klbackupdisk.sys [53432 2015-06-06] (Kaspersky Lab ZAO)
R1 klbackupflt; C:\Windows\System32\DRIVERS\klbackupflt.sys [70000 2015-06-27] (Kaspersky Lab ZAO)
R2 kldisk; C:\Windows\System32\DRIVERS\kldisk.sys [77728 2016-03-26] (AO Kaspersky Lab)
R3 klflt; C:\Windows\System32\DRIVERS\klflt.sys [181640 2015-12-06] (AO Kaspersky Lab)
R1 klhk; C:\Windows\System32\DRIVERS\klhk.sys [227000 2015-12-06] (AO Kaspersky Lab)
R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [934808 2016-03-26] (AO Kaspersky Lab)
R1 KLIM6; C:\Windows\System32\DRIVERS\klim6.sys [39096 2015-06-11] (Kaspersky Lab ZAO)
R3 klkbdflt; C:\Windows\System32\DRIVERS\klkbdflt.sys [41144 2015-06-06] (Kaspersky Lab ZAO)
R3 klmouflt; C:\Windows\System32\DRIVERS\klmouflt.sys [41648 2015-06-07] (Kaspersky Lab ZAO)
R1 klpd; C:\Windows\System32\DRIVERS\klpd.sys [41352 2015-12-06] (AO Kaspersky Lab)
R1 kltdi; C:\Windows\System32\DRIVERS\kltdi.sys [65208 2015-06-11] (Kaspersky Lab ZAO)
R1 Klwtp; C:\Windows\System32\DRIVERS\klwtp.sys [103096 2015-06-16] (Kaspersky Lab ZAO)
R1 kneps; C:\Windows\System32\DRIVERS\kneps.sys [187056 2015-06-23] (Kaspersky Lab ZAO)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [27008 2016-03-10] (Malwarebytes)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [192216 2016-05-03] (Malwarebytes)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [64896 2016-03-10] (Malwarebytes Corporation)
S0 rqkdql; no ImagePath
S3 rspLLL; C:\Windows\System32\DRIVERS\rspLLL64.sys [26368 2015-07-13] (Resplendence Software Projects Sp.)
S3 semav6msr64; C:\Windows\system32\drivers\semav6msr64.sys [21984 2015-06-04] ()
S3 ssudmdm; C:\Windows\System32\DRIVERS\ssudmdm.sys [221824 2016-04-25] (Samsung Electronics Co., Ltd.)
S3 ssudserd; C:\Windows\System32\DRIVERS\ssudserd.sys [221824 2016-04-25] (Samsung Electronics Co., Ltd.)
S3 wdm_usb; C:\Windows\System32\DRIVERS\usb2ser.sys [151184 2016-03-10] (MBB)
U4 klkbdflt2; system32\DRIVERS\klkbdflt2.sys [X]
S1 ZAM; \??\C:\Windows\System32\drivers\zam64.sys [X]
S1 ZAM_Guard; \??\C:\Windows\System32\drivers\zamguard64.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-05-03 23:07 - 2016-05-03 23:07 - 00000000 ____D C:\FRST
2016-05-03 04:52 - 2016-05-03 04:54 - 00000000 ____D C:\Program Files\CCleaner
2016-05-03 04:52 - 2016-05-03 04:52 - 00002802 _____ C:\Windows\System32\Tasks\CCleanerSkipUAC
2016-05-03 04:52 - 2016-05-03 04:52 - 00000822 _____ C:\Users\Public\Desktop\CCleaner.lnk
2016-05-03 04:14 - 2016-05-03 04:45 - 00002916 _____ C:\Windows\System32\Tasks\Uninstaller_SkipUac_Enigma
2016-05-03 04:14 - 2016-05-03 04:14 - 00000000 ____D C:\Users\Enigma\AppData\Roaming\ProductData
2016-05-03 04:14 - 2016-05-03 04:14 - 00000000 ____D C:\ProgramData\ProductData
2016-05-02 17:25 - 2012-03-01 08:02 - 25543488 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglv64.dll
2016-05-02 17:25 - 2012-03-01 08:02 - 25222976 _____ (NVIDIA Corporation) C:\Windows\system32\nvcompiler.dll
2016-05-02 17:25 - 2012-03-01 08:02 - 19444544 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglv32.dll
2016-05-02 17:25 - 2012-03-01 08:02 - 17642816 _____ (NVIDIA Corporation) C:\Windows\system32\nvd3dumx.dll
2016-05-02 17:25 - 2012-03-01 08:02 - 17543488 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcompiler.dll
2016-05-02 17:25 - 2012-03-01 08:02 - 15009600 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvd3dum.dll
