~ ZHPDiag v2015.7.18.93 By Nicolas Coolman (2015/07/18)
~ Run by samy (Administrator) (2015/07/18 17:15:31)
~ Site: http://www.nicolascoolman.fr
~ Facebook: https://www.facebook.com/nicolascoolman1
~ State version: Version OK
~ Mode: Scan
~ Report: C:\Users\samy\Desktop\ZHPDiag.txt
~ Report: C:\Users\samy\AppData\Roaming\ZHP\ZHPDiag.txt
~ UAC: Activate
~ System startup: Normal (Normal boot)
~ Windows 8.1, 32-bit (Build 9600)

---\\ Internet Browsers (2) - 0s
GCIE: Google Chrome v43.0.2357.134
MSIE: Internet Explorer v11.0.10162.0

---\\ Windows Product Information (3) - 13s
~ Windows Server License Manager Script : OK
~ Licence Script File Génération : OK
Windows Activation Technologies : OK

---\\ System protection software (2) - 0s
Malwarebytes Anti-Malware version 2.1.8.1057
SMADAV version 10.1.1 v10.1.1

---\\ Surveillance software (1) - 0s
Adobe Reader XI

---\\ Information on the system (6) - 0s
~ Operating System: x86 Family 15 Model 4 Stepping 3, GenuineIntel
~ Operating System: 32-bit
~ Boot mode: Normal (Normal boot)
Total RAM: 2088.5 MB (15% free)
~ System Restore: Activé (Enable)
~ System drive C: has 14 GB free of 50 GB

---\\ Connection to the system mode (3) - 0s
~ Computer Name: HAMHARIYGOOD
~ User Name: samy
~ Logged in as Administrator

---\\ Enumeration of the disk units (4) - 5s
~ Drive C: has 14 GB free of 50 GB (System)
~ Drive E: has 45 GB free of 90 GB
~ Drive F: has 11 GB free of 96 GB
~ Drive G: has 0 GB free of 0 GB

---\\ Search Generic System Files (22) - 2s
[MD5.C17698AC70C3BF10B13102AFF44BBBA7] - (.Microsoft Corporation - Windows Explorer.) () -- C:\WINDOWS\Explorer.exe [4043800]
[MD5.71C501A0AB1B76BB0DC19D611AF0C47D] - (.Microsoft Corporation - Windows host process (Rundll32).) () -- C:\WINDOWS\System32\rundll32.exe [53760]
[MD5.A8D7B907236309FBF2C0371065D98BF0] - (.Microsoft Corporation - Windows Start-Up Application.) () -- C:\WINDOWS\System32\Wininit.exe [191272]
[MD5.93021542DAD22EC64CD104A0B935DA78] - (.Microsoft Corporation - Internet Extensions for Win32.) () -- C:\WINDOWS\System32\wininet.dll [2201600]
[MD5.5F256EB3DFCEDF9B5128F360C8B93363] - (.Microsoft Corporation - Windows Logon Application.) () -- C:\WINDOWS\System32\Winlogon.exe [492032]
[MD5.0D3ADE16F53EDCB8DCE2876C80A5A99B] - (.Microsoft Corporation - Software Licensing Library.) () -- C:\WINDOWS\System32\sppcomapi.dll [418304]
[MD5.E14559C9D5FEC7C5F0CB47F7E3A92497] - (.Microsoft Corporation - Ancillary Function Driver for WinSock.) () -- C:\WINDOWS\System32\drivers\AFD.sys [478696]
[MD5.1BF33ECC95D6C972D2799C2FE05E5244] - (.Microsoft Corporation - ATAPI IDE Miniport Driver.) () -- C:\WINDOWS\System32\drivers\atapi.sys [23528]
[MD5.0DDF6AB0EF4B0E495D331895ABACBF84] - (.Microsoft Corporation - CD-ROM File System Driver.) () -- C:\WINDOWS\System32\drivers\Cdfs.sys [74752]
[MD5.E133EA7F4813380C2D336E6ACA283A9F] - (.Microsoft Corporation - SCSI CD-ROM Driver.) () -- C:\WINDOWS\System32\drivers\Cdrom.sys [130560]
[MD5.A0B8F3D65119E21D4664CD3DB40D75FB] - (.Microsoft Corporation - DFS Namespace Client Driver.) () -- C:\WINDOWS\System32\drivers\DfsC.sys [104960]
[MD5.E7D9F01A078ED8834ABCAA73E39C4B1A] - (.Microsoft Corporation - High Definition Audio Bus Driver.) () -- C:\WINDOWS\System32\drivers\HDAudBus.sys [72704]
[MD5.504DD70B1507D8D6FB645F9D831A36A1] - (.Microsoft Corporation - i8042 Port Driver.) () -- C:\WINDOWS\System32\drivers\i8042prt.sys [91136]
[MD5.3B6D822F5228970E2C875D6AC69E3FBC] - (.Microsoft Corporation - IP Network Address Translator.) () -- C:\WINDOWS\System32\drivers\IpNat.sys [124416]
[MD5.C044E63CD3B22EEF7F315C6A632CE84B] - (.Microsoft Corporation - Windows NT SMB Minirdr.) () -- C:\WINDOWS\System32\drivers\MRxSmb.sys [342528]
[MD5.F9B44D742B44C481829E4A1223262279] - (.Microsoft Corporation - MBT Transport driver.) () -- C:\WINDOWS\System32\drivers\netBT.sys [211968]
[MD5.F6B0444E87EC8F7388319D818FDFAFA6] - (.Microsoft Corporation - NT File System Driver.) () -- C:\WINDOWS\System32\drivers\ntfs.sys [1802216]
[MD5.F9D5EE0F5514B86ABA9F206B5D77D168] - (.Microsoft Corporation - Parallel Port Driver.) () -- C:\WINDOWS\System32\drivers\Parport.sys [81408]
[MD5.C67711CDA3746794443DC6230B72DA9A] - (.Microsoft Corporation - RAS L2TP mini-port/call-manager driver.) () -- C:\WINDOWS\System32\drivers\Rasl2tp.sys [81408]
[MD5.8DB27F73A186F76F8604292079BA7BE1] - (.Microsoft Corporation - Microsoft RDP Device redirector.) () -- C:\WINDOWS\System32\drivers\rdpdr.sys [132608]
[MD5.E02F511D18C0FC2F70BB8DF29BBC9737] - (.Microsoft Corporation - TDI Translation Driver.) () -- C:\WINDOWS\System32\drivers\tdx.sys [94184]
[MD5.9EAC4218D13B5CA0EC5A9984AC54C5EB] - (.Microsoft Corporation - Volume Shadow Copy Driver.) () -- C:\WINDOWS\System32\drivers\volsnap.sys [342504]

---\\ Process running (24) - 7s
[MD5.97715B4295C74B4D55B3445EEB9BD1F1] - (.BlueStack Systems, Inc. - BlueStacks Updater Service.) -- C:\Program Files\BlueStacks\HD-UpdaterService.exe [822904] [PID.768]
[MD5.95B960980034877821E7FB5BFE25136E] - (.BlueStack Systems, Inc. - BlueStacks Log Rotator Service.) -- C:\Program Files\BlueStacks\HD-LogRotatorService.exe [413304] [PID.824]
[MD5.FB51E8E39E3FDB6757874653B743BE72] - (.ESET - ESET Service.) -- C:\Program Files\ESET\ESET Smart Security\ekrn.exe [1349576] [PID.2128]
[MD5.6106526CA0AB6DFE788BDB29C98B5004] - (.Copyright (C) 2012-2013 - .) -- C:\Windows\runSW.exe [44104] [PID.2412]
[MD5.439BD966130226F464DC15F55ABD266E] - (.TechSmith Corporation - TechSmith Uploader Service.) -- C:\Program Files\Common Files\TechSmith Shared\Uploader\UploaderService.exe [3408384] [PID.2520]
[MD5.EC5D6E0B2AF375CF5BFA947F34A5F441] - (.VMware, Inc. - VMware VMnet DHCP service.) -- C:\Windows\System32\vmnetdhcp.exe [334384] [PID.2544]
[MD5.346AF8B2BE7E2E349B0FCA70C55CAC03] - (.VMware, Inc. - VMware USB Arbitration Service.) -- C:\Program Files\Common Files\VMware\USB\vmware-usbarbitrator.exe [563760] [PID.2552]
[MD5.E51474E134E5915ACBCD2CB26FAE5473] - (.VMware, Inc. - VMware Authorization Service.) -- E:\hamza\vmware-authd.exe [113200] [PID.2624]
[MD5.665BB54CBA86378D99328EFF57F0406C] - (.VMware, Inc. - VMware NAT Service.) -- C:\Windows\System32\vmnat.exe [395824] [PID.2788]
[MD5.755B9539021C26749F3234DF8B8A4788] - (.Copyright (C) 2012~2013 - .) -- C:\Program Files\Edimax\Edimax AC1200 Wireless LAN Driver\WPSService20.exe [96768] [PID.2844]
[MD5.349173F7D5763B2AD3F749C94187A418] - (.Smadsoft - Smadav USB Antivirus & Additional Protectio.) -- C:\Program Files\SMADAV\SM?RTP.exe [1630208] [PID.5016]
[MD5.89DEEECC036CF21CB954E2148ECA801D] - (.Realtek Semiconductor - Realtek HD Audio Manager.) -- C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [12336856] [PID.4504]
[MD5.B4809A4050B208CEF4FA50F626C7DCFA] - (.VMware, Inc. - VMware Host Network Access Status Tray Appl.) -- E:\hamza\hqtray.exe [64048] [PID.5528]
[MD5.EF3E22DB024654232D9232CD16D37615] - (.BlueStack Systems, Inc. - BlueStacks Agent.) -- C:\Program Files\BlueStacks\HD-Agent.exe [888440] [PID.4568]
[MD5.107AFCBC31E25314E56B69EEC25885BD] - (.ESET - ESET Main GUI.) -- C:\Program Files\ESET\ESET Smart Security\egui.exe [5088456] [PID.7880]
[MD5.3AE97CB476F6DF4DFA0B4378E9DD9A81] - (.Tonec Inc. - Internet Download Manager (IDM).) -- C:\Program Files\Internet Download Manager\IDMan.exe [3898960] [PID.8100]
[MD5.1F9D6BB3D93BD59285BED8BE26757C7C] - (. - Viber.) -- C:\Users\samy\AppData\Local\Viber\Viber.exe [80035536] [PID.5128]
[MD5.4D3FA23829B4AE3A0563113716259AC9] - (.TechSmith Corporation - Snagit.) -- C:\Program Files\TechSmith\Snagit 12\Snagit32.exe [7434560] [PID.3068]
[MD5.84289E333459DD1C5E9F2DC204FB1608] - (.TechSmith Corporation - Snagit RPC Helper.) -- C:\Program Files\TechSmith\Snagit 12\SnagPriv.exe [151872] [PID.3028]
[MD5.E9C6EF9437ECB30911488F9313AD821A] - (.Tonec Inc. - Internet Download Manager agent for click m.) -- C:\Program Files\Internet Download Manager\IEMonitor.exe [269848] [PID.1032]
[MD5.4AAA6D76DA9A243A4A6FC499EEC1C4A4] - (.Realtek - Switch USB2.0/USB3.0 for WinXP SP2+ ~ Win8.) -- C:\Windows\SwUSB.exe [445512] [PID.7312]
[MD5.0A1810F3CF866F67856C8A4E98194493] - (.TechSmith Corporation - TechSmith HTML Help Helper.) -- C:\Program Files\TechSmith\Snagit 12\TscHelp.exe [46080] [PID.7676]
[MD5.749A4EA9D92161BDA3CD59BBF6706949] - (.TechSmith Corporation - Snagit Editor.) -- C:\Program Files\TechSmith\Snagit 12\snagiteditor.exe [8604992] [PID.4948]
[MD5.59499B4B9127191704FAAF58E220F85D] - (.Internet Download Manager, Tonec Inc. - Broker for reading of IDM settings.) -- C:\Program Files\Internet Download Manager\idmBroker.exe [69144] [PID.3760]

