ComboFix 15-09-07.01 - MouRaD 17/09/2015 21:41:12.1.8 - x64 Microsoft Windows 7 Professional 6.1.7601.1.1252.44.1033.18.4003.2467 [GMT 1:00] Running from: c:\users\MouRaD\Desktop\ComboFix.exe AV: Kaspersky Internet Security *Disabled/Updated* {B41C7598-35F6-4D89-7D0E-7ADE69B4047B} FW: Kaspersky Internet Security *Disabled* {8C27F4BD-7F99-4CD1-5651-D3EB97674300} SP: Kaspersky Internet Security *Disabled/Updated* {0F7D947C-13CC-4207-47BE-41AC12334EC6} SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . c:\programdata\ma-config.com\Logs\activex.txt c:\programdata\ma-config.com\Logs\mcdetection.txt c:\programdata\ma-config.com\Logs\mcstubuser.txt c:\programdata\ma-config.com\mcbase.db c:\programdata\ma-config.com\server.pem c:\users\MouRaD\100.mat c:\users\MouRaD\AppData\Roaming\Microsoft\Windows\Recent\118e_6m.mat c:\users\MouRaD\ZHPDiag3.exe c:\windows\iun6002.exe . . ((((((((((((((((((((((((( Files Created from 2015-08-17 to 2015-09-17 ))))))))))))))))))))))))))))))) . . 2015-09-17 20:52 . 2015-09-17 20:52 -------- d-----w- c:\users\Default\AppData\Local\temp 2015-09-17 10:09 . 2015-09-17 10:09 710992 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight-2\SpotlightResources.dll 2015-09-17 09:31 . 2015-09-17 09:31 75888 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{FCF1CAE7-C2DE-4EFE-881B-FAFDC4C4910B}\offreg.6276.dll 2015-09-16 18:16 . 2015-09-16 18:16 75888 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{FCF1CAE7-C2DE-4EFE-881B-FAFDC4C4910B}\offreg.7124.dll 2015-09-15 19:35 . 2015-09-15 19:35 75888 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{FCF1CAE7-C2DE-4EFE-881B-FAFDC4C4910B}\offreg.7956.dll 2015-09-15 11:14 . 2015-09-15 11:14 75888 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{FCF1CAE7-C2DE-4EFE-881B-FAFDC4C4910B}\offreg.6852.dll 2015-09-15 11:11 . 2015-07-31 09:21 11745192 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{FCF1CAE7-C2DE-4EFE-881B-FAFDC4C4910B}\mpengine.dll 2015-09-15 10:21 . 2015-09-17 20:34 113880 ----a-w- c:\windows\system32\drivers\MBAMSwissArmy.sys 2015-09-15 10:20 . 2015-09-15 10:20 -------- d-----w- c:\program files (x86)\Malwarebytes Anti-Malware 2015-09-15 10:20 . 2015-09-15 10:20 -------- d-----w- c:\programdata\Malwarebytes 2015-09-15 10:20 . 2015-06-18 07:41 63704 ----a-w- c:\windows\system32\drivers\mwac.sys 2015-09-15 10:20 . 2015-06-18 07:41 109272 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys 2015-09-15 10:20 . 2015-06-18 07:41 25816 ----a-w- c:\windows\system32\drivers\mbam.sys 2015-09-14 21:15 . 2015-09-15 08:51 35064 ----a-w- c:\windows\system32\drivers\TrueSight.sys 2015-09-14 21:15 . 2015-09-15 10:08 -------- d-----w- c:\programdata\RogueKiller 2015-09-14 17:59 . 2015-09-14 17:59 55464 ----a-w- c:\program files (x86)\Mozilla Firefox\browser\components\browsercomps.dll 2015-09-14 17:59 . 2015-09-14 17:59 2106216 ----a-w- c:\program files (x86)\Mozilla Firefox\D3DCompiler_43.dll 2015-09-14 17:59 . 2015-09-14 17:59 20648 ----a-w- c:\program files (x86)\Mozilla Firefox\AccessibleMarshal.dll 2015-09-14 17:59 . 2015-09-14 17:59 109736 ----a-w- c:\program files (x86)\Mozilla Firefox\breakpadinjector.dll 2015-09-14 17:59 . 2015-09-14 17:59 3466856 ----a-w- c:\program files (x86)\Mozilla Firefox\d3dcompiler_47.dll 2015-09-14 17:59 . 2015-09-14 17:59 190120 ----a-w- c:\program files (x86)\Mozilla Firefox\gmp-clearkey\0.1\clearkey.dll 2015-09-14 17:59 . 2015-09-14 17:59 970912 ----a-w- c:\program files (x86)\Mozilla Firefox\msvcr120.dll 2015-09-14 17:59 . 2015-09-14 17:59 455328 ----a-w- c:\program files (x86)\Mozilla Firefox\msvcp120.dll 2015-09-14 17:59 . 