Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 31-08-2016
Ran by anhthe (administrator) on DESKTOP-RED7H5V (08-09-2016 12:07:54)
Running from D:\Download\Programs
Loaded Profiles: anhthe (Available Profiles: anhthe)
Platform: Windows 10 Home Single Language Version 1511 (X64) Language: English (United States)
Internet Explorer Version 11 (Default browser: "C:\Users\anhth\AppData\Local\CocCoc\Browser\Application\browser.exe" -- "%1")
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Intel Corporation) C:\Windows\System32\igfxCUIService.exe
(Intel Corporation) C:\Windows\SysWOW64\IntelCpHeciSvc.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\AsLdrSrv.exe
(Adobe Systems, Incorporated) C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exe
(Conexant Systems, Inc.) C:\Windows\SysWOW64\SASrv.exe
(Conexant Systems Inc.) C:\Windows\System32\CxAudMsg64.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(OSBASE) C:\Windows\System32\ddmgr.exe
(Intel Corporation) C:\Windows\SysWOW64\esif_uf.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe
(BlueStack Systems, Inc.) C:\Program Files (x86)\Bluestacks\HD-LogRotatorService.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(Intel) C:\Program Files\Intel Corporation\USB over IP\bin\UoipService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\NisSrv.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Security Assist\isa.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Hi-Rez Studios) D:\Games\Hi-Rez Studios\HiPatchService.exe
(Malwarebytes) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe
(Malwarebytes) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MpCmdRun.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe
(Intel Corporation) C:\Windows\Temp\DPTF\esif_assist_64.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\TeamViewer.exe
(Malwarebytes) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe
() D:\Games\LienMinhHuyenThoai\GameData\ggdllhost.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\USBChargerPlus\USBChargerPlus.exe
(Intel Corporation) C:\Windows\System32\igfxEM.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe
(Intel Corporation) C:\Windows\System32\igfxHK.exe
() C:\Windows\System32\igfxTray.exe
(Microsoft Corporation) C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersServer.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\tv_w32.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\tv_x64.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
() D:\Games\LienMinhHuyenThoai\GameData\ggdllhost.exe
(Microsoft Corporation) C:\Windows\System32\Speech_OneCore\Common\SpeechRuntime.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(AsusTek) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPLoader.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(AsusTek) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPCenter.exe
(AsusTek) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPHelper.exe
(Conexant Systems, Inc.) C:\Program Files\CONEXANT\cAudioFilterAgent\CAudioFilterAgent64.exe
(Coc Coc Co., Ltd.) C:\Users\anhth\AppData\Local\CocCoc\Update\1.3.39.21\CocCocCrashHandler.exe
() D:\Games\LienMinhHuyenThoai\GameData\GarenaMessenger.exe
(Tonec Inc.) C:\Program Files (x86)\Internet Download Manager\IDMan.exe
() D:\Setup\User\Unikey\UniKeyNT.exe
() C:\Program Files (x86)\ASUS Gaming Mouse\hid.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Tonec Inc.) C:\Program Files (x86)\Internet Download Manager\IEMonitor.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\OFFICE15\CSISYNCCLIENT.EXE
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamUserAgent.exe
(Conexant Systems, Inc) C:\Program Files\CONEXANT\SAII\SmartAudio.exe
(Coc Coc Co., Ltd.) C:\Users\anhth\AppData\Local\CocCoc\Browser\Application\browser.exe
(Coc Coc Co., Ltd.) C:\Users\anhth\AppData\Local\CocCoc\Browser\Application\browser.exe
(Coc Coc Co., Ltd.) C:\Users\anhth\AppData\Local\CocCoc\Browser\Application\browser.exe
(Coc Coc Co., Ltd.) C:\Users\anhth\AppData\Local\CocCoc\Browser\Application\browser.exe
(Coc Coc Co., Ltd.) C:\Users\anhth\AppData\Local\CocCoc\Browser\Application\browser.exe
(Coc Coc Co., Ltd.) C:\Users\anhth\AppData\Local\CocCoc\Browser\Application\browser.exe
(Coc Coc Co., Ltd.) C:\Users\anhth\AppData\Local\CocCoc\Browser\Application\browser.exe
(Coc Coc Co., Ltd.) C:\Users\anhth\AppData\Local\CocCoc\Browser\Application\browser.exe
(Coc Coc Co., Ltd.) C:\Users\anhth\AppData\Local\CocCoc\Browser\Application\browser.exe
(Coc Coc Co., Ltd.) C:\Users\anhth\AppData\Local\CocCoc\Browser\Application\browser.exe
() C:\Program Files\WindowsApps\61545TimGrabinat.wAPPerforGmail_1.1.18.0_x64__rcb0qdgx4z9ca\wAPPer for Gmail.exe
(Coc Coc Co., Ltd.) C:\Users\anhth\AppData\Local\CocCoc\Browser\Application\browser.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\AAM Updates Notifier.exe
(Coc Coc Co., Ltd.) C:\Users\anhth\AppData\Local\CocCoc\Browser\Application\browser.exe


==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [cAudioFilterAgent] => C:\Program Files\Conexant\cAudioFilterAgent\cAudioFilterAgent64.exe [599896 2015-06-10] (Conexant Systems, Inc.)
HKLM\...\Run: [SmartAudio] => C:\Program Files\CONEXANT\SAII\SACpl.exe [1830616 2014-04-10] (Conexant Systems, Inc.)
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2398776 2016-05-02] (NVIDIA Corporation)
HKLM\...\Run: [ShadowPlay] => C:\WINDOWS\system32\nvspcap64.dll [1767944 2016-05-02] (NVIDIA Corporation)
HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [508104 2015-09-04] (Adobe Systems Incorporated)
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [176952 2016-07-26] (Apple Inc.)
HKLM-x32\...\Run: [SwitchBoard] => C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [AdobeCS6ServiceManager] => C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe [1073312 2012-03-09] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [ROGNB] => C:\Program Files (x86)\ASUS Gaming Mouse\hid.exe [463872 2015-08-18] ()
HKLM-x32\...\Run: [Duet Display] => C:\Program Files\Kairos\Duet Display\duet.exe [1841264 2016-07-23] (Duet, Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] => "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
HKU\S-1-5-21-1483297329-2720066829-2040343632-1001\...\Run: [CocCoc Update] => C:\Users\anhth\AppData\Local\CocCoc\Update\CocCocUpdate.exe [147584 2016-05-04] (Coc Coc Co., Ltd.)
HKU\S-1-5-21-1483297329-2720066829-2040343632-1001\...\Run: [GarenaPlus] => D:\Games\LienMinhHuyenThoai\GameData\GarenaMessenger.exe [9863632 2016-08-29] ()
HKU\S-1-5-21-1483297329-2720066829-2040343632-1001\...\Run: [IDMan] => C:\Program Files (x86)\Internet Download Manager\IDMan.exe [3931728 2015-12-18] (Tonec Inc.)
HKU\S-1-5-21-1483297329-2720066829-2040343632-1001\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [29502592 2016-07-14] (Skype Technologies S.A.)
HKU\S-1-5-21-1483297329-2720066829-2040343632-1001\...\Run: [UniKey] => D:\Setup\User\Unikey\UniKeyNT.exe [521216 2016-03-29] ()
HKU\S-1-5-21-1483297329-2720066829-2040343632-1001\...\Run: [XperiaCompanionAgent] => C:\Program Files (x86)\Sony\Xperia Companion\XperiaCompanionAgent.exe [2062208 2016-05-26] (Sony)
HKU\S-1-5-21-1483297329-2720066829-2040343632-1001\...\Run: [BlueStacks Agent] => C:\Program Files (x86)\Bluestacks\HD-Agent.exe [978456 2016-08-03] (BlueStack Systems, Inc.)
HKU\S-1-5-21-1483297329-2720066829-2040343632-1001\...\Run: [Steam] => E:\Steam\steam.exe [2857248 2016-08-24] (Valve Corporation)
HKU\S-1-5-21-1483297329-2720066829-2040343632-1001\...\RunOnce: [Uninstall C:\Users\anhth\AppData\Local\Microsoft\OneDrive\17.3.6386.0412_1\amd64] => C:\WINDOWS\system32\cmd.exe /q /c rmdir /s /q "C:\Users\anhth\AppData\Local\Microsoft\OneDrive\17.3.6386.0412_1\amd64"
HKU\S-1-5-21-1483297329-2720066829-2040343632-1001\...\MountPoints2: {b4d2f8c5-2e77-11e6-9bf2-185e0f7a7e51} - "F:\startme.exe" 
ShellIconOverlayIdentifiers: [   IDM Shell Extension] -> {CDC95B92-E27C-4745-A8C5-64A52A78855D} => C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll [2015-08-14] (Tonec Inc.)
ShellIconOverlayIdentifiers: [BkavUhShell] -> {0937B0F7-CCD8-42F7-A9CB-5DA9D36F38E8} =>  No File
ShellIconOverlayIdentifiers: [HardLinkMenu] -> {0A479751-02BC-11d3-A855-0004AC2568AA} => C:\Program Files\LinkShellExtension\HardlinkShellExt.dll [2016-04-20] (Hermann Schinagl)
ShellIconOverlayIdentifiers: [IconOverlayHardLink] -> {0A479751-02BC-11d3-A855-0004AC2568DD} => C:\Program Files\LinkShellExtension\HardlinkShellExt.dll [2016-04-20] (Hermann Schinagl)
ShellIconOverlayIdentifiers: [IconOverlaySymbolicLink] -> {0A479751-02BC-11d3-A855-0004AC2568EE} => C:\Program Files\LinkShellExtension\HardlinkShellExt.dll [2016-04-20] (Hermann Schinagl)
CHR HKLM\SOFTWARE\Policies\Google: Restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{403af5de-8ddc-4bd9-b804-77a144a993fc}: [DhcpNameServer] 172.20.10.1
Tcpip\..\Interfaces\{61c73488-1340-4778-8329-7eb4dd6dbea1}: [NameServer] 188.120.239.115,8.8.8.8
Tcpip\..\Interfaces\{61c73488-1340-4778-8329-7eb4dd6dbea1}: [DhcpNameServer] 192.168.1.1
ManualProxies: 