---\\ Google Chrome, Start,Search,Extensions (G0,G1,G2) (20) - 1s
G0 - GCSP: Secure Preferences [User Data\Default][HomePage] http://www.google.com/
G0 - GCSP: Secure Preferences [User Data\Default][HomePage] http://www.trovigo.com/ =>PUP.Optional.Trovigo
G0 - GCSP: Secure Preferences [User Data\Default][HomePage] http://www.arabyonline.com/ =>Trojan.Vonteera
G0 - GCSP: Secure Preferences [User Data\Default][HomePage] http://arabia.msn.com/
G0 - GCSP: Secure Preferences [User Data\Default][HomePage] http://www.istartsurf.com/ =>PUP.Optional.IsStart
G2 - GCE: Preference [User Data\Default] [aapocclcgogkmnckokdopfmhonfmgoek] Google Chrome manifest =>.Google Inc.
G2 - GCE: Preference [User Data\Default] [aohghmighlieiainnegkcijnfilokake] Google Chrome manifest =>.Google Inc.
G2 - GCE: Preference [User Data\Default] [apdfllckaahabafndbhieahigkjlhalf] Google Chrome manifest =>.Google Inc.
G2 - GCE: Preference [User Data\Default] [bgbojmobaekecckmomemopckmeipecij] __MSG_extension_name__
G2 - GCE: Preference [User Data\Default] [bibbkdilejnhmpilleppebbkmcnknfli] Image Dictionary
G2 - GCE: Preference [User Data\Default] [blpcfgokakmgnkcojhhkbfbldkacnbeo] Google Chrome manifest =>.Google Inc.
G2 - GCE: Preference [User Data\Default] [chphlpgkkbolifaimnlloiipkdnihall] OneTab
G2 - GCE: Preference [User Data\Default] [coobgpohoikkiipiblmjeljniedjpjpf] Google Chrome manifest =>.Google Inc.
G2 - GCE: Preference [User Data\Default] [felcaaldnbdncclmgdcncolpebgiejap] Google Chrome manifest =>.Google Inc.
G2 - GCE: Preference [User Data\Default] [gighmmpiobklfepjocnamgkkbiglidom] AdBlock
G2 - GCE: Preference [User Data\Default] [klbibkeccnjlkjkiokjodocebajanakg] The Great Suspender
G2 - GCE: Preference [User Data\Default] [ngpampappnmepgilojfohadhhmbhlaek] IDM Integration Module
G2 - GCE: Preference [User Data\Default] [nmgcfemagnogdodbambjhdcmfcpicngl] Norton Safe
G2 - GCE: Preference [User Data\Default] [nmmhkkegccagdldgiimedpiccmgmieda] Google Chrome manifest =>.Google Inc.
G2 - GCE: Preference [User Data\Default] [pjkljhegncpnkpknbcohdijeoejaedia] Google Chrome manifest =>.Google Inc.

---\\ Internet Explorer Extensions, Start, Search (R4,R3,R0,R1) (9) - 0s
R0 - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com/
R0 - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/
R1 - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/
R1 - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/
R1 - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/
R1 - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:noadd-ons
R1 - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:securityrisk
R1 - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/
R3 - URLSearchHook: (no name) - {CFBFAE00-17A6-11D0-99CB-00C04FD64497} Orphean =>.Microsoft Internet Explorer

---\\ Internet Explorer, Proxy Management (R5) (4) - 0s
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,MigrateProxy = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,EnableHttp1_1 = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyHttp1.1 = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigProxy = wininet.dll

---\\ Line Analysis F0, F1, F2, F3 - IniFiles, Auto loading programs (3) - 1s
F2 - REG:system.ini: UserInit=C:\Windows\system32\userinit.exe (.Microsoft Corporation.)
F2 - REG:system.ini: Shell=C:\WINDOWS\explorer.exe (.Microsoft Corporation.)
F2 - REG:system.ini: VMApplet=C:\WINDOWS\system32\SystemPropertiesPerformance.exe (.Microsoft Corporation.)

---\\ Hosts file redirection (O1) (1) - 0s
~ Le fichier hôte est sain (The hosts file is clean) (21)

---\\ Browser Helper Object (BHO) (O2) (1) - 0s
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} . (.Internet Download Manager, Tonec Inc. - IDM Browser Helper Object.) -- C:\Program Files\Internet Download Manager\IDMIECC.dll

---\\ Auto loading programs from Registry and folders (O4) (18) - 1s
O4 - HKLM\..\Run: [RTHDVCPL] . (.Realtek Semiconductor - Realtek HD Audio Manager.) -- C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
O4 - HKLM\..\Run: [VMware hqtray] . (.VMware, Inc. - VMware Host Network Access Status Tray Appl.) -- E:\hamza\hqtray.exe
O4 - HKLM\..\Run: [BlueStacks Agent] . (.BlueStack Systems, Inc. - BlueStacks Agent.) -- C:\Program Files\BlueStacks\HD-Agent.exe
O4 - HKLM\..\Run: [egui] . (.ESET - ESET Main GUI.) -- C:\Program Files\ESET\ESET Smart Security\egui.exe
O4 - HKCU\..\Run: [Skype] . (.Skype Technologies S.A. - Skype.) -- C:\Program Files\Skype\Phone\Skype.exe
O4 - HKCU\..\Run: [BingSvc] . (.© 2015 Microsoft Corporation - Microsoft Bing Service.) -- C:\Users\samy\AppData\Local\Microsoft\BingSvc\BingSvc.exe
O4 - HKCU\..\Run: [IDMan] . (.Tonec Inc. - Internet Download Manager (IDM).) -- C:\Program Files\Internet Download Manager\IDMan.exe
O4 - HKCU\..\Run: [OneDrive] . (.Microsoft Corporation - Microsoft OneDrive.) -- C:\Users\samy\AppData\Local\Microsoft\OneDrive\OneDrive.exe
O4 - HKCU\..\Run: [GoogleChromeAutoLaunch_1B84C0C1EC1010B72EBDFEC4964B253E] . (.Google Inc. - Google Chrome.) -- C:\Program Files\Google\Chrome\Application\chrome.exe
O4 - HKCU\..\Run: [Viber] . (. - Viber.) -- C:\Users\samy\AppData\Local\Viber\Viber.exe
O4 - HKUS\S-1-5-19\..\Run: [OneDriveSetup] . (.Microsoft Corporation - Microsoft OneDrive Setup.) -- C:\Windows\System32\OneDriveSetup.exe
O4 - HKUS\S-1-5-20\..\Run: [OneDriveSetup] . (.Microsoft Corporation - Microsoft OneDrive Setup.) -- C:\Windows\System32\OneDriveSetup.exe
O4 - HKUS\S-1-5-21-2935308778-1239240103-3368453402-1001\..\Run: [Skype] . (.Skype Technologies S.A. - Skype.) -- C:\Program Files\Skype\Phone\Skype.exe
O4 - HKUS\S-1-5-21-2935308778-1239240103-3368453402-1001\..\Run: [BingSvc] . (.© 2015 Microsoft Corporation - Microsoft Bing Service.) -- C:\Users\samy\AppData\Local\Microsoft\BingSvc\BingSvc.exe
O4 - HKUS\S-1-5-21-2935308778-1239240103-3368453402-1001\..\Run: [IDMan] . (.Tonec Inc. - Internet Download Manager (IDM).) -- C:\Program Files\Internet Download Manager\IDMan.exe
O4 - HKUS\S-1-5-21-2935308778-1239240103-3368453402-1001\..\Run: [OneDrive] . (.Microsoft Corporation - Microsoft OneDrive.) -- C:\Users\samy\AppData\Local\Microsoft\OneDrive\OneDrive.exe
O4 - HKUS\S-1-5-21-2935308778-1239240103-3368453402-1001\..\Run: [GoogleChromeAutoLaunch_1B84C0C1EC1010B72EBDFEC4964B253E] . (.Google Inc. - Google Chrome.) -- C:\Program Files\Google\Chrome\Application\chrome.exe
O4 - HKUS\S-1-5-21-2935308778-1239240103-3368453402-1001\..\Run: [Viber] . (. - Viber.) -- C:\Users\samy\AppData\Local\Viber\Viber.exe

---\\ Global shortcuts Startup (O4G) (5) - 5s
O4 - GS\Quicklaunch [__vmware_user__]: QQPlayer.lnk . (.Tencent Technology Company limited - QQ Player.) C:\Program Files\Tencent\QQPlayer\QQPlayer.exe =>PUP.Optional.TencentAddressBar
O4 - GS\Quicklaunch [Administrator]: QQPlayer.lnk . (.Tencent Technology Company limited - QQ Player.) C:\Program Files\Tencent\QQPlayer\QQPlayer.exe =>PUP.Optional.TencentAddressBar
O4 - GS\Quicklaunch [DefaultAccount]: QQPlayer.lnk . (.Tencent Technology Company limited - QQ Player.) C:\Program Files\Tencent\QQPlayer\QQPlayer.exe =>PUP.Optional.TencentAddressBar
O4 - GS\Quicklaunch [Guest]: QQPlayer.lnk . (.Tencent Technology Company limited - QQ Player.) C:\Program Files\Tencent\QQPlayer\QQPlayer.exe =>PUP.Optional.TencentAddressBar
O4 - GS\Quicklaunch [samy]: QQPlayer.lnk . (.Tencent Technology Company limited - QQ Player.) C:\Program Files\Tencent\QQPlayer\QQPlayer.exe =>PUP.Optional.TencentAddressBar

---\\ Lop.com/Domain Hijackers (O17) (2) - 0s
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1

---\\ Non Microsoft non disabled Windows XP/NT/2000 Services (O23) (15) - 3s
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) . (.Adobe Systems Incorporated - Adobe Acrobat Update Service.) - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: BlueStacks Log Rotator Service (BstHdLogRotatorSvc) . (.BlueStack Systems, Inc. - BlueStacks Log Rotator Service.) - C:\Program Files\BlueStacks\HD-LogRotatorService.exe
O23 - Service: BlueStacks Updater Service (BstHdUpdaterSvc) . (.BlueStack Systems, Inc. - BlueStacks Updater Service.) - C:\Program Files\BlueStacks\HD-UpdaterService.exe
O23 - Service: ESET Service (ekrn) . (.ESET - ESET Service.) - C:\Program Files\ESET\ESET Smart Security\ekrn.exe
O23 - Service: ÎÏãÉ Google Update (gupdate) (gupdate) . (.Google Inc. - Google Installer.) - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: MBAMScheduler (MBAMScheduler) . (.Malwarebytes Corporation - Malwarebytes Anti-Malware.) - C:\Program Files\Malwarebytes Anti-Malware\mbamscheduler.exe
O23 - Service: MBAMService (MBAMService) . (.Malwarebytes Corporation - Malwarebytes Anti-Malware.) - C:\Program Files\Malwarebytes Anti-Malware\mbamservice.exe
O23 - Service: RunSwUSB (RunSwUSB) . (.Copyright (C) 2012-2013 - .) - C:\Windows\runSW.exe
O23 - Service: Skype Updater (SkypeUpdate) . (.Skype Technologies - Skype Updater Service.) - C:\Program Files\Skype\Updater\Updater.exe
O23 - Service: TechSmith Uploader Service (TechSmith Uploader Service) . (.TechSmith Corporation - TechSmith Uploader Service.) - C:\Program Files\Common Files\TechSmith Shared\Uploader\UploaderService.exe
O23 - Service: VMware Authorization Service (VMAuthdService) . (.VMware, Inc. - VMware Authorization Service.) - E:\hamza\vmware-authd.exe
O23 - Service: VMware DHCP Service (VMnetDHCP) . (.VMware, Inc. - VMware VMnet DHCP service.) - C:\Windows\System32\vmnetdhcp.exe
O23 - Service: VMware USB Arbitration Service (VMUSBArbService) . (.VMware, Inc. - VMware USB Arbitration Service.) - C:\Program Files\Common Files\VMware\USB\vmware-usbarbitrator.exe
O23 - Service: VMware NAT Service (VMware NAT Service) . (.VMware, Inc. - VMware NAT Service.) - C:\Windows\System32\vmnat.exe
O23 - Service: WPS2.0 HW PBC Service (WPSService20) . (.Copyright (C) 2012~2013 - .) - C:\Program Files\Edimax\Edimax AC1200 Wireless LAN Driver\WPSService20.exe