2015-09-14 17:59 108712 ----a-w- c:\program files (x86)\Mozilla Firefox\wow_helper.exe 2015-09-14 17:12 . 2015-09-16 09:34 -------- d-----w- c:\users\MouRaD\AppData\Roaming\ZHP 2015-09-13 17:43 . 2015-08-18 01:42 817240 ----a-w- c:\program files\Internet Explorer\iexplore.exe 2015-09-13 17:40 . 2015-08-05 17:56 1737216 ----a-w- c:\program files\Windows Journal\NBDoc.DLL 2015-09-13 17:36 . 2015-07-23 00:02 1390592 ----a-w- c:\windows\system32\diagtrack.dll 2015-09-13 17:34 . 2015-06-25 10:06 115136 ----a-w- c:\windows\system32\consent.exe 2015-09-13 17:34 . 2015-06-25 10:01 1941504 ----a-w- c:\windows\system32\authui.dll 2015-09-13 17:34 . 2015-06-25 10:01 70656 ----a-w- c:\windows\system32\appinfo.dll 2015-09-13 17:34 . 2015-06-25 09:44 1805824 ----a-w- c:\windows\SysWow64\authui.dll 2015-09-12 19:47 . 2015-09-12 19:47 895088 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup-2\markup.dll 2015-09-12 19:46 . 2015-09-12 19:46 42168 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\dSM-2\StartResources.dll 2015-09-11 00:42 . 2015-09-17 10:09 895088 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup\markup.dll 2015-09-11 00:42 . 2015-09-17 10:09 42168 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\dSM\StartResources.dll 2015-09-11 00:42 . 2015-09-11 00:42 710992 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll 2015-09-09 11:54 . 2015-09-02 03:04 41984 ----a-w- c:\windows\system32\lpk.dll 2015-09-09 11:54 . 2015-09-02 03:04 100864 ----a-w- c:\windows\system32\fontsub.dll 2015-09-09 11:54 . 2015-09-02 03:04 14336 ----a-w- c:\windows\system32\dciman32.dll 2015-09-09 11:54 . 2015-09-02 03:04 46080 ----a-w- c:\windows\system32\atmlib.dll 2015-09-09 11:54 . 2015-09-02 02:48 70656 ----a-w- c:\windows\SysWow64\fontsub.dll 2015-09-09 11:54 . 2015-09-02 02:48 10240 ----a-w- c:\windows\SysWow64\dciman32.dll 2015-09-09 11:54 . 2015-09-02 02:48 34304 ----a-w- c:\windows\SysWow64\atmlib.dll 2015-09-09 11:54 . 2015-09-02 02:47 25600 ----a-w- c:\windows\SysWow64\lpk.dll 2015-09-09 11:54 . 2015-09-02 01:51 3209216 ----a-w- c:\windows\system32\win32k.sys 2015-09-09 11:54 . 2015-09-02 01:47 372736 ----a-w- c:\windows\system32\atmfd.dll 2015-09-09 11:54 . 2015-09-02 01:33 299520 ----a-w- c:\windows\SysWow64\atmfd.dll 2015-09-09 11:00 . 2015-09-09 11:00 -------- d-----w- c:\program files\Common Files\AV 2015-09-04 13:33 . 2015-09-04 13:33 -------- d-----w- c:\users\MouRaD\AppData\Local\Macromedia 2015-09-04 13:08 . 2015-09-04 13:08 778440 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe 2015-09-04 13:08 . 2015-09-04 13:08 142536 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl 2015-09-04 13:08 . 2015-09-04 13:08 -------- d-----w- c:\windows\SysWow64\Macromed 2015-09-04 13:08 . 2015-09-04 13:08 -------- d-----w- c:\windows\system32\Macromed 2015-09-03 21:53 . 2015-09-03 21:53 -------- d-----w- C:\MinGW 2015-09-03 17:59 . 2015-09-03 17:59 -------- d-----w- c:\users\MouRaD\AppData\Local\Dropbox 2015-09-03 17:59 . 2015-09-03 17:59 -------- d-----w- c:\programdata\Dropbox . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2015-08-26 17:37 . 2014-12-28 20:23 134753440 ----a-w- c:\windows\system32\MRT.exe 2015-07-30 18:06 . 2015-08-15 09:44 1648128 ----a-w- c:\windows\system32\DWrite.dll 2015-07-30 18:06 . 2015-08-15 09:44 1180160 ----a-w- c:\windows\system32\FntCache.dll 2015-07-30 18:06 . 2015-08-15 09:44 2565120 ----a-w- c:\windows\system32\d3d10warp.dll 2015-07-30 17:57 . 2015-08-15 09:44 1251328 ----a-w- c:\windows\SysWow64\DWrite.dll 2015-07-30 17:57 . 2015-08-15 09:44 1987584 ----a-w- c:\windows\SysWow64\d3d10warp.dll 2015-07-30 13:13 . 