Internet Explorer:
==================
HKU\S-1-5-21-1483297329-2720066829-2040343632-1001\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkID=617910&ResetID=131175633612583159&GUID=C230E146-B60B-4104-B852-C39BB14A21C4
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://its-neu.com
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkID=617910&ResetID=131175633612597950&GUID=C230E146-B60B-4104-B852-C39BB14A21C4
HKU\S-1-5-21-1483297329-2720066829-2040343632-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/p/?LinkId=619797&pc=UE13&ocid=UE13DHP
SearchScopes: HKU\S-1-5-21-1483297329-2720066829-2040343632-1001 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-1483297329-2720066829-2040343632-1001 -> {F76C82E2-515F-4B42-AD10-5A741BEB1CD4} URL = hxxps://vn.search.yahoo.com/search?p={searchTerms}&fr=yset_ie_syc_oracle&type=orcl_default
BHO: IDM integration (IDMIEHlprObj Class) -> {0055C089-8582-441B-A0BF-17B458C2A3A8} -> C:\Program Files (x86)\Internet Download Manager\IDMIECC64.dll [2015-12-08] (Internet Download Manager, Tonec Inc.)
BHO: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office\Office15\OCHelper.dll [2016-07-19] (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL [2016-07-12] (Microsoft Corporation)
BHO-x32: IDM integration (IDMIEHlprObj Class) -> {0055C089-8582-441B-A0BF-17B458C2A3A8} -> C:\Program Files (x86)\Internet Download Manager\IDMIECC.dll [2015-12-08] (Internet Download Manager, Tonec Inc.)
BHO-x32: BkavSiteAdvisorEngine Class -> {2876549C-1023-4AA0-82FF-8ED7112D5269} -> C:\Program Files (x86)\BkavHomePlus\SiteAdvisor\BkavIESiteAdvisor.dll => No File
BHO-x32: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll [2016-07-19] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_101\bin\ssv.dll [2016-08-12] (Oracle Corporation)
BHO-x32: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\Office15\GROOVEEX.DLL [2016-07-12] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_101\bin\jp2ssv.dll [2016-08-12] (Oracle Corporation)
Handler: bksa - {AFBCA127-FD48-4FF5-B523-0E0DB4B8C295} - C:\Program Files (x86)\BkavHomePlus\SiteAdvisor\BkavIESiteAdvisor.dll No File
Handler: mso-minsb-roaming.16 - {83C25742-A9F7-49FB-9138-434302C88D07} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\MSOSB.DLL No File
Handler: mso-minsb.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\MSOSB.DLL No File
Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office\Office15\MSOSB.DLL [2016-05-17] (Microsoft Corporation)
Handler: osf-roaming.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\MSOSB.DLL No File
Handler: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\MSOSB.DLL No File

FireFox:
========
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~1\Office15\NPSPWRAP.DLL [2014-01-23] (Microsoft Corporation)
FF Plugin: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll [2015-07-29] (Adobe Systems)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32.dll [2016-07-25] ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2015-12-18] ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.68 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2015-04-21] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2015-04-21] (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=11.101.2 -> C:\Program Files (x86)\Java\jre1.8.0_101\bin\dtplugin\npDeployJava1.dll [2016-08-12] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.101.2 -> C:\Program Files (x86)\Java\jre1.8.0_101\bin\plugin2\npjp2.dll [2016-08-12] (Oracle Corporation)
FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files (x86)\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2016-07-19] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office15\NPSPWRAP.DLL [2014-01-22] (Microsoft Corporation)
FF Plugin-x32: @t.garena.com/garenatalk -> D:\Games\LienMinhHuyenThoai\GameData\bbtalk\plugins\npPlugin\npGarenaTalkPlugin.dll [2015-01-16] ( Garena)
FF Plugin-x32: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect32.dll [2015-07-29] (Adobe Systems)
FF Plugin HKU\S-1-5-21-1483297329-2720066829-2040343632-1001: @cos_mini_client_obj_2003 -> C:\Users\anhth\AppData\Roaming\s3_web\cos_vn\np_huyenthoaimoba_2003.dll [No File]
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npMeetingJoinPluginOC.dll [2016-07-19] (Microsoft Corporation)
FF HKLM-x32\...\Firefox\Extensions: [bkavsiteadvisor@bkav.com.vn] - C:\Program Files (x86)\BkavHomePlus\SiteAdvisor\Firefox => not found
FF HKU\S-1-5-21-1483297329-2720066829-2040343632-1001\...\SeaMonkey\Extensions: [mozilla_cc@internetdownloadmanager.com] - C:\Users\anhth\AppData\Roaming\IDM\idmmzcc5
FF Extension: (IDM CC) - C:\Users\anhth\AppData\Roaming\IDM\idmmzcc5 [2016-09-08] [not signed]
FF HKU\S-1-5-21-1483297329-2720066829-2040343632-1001\...\SeaMonkey\Extensions: [mozilla_cc2@internetdownloadmanager.com] - C:\Program Files (x86)\Internet Download Manager\idmmzcc2.xpi
FF Extension: (IDM integration) - C:\Program Files (x86)\Internet Download Manager\idmmzcc2.xpi [2015-12-09]

Chrome: 
=======
CHR HKLM\...\Chrome\Extension: [ngpampappnmepgilojfohadhhmbhlaek] - C:\Program Files (x86)\Internet Download Manager\IDMGCExt.crx [2015-12-29]
CHR HKLM-x32\...\Chrome\Extension: [ngpampappnmepgilojfohadhhmbhlaek] - C:\Program Files (x86)\Internet Download Manager\IDMGCExt.crx [2015-12-29]