2016-05-02 17:25 - 2012-03-01 08:02 - 13626688 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvlddmkm.sys
2016-05-02 17:25 - 2012-03-01 08:02 - 09717568 _____ (NVIDIA Corporation) C:\Windows\system32\nvwgf2umx.dll
2016-05-02 17:25 - 2012-03-01 08:02 - 08008000 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuda.dll
2016-05-02 17:25 - 2012-03-01 08:02 - 07713088 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvwgf2um.dll
2016-05-02 17:25 - 2012-03-01 08:02 - 05892928 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuda.dll
2016-05-02 17:25 - 2012-03-01 08:02 - 02872640 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvenc.dll
2016-05-02 17:25 - 2012-03-01 08:02 - 02672448 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvid.dll
2016-05-02 17:25 - 2012-03-01 08:02 - 02517312 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvid.dll
2016-05-02 17:25 - 2012-03-01 08:02 - 02437440 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvenc.dll
2016-05-02 17:25 - 2012-03-01 08:02 - 02301248 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvapi.dll
2016-05-02 17:25 - 2012-03-01 08:02 - 00068928 _____ (Khronos Group) C:\Windows\system32\OpenCL.dll
2016-05-02 17:25 - 2012-03-01 08:02 - 00061248 _____ (Khronos Group) C:\Windows\SysWOW64\OpenCL.dll
2016-05-02 17:20 - 2015-12-16 22:53 - 00523384 _____ (NVIDIA Corporation) C:\Windows\system32\nv3dappshext.dll
2016-05-02 17:20 - 2015-12-16 22:53 - 00075056 _____ (NVIDIA Corporation) C:\Windows\system32\nv3dappshextr.dll
2016-05-02 17:20 - 2015-12-16 22:49 - 06090019 _____ C:\Windows\system32\nvcoproc.bin
2016-05-02 17:18 - 2015-12-17 01:34 - 21122456 _____ (NVIDIA Corporation) C:\Windows\system32\nvopencl.dll
2016-05-02 17:18 - 2015-12-17 01:34 - 17561432 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvopencl.dll
2016-05-02 17:18 - 2015-12-17 01:34 - 01915696 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispco6436143.dll
2016-05-02 17:18 - 2015-12-17 01:34 - 01564976 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispgenco6436143.dll
2016-05-02 17:18 - 2015-12-17 01:34 - 00938104 _____ (NVIDIA Corporation) C:\Windows\system32\NvFBC64.dll
2016-05-02 17:18 - 2015-12-17 01:34 - 00872056 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFR64.dll
2016-05-02 17:18 - 2015-12-17 01:34 - 00734512 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvFBC.dll
2016-05-02 17:18 - 2015-12-17 01:34 - 00681592 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFR.dll
2016-05-02 16:25 - 2015-07-13 11:16 - 00026368 _____ (Resplendence Software Projects Sp.) C:\Windows\system32\Drivers\rspLLL64.sys
2016-05-02 03:25 - 2016-05-02 04:56 - 00192216 _____ (Malwarebytes) C:\Windows\system32\Drivers\47B43292.sys
2016-05-02 03:24 - 2016-05-02 03:25 - 00192216 _____ (Malwarebytes) C:\Windows\system32\Drivers\665631FF.sys
2016-05-01 22:17 - 2016-05-01 22:17 - 00000000 ____D C:\Windows\SysWOW64\BestPractices
2016-05-01 22:17 - 2016-05-01 22:17 - 00000000 ____D C:\Windows\system32\BestPractices
2016-05-01 22:17 - 2016-05-01 22:17 - 00000000 ____D C:\inetpub
2016-04-29 01:09 - 2016-04-29 01:09 - 00000000 ____D C:\Program Files (x86)\Malwarebytes Anti-Exploit
2016-04-29 01:00 - 2016-04-29 01:00 - 00053464 _____ (Malwarebytes) C:\Windows\system32\Drivers\farflt.sys