2015-08-18 12:29 103120 ----a-w- c:\windows\SysWow64\PresentationCFFRasterizerNative_v0300.dll 2015-07-30 13:13 . 2015-08-18 12:29 124624 ----a-w- c:\windows\system32\PresentationCFFRasterizerNative_v0300.dll 2015-07-28 20:09 . 2015-08-15 10:30 17344 ----a-w- c:\windows\system32\CompatTelRunner.exe 2015-07-28 20:05 . 2015-08-15 10:30 774656 ----a-w- c:\windows\system32\invagent.dll 2015-07-28 20:05 . 2015-08-15 10:30 743424 ----a-w- c:\windows\system32\generaltel.dll 2015-07-28 20:05 . 2015-08-15 10:30 437760 ----a-w- c:\windows\system32\devinv.dll 2015-07-28 20:05 . 2015-08-15 10:30 1116672 ----a-w- c:\windows\system32\appraiser.dll 2015-07-28 20:05 . 2015-08-15 10:30 69120 ----a-w- c:\windows\system32\acmigration.dll 2015-07-28 20:05 . 2015-08-15 10:30 227328 ----a-w- c:\windows\system32\aepdu.dll 2015-07-28 19:55 . 2015-08-15 10:30 1148416 ----a-w- c:\windows\system32\aeinv.dll 2015-07-22 17:53 . 2015-09-13 17:36 44032 ----a-w- c:\windows\apppatch\acwow64.dll 2015-07-15 18:15 . 2015-08-15 10:29 94656 ----a-w- c:\windows\system32\drivers\mountmgr.sys 2015-07-15 18:10 . 2015-08-15 10:29 1743360 ----a-w- c:\windows\system32\sysmain.dll 2015-07-15 18:10 . 2015-08-15 10:29 11264 ----a-w- c:\windows\system32\msmmsp.dll 2015-07-15 03:19 . 2015-08-15 10:28 52736 ----a-w- c:\windows\system32\basesrv.dll 2015-07-10 17:51 . 2015-08-15 10:28 44032 ----a-w- c:\windows\system32\tsgqec.dll 2015-07-10 17:51 . 2015-08-15 09:28 14177280 ----a-w- c:\windows\system32\shell32.dll 2015-07-10 17:51 . 2015-08-15 10:28 3722752 ----a-w- c:\windows\system32\mstscax.dll 2015-07-10 17:51 . 2015-08-15 10:28 158720 ----a-w- c:\windows\system32\aaclient.dll 2015-07-10 17:34 . 2015-08-15 10:28 36864 ----a-w- c:\windows\SysWow64\tsgqec.dll 2015-07-10 17:34 . 2015-08-15 10:28 3221504 ----a-w- c:\windows\SysWow64\mstscax.dll 2015-07-10 17:33 . 2015-08-15 10:28 131584 ----a-w- c:\windows\SysWow64\aaclient.dll 2015-07-09 17:57 . 2015-08-15 09:39 193536 ----a-w- c:\windows\system32\notepad.exe 2015-07-09 17:57 . 2015-08-15 09:39 193536 ----a-w- c:\windows\notepad.exe 2015-07-09 17:42 . 2015-08-15 09:39 179712 ----a-w- c:\windows\SysWow64\notepad.exe 2015-07-04 18:07 . 2015-07-15 23:31 2087424 ----a-w- c:\windows\system32\ole32.dll 2015-07-04 17:48 . 2015-07-15 23:31 1414656 ----a-w- c:\windows\SysWow64\ole32.dll 2015-06-26 11:03 . 2015-06-26 11:03 584848 ----a-w- C:\SecurityScanner.dll 2015-06-23 10:30 . 2010-11-21 03:27 300704 ------w- c:\windows\system32\MpSigStub.exe . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ DropboxExt1] @="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}" . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt1"] @="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}] 2015-08-14 08:16 189464 ----a-w- c:\users\MouRaD\AppData\Roaming\Dropbox\bin\DropboxExt.27.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ DropboxExt2] @="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}" . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt2"] @="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}] 2015-08-14 08:16 189464 ----a-w- c:\users\MouRaD\AppData\Roaming\Dropbox\bin\DropboxExt.27.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ DropboxExt3] @="{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}" . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt3"] @="{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}] 2015-08-14 08:16 189464 ----a-w- c:\users\MouRaD\AppData\Roaming\Dropbox\bin\DropboxExt.27.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ DropboxExt4] @="{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}" . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt4"] @="{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}] 2015-08-14 08:16 189464 ----a-w- c:\users\MouRaD\AppData\Roaming\Dropbox\bin\DropboxExt.27.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ DropboxExt5] @="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}" . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt5"] @="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}] 2015-08-14 08:16 189464 ----a-w- c:\users\MouRaD\AppData\Roaming\Dropbox\bin\DropboxExt.27.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ DropboxExt6] @="{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}" . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt6"] @="{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}] 2015-08-14 08:16 189464 ----a-w- c:\users\MouRaD\AppData\Roaming\Dropbox\bin\DropboxExt.27.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ DropboxExt7] @="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}" . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt7"] @="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}] 2015-08-14 08:16 189464 ----a-w- c:\users\MouRaD\AppData\Roaming\Dropbox\bin\DropboxExt.27.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ DropboxExt8] @="{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}" . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt8"] @="{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}] 2015-08-14 08:16 189464 ----a-w- c:\users\MouRaD\AppData\Roaming\Dropbox\bin\DropboxExt.27.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro1 (ErrorConflict)] @="{8BA85C75-763B-4103-94EB-9470F12FE0F7}" [HKEY_CLASSES_ROOT\CLSID\{8BA85C75-763B-4103-94EB-9470F12FE0F7}] 2015-06-16 13:34 1730264 ----a-w- c:\progra~2\MIF5BA~1\Office15\GROOVEEX.DLL . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro2 (SyncInProgress)] @="{CD55129A-B1A1-438E-A425-CEBC7DC684EE}" [HKEY_CLASSES_ROOT\CLSID\{CD55129A-B1A1-438E-A425-CEBC7DC684EE}] 2015-06-16 13:34 1730264 ----a-w- c:\progra~2\MIF5BA~1\Office15\GROOVEEX.DLL . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro3 (InSync)] @="{E768CD3B-BDDC-436D-9C13-E1B39CA257B1}" [HKEY_CLASSES_ROOT\CLSID\{E768CD3B-BDDC-436D-9C13-E1B39CA257B1}] 2015-06-16 13:34 1730264 ----a-w- c:\progra~2\MIF5BA~1\Office15\GROOVEEX.DLL . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ DropboxExt1] @="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}" . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt1"] @="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}] 2015-08-14 08:16 189464 ----a-w- c:\users\MouRaD\AppData\Roaming\Dropbox\bin\DropboxExt.27.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ DropboxExt2] @="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}" . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt2"] @="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}] 2015-08-14 08:16 189464 ----a-w- c:\users\MouRaD\AppData\Roaming\Dropbox\bin\DropboxExt.27.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ DropboxExt3] @="{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}" . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt3"] @="{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}] 2015-08-14 08:16 189464 ----a-w- c:\users\MouRaD\AppData\Roaming\Dropbox\bin\DropboxExt.27.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ DropboxExt4] @="{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}" . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt4"] @="{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}] 2015-08-14 08:16 189464 ----a-w- c:\users\MouRaD\AppData\Roaming\Dropbox\bin\DropboxExt.27.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ DropboxExt5] @="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}" . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt5"] @="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}] 2015-08-14 08:16 189464 ----a-w- c:\users\MouRaD\AppData\Roaming\Dropbox\bin\DropboxExt.27.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ DropboxExt6] @="{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}" . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt6"] @="{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}] 2015-08-14 08:16 189464 ----a-w- c:\users\MouRaD\AppData\Roaming\Dropbox\bin\DropboxExt.27.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ DropboxExt7] @="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}" . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt7"] @="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}] 2015-08-14 08:16 189464 ----a-w- c:\users\MouRaD\AppData\Roaming\Dropbox\bin\DropboxExt.27.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ DropboxExt8] @="{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}" . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt8"] @="{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}] 2015-08-14 08:16 189464 ----a-w- c:\users\MouRaD\AppData\Roaming\Dropbox\bin\DropboxExt.27.dll . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CCleaner Monitoring"="c:\program files\CCleaner\CCleaner64.exe" [2015-02-19 7416088] . c:\users\MouRaD\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ Dropbox.lnk - c:\users\MouRaD\AppData\Roaming\Dropbox\bin\Dropbox.exe /systemstartup [2015-2-11 39175960] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorUser"= 3 (0x3) "EnableLUA"= 0 (0x0) "EnableUIADesktopToggle"= 0 (0x0) "PromptOnSecureDesktop"= 0 (0x0) . [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus] "DisableMonitoring"=dword:00000001 . R2 AVP15.0.1;Kaspersky Anti-Virus Service 15.0.1;c:\program files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\avp.exe;c:\program files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\avp.exe [x] R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x] R2 MBAMScheduler;MBAMScheduler;c:\program files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe;c:\program files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [x] R2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes Anti-Malware\mbamservice.exe;c:\program files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [x] R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x] R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys;c:\windows\SYSNATIVE\drivers\dmvsc.sys [x] R3 ICCS;Intel(R) Integrated Clock Controller Service - Intel(R) ICCS;c:\program files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe;c:\program files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe [x] R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x] R3 libusb0;libusb-win32 - Kernel Driver 04/08/2011 1.2.4.0;c:\windows\system32\DRIVERS\libusb0.sys;c:\windows\SYSNATIVE\DRIVERS\libusb0.sys [x] R3 ma-config_amd64;ma-config_amd64;c:\program files\ma-config.com\Drivers\ma-config_amd64.sys;c:\program files\ma-config.com\Drivers\ma-config_amd64.sys [x] R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys;c:\windows\SYSNATIVE\drivers\mbam.sys [x] R3 MBAMWebAccessControl;MBAMWebAccessControl;c:\windows\system32\drivers\mwac.sys;c:\windows\SYSNATIVE\drivers\mwac.sys [x] R3 ose64;Office 