==================== Services (Whitelisted) ========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 AGSService; C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exe [2159320 2016-08-22] (Adobe Systems, Incorporated)
R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [83768 2016-03-02] (Apple Inc.)
S3 BstHdAndroidSvc; C:\Program Files (x86)\Bluestacks\HD-Service.exe [445976 2016-08-03] (BlueStack Systems, Inc.)
R2 BstHdLogRotatorSvc; C:\Program Files (x86)\Bluestacks\HD-LogRotatorService.exe [425496 2016-08-03] (BlueStack Systems, Inc.)
S3 BstHdPlusAndroidSvc; C:\Program Files (x86)\Bluestacks\HD-Plus-Service.exe [462360 2016-08-03] (BlueStack Systems, Inc.)
S3 cplspcon; C:\Windows\system32\IntelCpHDCPSvc.exe [607160 2015-08-13] ()
R2 ddmgr; C:\WINDOWS\system32\ddmgr.exe [1666720 2016-05-16] (OSBASE)
S3 DuetUpdater; C:\Program Files\Kairos\Duet Display\DuetUpdater.exe [734320 2016-07-23] (Kairos)
R2 esifsvc; C:\Windows\SysWOW64\esif_uf.exe [1394360 2016-05-04] (Intel Corporation)
R2 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [1165368 2016-05-02] (NVIDIA Corporation)
R2 HiPatchService; D:\Games\Hi-Rez Studios\HiPatchService.exe [9728 2016-08-31] (Hi-Rez Studios) [File not signed]
R2 igfxCUIService2.0.0.0; C:\Windows\system32\igfxCUIService.exe [370088 2015-08-13] (Intel Corporation)
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [881152 2015-05-22] (Intel(R) Corporation)
R3 Intel(R) Security Assist; C:\Program Files (x86)\Intel\Intel(R) Security Assist\isa.exe [335872 2015-05-19] (Intel Corporation) [File not signed]
S3 Intel(R) WiDi SAM; C:\Program Files (x86)\Intel Corporation\Intel WiDi\Intel(R) Software Asset Manager\bin\IntelSoftwareAssetManagerService.exe [19088 2015-06-16] (Intel Corporation)
R2 IntelUSBoverIP; C:\Program Files\Intel Corporation\USB over IP\bin\UoipService.exe [396992 2015-07-06] (Intel)
S2 isaHelperSvc; C:\Program Files (x86)\Intel\Intel(R) Security Assist\isaHelperService.exe [7680 2015-05-19] () [File not signed]
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [223520 2015-07-22] (Intel Corporation)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1514464 2016-03-10] (Malwarebytes)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [1136608 2016-03-10] (Malwarebytes)
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1881144 2016-05-02] (NVIDIA Corporation)
R3 NvStreamNetworkSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe [3634232 2016-05-02] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe [2522680 2016-05-02] (NVIDIA Corporation)
S3 SwitchBoard; C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated) [File not signed]
R2 TeamViewer; C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe [7534864 2016-08-25] (TeamViewer GmbH)
S3 vmicvss; C:\Windows\System32\ICSvc.dll [511488 2015-10-30] (Microsoft Corporation)
R3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [364464 2015-10-30] (Microsoft Corporation)
R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [24864 2016-07-01] (Microsoft Corporation)

===================== Drivers (Whitelisted) ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R3 AsusSGDrv; C:\Windows\system32\DRIVERS\AsusSGDrv.sys [135992 2015-06-30] (ASUS Corporation)
S3 BstHdDrv; C:\Program Files (x86)\Bluestacks\HD-Hypervisor-amd64.sys [152672 2016-08-03] (BlueStack Systems)
S3 BstkDrv; C:\Program Files (x86)\Bluestacks\BstkDrv.sys [307768 2016-07-29] (Bluestack System Inc. )
R4 ddkmd; C:\WINDOWS\system32\drivers\ddkmd.sys [270720 2016-05-16] (OSBASE)
R0 ddkmdldr; C:\Windows\System32\drivers\ddkmdldr.sys [29568 2016-05-16] (OSBASE)
R3 dptf_acpi; C:\Windows\System32\drivers\dptf_acpi.sys [55816 2016-05-04] (Intel Corporation)
R3 dptf_cpu; C:\Windows\System32\drivers\dptf_cpu.sys [53752 2016-05-04] (Intel Corporation)
R3 esif_lf; C:\Windows\system32\DRIVERS\esif_lf.sys [261624 2016-05-04] (Intel Corporation)
S3 ggsomc; C:\Windows\System32\drivers\ggsomc.sys [30424 2016-07-21] (Sony Mobile Communications)
R3 gkernel; C:\Users\anhth\AppData\Local\Temp\gkernel.sys [44544 2016-08-31] () [File not signed]
S3 hitmanpro37; C:\WINDOWS\system32\drivers\hitmanpro37.sys [46960 2016-08-31] ()
R3 ibtusb; C:\Windows\system32\DRIVERS\ibtusb.sys [266512 2016-05-03] (Intel Corporation)
R3 MBAMProtector; C:\WINDOWS\system32\drivers\mbam.sys [27008 2016-03-10] (Malwarebytes)
R3 MBAMSwissArmy; C:\WINDOWS\system32\drivers\MBAMSwissArmy.sys [192216 2016-09-08] (Malwarebytes)
R3 MBAMWebAccessControl; C:\WINDOWS\system32\drivers\mwac.sys [65408 2016-03-10] (Malwarebytes Corporation)
S3 MiraDispKmd; C:\Windows\System32\drivers\MiraDispKmd.sys [23552 2015-10-30] (Microsoft Corporation)
R3 Netwtw02; C:\Windows\System32\drivers\Netwtw02.sys [7034608 2015-08-09] (Intel Corporation)
R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [28216 2016-05-02] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\Windows\system32\drivers\nvvad64v.sys [56384 2016-04-14] (NVIDIA Corporation)
R3 rt640x64; C:\Windows\System32\drivers\rt640x64.sys [887552 2015-07-15] (Realtek                                            )
R3 RTSPER; C:\Windows\system32\DRIVERS\RtsPer.sys [753368 2015-06-15] (Realsil Semiconductor Corporation)
R1 UCGuard; C:\Windows\System32\DRIVERS\ucguard.sys [81792 2016-08-02] (Huorong Borui (Beijing) Technology Co., Ltd.) <==== ATTENTION
U5 UnlockerDriver5; C:\Program Files\Unlocker\UnlockerDriver5.sys [12352 2010-07-02] ()
R3 usb3Hub; C:\Windows\System32\drivers\usb3Hub.sys [212056 2015-07-06] (Windows (R) Win 7 DDK provider)
R1 VBoxUSBMon; C:\Windows\system32\DRIVERS\VBoxUSBMon.sys [127432 2015-09-16] (BigNox Corporation)
S0 WdBoot; C:\Windows\System32\drivers\WdBoot.sys [44568 2015-10-30] (Microsoft Corporation)
R0 WdFilter; C:\Windows\System32\drivers\WdFilter.sys [293216 2015-10-30] (Microsoft Corporation)
R3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [118112 2015-10-30] (Microsoft Corporation)

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

NETSVCx32: HpSvc -> no filepath.