---\\ Task Planned Automatically (O39) (27) - 6s
[MD5.E3FB05F33E1404AD606B1E1FE7C323C3] [APT] [Adobe Acrobat Update Task] (.Adobe Systems Incorporated.) -- C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [998104]
[MD5.DD3A4BEBE7EA3E75F71F3D9E9E2AA016] [APT] [AutoKMS] (.CODYQX4.) -- C:\Windows\AutoKMS\AutoKMS.exe [3798528] =>HackTool.AutoKMS
[MD5.00000000000000000000000000000000] [APT] [Driver Booster SkipUAC (samy)] (.CODYQX4.) -- C:\Program Files\IObit\Driver Booster\DriverBooster.exe (.not file.) [0] =>HackTool.AutoKMS
[MD5.00000000000000000000000000000000] [APT] [Driver Booster Update] (.CODYQX4.) -- C:\Users\samy\Desktop\s8fmi.IObit.Driver.Booster.Pro.2.4.0.19..Portable.Multilingual_2\s8fmi.IObit.Driver.Booster.Pro.2.4.0.19..Portable.Multilingual\App\Driver Booster\AutoUpdate.exe (.not file.) [0] =>HackTool.AutoKMS
[MD5.00000000000000000000000000000000] [APT] [DriverNavigator Scheduled Scan] (.CODYQX4.) -- C:\Program Files\Easeware\DriverNavigator\DriverNavigator.exe (.not file.) [0] =>HackTool.AutoKMS
[MD5.00000000000000000000000000000000] [APT] [DriverToolkit Autorun] (.CODYQX4.) -- C:\Program Files\DriverToolkit\DriverToolkit.exe (.not file.) [0] =>HackTool.AutoKMS
[MD5.E1B44A75947137F4143308D566889837] [APT] [GoogleUpdateTaskMachineCore] (.Google Inc..) -- C:\Program Files\Google\Update\GoogleUpdate.exe [107848]
[MD5.E1B44A75947137F4143308D566889837] [APT] [GoogleUpdateTaskMachineUA] (.Google Inc..) -- C:\Program Files\Google\Update\GoogleUpdate.exe [107848]
[MD5.00000000000000000000000000000000] [APT] [smadav] (.Authors.) -- C:\Program Files\Smadav\SM?RTP.exe [1630208]
[MD5.E0DEBE808C0FC71F6CAAB979547F84CD] [APT] [TechSmith Updater] (.TechSmith Corporation.) -- C:\Program Files\Common Files\TechSmith Shared\Updater\TSCUpdClt.exe [56704]
[MD5.00000000000000000000000000000000] [APT] [Windows 10 Manager - Privacy Protector] (.TechSmith Corporation.) -- C:\Program Files\Yamicsoft\Windows 10 Manager\PrivacyProtector.exe (.not file.) [0]
O39 - APT: Automatic Planified Task - (...) -- C:\WINDOWS\Tasks\CreateExplorerShellUnelevatedTask.job [214]
O39 - APT: DriverNavigator Scheduled Scan - (.CODYQX4.) -- C:\WINDOWS\Tasks\DriverNavigator Scheduled Scan.job [460] =>HackTool.AutoKMS
O39 - APT: DriverToolkit Autorun - (.CODYQX4.) -- C:\WINDOWS\Tasks\DriverToolkit Autorun.job [370] =>HackTool.AutoKMS
O39 - APT: GoogleUpdateTaskMachineCore - (.Google Inc..) -- C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job [916]
O39 - APT: GoogleUpdateTaskMachineUA - (.Google Inc..) -- C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job [920]
O39 - APT: Windows 10 Manager - Privacy Protector - (.TechSmith Corporation.) -- C:\WINDOWS\Tasks\Windows 10 Manager - Privacy Protector.job [322]
O39 - APT: Adobe Acrobat Update Task - (.Adobe Systems Incorporated.) -- C:\WINDOWS\System32\Tasks\Adobe Acrobat Update Task [3960]
O39 - APT: AutoKMS - (.CODYQX4.) -- C:\WINDOWS\System32\Tasks\AutoKMS [3808] =>HackTool.AutoKMS
O39 - APT: Driver Booster SkipUAC (samy) - (.CODYQX4.) -- C:\WINDOWS\System32\Tasks\Driver Booster SkipUAC (samy) [3062] =>HackTool.AutoKMS
O39 - APT: DriverNavigator Scheduled Scan - (.CODYQX4.) -- C:\WINDOWS\System32\Tasks\DriverNavigator Scheduled Scan [3956] =>HackTool.AutoKMS
O39 - APT: DriverToolkit Autorun - (.CODYQX4.) -- C:\WINDOWS\System32\Tasks\DriverToolkit Autorun [2824] =>HackTool.AutoKMS
O39 - APT: GoogleUpdateTaskMachineCore - (.Google Inc..) -- C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineCore [3746]
O39 - APT: GoogleUpdateTaskMachineUA - (.Google Inc..) -- C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineUA [3978]
O39 - APT: smadav - (.Authors.) -- C:\WINDOWS\System32\Tasks\smadav [3262]
O39 - APT: TechSmith Updater - (.TechSmith Corporation.) -- C:\WINDOWS\System32\Tasks\TechSmith Updater [3898]
O39 - APT: Windows 10 Manager - Privacy Protector - (.TechSmith Corporation.) -- C:\WINDOWS\System32\Tasks\Windows 10 Manager - Privacy Protector [2712]

---\\ Software installed (O42) (32) - 16s
O42 - Logiciel: BlueStacks App Player - (.BlueStack Systems, Inc..) [HKLM] -- BlueStacks App Player
O42 - Logiciel: FileViewPro - (.Solvusoft Corporation.) [HKLM] -- FileViewPro_is1
O42 - Logiciel: Google Chrome - (.Google Incý.ý.) [HKLM] -- Google Chrome
O42 - Logiciel: Hard Disk Low Level Format Tool 4.25 - (.HDDGURU.) [HKLM] -- Hard Disk Low Level Format Tool_is1
O42 - Logiciel: HD Tune Pro 5.50 - (.EFD Software.) [HKLM] -- HD Tune Pro_is1
O42 - Logiciel: Internet Download Manager - (.Tonec Inc..) [HKLM] -- Internet Download Manager
O42 - Logiciel: Malwarebytes Anti-Malware version 2.1.8.1057 - (.Malwarebytes Corporation.) [HKLM] -- Malwarebytes Anti-Malware_is1
O42 - Logiciel: SoftOrbits Flash Drive Recovery 2.3 - (.SoftOrbits.) [HKLM] -- SoftOrbits Flash Drive Recovery_is1
O42 - Logiciel: UltraISO Premium V9.62 - (...) [HKLM] -- UltraISO_is1
O42 - Logiciel: VMware Player - (.VMware, Inc.) [HKLM] -- VMware_Player
O42 - Logiciel: WinRAR 5.21 (32-bit) - (.win.rar GmbH.) [HKLM] -- WinRAR archiver
O42 - Logiciel: HDD Regenerator - (.Abstradrome.) [HKLM] -- {2445981B-A23B-4A0E-AD15-3D391BDAEC3E}
O42 - Logiciel: Skype™ 7.6 - (.Skype Technologies S.A..) [HKLM] -- {24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}
O42 - Logiciel: BlueStacks Notification Center - (.BlueStack Systems, Inc..) [HKLM] -- {3792811C-832F-4392-B44A-24092901EDDC}
O42 - Logiciel: Snagit 12 - (.TechSmith Corporation.) [HKLM] -- {50f2d2b0-9e6e-466f-b418-b3526b61aa3f}
O42 - Logiciel: Snagit 12 - (.TechSmith Corporation.) [HKLM] -- {588591F5-74D7-4646-87C5-6A07E526F303}
O42 - Logiciel: Google Update Helper - (.Google Inc..) [HKLM] -- {60EC980A-BDA2-4CB6-A427-B07A5498B4CA}
O42 - Logiciel: Revo Uninstaller Pro 3.0.2 - (.VS Revo Group, Ltd..) [HKLM] -- {67579783-0FB7-4F7B-B881-E5BE47C9DBE0}_is1
O42 - Logiciel: Skype Click to Call - (.Microsoft Corporation.) [HKLM] -- {6D1221A9-17BF-4EC0-81F2-27D30EC30701}
O42 - Logiciel: SMADAV version 10.1.1 - (.SmadSoft.) [HKLM] -- {8B9FA5FF-3E61-4658-B0DA-E6DDB46D6BAD}_is1
O42 - Logiciel: Eassos PartitionGuru Free 3.7.0 - (.Eassos Co., Ltd..) [HKLM] -- {971F12D0-D834-4BAC-BD22-8769EBA08106}_is1
O42 - Logiciel: VMware Player - (.VMware, Inc..) [HKLM] -- {A53A11EA-0095-493F-86FA-A15E8A86A405}
O42 - Logiciel: Adobe Refresh Manager - (.Adobe Systems Incorporated.) [HKLM] -- {AC76BA86-0804-1033-1959-001824147215}
O42 - Logiciel: Adobe Reader XI (11.0.12) - (.Adobe Systems Incorporated.) [HKLM] -- {AC76BA86-7AD7-1033-7B44-AB0000000001}
O42 - Logiciel: @BIOS - (.GIGABYTE.) [HKLM] -- {B2DC3F08-2EB2-49A5-AA24-15DFC8B1CB83}
O42 - Logiciel: Edimax AC1200 Wireless LAN Driver - (.Edimax Technology Co..) [HKLM] -- {B63CCD1C-A133-4DF8-8306-DA0387231152}
O42 - Logiciel: ESET Smart Security - (.ESET, spol s r. o..) [HKLM] -- {D66C9F03-5F7C-4A4F-A4D0-7D04FCD426AE}
O42 - Logiciel: Oracle VM VirtualBox 4.3.12_ZZZZ - (.Oracle Corporation.) [HKLM] -- {D90E08B8-E7BB-4D29-8249-8670D4CC24BD}
O42 - Logiciel: Realtek High Definition Audio Driver - (.Realtek Semiconductor Corp..) [HKLM] -- {F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}
O42 - Logiciel: tools-windows - (.VMware, Inc..) [HKLM] -- {FFD9383C-01D5-4897-A954-43AF599AED30}
O42 - Logiciel: QQ??3.7 - (.????(??)????.) [HKCU] -- QQPlayer
O42 - Logiciel: Viber - (.Viber Media Inc.) [HKCU] -- Viber

---\\ HKCU & HKLM Software Keys (90) - 17s
HKLM\SOFTWARE\Adobe
HKLM\SOFTWARE\Belarc
HKLM\SOFTWARE\BlueStacks
HKLM\SOFTWARE\CA561A
HKLM\SOFTWARE\Chicony
HKLM\SOFTWARE\CyberLink
HKLM\SOFTWARE\Dolby
HKLM\SOFTWARE\EasyBoot Systems
HKLM\SOFTWARE\Edimax Technology Co.
HKLM\SOFTWARE\ESET
HKLM\SOFTWARE\GIGABYTE
HKLM\SOFTWARE\Google
HKLM\SOFTWARE\HaaliMkx
HKLM\SOFTWARE\IM Providers
HKLM\SOFTWARE\Intel
HKLM\SOFTWARE\Internet Download Manager
HKLM\SOFTWARE\IObit
HKLM\SOFTWARE\Knowles
HKLM\SOFTWARE\Licenses
HKLM\SOFTWARE\Macromedia
HKLM\SOFTWARE\MozillaPlugins
HKLM\SOFTWARE\Nahimic
HKLM\SOFTWARE\Nuance
HKLM\SOFTWARE\ODBC
HKLM\SOFTWARE\OEM
HKLM\SOFTWARE\Oracle
HKLM\SOFTWARE\Partner
HKLM\SOFTWARE\Realtek
HKLM\SOFTWARE\RegisteredApplications
HKLM\SOFTWARE\RtWLan
HKLM\SOFTWARE\Skype
HKLM\SOFTWARE\SRS Labs
HKLM\SOFTWARE\SUPERAntiSpyware.com
HKLM\SOFTWARE\SwUSB
HKLM\SOFTWARE\TechSmith
HKLM\SOFTWARE\Tencent =>PUP.Optional.TencentAddressBar
HKLM\SOFTWARE\ThinPrint
HKLM\SOFTWARE\Ubisoft
HKLM\SOFTWARE\VMware, Inc.
HKLM\SOFTWARE\Volatile
HKLM\SOFTWARE\Waves Audio
HKLM\SOFTWARE\Windows
HKLM\SOFTWARE\WinRAR
HKCU\SOFTWARE\8GadgetPack
HKCU\SOFTWARE\Adobe
HKCU\SOFTWARE\Anvisoft
HKCU\SOFTWARE\AppDataLow
HKCU\SOFTWARE\Clipboarder
HKCU\SOFTWARE\CompSoft
HKCU\SOFTWARE\CoreAAC
HKCU\SOFTWARE\CyberLink
HKCU\SOFTWARE\DownloadManager
HKCU\SOFTWARE\DriverToolkit
HKCU\SOFTWARE\DSP-worx
HKCU\SOFTWARE\EasyBoot Systems
HKCU\SOFTWARE\EFD Software
HKCU\SOFTWARE\ESET
HKCU\SOFTWARE\Gabest
HKCU\SOFTWARE\Google
HKCU\SOFTWARE\HashTab
HKCU\SOFTWARE\IM Providers
HKCU\SOFTWARE\Intel
HKCU\SOFTWARE\LockHunter
HKCU\SOFTWARE\Macromedia
HKCU\SOFTWARE\Mine
HKCU\SOFTWARE\Mirage
HKCU\SOFTWARE\Mozilla
HKCU\SOFTWARE\MozillaPlugins
HKCU\SOFTWARE\Netscape
HKCU\SOFTWARE\QtProject
HKCU\SOFTWARE\Realtek
HKCU\SOFTWARE\RegisteredApplications
HKCU\SOFTWARE\Skype
HKCU\SOFTWARE\SMAD?V
HKCU\SOFTWARE\softorbits
HKCU\SOFTWARE\SUPERAntiSpyware.com
HKCU\SOFTWARE\TechSmith
HKCU\SOFTWARE\TempCleaner
HKCU\SOFTWARE\Tencent =>PUP.Optional.TencentAddressBar
HKCU\SOFTWARE\Ubisoft
HKCU\SOFTWARE\Viber
HKCU\SOFTWARE\VMware, Inc.
HKCU\SOFTWARE\VS Revo Group
HKCU\SOFTWARE\WinRAR
HKCU\SOFTWARE\WinRAR SFX
HKCU\SOFTWARE\Yamicsoft
HKCU\SOFTWARE\ZebHelpProcess Helper
HKCU\SOFTWARE\ZRT Labs
HKCU\SOFTWARE\AppDataLow\Software
HKCU\SOFTWARE\AppDataLow\Software\ThinPrint