64 Source Engine;c:\program files\Common Files\Microsoft Shared\Source Engine\OSE.EXE;c:\program files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [x] R3 SpotUsb;SpotUsb;c:\windows\system32\DRIVERS\MFUSB_Netduino.sys;c:\windows\SYSNATIVE\DRIVERS\MFUSB_Netduino.sys [x] R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x] R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x] R3 wampapache64;wampapache64;c:\wamp\bin\apache\apache2.4.9\bin\httpd.exe;c:\wamp\bin\apache\apache2.4.9\bin\httpd.exe [x] R3 wampmysqld64;wampmysqld64;c:\wamp\bin\mysql\mysql5.6.17\bin\mysqld.exe wampmysqld64;c:\wamp\bin\mysql\mysql5.6.17\bin\mysqld.exe wampmysqld64 [x] R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x] R4 MSSQLServerADHelper100;SQL Active Directory Helper Service;c:\program files\Microsoft SQL Server\100\Shared\SQLADHLP.EXE;c:\program files\Microsoft SQL Server\100\Shared\SQLADHLP.EXE [x] R4 NIApplicationWebServer64;NI Application Web Server (64-bit);c:\program files\National Instruments\Shared\NI WebServer\ApplicationWebServer.exe;c:\program files\National Instruments\Shared\NI WebServer\ApplicationWebServer.exe [x] R4 RsFx0103;RsFx0103 Driver;c:\windows\system32\DRIVERS\RsFx0103.sys;c:\windows\SYSNATIVE\DRIVERS\RsFx0103.sys [x] R4 SQLAgent$SQLEXPRESS;SQL Server Agent (SQLEXPRESS);c:\program files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE;c:\program files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE [x] S0 cm_km_w;Kaspersky Lab Crypto Module (FDE PDK);c:\windows\system32\DRIVERS\cm_km_w.sys;c:\windows\SYSNATIVE\DRIVERS\cm_km_w.sys [x] S1 klhk;klhk;c:\windows\system32\DRIVERS\klhk.sys;c:\windows\SYSNATIVE\DRIVERS\klhk.sys [x] S1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter;c:\windows\system32\DRIVERS\klim6.sys;c:\windows\SYSNATIVE\DRIVERS\klim6.sys [x] S1 klpd;klpd;c:\windows\system32\DRIVERS\klpd.sys;c:\windows\SYSNATIVE\DRIVERS\klpd.sys [x] S1 kltdi;kltdi;c:\windows\system32\DRIVERS\kltdi.sys;c:\windows\SYSNATIVE\DRIVERS\kltdi.sys [x] S1 Klwtp;Klwtp;c:\windows\system32\DRIVERS\klwtp.sys;c:\windows\SYSNATIVE\DRIVERS\klwtp.sys [x] S1 kneps;kneps;c:\windows\system32\DRIVERS\kneps.sys;c:\windows\SYSNATIVE\DRIVERS\kneps.sys [x] S2 c2cautoupdatesvc;Skype Click to Call Updater;c:\program files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe;c:\program files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [x] S2 c2cpnrsvc;Skype Click to Call PNR Service;c:\program files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe;c:\program files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [x] S2 DiagTrack;Diagnostics Tracking Service;c:\windows\System32\svchost.exe;c:\windows\SYSNATIVE\svchost.exe [x] S2 kldisk;kldisk;c:\windows\system32\DRIVERS\kldisk.sys;c:\windows\SYSNATIVE\DRIVERS\kldisk.sys [x] S2 MaConfigAgent;Ma-Config Agent;c:\program files\ma-config.com\MaConfigAgent.exe;c:\program files\ma-config.com\MaConfigAgent.exe [x] S2 NIApplicationWebServer;NI Application Web Server;c:\program files (x86)\National Instruments\Shared\NI WebServer\ApplicationWebServer.exe;c:\program files (x86)\National Instruments\Shared\NI WebServer\ApplicationWebServer.exe [x] S2 niauth;NI Authentication Service;c:\program files (x86)\National Instruments\Shared\niauth\niauth_daemon.exe;c:\program files (x86)\National Instruments\Shared\niauth\niauth_daemon.exe [x] S2 nimDNSResponder;NI mDNS Responder Service;c:\program files (x86)\National Instruments\Shared\mDNS Responder\nimdnsResponder.exe;c:\program files (x86)\National Instruments\Shared\mDNS Responder\nimdnsResponder.exe [x] S2 NINetworkDiscovery;NI