==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-09-08 12:07 - 2016-09-08 12:07 - 00000000 ____D C:\FRST
2016-09-08 11:40 - 2016-09-08 11:40 - 00000000 ___HD C:\OneDriveTemp
2016-09-07 23:00 - 2016-09-07 23:06 - 00715264 _____ C:\Users\anhth\Downloads\636088736806073333Điểm CTĐK 56 hoc đợt 1 và đợt 2.xls
2016-09-07 22:49 - 2016-09-07 22:55 - 01151488 _____ C:\Users\anhth\Downloads\636088736697117101diem ct dau khoa - K57.xls
2016-09-07 22:04 - 2016-09-07 22:04 - 04547567 _____ C:\Users\anhth\Downloads\Cẩm nang tiếng Anh.pdf
2016-09-07 09:35 - 2016-09-07 09:35 - 00001044 _____ C:\Users\anhth\Desktop\report-mbam.txt
2016-09-07 09:22 - 2016-09-07 09:22 - 00001181 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2016-09-07 09:22 - 2016-09-07 09:22 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2016-09-07 09:22 - 2016-09-07 09:22 - 00000000 ____D C:\Program Files (x86)\Malwarebytes Anti-Malware
2016-09-07 09:22 - 2016-03-10 14:09 - 00065408 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mwac.sys
2016-09-07 09:22 - 2016-03-10 14:08 - 00140672 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbamchameleon.sys
2016-09-07 09:22 - 2016-03-10 14:08 - 00027008 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbam.sys
2016-09-05 21:47 - 2016-09-06 10:37 - 00000000 ____D C:\Users\anhth\Desktop\New folder (2)
2016-09-05 21:29 - 2016-09-05 21:29 - 00001976 _____ C:\Users\Public\Desktop\EOSMSG.lnk
2016-09-05 21:29 - 2016-09-05 21:29 - 00000155 _____ C:\Users\Public\Desktop\Visit EosMsg.url
2016-09-05 21:29 - 2016-09-05 21:29 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EOSMSG
2016-09-05 21:29 - 2016-09-05 21:29 - 00000000 ____D C:\Program Files (x86)\www.eosmsg.com
2016-08-31 22:12 - 2016-08-31 22:12 - 00142336 ____H C:\Program Files (x86)\local64spl.dll
2016-08-31 22:12 - 2016-08-31 22:12 - 00000020 ____H C:\Program Files (x86)\local64spl.dll.ini
2016-08-31 22:12 - 2016-08-31 22:12 - 00000000 ___HD C:\Program Files (x86)_
2016-08-31 20:39 - 2016-08-31 20:39 - 00001178 _____ C:\Users\anhth\Desktop\Cheat Engine.lnk
2016-08-31 20:39 - 2016-08-31 20:39 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Cheat Engine 6.5.1
2016-08-31 20:39 - 2016-08-31 20:39 - 00000000 ____D C:\Program Files (x86)\Cheat Engine 6.5.1
2016-08-31 20:21 - 2016-08-31 20:21 - 00000000 ____D C:\Users\anhth\AppData\Local\PAYDAY 2
2016-08-31 20:21 - 2016-08-31 20:21 - 00000000 ____D C:\Users\anhth\AppData\Local\EMU
2016-08-31 10:47 - 2016-09-08 11:41 - 00192216 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2016-08-31 10:47 - 2016-08-31 10:47 - 00000000 ____D C:\ProgramData\Malwarebytes
2016-08-31 10:33 - 2016-08-31 20:08 - 00000000 ____D C:\AdwCleaner
2016-08-31 10:26 - 2016-08-31 10:26 - 00001564 _____ C:\WINDOWS\system32\.crusader
2016-08-31 10:22 - 2016-08-31 10:27 - 00046960 _____ C:\WINDOWS\system32\Drivers\hitmanpro37.sys
2016-08-31 10:22 - 2016-08-31 10:26 - 00000000 ____D C:\ProgramData\HitmanPro
2016-08-31 09:47 - 2016-09-08 11:40 - 00003620 _____ C:\WINDOWS\System32\Tasks\Garena+ Plugin Host Service
2016-08-31 00:16 - 2016-08-31 00:16 - 00000000 ____D C:\ProgramData\Bkav
2016-08-30 23:22 - 2016-08-29 09:07 - 00851104 _____ (Bkav Corporation) C:\WINDOWS\SysWOW64\Drivers\SysLib4.sys
2016-08-30 23:22 - 2016-08-20 09:18 - 04105888 _____ (Bkav Corporation) C:\WINDOWS\SysWOW64\Drivers\SysLib6.sys
2016-08-30 23:19 - 2016-08-30 23:19 - 00000000 ____D C:\Users\anhth\AppData\Local\UCBrowser
2016-08-30 22:31 - 2016-08-30 23:19 - 00001623 _____ C:\Users\anhth\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\UC浏览器.lnk
2016-08-30 22:31 - 2016-08-30 23:19 - 00000000 ____D C:\Users\anhth\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\UC浏览器
2016-08-30 22:30 - 2016-09-07 23:17 - 00000490 _____ C:\WINDOWS\Tasks\UCBrowserUpdater.job
2016-08-30 22:30 - 2016-08-30 22:30 - 00003510 _____ C:\WINDOWS\System32\Tasks\UCBrowserUpdater
2016-08-30 22:30 - 2016-08-02 13:03 - 00081792 _____ (Huorong Borui (Beijing) Technology Co., Ltd.) C:\WINDOWS\system32\Drivers\ucguard.sys
2016-08-30 22:20 - 2016-08-30 22:32 - 00250912 _____ C:\WINDOWS\SysWOW64\kz.exe
2016-08-30 22:18 - 2016-08-30 22:20 - 00000000 ____D C:\Program Files\¿ìѹ
2016-08-30 22:17 - 2016-08-31 10:26 - 00000000 ____D C:\Program Files (x86)\sbqh
2016-08-30 22:17 - 2016-08-30 22:17 - 00009060 _____ C:\WINDOWS\System32\Tasks\Moserslifoing Community
2016-08-30 22:14 - 2016-08-30 22:13 - 00001188 _____ C:\WINDOWS\system32\Drivers\etc\hp.bak
2016-08-30 22:12 - 2016-08-31 22:12 - 00000000 ___HD C:\Program Files (x86)\uvzE4A3
2016-08-30 22:12 - 2016-08-30 22:13 - 00000000 ____D C:\WINDOWS\system32\SSL
2016-08-30 22:12 - 2016-08-30 22:12 - 00009112 _____ C:\WINDOWS\System32\Tasks\Vovoentgrobosy Schedule
2016-08-30 22:12 - 2016-08-30 22:12 - 00000000 ____D C:\ProgramData\Avg
2016-08-30 22:12 - 2016-08-30 22:12 - 00000000 ____D C:\ProgramData\AVAST Software
2016-08-30 22:11 - 2016-08-31 10:59 - 00000000 ____D C:\Program Files (x86)\Totekreiduty
2016-08-28 01:36 - 2016-08-28 01:36 - 00003756 _____ C:\WINDOWS\System32\Tasks\Red Giant Link
2016-08-28 01:36 - 2016-08-28 01:36 - 00000000 ____D C:\Users\anhth\AppData\Roaming\Red Giant
2016-08-28 01:36 - 2016-08-28 01:36 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Red Giant
2016-08-28 01:36 - 2016-08-28 01:36 - 00000000 ____D C:\Program Files (x86)\Red Giant Link
2016-08-28 01:35 - 2016-08-28 01:36 - 00000000 ____D C:\ProgramData\Red Giant
2016-08-28 01:35 - 2016-08-28 01:35 - 00000000 ____D C:\Program Files (x86)\Red Giant
2016-08-28 01:35 - 2016-08-09 08:36 - 15576576 _____ (Trapcode AB) C:\WINDOWS\system32\TCParticleBuilder.dll
2016-08-28 01:34 - 2016-08-28 01:34 - 00000000 ____D C:\ProgramData\RedGiant
2016-08-28 01:15 - 2016-08-28 14:56 - 00000000 ____D C:\Users\anhth\Documents\Adobe
2016-08-28 01:12 - 2016-08-28 01:12 - 00000981 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe After Effects CC 2016.lnk
2016-08-28 01:12 - 2016-08-28 01:12 - 00000000 ____D C:\Users\Public\Documents\AdobeInstalledCodecs
2016-08-28 01:10 - 2016-08-28 01:10 - 00001069 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Character Animator (Preview).lnk
2016-08-28 01:09 - 2016-08-28 01:09 - 00001625 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Application Manager.lnk
2016-08-28 01:09 - 2016-08-28 01:09 - 00001613 _____ C:\Users\Public\Desktop\Adobe Application Manager.lnk
2016-08-27 23:54 - 2016-08-28 00:01 - 00298504 _____ C:\Users\anhth\Downloads\Lot To Learn - Luke Christopher [MP3 320kbps].mp3.sfk
2016-08-27 23:46 - 2016-08-27 23:46 - 00000000 ____D C:\Users\anhth\AppData\Roaming\Publish Providers
2016-08-27 23:42 - 2016-08-27 23:43 - 00000000 ____D C:\Users\anhth\AppData\Local\Sony
2016-08-27 23:42 - 2016-08-27 23:42 - 00000000 ____D C:\ProgramData\Sony
2016-08-27 23:41 - 2016-08-28 00:00 - 00000000 ____D C:\Users\anhth\AppData\Roaming\Sony
2016-08-27 23:19 - 2016-08-27 23:19 - 00000000 ____D C:\Users\Public\Documents\Adobe
2016-08-27 23:19 - 2016-08-27 23:19 - 00000000 ____D C:\Users\anhth\AppData\Roaming\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
2016-08-27 22:48 - 2016-08-27 22:48 - 00000000 ____D C:\Users\anhth\AppData\LocalLow\Adobe
2016-08-27 20:21 - 2016-08-27 20:21 - 00003344 _____ C:\WINDOWS\System32\Tasks\OneDrive Standalone Update Task
2016-08-26 20:23 - 2016-08-26 20:23 - 00000000 ____D C:\Users\anhth\Documents\KONAMI
2016-08-25 21:42 - 2016-08-25 21:42 - 00000000 ____D C:\Users\anhth\AppData\Local\Steam
2016-08-25 21:39 - 2016-08-25 21:39 - 00000549 _____ C:\Users\Public\Desktop\Steam.lnk
2016-08-25 21:39 - 2016-08-25 21:39 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Steam
2016-08-23 18:34 - 2016-08-26 09:21 - 00000000 ____D C:\Users\anhth\AppData\Local\GMap.NET
2016-08-22 20:36 - 2016-08-22 20:36 - 00000885 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe After Effects CS6.lnk
2016-08-22 20:36 - 2016-08-22 20:36 - 00000787 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Media Encoder CS6.lnk
2016-08-22 20:35 - 2016-08-22 20:35 - 00001076 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Help.lnk
2016-08-22 20:35 - 2016-08-22 20:35 - 00000000 ____D C:\Users\Default\AppData\Roaming\Macromedia
2016-08-22 20:35 - 2016-08-22 20:35 - 00000000 ____D C:\Users\Default User\AppData\Roaming\Macromedia
2016-08-22 19:35 - 2016-08-22 20:37 - 00000000 ____D C:\Users\anhth\AppData\Roaming\NVIDIA
2016-08-22 12:49 - 2016-08-22 12:49 - 00413796 _____ C:\WINDOWS\Minidump\082216-8734-01.dmp
2016-08-22 09:43 - 2016-08-22 09:43 - 00000918 _____ C:\Users\Public\Desktop\BlueStacks.lnk
2016-08-22 09:43 - 2016-08-22 09:43 - 00000918 _____ C:\ProgramData\Microsoft\Windows\Start Menu\BlueStacks.lnk
2016-08-22 09:41 - 2016-08-22 09:43 - 00000000 ____D C:\Program Files (x86)\Bluestacks
2016-08-21 23:18 - 2016-08-21 23:20 - 00000000 ___RD C:\Users\anhth\Downloads\61545TimGrabinat.wAPPerforGmail_rcb0qdgx4z9ca!App
2016-08-20 20:10 - 2016-08-20 20:10 - 00000000 ____D C:\Users\anhth\AppData\LocalLow\Unity
2016-08-20 20:09 - 2016-08-20 20:09 - 00000000 ____D C:\TouchDefence
2016-08-20 20:08 - 2016-08-20 20:08 - 00000549 _____ C:\Users\anhth\Desktop\Touch.lnk
2016-08-20 20:08 - 2016-08-20 20:08 - 00000000 ____D C:\Users\anhth\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Touch
2016-08-19 10:32 - 2016-08-19 10:32 - 00000000 ____D C:\Users\anhth\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ClashFarmer
2016-08-14 21:52 - 2016-08-14 21:52 - 00000000 ____D C:\Users\anhth\AppData\Local\HirezLauncherUI