---\\ Contents of the Common Files folders (O43) (208) - 17s
O43 - CFD: 2015/06/16 16:24:31 - [] D -- C:\Program Files\Adobe
O43 - CFD: 2015/07/11 14:48:30 - [] D -- C:\Program Files\BlueStacks
O43 - CFD: 2015/07/17 17:26:47 - [] D -- C:\Program Files\CalendarTool
O43 - CFD: 2015/07/17 19:38:50 - [0] D -- C:\Program Files\CinemaP-1.9cV17.07 =>PUP.Optional.CrossRider
O43 - CFD: 2015/07/13 21:42:17 - [] D -- C:\Program Files\Common Files
O43 - CFD: 2015/07/17 19:38:50 - [] D -- C:\Program Files\DownChecker
O43 - CFD: 2015/07/12 14:21:19 - [] D -- C:\Program Files\Droid4Xext
O43 - CFD: 2015/06/17 12:16:52 - [] D -- C:\Program Files\Edimax
O43 - CFD: 2015/06/18 18:03:34 - [] D -- C:\Program Files\ESET
O43 - CFD: 2015/07/18 17:02:46 - [] D -- C:\Program Files\FileViewPro
O43 - CFD: 2015/07/14 03:49:38 - [0] D -- C:\Program Files\Flobo Hard Disk Repair
O43 - CFD: 2015/07/16 09:51:17 - [] D -- C:\Program Files\Genymobile
O43 - CFD: 2015/06/19 20:23:25 - [] D -- C:\Program Files\GIGABYTE
O43 - CFD: 2015/07/05 02:59:37 - [] D -- C:\Program Files\Google
O43 - CFD: 2015/06/21 08:00:47 - [] D -- C:\Program Files\HD Tune Pro
O43 - CFD: 2015/06/26 20:33:46 - [] D -- C:\Program Files\HDD Regenerator
O43 - CFD: 2015/06/20 18:16:02 - [] D -- C:\Program Files\HDDGURU LLF Tool
O43 - CFD: 2015/06/19 20:23:24 - [] HD -- C:\Program Files\InstallShield Installation Information
O43 - CFD: 2015/06/17 00:24:04 - [] D -- C:\Program Files\Internet Download Manager
O43 - CFD: 2015/07/14 16:47:43 - [] D -- C:\Program Files\Internet Explorer
O43 - CFD: 2015/07/05 12:23:42 - [] D -- C:\Program Files\LockHunter
O43 - CFD: 2015/07/10 04:07:31 - [] D -- C:\Program Files\Malwarebytes Anti-Malware
O43 - CFD: 2015/06/30 09:15:29 - [] D -- C:\Program Files\Microsoft.NET
O43 - CFD: 2015/07/17 19:38:47 - [] D -- C:\Program Files\MixVideoPlayer =>PUP.Optional.MixVideoPlayer
O43 - CFD: 2015/07/14 07:23:20 - [] D -- C:\Program Files\MSBuild
O43 - CFD: 2015/07/05 12:23:22 - [] D -- C:\Program Files\OCCTPT
O43 - CFD: 2015/07/17 19:38:47 - [] D -- C:\Program Files\OLBPre =>PUP.Optional.MyPCBackup
O43 - CFD: 2015/07/17 17:29:38 - [] D -- C:\Program Files\Opera
O43 - CFD: 2015/06/26 12:40:48 - [] D -- C:\Program Files\Oracle
O43 - CFD: 2015/07/17 19:38:47 - [] D -- C:\Program Files\OSForensics
O43 - CFD: 2015/07/08 14:55:21 - [] D -- C:\Program Files\PartitionGuru Free
O43 - CFD: 2015/07/13 21:35:07 - [] D -- C:\Program Files\Realtek
O43 - CFD: 2015/07/14 07:23:20 - [] D -- C:\Program Files\Reference Assemblies
O43 - CFD: 2015/07/04 03:23:19 - [] D -- C:\Program Files\Seagate
O43 - CFD: 2015/07/11 13:12:30 - [] RD -- C:\Program Files\Skype
O43 - CFD: 2015/07/12 14:05:14 - [] D -- C:\Program Files\SMADAV
O43 - CFD: 2015/06/19 14:13:20 - [] D -- C:\Program Files\SoftOrbits Flash Drive Recovery
O43 - CFD: 2015/06/17 00:08:40 - [] D -- C:\Program Files\TechSmith
O43 - CFD: 2015/07/17 19:38:52 - [] D -- C:\Program Files\Tencent =>PUP.Optional.TencentAddressBar
O43 - CFD: 2015/07/17 19:38:54 - [] D -- C:\Program Files\Ubisoft
O43 - CFD: 2015/06/26 03:45:52 - [] D -- C:\Program Files\UltraISO
O43 - CFD: 2015/07/11 14:11:44 - [] D -- C:\Program Files\Unlocker
O43 - CFD: 2015/07/10 13:49:36 - [] D -- C:\Program Files\Unlocker Tool
O43 - CFD: 2015/07/18 04:49:58 - [] D -- C:\Program Files\VS Revo Group
O43 - CFD: 2015/07/17 19:39:06 - [] D -- C:\Program Files\Windows Defender
O43 - CFD: 2015/06/30 11:10:54 - [] D -- C:\Program Files\Windows Journal
O43 - CFD: 2015/06/30 11:03:11 - [] D -- C:\Program Files\Windows Mail
O43 - CFD: 2015/06/30 11:03:11 - [] D -- C:\Program Files\Windows Media Player
O43 - CFD: 2015/06/30 09:15:30 - [] D -- C:\Program Files\Windows Multimedia Platform
O43 - CFD: 2015/06/30 09:15:29 - [] D -- C:\Program Files\Windows NT
O43 - CFD: 2015/06/30 11:03:11 - [] D -- C:\Program Files\Windows Photo Viewer
O43 - CFD: 2015/06/30 09:15:30 - [] D -- C:\Program Files\Windows Portable Devices
O43 - CFD: 2015/07/18 16:59:22 - [] HD -- C:\Program Files\WindowsApps
O43 - CFD: 2015/06/30 09:15:29 - [] SD -- C:\Program Files\WindowsPowerShell
O43 - CFD: 2015/06/16 15:03:57 - [] D -- C:\Program Files\WinRAR
O43 - CFD: 2015/07/17 19:32:03 - [] D -- C:\Program Files\Yamicsoft
O43 - CFD: 2015/06/30 09:15:30 - [] RD -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility
O43 - CFD: 2015/06/30 11:10:58 - [] RD -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories
O43 - CFD: 2015/07/13 21:42:21 - [] RD -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools
O43 - CFD: 2015/07/13 21:46:12 - [] D -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\BlueStacks
O43 - CFD: 2015/07/13 21:46:12 - [] D -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Edimax Wireless LAN
O43 - CFD: 2015/07/13 21:42:21 - [] D -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ESET
O43 - CFD: 2015/07/18 17:02:38 - [] D -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FileViewPro
O43 - CFD: 2015/07/17 17:17:38 - [0] D -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
O43 - CFD: 2015/07/13 21:42:21 - [] D -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GIGABYTE
O43 - CFD: 2015/07/17 19:38:55 - [] D -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
O43 - CFD: 2015/07/13 21:46:12 - [] D -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HD Tune Pro
O43 - CFD: 2015/07/13 21:46:12 - [] D -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HDD Low Level Format Tool
O43 - CFD: 2015/07/13 21:46:12 - [] D -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HDD Regenerator
O43 - CFD: 2015/07/13 21:46:12 - [] D -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Internet Download Manager
O43 - CFD: 2015/06/30 09:15:30 - [] D -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance
O43 - CFD: 2015/07/13 21:46:12 - [] D -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
O43 - CFD: 2015/07/13 21:46:12 - [] D -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PartitionGuru Free
O43 - CFD: 2015/07/18 04:50:06 - [] D -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Revo Uninstaller Pro
O43 - CFD: 2015/07/13 21:46:12 - [] D -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
O43 - CFD: 2015/07/13 21:46:12 - [] D -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SMADAV Antivirus
O43 - CFD: 2015/07/13 21:46:12 - [] D -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SoftOrbits Flash Drive Recovery
O43 - CFD: 2015/07/13 21:46:12 - [] RD -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp
O43 - CFD: 2015/06/30 09:15:30 - [] RD -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools
O43 - CFD: 2015/07/13 21:46:13 - [] D -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TechSmith
O43 - CFD: 2015/07/13 21:46:13 - [] D -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\UltraISO
O43 - CFD: 2015/07/13 21:46:13 - [] D -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VMware
O43 - CFD: 2015/07/13 21:46:13 - [] D -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR
O43 - CFD: 2015/06/29 03:00:47 - [] D -- C:\ProgramData\Adobe
O43 - CFD: 2015/06/30 10:11:10 - [0] SHD -- C:\ProgramData\Application Data
O43 - CFD: 2015/07/11 14:41:13 - [] D -- C:\ProgramData\BlueStacks
O43 - CFD: 2015/07/11 14:37:54 - [] D -- C:\ProgramData\BlueStacksSetup
O43 - CFD: 2015/06/30 09:15:29 - [0] D -- C:\ProgramData\Comms
O43 - CFD: 2015/06/30 10:11:10 - [0] SHD -- C:\ProgramData\Desktop
O43 - CFD: 2015/07/17 21:49:49 - [] D -- C:\ProgramData\DhmReu
O43 - CFD: 2015/06/30 10:11:10 - [0] SHD -- C:\ProgramData\Documents
O43 - CFD: 2015/07/10 02:25:31 - [] D -- C:\ProgramData\ESET
O43 - CFD: 2015/07/17 05:17:00 - [0] D -- C:\ProgramData\firebird
O43 - CFD: 2015/06/17 00:24:01 - [0] D -- C:\ProgramData\IDM
O43 - CFD: 2015/06/16 15:07:26 - [] D -- C:\ProgramData\IObit
O43 - CFD: 2015/07/05 12:23:40 - [] D -- C:\ProgramData\LHService
O43 - CFD: 2015/07/02 14:55:04 - [] D -- C:\ProgramData\Malwarebytes
O43 - CFD: 2015/07/13 21:54:44 - [] SD -- C:\ProgramData\Microsoft
O43 - CFD: 2015/06/26 19:04:12 - [] D -- C:\ProgramData\Microsoft OneDrive
O43 - CFD: 2015/06/26 19:21:47 - [] D -- C:\ProgramData\Microsoft Toolkit
O43 - CFD: 2015/06/17 00:08:21 - [] D -- C:\ProgramData\Package Cache
O43 - CFD: 2015/07/17 05:02:32 - [] D -- C:\ProgramData\PassMark
O43 - CFD: 2015/07/13 14:22:22 - [] D -- C:\ProgramData\ProductData
O43 - CFD: 2015/06/30 11:10:54 - [] D -- C:\ProgramData\regid.1991-06.com.microsoft
O43 - CFD: 2015/07/13 21:46:13 - [] D -- C:\ProgramData\regid.1995-08.com.techsmith
O43 - CFD: 2015/07/11 13:12:41 - [] D -- C:\ProgramData\Skype