Network Discovery;c:\program files (x86)\National Instruments\Shared\NI Network Discovery\niDiscSvc.exe;c:\program files (x86)\National Instruments\Shared\NI Network Discovery\niDiscSvc.exe [x] S2 NISystemWebServer;NI System Web Server;c:\program files (x86)\National Instruments\Shared\NI WebServer\SystemWebServer.exe;c:\program files (x86)\National Instruments\Shared\NI WebServer\SystemWebServer.exe [x] S3 IntcDAud;Intel(R) Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys;c:\windows\SYSNATIVE\DRIVERS\IntcDAud.sys [x] S3 klflt;Kaspersky Lab Kernel DLL;c:\windows\system32\DRIVERS\klflt.sys;c:\windows\SYSNATIVE\DRIVERS\klflt.sys [x] S3 klkbdflt;Kaspersky Lab KLKBDFLT;c:\windows\system32\DRIVERS\klkbdflt.sys;c:\windows\SYSNATIVE\DRIVERS\klkbdflt.sys [x] S3 klmouflt;Kaspersky Lab KLMOUFLT;c:\windows\system32\DRIVERS\klmouflt.sys;c:\windows\SYSNATIVE\DRIVERS\klmouflt.sys [x] S3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\nusb3hub.sys;c:\windows\SYSNATIVE\DRIVERS\nusb3hub.sys [x] S3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;c:\windows\system32\DRIVERS\nusb3xhc.sys;c:\windows\SYSNATIVE\DRIVERS\nusb3xhc.sys [x] S3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys;c:\windows\SYSNATIVE\Drivers\RtsUStor.sys [x] S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x] . . --- Other Services/Drivers In Memory --- . *NewlyCreated* - WS2IFSL . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}] 2015-09-16 19:28 997704 ----a-w- c:\program files (x86)\Google\Chrome\Application\45.0.2454.93\Installer\chrmstp.exe . Contents of the 'Scheduled Tasks' folder . 2015-09-17 c:\windows\Tasks\Adobe Flash Player Updater.job - c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-09-04 13:08] . 2015-09-17 c:\windows\Tasks\DropboxUpdateTaskUserS-1-5-21-2988065644-2016269040-228604876-1000Core.job - c:\users\MouRaD\AppData\Local\Dropbox\Update\DropboxUpdate.exe [2015-09-03 17:59] . 2015-09-17 c:\windows\Tasks\DropboxUpdateTaskUserS-1-5-21-2988065644-2016269040-228604876-1000UA.job - c:\users\MouRaD\AppData\Local\Dropbox\Update\DropboxUpdate.exe [2015-09-03 17:59] . 2015-09-17 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2015-01-17 15:13] . 2015-09-17 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2015-01-17 15:13] . . --------- X64 Entries ----------- . . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ GoogleDriveBlacklisted] @="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42}" [HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42}] 2015-07-29 06:23 775496 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ GoogleDriveSynced] @="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}" [HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}] 2015-07-29 06:23 775496 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ GoogleDriveSyncing] @="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41}" [HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41}] 2015-07-29 06:23 775496 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ DropboxExt1] @="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}] 2015-08-14 08:16 226328 ----a-w- c:\users\MouRaD\AppData\Roaming\Dropbox\bin\DropboxExt64.27.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ DropboxExt2] @="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}] 2015-08-14 08:16 226328 ----a-w- c:\users\MouRaD\AppData\Roaming\Dropbox\bin\DropboxExt64.27.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ DropboxExt3] @="{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}] 2015-08-14 08:16 226328 ----a-w- c:\users\MouRaD\AppData\Roaming\Dropbox\bin\DropboxExt64.27.