2016-08-13 21:04 - 2016-08-13 21:04 - 00002011 _____ C:\Users\anhth\Desktop\MP3 Key Shifter.lnk
2016-08-13 21:04 - 2016-08-13 21:04 - 00000000 ____D C:\Users\anhth\AppData\Roaming\mp3keyshifter
2016-08-13 21:04 - 2016-08-13 21:04 - 00000000 ____D C:\Users\anhth\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\MP3 Key Shifter
2016-08-13 21:04 - 2016-08-13 21:04 - 00000000 ____D C:\Program Files (x86)\MP3 Key Shifter
2016-08-12 15:31 - 2016-08-12 15:31 - 00003264 _____ C:\WINDOWS\System32\Tasks\{3C0BE3BD-A80A-439C-AA24-66D8BB71D524}
2016-08-12 14:07 - 2016-08-12 14:07 - 00000000 ____D C:\Users\anhth\AppData\Roaming\java
2016-08-12 13:57 - 2016-08-12 13:57 - 00000052 _____ C:\Users\anhth\pokemon_encryption.data
2016-08-12 13:09 - 2016-09-08 11:43 - 00004170 _____ C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{AFBA63B9-20B1-4DC0-ADEC-1D9845112F49}
2016-08-12 13:09 - 2016-08-12 13:09 - 00097856 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\WindowsAccessBridge-32.dll
2016-08-12 13:09 - 2016-08-12 13:09 - 00000000 ____D C:\Users\anhth\AppData\Roaming\Sun
2016-08-12 13:09 - 2016-08-12 13:09 - 00000000 ____D C:\Users\anhth\AppData\LocalLow\Sun
2016-08-12 13:09 - 2016-08-12 13:09 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2016-08-12 13:08 - 2016-08-12 13:09 - 00000000 ____D C:\ProgramData\Oracle
2016-08-12 13:08 - 2016-08-12 13:08 - 00000000 ____D C:\Program Files (x86)\Java
2016-08-12 00:18 - 2016-08-12 00:18 - 00000000 ____D C:\Users\anhth\AppData\Local\TeamViewer
2016-08-11 23:30 - 2016-08-11 23:38 - 00000000 ____D C:\Users\anhth\.android
2016-08-11 23:29 - 2016-08-11 23:29 - 00000000 ____D C:\Users\anhth\Nox_share
2016-08-11 23:28 - 2016-08-11 23:38 - 00000000 ____D C:\Users\anhth\vmlogs
2016-08-11 23:28 - 2015-09-16 13:07 - 00127432 _____ (BigNox Corporation) C:\WINDOWS\system32\Drivers\VBoxUSBMon.sys
2016-08-11 23:28 - 2015-09-16 10:29 - 00253384 _____ (BigNox Corporation) C:\WINDOWS\system32\Drivers\XQHDrv.sys
2016-08-11 11:53 - 2016-08-11 11:53 - 00001004 _____ C:\Users\anhth\Desktop\PokeAuto - Shortcut.lnk
2016-08-11 06:53 - 2016-08-11 06:53 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2016-08-11 06:40 - 2016-08-03 17:36 - 00099680 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\pdc.sys
2016-08-11 06:40 - 2016-08-03 17:23 - 00693600 _____ (Microsoft Corporation) C:\WINDOWS\system32\NetSetupEngine.dll
2016-08-11 06:40 - 2016-08-03 17:23 - 00115040 _____ (Microsoft Corporation) C:\WINDOWS\system32\NetSetupApi.dll
2016-08-11 06:40 - 2016-08-03 17:22 - 00808288 _____ (Microsoft Corporation) C:\WINDOWS\system32\WWAHost.exe
2016-08-11 06:40 - 2016-08-03 17:21 - 00566112 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingSyncHost.exe
2016-08-11 06:40 - 2016-08-03 17:19 - 00604928 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\cng.sys
2016-08-11 06:40 - 2016-08-03 17:19 - 00161632 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ksecpkg.sys
2016-08-11 06:40 - 2016-08-03 17:13 - 01988448 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgkrnl.sys
2016-08-11 06:40 - 2016-08-03 17:13 - 00576864 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgmms2.sys
2016-08-11 06:40 - 2016-08-03 17:13 - 00393056 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgmms1.sys
2016-08-11 06:40 - 2016-08-03 16:51 - 00084480 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpudd.dll
2016-08-11 06:40 - 2016-08-03 16:44 - 00189952 _____ (Microsoft Corporation) C:\WINDOWS\system32\MusNotification.exe
2016-08-11 06:40 - 2016-08-03 16:44 - 00044544 _____ (Microsoft Corporation) C:\WINDOWS\system32\musdialoghandlers.dll
2016-08-11 06:40 - 2016-08-03 16:43 - 16985088 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.dll
2016-08-11 06:40 - 2016-08-03 16:41 - 00128512 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\bthpan.sys
2016-08-11 06:40 - 2016-08-03 16:41 - 00112640 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\bthenum.sys
2016-08-11 06:40 - 2016-08-03 16:40 - 00181248 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\rfcomm.sys
2016-08-11 06:40 - 2016-08-03 16:40 - 00058880 _____ (Microsoft Corporation) C:\WINDOWS\system32\MusNotificationUx.exe
2016-08-11 06:40 - 2016-08-03 16:40 - 00047616 _____ (Microsoft Corporation) C:\WINDOWS\system32\TpmTasks.dll
2016-08-11 06:40 - 2016-08-03 16:39 - 00218624 _____ (Microsoft Corporation) C:\WINDOWS\system32\cdd.dll
2016-08-11 06:40 - 2016-08-03 16:38 - 00379392 _____ (Microsoft Corporation) C:\WINDOWS\system32\usocore.dll
2016-08-11 06:40 - 2016-08-03 16:36 - 00211456 _____ (Microsoft Corporation) C:\WINDOWS\system32\NetSetupSvc.dll
2016-08-11 06:40 - 2016-08-03 16:36 - 00198144 _____ (Microsoft Corporation) C:\WINDOWS\system32\winsrv.dll
2016-08-11 06:40 - 2016-08-03 16:35 - 00200192 _____ (Microsoft Corporation) C:\WINDOWS\system32\WUDFPlatform.dll
2016-08-11 06:40 - 2016-08-03 16:31 - 00247296 _____ (Microsoft Corporation) C:\WINDOWS\system32\wevtutil.exe
2016-08-11 06:40 - 2016-08-03 16:30 - 00515072 _____ (Microsoft Corporation) C:\WINDOWS\system32\OneDriveSettingSyncProvider.dll
2016-08-11 06:40 - 2016-08-03 16:29 - 14252544 _____ (Microsoft Corporation) C:\WINDOWS\system32\wmp.dll
2016-08-11 06:40 - 2016-08-03 16:29 - 01500160 _____ (Microsoft Corporation) C:\WINDOWS\system32\RecoveryDrive.exe
2016-08-11 06:40 - 2016-08-03 16:29 - 01387520 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kbase.sys
2016-08-11 06:40 - 2016-08-03 16:29 - 00954368 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\bthport.sys
2016-08-11 06:40 - 2016-08-03 16:29 - 00084992 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\BTHUSB.SYS
2016-08-11 06:40 - 2016-08-03 16:28 - 01213440 _____ (Microsoft Corporation) C:\WINDOWS\system32\wwansvc.dll
2016-08-11 06:40 - 2016-08-03 16:27 - 07536640 _____ (Microsoft Corporation) C:\WINDOWS\system32\mstscax.dll
2016-08-11 06:40 - 2016-08-03 16:27 - 01717760 _____ (Microsoft Corporation) C:\WINDOWS\system32\GdiPlus.dll
2016-08-11 06:40 - 2016-08-03 16:18 - 06974464 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Data.Pdf.dll
2016-08-11 06:40 - 2016-08-03 16:18 - 01388032 _____ (Microsoft Corporation) C:\WINDOWS\system32\lsasrv.dll
2016-08-11 06:40 - 2016-08-03 16:16 - 05123072 _____ (Microsoft Corporation) C:\WINDOWS\system32\dbgeng.dll
2016-08-11 06:40 - 2016-08-03 16:16 - 03589120 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kfull.sys
2016-08-11 06:40 - 2016-08-03 16:14 - 01997824 _____ (Microsoft Corporation) C:\WINDOWS\system32\ActiveSyncProvider.dll
2016-08-11 06:40 - 2016-08-03 16:11 - 04171264 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpcorets.dll
2016-08-11 06:40 - 2016-08-03 12:52 - 00034088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wldp.dll
2016-08-11 06:40 - 2016-08-03 12:34 - 00501592 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\NetSetupEngine.dll
2016-08-11 06:40 - 2016-08-03 12:34 - 00084832 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\NetSetupApi.dll
2016-08-11 06:40 - 2016-08-03 12:33 - 00051128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SensorsNativeApi.dll
2016-08-11 06:40 - 2016-08-03 12:31 - 02921368 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll
2016-08-11 06:40 - 2016-08-03 12:31 - 00957608 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ole32.dll
2016-08-11 06:40 - 2016-08-03 12:31 - 00703840 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WWAHost.exe
2016-08-11 06:40 - 2016-08-03 11:57 - 00091648 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tdlrecover.exe
2016-08-11 06:40 - 2016-08-03 11:48 - 00051712 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wshbth.dll
2016-08-11 06:40 - 2016-08-03 11:44 - 00048640 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.StateRepositoryClient.dll
2016-08-11 06:40 - 2016-08-03 11:44 - 00048128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.StateRepositoryBroker.dll
2016-08-11 06:40 - 2016-08-03 11:42 - 00080896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\BluetoothApis.dll
2016-08-11 06:40 - 2016-08-03 11:37 - 00219136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\VEEventDispatcher.dll
2016-08-11 06:40 - 2016-08-03 11:34 - 00792064 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\kerberos.dll
2016-08-11 06:40 - 2016-08-03 11:32 - 12585984 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wmp.dll
2016-08-11 06:40 - 2016-08-03 11:32 - 00434688 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LogonController.dll
2016-08-11 06:40 - 2016-08-03 11:31 - 06743040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mstscax.dll
2016-08-11 06:40 - 2016-08-03 11:31 - 00705536 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuapi.dll
2016-08-11 06:40 - 2016-08-03 11:25 - 04078080 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dbgeng.dll
2016-08-11 06:40 - 2016-08-03 11:19 - 02180096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.StateRepository.dll
2016-08-11 06:39 - 2016-08-03 18:14 - 01505984 _____ (Microsoft Corporation) C:\WINDOWS\system32\appraiser.dll
2016-08-11 06:39 - 2016-08-03 18:14 - 00092352 _____ (Microsoft Corporation) C:\WINDOWS\system32\acmigration.dll
2016-08-11 06:39 - 2016-08-03 18:14 - 00050368 _____ (Microsoft Corporation) C:\WINDOWS\system32\CompatTelRunner.exe
2016-08-11 06:39 - 2016-08-03 17:36 - 07469408 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe
2016-08-11 06:39 - 2016-08-03 17:36 - 00037744 _____ (Microsoft Corporation) C:\WINDOWS\system32\wldp.dll