O43 - CFD: 2015/06/30 09:15:29 - [0] D -- C:\ProgramData\SoftwareDistribution
O43 - CFD: 2015/06/30 10:11:10 - [0] SHD -- C:\ProgramData\Start Menu
O43 - CFD: 2015/06/24 12:54:52 - [] D -- C:\ProgramData\SUPERAntiSpyware.com
O43 - CFD: 2015/06/17 00:09:46 - [] D -- C:\ProgramData\TechSmith
O43 - CFD: 2015/06/27 00:52:24 - [0] AD -- C:\ProgramData\TEMP
O43 - CFD: 2015/06/30 10:11:10 - [0] SHD -- C:\ProgramData\Templates
O43 - CFD: 2015/07/18 05:04:10 - [] D -- C:\ProgramData\Tencent =>PUP.Optional.TencentAddressBar
O43 - CFD: 2015/07/12 14:03:42 - [] D -- C:\ProgramData\Thunder Network
O43 - CFD: 2015/07/17 19:38:45 - [] D -- C:\ProgramData\ToolsUpdatePlatform
O43 - CFD: 2015/06/26 18:59:28 - [] D -- C:\ProgramData\Users
O43 - CFD: 2015/06/30 10:12:25 - [] D -- C:\ProgramData\USOPrivate
O43 - CFD: 2015/06/30 10:12:24 - [] D -- C:\ProgramData\USOShared
O43 - CFD: 2015/07/18 14:37:59 - [] D -- C:\ProgramData\VMware
O43 - CFD: 2015/07/18 04:50:03 - [] D -- C:\ProgramData\VS Revo Group
O43 - CFD: 2015/06/29 03:00:55 - [] D -- C:\Program Files\Common Files\Adobe
O43 - CFD: 2015/06/26 03:45:52 - [] D -- C:\Program Files\Common Files\EZB Systems
O43 - CFD: 2015/06/19 20:22:29 - [] D -- C:\Program Files\Common Files\InstallShield
O43 - CFD: 2015/07/13 21:42:17 - [] D -- C:\Program Files\Common Files\microsoft shared
O43 - CFD: 2015/06/30 09:15:30 - [] D -- C:\Program Files\Common Files\Services
O43 - CFD: 2015/06/16 17:29:30 - [] D -- C:\Program Files\Common Files\Skype
O43 - CFD: 2015/06/30 11:03:11 - [] D -- C:\Program Files\Common Files\System
O43 - CFD: 2015/06/17 00:08:51 - [] D -- C:\Program Files\Common Files\TechSmith Shared
O43 - CFD: 2015/07/02 01:32:55 - [] D -- C:\Program Files\Common Files\VMware
O43 - CFD: 2015/06/17 10:48:21 - [] D -- C:\Users\samy\AppData\Roaming\Adobe
O43 - CFD: 2015/07/17 19:38:31 - [] D -- C:\Users\samy\AppData\Roaming\CalendarTool
O43 - CFD: 2015/07/18 14:48:37 - [] D -- C:\Users\samy\AppData\Roaming\DMCache
O43 - CFD: 2015/06/17 12:06:57 - [] D -- C:\Users\samy\AppData\Roaming\Easeware
O43 - CFD: 2015/06/18 18:15:59 - [] D -- C:\Users\samy\AppData\Roaming\ESET
O43 - CFD: 2015/07/12 14:03:58 - [] D -- C:\Users\samy\AppData\Roaming\HaiYuInst
O43 - CFD: 2015/06/21 08:03:35 - [] D -- C:\Users\samy\AppData\Roaming\HD Tune Pro
O43 - CFD: 2015/06/17 07:41:43 - [] D -- C:\Users\samy\AppData\Roaming\Identities
O43 - CFD: 2015/07/14 01:05:08 - [] D -- C:\Users\samy\AppData\Roaming\IDM
O43 - CFD: 2015/07/13 15:25:32 - [] D -- C:\Users\samy\AppData\Roaming\IObit
O43 - CFD: 2015/07/17 17:44:47 - [] D -- C:\Users\samy\AppData\Roaming\istartsurf =>PUP.Optional.IsStart
O43 - CFD: 2015/06/27 14:21:38 - [] D -- C:\Users\samy\AppData\Roaming\LockHunter
O43 - CFD: 2015/06/16 15:07:44 - [] D -- C:\Users\samy\AppData\Roaming\Macromedia
O43 - CFD: 2015/07/18 12:19:20 - [] SD -- C:\Users\samy\AppData\Roaming\Microsoft
O43 - CFD: 2015/07/17 17:29:29 - [0] D -- C:\Users\samy\AppData\Roaming\Opera Software
O43 - CFD: 2015/07/11 14:12:32 - [] D -- C:\Users\samy\AppData\Roaming\Process Hacker 2
O43 - CFD: 2015/07/18 17:12:30 - [] D -- C:\Users\samy\AppData\Roaming\Skype
O43 - CFD: 2015/07/12 01:36:47 - [] D -- C:\Users\samy\AppData\Roaming\Smadav
O43 - CFD: 2015/07/17 19:38:30 - [] D -- C:\Users\samy\AppData\Roaming\Software Tool
O43 - CFD: 2015/06/24 12:54:52 - [] D -- C:\Users\samy\AppData\Roaming\SUPERAntiSpyware.com
O43 - CFD: 2015/07/18 05:04:10 - [] D -- C:\Users\samy\AppData\Roaming\Tencent =>PUP.Optional.TencentAddressBar
O43 - CFD: 2015/07/14 16:24:12 - [] D -- C:\Users\samy\AppData\Roaming\USBSafelyRemove
O43 - CFD: 2015/07/18 16:46:44 - [] D -- C:\Users\samy\AppData\Roaming\ViberPC
O43 - CFD: 2015/07/02 03:32:53 - [] D -- C:\Users\samy\AppData\Roaming\VMware
O43 - CFD: 2015/06/16 23:50:06 - [] D -- C:\Users\samy\AppData\Roaming\WinRAR
O43 - CFD: 2015/07/14 03:19:49 - [] D -- C:\Users\samy\AppData\Roaming\Yamicsoft
O43 - CFD: 2015/07/18 17:16:10 - [] D -- C:\Users\samy\AppData\Roaming\ZHP
O43 - CFD: 2015/07/18 16:46:41 - [] D -- C:\Users\samy\AppData\Local\ActiveSync
O43 - CFD: 2015/06/17 10:48:21 - [] D -- C:\Users\samy\AppData\Local\Adobe
O43 - CFD: 2015/07/13 21:39:56 - [0] SHD -- C:\Users\samy\AppData\Local\Application Data
O43 - CFD: 2015/07/11 14:34:48 - [] D -- C:\Users\samy\AppData\Local\Bluestacks
O43 - CFD: 2015/06/29 14:06:08 - [] D -- C:\Users\samy\AppData\Local\Clipboarder
O43 - CFD: 2015/06/26 19:01:27 - [] D -- C:\Users\samy\AppData\Local\Comms
O43 - CFD: 2015/06/19 03:00:45 - [] D -- C:\Users\samy\AppData\Local\CrashDumps
O43 - CFD: 2015/06/26 01:12:47 - [] D -- C:\Users\samy\AppData\Local\Diagnostics
O43 - CFD: 2015/06/21 12:26:11 - [] D -- C:\Users\samy\AppData\Local\Downloaded Installations
O43 - CFD: 2015/07/13 14:50:44 - [] D -- C:\Users\samy\AppData\Local\Droid4X
O43 - CFD: 2015/06/18 01:28:42 - [] D -- C:\Users\samy\AppData\Local\ElevatedDiagnostics
O43 - CFD: 2015/06/17 10:16:14 - [0] SHD -- C:\Users\samy\AppData\Local\EmieSiteList
O43 - CFD: 2015/06/17 10:16:14 - [0] SHD -- C:\Users\samy\AppData\Local\EmieUserList
O43 - CFD: 2015/06/18 18:15:59 - [] D -- C:\Users\samy\AppData\Local\ESET
O43 - CFD: 2015/06/26 18:59:02 - [0] D -- C:\Users\samy\AppData\Local\GameDVR
O43 - CFD: 2015/07/16 09:53:15 - [] D -- C:\Users\samy\AppData\Local\Genymobile
O43 - CFD: 2015/07/05 03:00:04 - [] D -- C:\Users\samy\AppData\Local\Google
O43 - CFD: 2015/06/19 12:42:02 - [] D -- C:\Users\samy\AppData\Local\GWX
O43 - CFD: 2015/07/13 21:39:56 - [0] SHD -- C:\Users\samy\AppData\Local\History
O43 - CFD: 2015/07/14 15:30:42 - [] D -- C:\Users\samy\AppData\Local\Microsoft
O43 - CFD: 2015/07/14 00:57:01 - [] D -- C:\Users\samy\AppData\Local\MicrosoftEdge
O43 - CFD: 2015/06/26 19:08:06 - [0] D -- C:\Users\samy\AppData\Local\NetworkTiles
O43 - CFD: 2015/06/22 01:56:28 - [] D -- C:\Users\samy\AppData\Local\OCCT_-_Ocbase_-_Adrien_Me
O43 - CFD: 2015/07/17 17:29:29 - [0] D -- C:\Users\samy\AppData\Local\Opera Software
O43 - CFD: 2015/07/14 01:15:49 - [] D -- C:\Users\samy\AppData\Local\Packages
O43 - CFD: 2015/06/16 14:54:42 - [0] D -- C:\Users\samy\AppData\Local\PackageStaging
O43 - CFD: 2015/06/26 19:17:51 - [0] D -- C:\Users\samy\AppData\Local\PeerDistRepub
O43 - CFD: 2015/06/16 15:06:37 - [] D -- C:\Users\samy\AppData\Local\Programs
O43 - CFD: 2015/06/28 13:36:48 - [] D -- C:\Users\samy\AppData\Local\Publishers
O43 - CFD: 2015/06/29 14:18:35 - [] D -- C:\Users\samy\AppData\Local\Sidebar7
O43 - CFD: 2015/06/16 17:29:49 - [] D -- C:\Users\samy\AppData\Local\Skype
O43 - CFD: 2015/06/30 14:22:06 - [] D -- C:\Users\samy\AppData\Local\Spartan
O43 - CFD: 2015/06/17 00:09:54 - [] D -- C:\Users\samy\AppData\Local\TechSmith
O43 - CFD: 2015/07/18 17:16:31 - [] D -- C:\Users\samy\AppData\Local\Temp
O43 - CFD: 2015/07/13 21:39:56 - [0] SHD -- C:\Users\samy\AppData\Local\Temporary Internet Files
O43 - CFD: 2015/06/26 18:56:36 - [] D -- C:\Users\samy\AppData\Local\TileDataLayer
O43 - CFD: 2015/07/17 17:17:46 - [0] D -- C:\Users\samy\AppData\Local\Ubisoft Game Launcher
O43 - CFD: 2015/07/07 16:19:07 - [] D -- C:\Users\samy\AppData\Local\Viber
O43 - CFD: 2015/07/11 10:50:56 - [] D -- C:\Users\samy\AppData\Local\VirtualStore
O43 - CFD: 2015/06/28 15:19:23 - [] D -- C:\Users\samy\AppData\Local\VMware
O43 - CFD: 2015/07/18 04:50:19 - [] D -- C:\Users\samy\AppData\Local\VS Revo Group
O43 - CFD: 2015/07/13 21:41:09 - [] RD -- C:\Users\samy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility
O43 - CFD: 2015/07/17 19:39:05 - [] RD -- C:\Users\samy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
O43 - CFD: 2015/07/14 00:46:16 - [] RD -- C:\Users\samy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
O43 - CFD: 2015/07/13 21:46:10 - [] D -- C:\Users\samy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Download Manager
O43 - CFD: 2015/07/13 21:41:10 - [] D -- C:\Users\samy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
O43 - CFD: 2015/07/14 00:46:16 - [] RD -- C:\Users\samy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
O43 - CFD: 2015/07/13 21:41:10 - [] RD -- C:\Users\samy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools
O43 - CFD: 2015/07/13 21:41:10 - [] D -- C:\Users\samy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Tencent =>PUP.Optional.TencentAddressBar
O43 - CFD: 2015/07/13 21:46:10 - [] D -- C:\Users\samy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Unlocker Tool
O43 - CFD: 2015/06/30 09:15:37 - [] RSD -- C:\Users\samy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell
O43 - CFD: 2015/07/13 21:46:11 - [] D -- C:\Users\samy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR

---\\ Latest files created in Windows Prefetcher (O45) (4) - 24s
O45 - LFCP:[MD5.BCACC904F4D15B1B7C200140C5EC76B0] 2015/07/17 18:43:28 A -- C:\WINDOWS\Prefetch\MIXVIDEOPLAYERSETUP.EXE-AC20AE3B.pf =>PUP.Optional.MixVideoPlayer
O45 - LFCP:[MD5.2BBD1EA3C0902C300D8F1045EC9CB30C] 2015/07/17 18:49:15 A -- C:\WINDOWS\Prefetch\OLBPRE.EXE-5CC5F889.pf =>PUP.Optional.MyPCBackup
O45 - LFCP:[MD5.C3597963A9885E2018D0EA1528261E18] 2015/07/17 18:43:15 A -- C:\WINDOWS\Prefetch\SPEEDUPMYPC.EXE-65B6E02C.pf =>PUP.Optional.SpeedUpMyPC
O45 - LFCP:[MD5.48E5BA9FFDBAFCC89B26E9EC142D836C] 2015/07/17 18:43:24 A -- C:\WINDOWS\Prefetch\SPEEDUPMYPC.TMP-74DD751A.pf =>PUP.Optional.SpeedUpMyPC

---\\ System Drivers List (SDL) (O58) (80) - 19s
O58 - SDL:2015/06/30 09:11:17 A . (.LSI - LSI 3ware SCSI Storport Driver.) -- C:\WINDOWS\System32\drivers\3ware.sys [85992]
O58 - SDL:2015/07/03 15:59:30 A . (.Malwarebytes Corporation - Malwarebytes Anti-Malware.) -- C:\WINDOWS\System32\drivers\4C0D3ECE.sys [98520]
O58 - SDL:2015/06/30 09:11:17 A . (.PMC-Sierra - PMC-Sierra Storport Driver For SPC8x6G SAS.) -- C:\WINDOWS\System32\drivers\adp80xx.sys [1038312]
O58 - SDL:2015/06/30 09:11:17 A . (.Advanced Micro Devices - AHCI 1.3 Device Driver.) -- C:\WINDOWS\System32\drivers\amdsata.sys [75240]
O58 - SDL:2015/06/30 09:11:17 A . (.AMD Technologies Inc. - AMD Technology AHCI Compatible Controller D.) -- C:\WINDOWS\System32\drivers\amdsbs.sys [215528]
O58 - SDL:2015/06/30 09:11:17 A . (.Advanced Micro Devices - Storage Filter Driver.) -- C:\WINDOWS\System32\drivers\amdxata.sys [23016]
O58 - SDL:2015/06/30 09:11:17 A . (.PMC-Sierra, Inc. - Adaptec SAS RAID WS03 Driver.) -- C:\WINDOWS\System32\drivers\arcsas.sys [116712]
O58 - SDL:2015/06/30 09:11:17 A . (.Windows (R) Win 7 DDK provider - BCM Function 2 Device Driver.) -- C:\WINDOWS\System32\drivers\bcmfn2.sys [16088]
O58 - SDL:2015/01/30 16:13:30 A . (.ESET - Amon monitor.) -- C:\WINDOWS\System32\drivers\eamonm.sys [193464]
O58 - SDL:2015/01/30 16:13:30 A . (.ESET - Devmon monitor.) -- C:\WINDOWS\System32\drivers\edevmon.sys [190880]
O58 - SDL:2015/03/19 12:51:22 A . (.ESET - ESET ELAM driver.) -- C:\WINDOWS\System32\drivers\eelam.sys [14496]
O58 - SDL:2015/01/30 16:13:30 A . (.ESET - ESET Helper driver.) -- C:\WINDOWS\System32\drivers\ehdrv.sys [135808]
O58 - SDL:2015/05/21 11:10:58 A . (.ESET - ESET OPP Keyboard Filter.) -- C:\WINDOWS\System32\drivers\ekbdflt.sys [110528]
O58 - SDL:2015/01/30 16:13:30 A . (.ESET - ESET Personal Firewall driver.) -- C:\WINDOWS\System32\drivers\epfw.sys [176448]
O58 - SDL:2015/01/30 16:13:30 A . (.ESET - Epfw NDIS LightWeight Filter.) -- C:\WINDOWS\System32\drivers\EpfwLWF.sys [37928]
O58 - SDL:2015/01/30 16:13:30 A . (.ESET - ESET Personal Firewall driver.) -- C:\WINDOWS\System32\drivers\epfwwfp.sys [51824]
O58 - SDL:2002/06/03 10:18:32 A . (.Creative Technology Ltd. - ENSONIQ AudioPCI 97 WDM Audio Miniport.) -- C:\WINDOWS\System32\drivers\es1371mp.sys [40832]
O58 - SDL:2009/10/22 03:47:52 A . (.VMware, Inc. - VMware USB monitor.) -- C:\WINDOWS\System32\drivers\hcmon.sys [32304]
O58 - SDL:2015/06/30 09:11:17 A . (.Hewlett-Packard Company - Smart Array SAS/SATA Controller Media Drive.) -- C:\WINDOWS\System32\drivers\HpSAMD.sys [56808]
O58 - SDL:2015/06/16 15:07:26 A . (.REALiX(tm) - HWiNFO x86 Kernel Driver.) -- C:\WINDOWS\System32\drivers\HWiNFO32.SYS [23840]
O58 - SDL:2006/10/20 23:32:32 A . (.Chicony - Numpad.sys.) -- C:\WINDOWS\System32\drivers\i8042HDR.sys [13224]
O58 - SDL:2015/06/30 09:11:17 A . (.Intel Corporation - Intel(R) Atom(TM) Processor GPIO Controller.) -- C:\WINDOWS\System32\drivers\iaiogpio.sys [22016]
O58 - SDL:2015/06/30 09:11:17 A . (.Intel Corporation - Intel(R) Atom(TM) Processor I2C Controller.) -- C:\WINDOWS\System32\drivers\iaioi2c.sys [61936]
O58 - SDL:2015/06/30 09:11:17 A . (.Intel Corporation - Intel(R) Rapid Storage Technology driver (i.) -- C:\WINDOWS\System32\drivers\iaStorAV.sys [524776]
O58 - SDL:2015/06/30 09:11:17 A . (.Intel Corporation - Intel Matrix Storage Manager driver - ia32.) -- C:\WINDOWS\System32\drivers\iaStorV.sys [333800]
O58 - SDL:2015/04/18 03:06:24 A . (.Tonec Inc. - Internet Download Manager WFP Driver.) -- C:\WINDOWS\System32\drivers\idmwfp.sys [122432]
O58 - SDL:2015/06/26 19:09:46 A . (.Intel Corporation - Intel Graphics Kernel Mode Driver.) -- C:\WINDOWS\System32\drivers\igdkmd32.sys [4815872]
O58 - SDL:2015/06/30 09:11:17 A . (.LSI Corporation - LSI Fusion-MPT SAS Driver (StorPort).) -- C:\WINDOWS\System32\drivers\lsi_sas.sys [94184]
O58 - SDL:2015/06/30 09:11:17 A . (.LSI Corporation - LSI SAS Gen2 Driver (StorPort).) -- C:\WINDOWS\System32\drivers\lsi_sas2i.sys [89064]
O58 - SDL:2015/06/30 09:11:17 A . (.Avago Technologies - Avago SAS Gen3 Driver (StorPort).) -- C:\WINDOWS\System32\drivers\lsi_sas3i.sys [83432]
O58 - SDL:2015/06/30 09:11:17 A . (.LSI Corporation - LSI SSS PCIe/Flash Driver (StorPort).) -- C:\WINDOWS\System32\drivers\lsi_sss.sys [69608]
O58 - SDL:2015/06/18 08:41:36 A . (.Malwarebytes Corporation - Malwarebytes Anti-Malware.) -- C:\WINDOWS\System32\drivers\mbam.sys [23256]
O58 - SDL:2015/06/18 08:41:42 A . (.Malwarebytes Corporation - Malwarebytes Chameleon Protection Driver.) -- C:\WINDOWS\System32\drivers\mbamchameleon.sys [94936]
O58 - SDL:2015/07/18 16:44:47 A . (.Malwarebytes Corporation - Malwarebytes Anti-Malware.) -- C:\WINDOWS\System32\drivers\MBAMSwissArmy.sys [98520]
O58 - SDL:2015/06/30 09:11:18 A . (.Avago Technologies - MEGASAS RAID Controller Driver for Windows.) -- C:\WINDOWS\System32\drivers\megasas.sys [52200]
O58 - SDL:2015/06/30 09:11:18 A . (.LSI Corporation, Inc. - LSI MegaRAID Software RAID Driver.) -- C:\WINDOWS\System32\drivers\megasr.sys [464872]
O58 - SDL:2015/06/30 09:11:18 A . (.Marvell Semiconductor, Inc. - Marvell Flash Controller Driver.) -- C:\WINDOWS\System32\drivers\mvumis.sys [58344]
O58 - SDL:2015/06/18 08:41:58 A . (.Malwarebytes Corporation - Malwarebytes Web Access Control.) -- C:\WINDOWS\System32\drivers\mwac.sys [51928]
O58 - SDL:2015/06/30 09:11:18 A . (.NVIDIA Corporation - NVIDIA® nForce(TM) RAID Driver.) -- C:\WINDOWS\System32\drivers\nvraid.sys [119272]
O58 - SDL:2015/06/30 09:11:18 A . (.NVIDIA Corporation - NVIDIA® nForce(TM) Sata Performance Driver.) -- C:\WINDOWS\System32\drivers\nvstor.sys [142312]
O58 - SDL:2015/06/30 09:11:18 A . (.LSI Corporation - MEGASAS RAID Controller Driver for Windows.) -- C:\WINDOWS\System32\drivers\percsas2i.sys [51176]
O58 - SDL:2015/06/30 09:11:18 A . (.Avago Technologies - MEGASAS RAID Controller Driver for Windows.) -- C:\WINDOWS\System32\drivers\percsas3i.sys [51688]
O58 - SDL:2009/12/30 10:21:18 A . (.VS Revo Group - Revo Uninstaller Minifilter.) -- C:\WINDOWS\System32\drivers\revoflt.sys [27192]
O58 - SDL:2015/06/30 09:11:18 A . (.Realtek - Realtek 8136/8168/8169 NDIS 6.40 32-bit Dri.) -- C:\WINDOWS\System32\drivers\rt640x86.sys [492032]
O58 - SDL:2015/07/06 03:22:54 A . (.Realtek Semiconductor Corp. - Realtek(r) High Definition Audio Function D.) -- C:\WINDOWS\System32\drivers\RTKVHDA.sys [3522264]
O58 - SDL:2015/06/30 09:11:18 A . (.Silicon Integrated Systems Corp. - SiS RAID Stor Miniport Driver.) -- C:\WINDOWS\System32\drivers\sisraid2.sys [41448]
O58 - SDL:2015/06/30 09:11:18 A . (.Silicon Integrated Systems - SiS AHCI Stor-Miniport Driver.) -- C:\WINDOWS\System32\drivers\sisraid4.sys [79336]
O58 - SDL:2009/10/12 14:33:00 A . (.StorageCraft Technology Corporation - StorageCraft Volume Snapshot Driver.) -- C:\WINDOWS\System32\drivers\stcp2v30.sys [64960]
O58 - SDL:2015/06/30 09:11:18 A . (.Promise Technology, Inc. - Promise SuperTrak EX Series Driver for Wind.) -- C:\WINDOWS\System32\drivers\stexstor.sys [27112]
O58 - SDL:2013/08/22 14:40:22 A . (.The OpenVPN Project - TAP-Windows Virtual Network Driver.) -- C:\WINDOWS\System32\drivers\tap0901.sys [35288]
O58 - SDL:2015/06/30 09:11:23 A . (...) -- C:\WINDOWS\System32\drivers\Udecx.sys [31744]
O58 - SDL:2014/05/16 15:25:48 A . (.Oracle Corporation - VirtualBox Support Driver.) -- C:\WINDOWS\System32\drivers\VBoxDrv.sys [204064]
O58 - SDL:2015/05/13 17:29:54 A . (.Oracle Corporation - VirtualBox Host-Only Network Adapter Driver.) -- C:\WINDOWS\System32\drivers\VBoxNetAdp.sys [115672]
O58 - SDL:2015/05/13 17:29:54 A . (.Oracle Corporation - VirtualBox Bridged Networking Driver.) -- C:\WINDOWS\System32\drivers\VBoxNetFlt.sys [127008]
O58 - SDL:2015/05/13 17:29:54 A . (.Oracle Corporation - VirtualBox USB Monitor Driver.) -- C:\WINDOWS\System32\drivers\VBoxUSBMon.sys [104896]
O58 - SDL:2009/10/22 04:45:00 A . (.VMware, Inc. - VMware kernel driver.) -- C:\WINDOWS\System32\drivers\vmci.sys [70704]
O58 - SDL:2009/10/22 04:45:00 A . (.VMware, Inc. - VMware keyboard filter driver (32-bit).) -- C:\WINDOWS\System32\drivers\VMkbd.sys [23216]
O58 - SDL:2009/10/22 00:13:32 A . (.VMware, Inc. - VMware virtual network driver (32-bit).) -- C:\WINDOWS\System32\drivers\vmnet.sys [18736]
O58 - SDL:2009/10/22 00:13:32 A . (.VMware, Inc. - VMware virtual network adapter driver (32-b.) -- C:\WINDOWS\System32\drivers\vmnetadapter.sys [16560]
O58 - SDL:2009/10/22 00:13:32 RA . (.VMware, Inc. - VMware bridge driver (32-bit).) -- C:\WINDOWS\System32\drivers\vmnetbridge.sys [36400]
O58 - SDL:2009/10/22 04:44:58 A . (.VMware, Inc. - VMware network application interface driver.) -- C:\WINDOWS\System32\drivers\vmnetuserif.sys [26288]
O58 - SDL:2009/10/22 04:44:06 A . (.VMware, Inc. - VMware parallel port driver.) -- C:\WINDOWS\System32\drivers\vmparport.sys [14896]
O58 - SDL:2009/10/22 04:45:02 A . (.VMware, Inc. - VMware kernel driver.) -- C:\WINDOWS\System32\drivers\vmx86.sys [853936]
O58 - SDL:2015/06/30 09:11:18 A . (.VIA Technologies Inc.,Ltd - VIA RAID DRIVER FOR X86-32.) -- C:\WINDOWS\System32\drivers\vsmraid.sys [149992]
O58 - SDL:2015/06/30 09:11:18 A . (.VIA Corporation - VIA StorX RAID Controller Driver.) -- C:\WINDOWS\System32\drivers\VSTXRAID.SYS [276968]
O58 - SDL:2015/07/14 07:23:08 A . (...) -- C:\WINDOWS\System32\ANSI.SYS [9029]
O58 - SDL:2015/07/14 07:23:08 A . (...) -- C:\WINDOWS\System32\country.sys [27097]
O58 - SDL:2015/07/14 07:23:08 A . (...) -- C:\WINDOWS\System32\HIMEM.SYS [4768]
O58 - SDL:2015/07/14 07:23:08 A . (...) -- C:\WINDOWS\System32\KEY01.SYS [42809]
O58 - SDL:2015/07/14 07:23:09 A . (...) -- C:\WINDOWS\System32\KEYBOARD.SYS [42537]
O58 - SDL:2015/07/14 07:23:09 A . (...) -- C:\WINDOWS\System32\NTDOS.SYS [27866]
O58 - SDL:2015/07/14 07:23:08 A . (...) -- C:\WINDOWS\System32\NTDOS404.SYS [29146]
O58 - SDL:2015/07/14 07:23:08 A . (...) -- C:\WINDOWS\System32\NTDOS411.SYS [29370]
O58 - SDL:2015/07/14 07:23:08 A . (...) -- C:\WINDOWS\System32\NTDOS412.SYS [29274]
O58 - SDL:2015/07/14 07:23:08 A . (...) -- C:\WINDOWS\System32\NTDOS804.SYS [29146]
O58 - SDL:2015/07/14 07:23:09 A . (...) -- C:\WINDOWS\System32\NTIO.SYS [33968]
O58 - SDL:2015/07/14 07:23:08 A . (...) -- C:\WINDOWS\System32\NTIO404.SYS [34688]
O58 - SDL:2015/07/14 07:23:08 A . (...) -- C:\WINDOWS\System32\NTIO411.SYS [35776]
O58 - SDL:2015/07/14 07:23:08 A . (...) -- C:\WINDOWS\System32\NTIO412.SYS [35552]
O58 - SDL:2015/07/14 07:23:08 A . (...) -- C:\WINDOWS\System32\NTIO804.SYS [34688]