2016-04-28 04:40 - 2016-04-28 04:50 - 00000000 ____D C:\Program Files (x86)\Secunia
2016-04-25 02:27 - 2016-04-25 02:44 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2016-04-25 00:36 - 2016-04-25 00:36 - 00221824 _____ (Samsung Electronics Co., Ltd.) C:\Windows\system32\Drivers\ssudserd.sys
2016-04-25 00:35 - 2016-04-25 00:35 - 00221824 _____ (Samsung Electronics Co., Ltd.) C:\Windows\system32\Drivers\ssudmdm.sys
2016-04-25 00:35 - 2016-04-25 00:35 - 00129152 _____ (Samsung Electronics Co., Ltd.) C:\Windows\system32\Drivers\ssudbus.sys
2016-04-23 18:33 - 2016-04-23 18:33 - 00000000 ____H C:\Windows\system32\Drivers\Msft_Kernel_WinUSB_01009.Wdf
2016-04-21 03:31 - 2016-04-21 03:31 - 00000000 ____D C:\Intel
2016-04-19 23:29 - 2016-04-24 23:54 - 00000451 _____ C:\Windows\ZAM_Guard.krnl.trace
2016-04-19 23:29 - 2016-04-24 23:50 - 00027436 _____ C:\Windows\ZAM.krnl.trace
2016-04-19 16:28 - 2016-04-19 16:28 - 00012872 _____ (SurfRight B.V.) C:\Windows\system32\bootdelete.exe
2016-04-17 18:50 - 2016-04-17 18:50 - 00262144 _____ C:\Windows\system32\config\elam
2016-04-15 17:27 - 2016-04-15 20:43 - 00000000 ____D C:\Users\Enigma\Documents\Fireglow Games
2016-04-14 04:15 - 2016-04-14 13:39 - 00192216 _____ (Malwarebytes) C:\Windows\system32\Drivers\0A945AA3.sys
2016-04-13 03:06 - 2016-04-13 03:06 - 00192216 _____ (Malwarebytes) C:\Windows\system32\Drivers\738657B5.sys
2016-04-13 03:06 - 2016-04-13 03:06 - 00192216 _____ (Malwarebytes) C:\Windows\system32\Drivers\498957B2.sys
2016-04-11 22:57 - 2016-05-03 22:54 - 00000000 ____D C:\KMPlayer
2016-04-11 22:57 - 2016-04-12 04:02 - 00000606 _____ C:\Users\Enigma\Documents\KMPlayer.lnk
2016-04-11 22:57 - 2016-04-11 23:20 - 00000000 ____D C:\Users\Enigma\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\The KMPlayer
2016-04-11 22:57 - 2016-04-11 23:00 - 00000000 ____D C:\ProgramData\MyGoya
2016-04-11 22:57 - 2015-05-06 15:54 - 00120200 _____ () C:\Windows\SysWOW64\DLLDEV32i.dll
2016-04-11 05:26 - 2016-04-05 02:14 - 00038120 _____ (Microsoft Corporation) C:\Windows\system32\CompatTelRunner.exe
2016-04-11 05:26 - 2016-04-05 02:02 - 01169408 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2016-04-11 05:26 - 2016-04-02 21:08 - 01386496 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2016-04-09 02:04 - 2016-05-03 22:17 - 00000000 ____D C:\Users\Enigma\AppData\Roaming\IDM
2016-04-09 02:04 - 2016-04-09 02:04 - 00000000 ____D C:\Users\Enigma\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Download Manager
2016-04-09 02:04 - 2016-04-09 02:04 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Internet Download Manager
2016-04-08 22:56 - 2016-04-09 22:56 - 00000000 ____D C:\Program Files (x86)\Internet Download Manager
2016-04-07 23:46 - 2016-03-23 22:02 - 00215040 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll
2016-04-07 23:46 - 2016-03-18 02:04 - 00698368 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2016-04-07 23:46 - 2016-03-18 02:04 - 00499200 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2016-04-07 23:46 - 2016-03-18 02:04 - 00279040 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2016-04-07 23:46 - 2016-03-18 02:04 - 00076800 _____ (Microsoft Corporation) C:\Windows\system32\acmigration.dll
2016-04-07 01:01 - 2016-04-07 01:01 - 00002394 _____ C:\Users\Enigma\Documents\Safe Money.lnk