2016-08-11 06:39 - 2016-08-03 17:30 - 00026408 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuauclt.exe
2016-08-11 06:39 - 2016-08-03 17:22 - 01322760 _____ (Microsoft Corporation) C:\WINDOWS\system32\ole32.dll
2016-08-11 06:39 - 2016-08-03 17:22 - 00465248 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\storport.sys
2016-08-11 06:39 - 2016-08-03 17:22 - 00331616 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\pci.sys
2016-08-11 06:39 - 2016-08-03 17:22 - 00058408 _____ (Microsoft Corporation) C:\WINDOWS\system32\SensorsNativeApi.dll
2016-08-11 06:39 - 2016-08-03 17:21 - 22561256 _____ (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll
2016-08-11 06:39 - 2016-08-03 17:21 - 03675512 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll
2016-08-11 06:39 - 2016-08-03 17:21 - 00303216 _____ (Microsoft Corporation) C:\WINDOWS\system32\LockAppHost.exe
2016-08-11 06:39 - 2016-08-03 17:20 - 01540224 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppobjs.dll
2016-08-11 06:39 - 2016-08-03 17:20 - 00692136 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppwinob.dll
2016-08-11 06:39 - 2016-08-03 17:11 - 00422744 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\rdbss.sys
2016-08-11 06:39 - 2016-08-03 16:51 - 00123392 _____ (Microsoft Corporation) C:\WINDOWS\system32\tdlrecover.exe
2016-08-11 06:39 - 2016-08-03 16:46 - 22384128 _____ (Microsoft Corporation) C:\WINDOWS\system32\edgehtml.dll
2016-08-11 06:39 - 2016-08-03 16:44 - 00063488 _____ (Microsoft Corporation) C:\WINDOWS\system32\wshbth.dll
2016-08-11 06:39 - 2016-08-03 16:41 - 00064000 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.StateRepositoryClient.dll
2016-08-11 06:39 - 2016-08-03 16:41 - 00059904 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.StateRepositoryBroker.dll
2016-08-11 06:39 - 2016-08-03 16:40 - 00127488 _____ (Microsoft Corporation) C:\WINDOWS\system32\VEDataLayerHelpers.dll
2016-08-11 06:39 - 2016-08-03 16:40 - 00091136 _____ (Microsoft Corporation) C:\WINDOWS\system32\bthserv.dll
2016-08-11 06:39 - 2016-08-03 16:39 - 00104448 _____ (Microsoft Corporation) C:\WINDOWS\system32\BluetoothApis.dll
2016-08-11 06:39 - 2016-08-03 16:38 - 00412160 _____ (Microsoft Corporation) C:\WINDOWS\system32\MusUpdateHandlers.dll
2016-08-11 06:39 - 2016-08-03 16:37 - 00110080 _____ (Microsoft Corporation) C:\WINDOWS\system32\IdCtrls.dll
2016-08-11 06:39 - 2016-08-03 16:36 - 00221696 _____ (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe
2016-08-11 06:39 - 2016-08-03 16:35 - 00764928 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakradiag.dll
2016-08-11 06:39 - 2016-08-03 16:34 - 00383488 _____ (Microsoft Corporation) C:\WINDOWS\system32\iedkcs32.dll
2016-08-11 06:39 - 2016-08-03 16:33 - 00339968 _____ (Microsoft Corporation) C:\WINDOWS\system32\SensorService.dll
2016-08-11 06:39 - 2016-08-03 16:33 - 00285184 _____ (Microsoft Corporation) C:\WINDOWS\system32\VEEventDispatcher.dll
2016-08-11 06:39 - 2016-08-03 16:31 - 00506880 _____ (Microsoft Corporation) C:\WINDOWS\system32\tileobjserver.dll
2016-08-11 06:39 - 2016-08-03 16:31 - 00359936 _____ (Microsoft Corporation) C:\WINDOWS\system32\SensorsApi.dll
2016-08-11 06:39 - 2016-08-03 16:30 - 24613888 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2016-08-11 06:39 - 2016-08-03 16:30 - 00970752 _____ (Microsoft Corporation) C:\WINDOWS\system32\kerberos.dll
2016-08-11 06:39 - 2016-08-03 16:29 - 02127360 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcpl.cpl
2016-08-11 06:39 - 2016-08-03 16:29 - 00784384 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll
2016-08-11 06:39 - 2016-08-03 16:28 - 00848896 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuapi.dll
2016-08-11 06:39 - 2016-08-03 16:28 - 00529920 _____ (Microsoft Corporation) C:\WINDOWS\system32\LogonController.dll
2016-08-11 06:39 - 2016-08-03 16:27 - 01752576 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll
2016-08-11 06:39 - 2016-08-03 16:27 - 00381952 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuuhext.dll
2016-08-11 06:39 - 2016-08-03 16:20 - 13390336 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2016-08-11 06:39 - 2016-08-03 16:18 - 02067968 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.dll
2016-08-11 06:39 - 2016-08-03 16:17 - 02175488 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentServer.dll
2016-08-11 06:39 - 2016-08-03 16:16 - 02635776 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Logon.dll
2016-08-11 06:39 - 2016-08-03 16:16 - 01732096 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll
2016-08-11 06:39 - 2016-08-03 16:15 - 07833088 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakra.dll
2016-08-11 06:39 - 2016-08-03 16:14 - 04895232 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
2016-08-11 06:39 - 2016-08-03 16:13 - 03025920 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll
2016-08-11 06:39 - 2016-08-03 16:13 - 02280960 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaueng.dll
2016-08-11 06:39 - 2016-08-03 16:12 - 02746368 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.StateRepository.dll
2016-08-11 06:39 - 2016-08-03 12:30 - 21123320 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shell32.dll
2016-08-11 06:39 - 2016-08-03 12:30 - 00465760 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SettingSyncHost.exe
2016-08-11 06:39 - 2016-08-03 12:30 - 00255168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LockAppHost.exe
2016-08-11 06:39 - 2016-08-03 11:47 - 13018112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Xaml.dll
2016-08-11 06:39 - 2016-08-03 11:40 - 00092160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\IdCtrls.dll
2016-08-11 06:39 - 2016-08-03 11:39 - 19351040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2016-08-11 06:39 - 2016-08-03 11:37 - 00335872 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iedkcs32.dll
2016-08-11 06:39 - 2016-08-03 11:35 - 00286208 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SensorsApi.dll
2016-08-11 06:39 - 2016-08-03 11:35 - 00178688 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wevtutil.exe
2016-08-11 06:39 - 2016-08-03 11:34 - 00400896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\OneDriveSettingSyncProvider.dll
2016-08-11 06:39 - 2016-08-03 11:33 - 18677760 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\edgehtml.dll
2016-08-11 06:39 - 2016-08-03 11:33 - 02050048 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcpl.cpl
2016-08-11 06:39 - 2016-08-03 11:33 - 00687616 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll
2016-08-11 06:39 - 2016-08-03 11:32 - 01526272 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll
2016-08-11 06:39 - 2016-08-03 11:32 - 01467392 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\GdiPlus.dll
2016-08-11 06:39 - 2016-08-03 11:29 - 12133376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2016-08-11 06:39 - 2016-08-03 11:28 - 03663360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
2016-08-11 06:39 - 2016-08-03 11:25 - 05323776 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Data.Pdf.dll
2016-08-11 06:39 - 2016-08-03 11:23 - 05660672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakra.dll
2016-08-11 06:39 - 2016-08-03 11:23 - 01799680 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Logon.dll
2016-08-11 06:39 - 2016-08-03 11:22 - 02501120 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll
2016-08-11 06:39 - 2016-08-03 11:22 - 01502208 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll
2016-08-11 06:39 - 2016-08-03 11:21 - 01708032 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ActiveSyncProvider.dll
2016-08-10 20:48 - 2016-08-10 12:47 - 00007225 _____ C:\WINDOWS\system32\-1.14-windows.xml
2016-08-10 18:23 - 2016-08-25 18:16 - 00000382 _____ C:\gnbotpokestat
2016-08-10 18:23 - 2016-08-25 18:16 - 00000000 _____ C:\gnbotpokelog
2016-08-10 18:22 - 2016-08-25 18:16 - 00000038 _____ C:\gnbotpokectrl
2016-08-10 18:22 - 2016-08-25 16:43 - 00000000 ____D C:\gnbotpoke
2016-08-10 18:22 - 2016-08-10 18:22 - 00000047 _____ C:\mycard.ini
2016-08-10 18:17 - 2016-08-10 18:17 - 00000000 ____D C:\Users\anhth\AppData\Roaming\qmacro
2016-08-10 18:17 - 2016-08-10 18:17 - 00000000 ____D C:\Users\anhth\AppData\Roaming\mymacro
2016-08-10 12:55 - 2016-08-10 12:55 - 00000000 ____D C:\Users\anhth\AppData\Local\Macromedia
2016-08-10 12:54 - 2016-08-10 12:54 - 00000000 ____D C:\Users\anhth\AppData\Roaming\Mozilla
2016-08-10 12:47 - 2016-08-28 15:05 - 00000000 ____D C:\ProgramData\BlueStacksSetup
2016-08-10 12:46 - 2016-08-22 09:41 - 00000000 ____D C:\Users\anhth\AppData\Local\Bluestacks
2016-08-09 23:43 - 2016-09-05 21:11 - 00000003 _____ C:\WINDOWS\SysWOW64\HRUPPROG.TXT
2016-08-09 23:43 - 2016-08-09 23:43 - 00000003 _____ C:\WINDOWS\SysWOW64\HRUPPROG.EXIT
2016-08-09 23:27 - 2016-08-09 23:27 - 00000435 _____ C:\Users\anhth\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\DATA (D).lnk
2016-08-09 23:17 - 2016-08-09 23:33 - 00000000 ____D C:\Users\anhth\AppData\Local\Bkav
2016-08-09 21:41 - 2016-08-31 10:01 - 00112928 _____ (Bkav Corporation) C:\WINDOWS\SysWOW64\C
2016-08-09 21:41 - 2016-08-09 21:41 - 00000106 ___SH C:\bksesysinfo.sys
2016-08-09 21:41 - 2016-08-09 21:41 - 00000000 ____D C:\Users\anhth\AppData\Roaming\Bkav Corporation
2016-08-09 21:40 - 2016-08-09 23:34 - 00000000 ____D C:\Program Files (x86)\Bkav Corporation
2016-08-09 20:19 - 2016-08-09 20:56 - 00001058 _____ C:\Users\anhth\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\iPadian.lnk