---\\ Last modified or created user files (O61) (39) - 107s
O61 - LFC: 2015/07/17 21:11:40 A . (.ESET, spol. s r.o..) -- C:\Users\samy\Downloads\Programs\ESETRepairNdis.exe [85024]
O61 - LFC: 2015/07/17 21:32:25 A . (.ESET, spol. s r.o..) -- C:\Users\samy\Downloads\Programs\ESETRepairNdis_2.exe [85024]
O61 - LFC: 2015/07/18 04:08:39 A . (.ESET.) -- C:\Users\samy\Downloads\Programs\eset_smart_security_live_installer.exe [1661128]
O61 - LFC: 2015/07/18 17:00:31 A . (..) -- C:\Users\samy\Desktop\2015_FileViewPro_Setup.exe [2983168]
O61 - LFC: 2015/07/12 01:36:45 A . (..) -- C:\Users\samy\AppData\Roaming\Smadav\Update-Smadav.exe [1015475]
O61 - LFC: 2015/07/18 16:45:42 A . (.Tonec Inc..) -- C:\Users\samy\AppData\Roaming\IDM\idmmzcc5\components2\idmcchandler2.dll [332824]
O61 - LFC: 2015/07/18 16:45:43 A . (.Tonec Inc..) -- C:\Users\samy\AppData\Roaming\IDM\idmmzcc5\components2\idmcchandler2_64.dll [460824]
O61 - LFC: 2015/07/18 16:45:43 A . (.Tonec Inc..) -- C:\Users\samy\AppData\Roaming\IDM\idmmzcc5\components2\idmmzcc.dll [34216]
O61 - LFC: 2015/07/18 16:45:43 A . (.Tonec Inc..) -- C:\Users\samy\AppData\Roaming\IDM\idmmzcc5\components2\idmmzcc64.dll [28512]
O61 - LFC: 2015/07/18 16:45:42 A . (.Tonec Inc..) -- C:\Users\samy\AppData\Roaming\IDM\idmmzcc5\components12\idmmzcc.dll [26648]
O61 - LFC: 2015/07/18 16:45:42 A . (.Tonec Inc..) -- C:\Users\samy\AppData\Roaming\IDM\idmmzcc5\components12\idmmzcc64.dll [31768]
O61 - LFC: 2015/07/18 16:45:42 A . (.Tonec Inc..) -- C:\Users\samy\AppData\Roaming\IDM\idmmzcc5\components\idmmzcc.dll [34216]
O61 - LFC: 2015/07/18 12:34:25 A . (.Reimage®.) -- C:\Users\samy\AppData\Roaming\IDM\DwnlData\samy\ReimageRepair_541\ReimageRepair.exe [772016] =>PUP.Optional.ReImageRepair
O61 - LFC: 2015/07/12 01:59:22 A . (.MEGA Limited.) -- C:\Users\samy\AppData\Roaming\IDM\DwnlData\samy\MEGAsyncSetup_456\MEGAsyncSetup.exe [3079911]
O61 - LFC: 2015/07/12 14:20:54 A . (.?????????????.) -- C:\Users\samy\AppData\Roaming\HaiYuInst\plugins\xldl.dll [297416]
O61 - LFC: 2015/07/12 14:20:54 A . (.ShenZhen Xunlei Networking Technologies,LTD.) -- C:\Users\samy\AppData\Roaming\HaiYuInst\plugins\download\dl_peer_id.dll [92080]
O61 - LFC: 2015/07/12 14:20:54 A . (.Thunder Networking Technologies,LTD.) -- C:\Users\samy\AppData\Roaming\HaiYuInst\plugins\download\download_engine.dll [3512776]
O61 - LFC: 2015/07/12 14:20:54 A . (.?????????????.) -- C:\Users\samy\AppData\Roaming\HaiYuInst\plugins\download\MiniThunderPlatform.exe [272840]
O61 - LFC: 2015/07/12 14:20:54 A . (.???? (C) 2011.) -- C:\Users\samy\AppData\Roaming\HaiYuInst\plugins\download\minizip.dll [19968]
O61 - LFC: 2015/07/12 14:20:54 A . (.Copyright (C) 2009.) -- C:\Users\samy\AppData\Roaming\HaiYuInst\plugins\download\XLBugHandler.dll [100808]
O61 - LFC: 2015/07/12 14:20:54 A . (.Copyright 2010.) -- C:\Users\samy\AppData\Roaming\HaiYuInst\plugins\download\XLBugReport.exe [248264]
O61 - LFC: 2015/07/12 14:20:54 A . (.(C) 1995-2004 Jean-loup Gailly & Mark Adler.) -- C:\Users\samy\AppData\Roaming\HaiYuInst\plugins\download\zlib1.dll [59904]
O61 - LFC: 2015/07/12 14:13:03 A . (..) -- C:\Users\samy\AppData\Roaming\HaiYuInst\DXInst\Setup.exe [241577560]
O61 - LFC: 2015/07/18 17:17:30 A . (..) -- C:\Users\samy\AppData\Local\TechSmith\SnagIt\Tray.bin [628]
O61 - LFC: 2015/07/14 00:47:54 A . (..) -- C:\Users\samy\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\TempState\TileCache_100_0_Data.bin [2109468]
O61 - LFC: 2015/07/14 00:47:54 A . (..) -- C:\Users\samy\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\TempState\TileCache_100_0_Header.bin [9640]
O61 - LFC: 2015/07/18 14:48:44 A . (..) -- C:\Users\samy\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\LocalState\speech_onecorereg.bin [8192]
O61 - LFC: 2015/07/17 20:26:11 A . (..) -- C:\Users\samy\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\UrlBlock\urlblock_635727492210169964.bin [77641]
O61 - LFC: 2015/07/13 20:53:38 A . (..) -- C:\Users\samy\AppData\Local\Microsoft\Windows\appsFolderLayout-menu.bin [818]
O61 - LFC: 2015/07/13 20:53:38 A . (..) -- C:\Users\samy\AppData\Local\Microsoft\Windows\appsFolderLayout.bin [818]
O61 - LFC: 2015/07/17 21:11:40 A . (..) -- C:\Users\samy\AppData\Local\Microsoft\Windows\INetCache\Low\IE\5L7L79JC\ESETRepairNdis[1].exe [735]
O61 - LFC: 2015/07/14 00:49:57 A . (..) -- C:\Users\samy\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin [395737]
O61 - LFC: 2015/07/16 10:09:47 A . (..) -- C:\Users\samy\AppData\Local\Microsoft\Internet Explorer\UrlBlock\urlblock_635726268619325651.bin [77629]
O61 - LFC: 2015/07/17 17:08:47 A . (..) -- C:\Users\samy\AppData\Local\Microsoft\Internet Explorer\UrlBlock\urlblock_635727384435897334.bin [77293]
O61 - LFC: 2015/07/18 16:47:45 A . (..) -- C:\Users\samy\AppData\Local\Microsoft\Internet Explorer\UrlBlock\urlblock_635728248441712474.bin [73209]
O61 - LFC: 2015/07/18 16:55:35 A . (..) -- C:\Users\samy\AppData\Local\Microsoft\GameDVR\KnownGameList.bin [38396]
O61 - LFC: 2015/07/18 16:45:45 A . (..) -- C:\Users\samy\AppData\Local\Google\Chrome\User Data\ev_hashes_whitelist.bin [1113849]
O61 - LFC: 2015/07/13 10:14:22 A . (..) -- C:\Users\samy\AppData\Local\Google\Chrome\User Data\PepperFlash\18.0.0.209\pepflashplayer.dll [16307888]
O61 - LFC: 2015/07/15 15:45:09 A . (..) -- C:\Users\samy\AppData\Local\Adobe\Acrobat\11.0\UserCache.bin [78720]

---\\ File Associations Shell Spawning (O67) (9) - 1s
O67 - Shell Spawning: <.bat> [HKLM\..\open\Command] (...) -- "%1" %*
O67 - Shell Spawning: <.cpl> [HKLM\..\cplopen\Command] (.Microsoft Corporation - Windows Control Panel.) -- C:\Windows\System32\control.exe
O67 - Shell Spawning: <.cmd> [HKLM\..\open\Command] (...) -- "%1" %*
O67 - Shell Spawning: <.com> [HKLM\..\open\Command] (...) -- "%1" %*
O67 - Shell Spawning: <.exe> [HKLM\..\open\Command] (...) -- "%1" %*
O67 - Shell Spawning: <.html> [HKLM\..\open\Command] (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
O67 - Shell Spawning: <.js> [HKLM\..\open\Command] (.Microsoft Corporation - Microsoft ® Windows Based Script Host.) -- C:\Windows\System32\wscript.exe
O67 - Shell Spawning: <.reg> [HKLM\..\open\Command] (.Microsoft Corporation - Registry Editor.) -- C:\Windows\regedit.exe
O67 - Shell Spawning: <.scr> [HKLM\..\open\Command] (...) -- "%1" /S