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ DropboxExt4] @="{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}] 2015-08-14 08:16 226328 ----a-w- c:\users\MouRaD\AppData\Roaming\Dropbox\bin\DropboxExt64.27.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ DropboxExt5] @="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}] 2015-08-14 08:16 226328 ----a-w- c:\users\MouRaD\AppData\Roaming\Dropbox\bin\DropboxExt64.27.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ DropboxExt6] @="{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}] 2015-08-14 08:16 226328 ----a-w- c:\users\MouRaD\AppData\Roaming\Dropbox\bin\DropboxExt64.27.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ DropboxExt7] @="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}] 2015-08-14 08:16 226328 ----a-w- c:\users\MouRaD\AppData\Roaming\Dropbox\bin\DropboxExt64.27.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ DropboxExt8] @="{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}] 2015-08-14 08:16 226328 ----a-w- c:\users\MouRaD\AppData\Roaming\Dropbox\bin\DropboxExt64.27.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro1 (ErrorConflict)] @="{8BA85C75-763B-4103-94EB-9470F12FE0F7}" [HKEY_CLASSES_ROOT\CLSID\{8BA85C75-763B-4103-94EB-9470F12FE0F7}] 2015-06-16 13:31 2335448 ----a-w- c:\progra~1\MIF5BA~1\Office15\GROOVEEX.DLL . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro2 (SyncInProgress)] @="{CD55129A-B1A1-438E-A425-CEBC7DC684EE}" [HKEY_CLASSES_ROOT\CLSID\{CD55129A-B1A1-438E-A425-CEBC7DC684EE}] 2015-06-16 13:31 2335448 ----a-w- c:\progra~1\MIF5BA~1\Office15\GROOVEEX.DLL . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro3 (InSync)] @="{E768CD3B-BDDC-436D-9C13-E1B39CA257B1}" [HKEY_CLASSES_ROOT\CLSID\{E768CD3B-BDDC-436D-9C13-E1B39CA257B1}] 2015-06-16 13:31 2335448 ----a-w- c:\progra~1\MIF5BA~1\Office15\GROOVEEX.DLL . ------- Supplementary Scan ------- . uLocal Page = c:\windows\system32\blank.htm mLocal Page = c:\windows\SysWOW64\blank.htm uInternet Settings,ProxyOverride = IE: &Envoyer à OneNote - c:\progra~1\MIF5BA~1\Office15\ONBttnIE.dll/105 IE: E&xporter vers Microsoft Excel - c:\progra~1\MIF5BA~1\Office15\EXCEL.EXE/3000 IE: {{09A10376-994C-4BBF-9121-F50CF7BA237E} - {F2A56BFE-7911-451A-BC74-A9C3C2E95126} - c:\program files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\IEExt\ie_plugin.dll Trusted Zone: dell.com TCP: DhcpNameServer = 192.168.1.254 192.168.1.254 Filter: text/xml - {807583E5-5146-11D5-A672-00B0D022E945} - c:\program files (x86)\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL FF - ProfilePath - c:\users\MouRaD\AppData\Roaming\Mozilla\Firefox\Profiles\jv2mr8ps.default\ FF - user.js: plugin.state.npcontentblocker - 2 FF - user.js: plugin.state.nponlinebanking - 2 FF - user.js: plugin.state.npvkplugin - 2 FF - user.js: plugin.state.npcontentblocker - 2 FF - user.js: plugin.state.nponlinebanking - 2 FF - user.js: plugin.state.npvkplugin - 2 FF - user.js: plugin.state.npcontentblocker - 2 FF - user.js: plugin.state.nponlinebanking - 2 FF - user.js: plugin.state.npvkplugin - 2 user_pref(extensions.autoDisableScopes,14); . - - - - ORPHANS REMOVED - - - - . AddRemove-Athan - c:\windows\iun6002.exe . . . --------------------- LOCKED REGISTRY KEYS --------------------- . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . Completion time: 2015-09-17 21:56:25 ComboFix-quarantined-files.txt 2015-09-17 20:56 . Pre-Run: 189,319,282,688 bytes free Post-Run: 189,337,362,432 bytes free . - - End Of File - - 6DEB390E5D35D46B07E98D63CB054BE3 A36C5E4F47E84449FF07ED3517B43A31