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-09-08 11:43 - 2016-05-11 21:17 - 00000000 ____D C:\Users\anhth\AppData\Local\Adobe
2016-09-08 11:43 - 2016-05-04 10:37 - 00000000 ____D C:\Users\anhth\AppData\Roaming\GarenaPlus
2016-09-08 11:43 - 2016-05-04 10:37 - 00000000 ____D C:\ProgramData\GarenaMessenger
2016-09-08 11:40 - 2016-05-10 11:02 - 00000180 _____ C:\WINDOWS\system32\{A6D608F0-0BDE-491A-97AE-5C4B05D86E01}.bat
2016-09-08 11:40 - 2016-05-04 00:09 - 00000000 ___RD C:\Users\anhth\OneDrive
2016-09-07 23:46 - 2016-05-04 10:43 - 00000000 ____D C:\Users\anhth\AppData\Roaming\DMCache
2016-09-07 23:46 - 2016-05-04 00:06 - 00000000 ____D C:\Users\anhth\AppData\Local\Packages
2016-09-07 23:31 - 2016-05-04 00:20 - 00001034 _____ C:\WINDOWS\Tasks\CocCocUpdateTaskUserS-1-5-21-1483297329-2720066829-2040343632-1001UA.job
2016-09-07 09:18 - 2016-06-14 15:58 - 00000000 ____D C:\Users\anhth\AppData\Roaming\xim
2016-09-07 00:00 - 2016-05-04 00:20 - 00000982 _____ C:\WINDOWS\Tasks\CocCocUpdateTaskUserS-1-5-21-1483297329-2720066829-2040343632-1001Core.job
2016-09-06 23:37 - 2015-10-30 14:24 - 00000000 ____D C:\WINDOWS\AppReadiness
2016-09-05 22:29 - 2015-10-30 14:24 - 00000000 ____D C:\WINDOWS\system32\appraiser
2016-09-05 22:29 - 2015-10-30 14:11 - 00000000 ____D C:\WINDOWS\CbsTemp
2016-09-05 21:15 - 2015-10-30 14:24 - 00000000 ___HD C:\Program Files\WindowsApps
2016-08-31 20:12 - 2016-05-04 00:06 - 00879220 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2016-08-31 20:12 - 2015-10-30 14:21 - 00000000 ____D C:\WINDOWS\INF
2016-08-31 20:08 - 2016-02-13 20:10 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT
2016-08-31 20:08 - 2015-10-30 13:28 - 00524288 ___SH C:\WINDOWS\system32\config\BBI
2016-08-31 11:30 - 2016-05-10 11:04 - 00000000 ____D C:\Users\anhth
2016-08-31 11:00 - 2016-02-13 19:52 - 00000000 ____D C:\WINDOWS\SKB
2016-08-31 10:43 - 2016-05-18 23:25 - 00000000 ____D C:\Program Files (x86)\TeamViewer
2016-08-30 23:21 - 2016-05-04 23:03 - 00000000 ____D C:\Program Files\Unlocker
2016-08-30 23:19 - 2016-05-10 12:12 - 00000000 ____D C:\Users\anhth\AppData\Local\CrashDumps
2016-08-30 22:16 - 2016-02-13 20:07 - 05149344 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2016-08-28 11:45 - 2016-05-11 21:16 - 00000000 ____D C:\ProgramData\Adobe
2016-08-28 01:35 - 2016-05-24 14:40 - 00000000 ____D C:\Program Files\Adobe
2016-08-28 01:16 - 2016-05-04 00:06 - 00000000 ____D C:\Users\anhth\AppData\Roaming\Adobe
2016-08-28 01:12 - 2016-05-24 14:41 - 00000000 ____D C:\ProgramData\regid.1986-12.com.adobe
2016-08-28 01:12 - 2016-05-24 14:39 - 00000000 ____D C:\Program Files\Common Files\Adobe
2016-08-27 23:42 - 2016-07-21 00:08 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sony
2016-08-27 23:42 - 2016-07-21 00:08 - 00000000 ____D C:\Program Files (x86)\Sony
2016-08-27 22:47 - 2016-05-24 14:40 - 00001088 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Bridge CS6 (64bit).lnk
2016-08-27 22:46 - 2016-05-24 14:40 - 00001606 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe ExtendScript Toolkit CS6.lnk
2016-08-27 20:21 - 2016-05-04 00:09 - 00002373 _____ C:\Users\anhth\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk
2016-08-26 09:47 - 2016-05-18 23:25 - 00001046 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamViewer 11.lnk
2016-08-26 09:47 - 2016-05-18 23:25 - 00001034 _____ C:\Users\Public\Desktop\TeamViewer 11.lnk
2016-08-25 22:38 - 2016-05-04 10:51 - 00000000 ___RD C:\Program Files (x86)\Skype
2016-08-25 22:38 - 2016-05-04 10:51 - 00000000 ____D C:\Users\anhth\AppData\Roaming\Skype
2016-08-25 22:38 - 2016-05-04 10:51 - 00000000 ____D C:\ProgramData\Skype
2016-08-25 18:46 - 2016-05-14 00:11 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2013
2016-08-25 16:59 - 2015-10-30 14:24 - 00000000 ____D C:\WINDOWS\LiveKernelReports
2016-08-23 22:47 - 2016-05-12 11:27 - 00000000 ____D C:\Users\anhth\Downloads\Arrow.S04E21.HDTV.x264-LOL[ettv]
2016-08-23 22:47 - 2016-05-06 19:52 - 00000000 ____D C:\Users\anhth\Downloads\DCs.Legends.of.Tomorrow.S01E14.HDTV.x264-LOL[ettv]
2016-08-22 20:35 - 2016-05-24 14:40 - 00000000 ____D C:\Program Files (x86)\Adobe
2016-08-22 12:49 - 2016-05-12 08:58 - 00000000 ____D C:\WINDOWS\Minidump
2016-08-22 09:43 - 2015-10-30 14:24 - 00000000 __RHD C:\Users\Public\Libraries
2016-08-12 23:47 - 2015-10-30 14:24 - 00000000 ____D C:\WINDOWS\rescache
2016-08-12 13:09 - 2016-07-21 10:08 - 00000000 ____D C:\Users\anhth\.oracle_jre_usage
2016-08-12 12:37 - 2016-08-08 11:06 - 00000296 _____ C:\Users\anhth\Desktop\New Text Document.txt
2016-08-11 23:28 - 2016-05-04 10:10 - 00000000 ____D C:\Program Files\DIFX
2016-08-11 23:28 - 2015-10-30 14:24 - 00000000 ____D C:\WINDOWS\Registration
2016-08-11 10:12 - 2016-02-13 20:15 - 00000000 __RHD C:\Users\Public\AccountPictures
2016-08-11 07:46 - 2016-02-13 19:59 - 00000000 ____D C:\Program Files\Windows Journal
2016-08-11 07:46 - 2015-10-30 14:24 - 00000000 ___RD C:\WINDOWS\ImmersiveControlPanel
2016-08-11 06:55 - 2015-10-30 14:24 - 00000000 ____D C:\WINDOWS\system32\SecureBootUpdates
2016-08-11 06:54 - 2016-05-04 09:06 - 00000000 ____D C:\WINDOWS\system32\MRT
2016-08-11 06:54 - 2015-07-10 18:04 - 00000167 _____ C:\WINDOWS\win.ini
2016-08-11 06:53 - 2016-05-04 09:06 - 147640136 ____C (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2016-08-10 12:09 - 2016-07-31 13:26 - 00000000 ____D C:\Users\anhth\AppData\Roaming\duet
2016-08-09 23:33 - 2016-05-04 00:21 - 00002471 _____ C:\Users\anhth\Desktop\Cốc Cốc.lnk
2016-08-09 20:19 - 2016-05-04 00:06 - 00000000 ____D C:\Users\anhth\AppData\Local\VirtualStore