2016-04-03 03:27 - 2016-04-03 03:27 - 00000000 ____D C:\Users\Enigma\Documents\Banished
2016-04-03 03:00 - 2016-04-26 02:09 - 00000000 ____D C:\Users\Enigma\Desktop\Game
2016-04-03 01:14 - 2016-04-03 01:58 - 00000000 ____D C:\Users\Enigma\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games
2016-04-03 01:12 - 2016-04-03 01:12 - 00000000 __SHD C:\Windows\ftpcache
2016-04-03 01:11 - 2016-04-03 01:11 - 00000273 _____ C:\Windows\game.ini
2016-04-03 01:11 - 2016-04-03 01:11 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Activision

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-05-03 23:04 - 2016-03-22 13:59 - 00000898 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2016-05-03 22:54 - 2016-03-25 12:12 - 00000000 ____D C:\Users\Enigma\AppData\Roaming\Notepad++
2016-05-03 22:42 - 2016-03-22 14:55 - 00000000 ____D C:\Users\Enigma\AppData\Roaming\DMCache
2016-05-03 22:32 - 2016-03-26 20:04 - 00000000 ____D C:\ProgramData\Kaspersky Lab
2016-05-03 22:29 - 2016-03-23 14:22 - 00192216 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2016-05-03 19:25 - 2009-07-14 12:45 - 00066816 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2016-05-03 19:25 - 2009-07-14 12:45 - 00066816 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2016-05-03 15:39 - 2009-07-14 13:13 - 00007156 _____ C:\Windows\system32\PerfStringBackup.INI
2016-05-03 15:36 - 2009-07-14 11:20 - 00000000 ____D C:\Windows\system32\inetsrv
2016-05-03 15:35 - 2016-03-22 13:59 - 00000894 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2016-05-03 15:35 - 2009-07-14 11:20 - 00000000 ____D C:\Windows\inf
2016-05-03 15:34 - 2009-07-14 13:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2016-05-03 04:41 - 2016-03-22 11:40 - 00000000 ____D C:\Users\Enigma\AppData\Roaming\MPC-HC
2016-05-03 04:40 - 2016-03-22 14:55 - 00000000 ____D C:\Users\Enigma\Downloads\Compressed
2016-05-03 04:40 - 2016-03-22 11:31 - 00000000 ____D C:\Program Files\MPC-HC
2016-05-03 04:12 - 2016-04-02 14:27 - 00000000 ____D C:\Users\UpdatusUser
2016-05-03 03:34 - 2016-03-26 13:29 - 00000000 ____D C:\ProgramData\Malwarebytes Anti-Exploit
2016-05-02 17:26 - 2016-04-02 14:27 - 00000000 ____D C:\ProgramData\NVIDIA
2016-05-02 17:25 - 2016-03-22 10:33 - 00000000 ____D C:\Program Files\NVIDIA Corporation
2016-05-02 13:47 - 2009-07-14 11:20 - 00000000 ____D C:\Windows\rescache
2016-05-02 04:55 - 2016-03-22 14:55 - 00000000 ____D C:\Users\Enigma\Downloads\Video
2016-05-01 22:19 - 2016-03-22 11:09 - 00006730 _____ C:\Windows\SysWOW64\PerfStringBackup.INI
2016-05-01 22:17 - 2009-07-14 11:20 - 00000000 ____D C:\Windows\SysWOW64\inetsrv
2016-05-01 04:52 - 2016-03-22 11:42 - 00000000 ____D C:\Windows\SysWOW64\directx
2016-05-01 04:38 - 2016-03-23 03:22 - 00000000 ____D C:\Windows\Panther
2016-05-01 03:33 - 2016-03-27 07:12 - 00007604 _____ C:\Users\Enigma\AppData\Local\resmon.resmoncfg
2016-04-30 06:08 - 2009-07-14 13:32 - 00000000 ____D C:\Program Files\DVD Maker
2016-04-30 06:08 - 2009-07-14 11:20 - 00000000 ____D C:\Windows\system32\spool
2016-04-30 06:08 - 2009-07-14 11:20 - 00000000 ____D C:\Windows\PolicyDefinitions
2016-04-30 05:41 - 2009-07-14 11:20 - 00000000 ____D C:\Windows\system32\Setup
2016-04-29 06:07 - 2016-03-22 14:10 - 00002225 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2016-04-29 06:07 - 2016-03-22 14:10 - 00002213 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2016-04-29 01:36 - 2016-03-23 14:03 - 00000000 ____D C:\ProgramData\Malwarebytes