==================== Files in the root of some directories =======

2016-08-31 22:12 - 2016-08-31 22:12 - 0142336 ____H () C:\Program Files (x86)\local64spl.dll
2016-08-31 22:12 - 2016-08-31 22:12 - 0000020 ____H () C:\Program Files (x86)\local64spl.dll.ini
2016-08-09 21:41 - 2016-08-09 23:13 - 0002056 _____ () C:\Users\anhth\AppData\Roaming\Home.exe.log

Some files in TEMP:
====================
C:\Users\anhth\AppData\Local\Temp\libeay32.dll
C:\Users\anhth\AppData\Local\Temp\msvcr120.dll
C:\Users\anhth\AppData\Local\Temp\Quarantine.exe
C:\Users\anhth\AppData\Local\Temp\sqlite3.dll


==================== Bamital & volsnap =================

(There is no automatic fix for files that do not pass verification.)

C:\WINDOWS\system32\winlogon.exe => File is digitally signed
C:\WINDOWS\system32\wininit.exe => File is digitally signed
C:\WINDOWS\explorer.exe => File is digitally signed
C:\WINDOWS\SysWOW64\explorer.exe => File is digitally signed
C:\WINDOWS\system32\svchost.exe => File is digitally signed
C:\WINDOWS\SysWOW64\svchost.exe => File is digitally signed
C:\WINDOWS\system32\services.exe => File is digitally signed
C:\WINDOWS\system32\User32.dll => File is digitally signed
C:\WINDOWS\SysWOW64\User32.dll => File is digitally signed
C:\WINDOWS\system32\userinit.exe => File is digitally signed
C:\WINDOWS\SysWOW64\userinit.exe => File is digitally signed
C:\WINDOWS\system32\rpcss.dll => File is digitally signed
C:\WINDOWS\system32\dnsapi.dll => File is digitally signed
C:\WINDOWS\SysWOW64\dnsapi.dll => File is digitally signed
C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2016-09-07 08:21

==================== End of FRST.txt ============================