2016-04-28 00:38 - 2009-07-14 11:20 - 00000000 ____D C:\Windows\system32\NDF
2016-04-26 05:12 - 2016-03-23 02:22 - 00000000 ____D C:\Users\Enigma\AppData\Roaming\IObit
2016-04-26 02:07 - 2016-04-02 00:08 - 00000000 ____D C:\Program Files\Intel Corporation
2016-04-26 02:06 - 2016-03-22 10:31 - 00000000 ____D C:\Users\Enigma\AppData\Local\ElevatedDiagnostics
2016-04-25 02:25 - 2016-03-23 14:22 - 00109272 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbamchameleon.sys
2016-04-24 00:33 - 2009-07-14 13:37 - 00000000 ____D C:\Windows\DigitalLocker
2016-04-23 14:09 - 2016-03-22 10:29 - 00000000 ____D C:\Users\Enigma\AppData\Local\VirtualStore
2016-04-21 03:37 - 2016-03-22 19:31 - 00000000 ____D C:\Program Files (x86)\Intel
2016-04-21 03:27 - 2009-07-14 11:20 - 00000000 ____D C:\Program Files\Common Files\Microsoft Shared
2016-04-21 01:25 - 2009-07-14 13:32 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
2016-04-20 05:20 - 2009-07-14 13:08 - 00012856 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2016-04-17 18:37 - 2009-07-14 11:20 - 00000000 ____D C:\Windows\LiveKernelReports
2016-04-12 12:28 - 2009-07-14 12:45 - 00267672 _____ C:\Windows\system32\FNTCACHE.DAT
2016-04-12 04:02 - 2016-04-02 19:51 - 00000907 _____ C:\Users\Public\Desktop\CPUID CPU-Z.lnk
2016-04-12 04:02 - 2016-03-26 20:05 - 00002270 _____ C:\Users\Public\Desktop\Kaspersky Internet Security.lnk
2016-04-12 04:02 - 2016-03-23 14:22 - 00001096 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2016-04-12 04:02 - 2016-03-23 02:23 - 00001354 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\IObit Uninstaller.lnk
2016-04-12 04:02 - 2016-03-22 11:31 - 00001178 _____ C:\Users\Public\Desktop\Media Player Classic HC.lnk
2016-04-12 04:02 - 2009-07-14 13:01 - 00001282 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Default Programs.lnk
2016-04-12 04:02 - 2009-07-14 12:57 - 00001535 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk
2016-04-12 04:02 - 2009-07-14 12:57 - 00001340 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Anytime Upgrade.lnk
2016-04-12 04:02 - 2009-07-14 12:49 - 00001266 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Windows Update.lnk
2016-04-11 23:03 - 2016-03-22 10:38 - 00058016 _____ C:\Users\Enigma\AppData\Local\GDIPFONTCACHEV1.DAT
2016-04-11 22:57 - 2016-03-22 10:34 - 00000000 ____D C:\ProgramData\Package Cache
2016-04-11 05:26 - 2016-03-29 04:03 - 00000000 ____D C:\Windows\system32\appraiser
2016-04-05 21:31 - 2016-03-22 14:53 - 00000000 ____D C:\Program Files\WinRAR
2016-04-03 01:12 - 2016-03-22 10:49 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information

==================== Files in the root of some directories =======

2016-03-27 07:12 - 2016-05-01 03:33 - 0007604 _____ () C:\Users\Enigma\AppData\Local\resmon.resmoncfg

Some files in TEMP:
====================
C:\Users\Enigma\AppData\Local\Temp\libeay32.dll
C:\Users\Enigma\AppData\Local\Temp\msvcr120.dll
C:\Users\Enigma\AppData\Local\Temp\sqlite3.dll


Some zero byte size files/folders:
==========================
C:\Windows\SysWOW64\NTAgent.exe

==================== Bamital & volsnap =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2016-04-28 07:52

==================== End of FRST.txt ============================