---\\ Start Menu Internet (SMI) (O68) (8) - 0s
O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Google Inc. - Google Chrome.) -- C:\Program Files\Google\Chrome\Application\chrome.exe
O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
O68 - StartMenuInternet: [HKLM\..\InstallInfo\ShowIconsCommand] (.Google Inc. - Google Chrome.) -- C:\Program Files\Google\Chrome\Application\chrome.exe
O68 - StartMenuInternet: [HKLM\..\InstallInfo\ShowIconsCommand] (.Microsoft Corporation - IE Per-User Initialization Utility.) -- C:\Windows\System32\ie4uinit.exe
O68 - StartMenuInternet: [HKLM\..\InstallInfo\ReinstallCommand] (.Google Inc. - Google Chrome.) -- C:\Program Files\Google\Chrome\Application\chrome.exe
O68 - StartMenuInternet: [HKLM\..\InstallInfo\ReinstallCommand] (.Microsoft Corporation - IE Per-User Initialization Utility.) -- C:\Windows\System32\ie4uinit.exe
O68 - StartMenuInternet: [HKLM\..\InstallInfo\HideIconsCommand] (.Google Inc. - Google Chrome.) -- C:\Program Files\Google\Chrome\Application\chrome.exe
O68 - StartMenuInternet: [HKLM\..\InstallInfo\HideIconsCommand] (.Microsoft Corporation - IE Per-User Initialization Utility.) -- C:\Windows\System32\ie4uinit.exe

---\\ Search Browser Infection (SBI) (O69) (1) - 1s
O69 - SBI: SearchScopes [HKCU] {0633EE93-D776-472f-A0FF-E1416B8B2E3A} [DefaultScope] - (Bing) - http://www.bing.com/

---\\ Search Svchost Services (SSS) (O83) (42) - 3s
O83 - Search Svchost Services: CertPropSvc (CertPropSvc) . (.Microsoft Corporation - Microsoft Smartcard Certificate Propagation.) -- C:\Windows\System32\certprop.dll [161792]
O83 - Search Svchost Services: SCPolicySvc (SCPolicySvc) . (.Microsoft Corporation - Microsoft Smartcard Certificate Propagation.) -- C:\Windows\System32\certprop.dll [161792]
O83 - Search Svchost Services: lanmanserver (lanmanserver) . (.Microsoft Corporation - Server Service DLL.) -- C:\Windows\System32\srvsvc.dll [218112]
O83 - Search Svchost Services: gpsvc (gpsvc) . (.Microsoft Corporation - Group Policy Client.) -- C:\Windows\System32\gpsvc.dll [1195520]
O83 - Search Svchost Services: IKEEXT (IKEEXT) . (.Microsoft Corporation - IKE extension.) -- C:\Windows\System32\IKEEXT.DLL [737792]
O83 - Search Svchost Services: iphlpsvc (iphlpsvc) . (.Microsoft Corporation - Service that offers IPv6 connectivity over.) -- C:\Windows\System32\iphlpsvc.dll [838144]
O83 - Search Svchost Services: seclogon (seclogon) . (.Microsoft Corporation - Secondary Logon Service DLL.) -- C:\Windows\System32\seclogon.dll [25088]
O83 - Search Svchost Services: AppInfo (AppInfo) . (.Microsoft Corporation - Application Information Service.) -- C:\Windows\System32\appinfo.dll [75264]
O83 - Search Svchost Services: msiscsi (msiscsi) . (.Microsoft Corporation - iSCSI Discovery service.) -- C:\Windows\System32\iscsiexe.dll [116224]
O83 - Search Svchost Services: EapHost (EapHost) . (.Microsoft Corporation - Microsoft EAPHost service.) -- C:\Windows\System32\eapsvc.dll [87040]
O83 - Search Svchost Services: schedule (schedule) . (.Microsoft Corporation - Task Scheduler Service.) -- C:\Windows\System32\schedsvc.dll [822784]
O83 - Search Svchost Services: winmgmt (winmgmt) . (.Microsoft Corporation - WMI.) -- C:\Windows\System32\wbem\WMIsvc.dll [183808]
O83 - Search Svchost Services: browser (browser) . (.Microsoft Corporation - Computer Browser Service DLL.) -- C:\Windows\System32\browser.dll [105984]
O83 - Search Svchost Services: ProfSvc (ProfSvc) . (.Microsoft Corporation - ProfSvc.) -- C:\Windows\System32\profsvc.dll [244224]
O83 - Search Svchost Services: SessionEnv (SessionEnv) . (.Microsoft Corporation - Remote Desktop Configuration service.) -- C:\Windows\System32\SessEnv.dll [312320]
O83 - Search Svchost Services: wercplsupport (wercplsupport) . (.Microsoft Corporation - Problem Reports and Solutions.) -- C:\Windows\System32\wercplsupport.dll [68096]
O83 - Search Svchost Services: Themes (Themes) . (.Microsoft Corporation - Windows Shell Theme Service Dll.) -- C:\Windows\System32\themeservice.dll [44032]
O83 - Search Svchost Services: UserManager (UserManager) . (.Microsoft Corporation - UserMgr.) -- C:\Windows\System32\usermgr.dll [541184]
O83 - Search Svchost Services: wlidsvc (wlidsvc) . (.Microsoft Corporation - Microsoft® Account Service.) -- C:\Windows\System32\wlidsvc.dll [1565184]
O83 - Search Svchost Services: XblGameSave (XblGameSave) . (.Microsoft Corporation - Xbox Live Game Save Service.) -- C:\Windows\System32\XblGameSave.dll [733696]
O83 - Search Svchost Services: XblAuthManager (XblAuthManager) . (.Microsoft Corporation - Xbox Live Auth Manager.) -- C:\Windows\System32\XblAuthManager.dll [519680]
O83 - Search Svchost Services: DmEnrollmentSvc (DmEnrollmentSvc) . (.Microsoft Corporation - Windows Managent Service DLL.) -- C:\Windows\System32\Windows.Internal.Management.dll [193024]
O83 - Search Svchost Services: BDESVC (BDESVC) . (.Microsoft Corporation - BDE Service.) -- C:\Windows\System32\bdesvc.dll [307200]
O83 - Search Svchost Services: RetailDemo (RetailDemo) . (.Microsoft Corporation - RDXService.) -- C:\Windows\System32\RDXService.dll [696320]
O83 - Search Svchost Services: NetSetupSvc (NetSetupSvc) . (.Microsoft Corporation - Network Setup Service.) -- C:\Windows\System32\NetSetupSvc.dll [128000]
O83 - Search Svchost Services: dmwappushservice (dmwappushservice) . (.Microsoft Corporation - dmwappushsvc.) -- C:\Windows\System32\dmwappushsvc.dll [53760]
O83 - Search Svchost Services: DcpSvc (DcpSvc) . (.Microsoft Corporation - dcpsvc Task.) -- C:\Windows\System32\dcpsvc.dll [152064]
O83 - Search Svchost Services: XboxNetApiSvc (XboxNetApiSvc) . (.Microsoft Corporation - Xbox Live Networking Service.) -- C:\Windows\System32\XboxNetApiSvc.dll [802304]
O83 - Search Svchost Services: DsmSvc (DsmSvc) . (.Microsoft Corporation - Device Setup Manager.) -- C:\Windows\System32\DeviceSetupManager.dll [183808]
O83 - Search Svchost Services: NcaSvc (NcaSvc) . (.Microsoft Corporation - Microsoft Network Connectivity Assistant Se.) -- C:\Windows\System32\NcaSvc.dll [143360]
O83 - Search Svchost Services: UsoSvc (UsoSvc) . (.Microsoft Corporation - Update Session Orchestrator Core.) -- C:\Windows\System32\usocore.dll [234496]
O83 - Search Svchost Services: Rasauto (Rasauto) . (.Microsoft Corporation - Remote Access AutoDial Manager.) -- C:\Windows\System32\rasauto.dll [93184]
O83 - Search Svchost Services: Rasman (Rasman) . (.Microsoft Corporation - Remote Access Connection Manager.) -- C:\Windows\System32\rasmans.dll [587264]
O83 - Search Svchost Services: Remoteaccess (Remoteaccess) . (.Microsoft Corporation - Dynamic Interface Manager.) -- C:\Windows\System32\mprdim.dll [410112]
O83 - Search Svchost Services: SENS (SENS) . (.Microsoft Corporation - System Event Notification Service (SENS).) -- C:\Windows\System32\Sens.dll [57856]
O83 - Search Svchost Services: Sharedaccess (Sharedaccess) . (.Microsoft Corporation - Microsoft NAT Helper Components.) -- C:\Windows\System32\ipnathlp.dll [392704]
O83 - Search Svchost Services: Tapisrv (Tapisrv) . (.Microsoft Corporation - Microsoft® Windows(TM) Telephony Server.) -- C:\Windows\System32\tapisrv.dll [254976]
O83 - Search Svchost Services: wuauserv (wuauserv) . (.Microsoft Corporation - Windows Update Agent.) -- C:\Windows\System32\wuaueng.dll [1734656]
O83 - Search Svchost Services: BITS (BITS) . (.Microsoft Corporation - Background Intelligent Transfer Service.) -- C:\Windows\System32\qmgr.dll [956416]
O83 - Search Svchost Services: ShellHWDetection (ShellHWDetection) . (.Microsoft Corporation - Windows Shell Services Dll.) -- C:\Windows\System32\shsvcs.dll [544768]
O83 - Search Svchost Services: lfsvc (lfsvc) . (.Microsoft Corporation - Geolocation Service.) -- C:\Windows\System32\lfsvc.dll [22528]
O83 - Search Svchost Services: AppMgmt (AppMgmt) . (.Microsoft Corporation - Software installation Service.) -- C:\Windows\System32\appmgmts.dll [165376]

---\\ Firewall Active Exception List (FirewallRules) (O87) (5) - 3s
O87 - FAEL: "{1E08C7F0-78AB-427A-A7A3-CD16778C3F4E}" [In-None-P6-TRUE] .(...) -- C:\Program Files\Oracle\VirtualBox\vboxheadless.exe
O87 - FAEL: "{455ABF61-2AD4-4E95-9A73-3F071BBAC403}" [In-None-P17-TRUE] .(.VMware, Inc. - VMware Authorization Service.) -- E:\hamza\vmware-authd.exe
O87 - FAEL: "{DF6712BB-BB9E-495A-8032-3F77AC2B10BB}" [In-None-P6-TRUE] .(.VMware, Inc. - VMware Authorization Service.) -- E:\hamza\vmware-authd.exe
O87 - FAEL: "{9F194D34-88CD-481E-8B8C-39FCDC834F94}" [In-None-P17-TRUE] .(.VMware, Inc. - VMware Authorization Service.) -- E:\hamza\vmware-authd.exe
O87 - FAEL: "{D29FCF33-DA3F-4C5C-B8BB-9CB96034772A}" [In-None-P6-TRUE] .(.VMware, Inc. - VMware Authorization Service.) -- E:\hamza\vmware-authd.exe

---\\ General States of Services not Microsoft (EGS) (SR=Running, SS=Stopped) (18) - 40s
SR - Auto [2015/07/07 20:12:28] [ 82128] Adobe Acrobat Update Service (AdobeARMservice) . (.Adobe Systems Incorporated.) - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
SS - Demand [2015/06/16 22:33:14] [ 433784] BlueStacks Android Service (BstHdAndroidSvc) . (.BlueStack Systems, Inc..) - C:\Program Files\BlueStacks\HD-Service.exe
SR - Auto [2015/06/16 22:33:36] [ 413304] BlueStacks Log Rotator Service (BstHdLogRotatorSvc) . (.BlueStack Systems, Inc..) - C:\Program Files\BlueStacks\HD-LogRotatorService.exe
SR - Auto [2015/06/16 22:34:50] [ 822904] BlueStacks Updater Service (BstHdUpdaterSvc) . (.BlueStack Systems, Inc..) - C:\Program Files\BlueStacks\HD-UpdaterService.exe
SR - Auto [2015/01/28 14:08:58] [ 1349576] ESET Service (ekrn) . (.ESET.) - C:\Program Files\ESET\ESET Smart Security\ekrn.exe
SS - Auto [2015/07/05 02:59:22] [ 107848] ÎÏãÉ Google Update (gupdate) (gupdate) . (.Google Inc..) - C:\Program Files\Google\Update\GoogleUpdate.exe
SS - Demand [2015/07/05 02:59:22] [ 107848] ÎÏãÉ Google Update (gupdatem) (gupdatem) . (.Google Inc..) - C:\Program Files\Google\Update\GoogleUpdate.exe
SR - Auto [2015/06/18 08:39:46] [ 1871160] MBAMScheduler (MBAMScheduler) . (.Malwarebytes Corporation.) - C:\Program Files\Malwarebytes Anti-Malware\mbamscheduler.exe
SR - Auto [2015/06/18 08:39:50] [ 1133880] MBAMService (MBAMService) . (.Malwarebytes Corporation.) - C:\Program Files\Malwarebytes Anti-Malware\mbamservice.exe
SR - Auto [2014/01/16 16:19:36] [ 44104] RunSwUSB (RunSwUSB) . (.Copyright (C) 2012-2013.) - C:\Windows\runSW.exe
SS - Auto [2015/06/03 16:42:38] [ 327296] Skype Updater (SkypeUpdate) . (.Skype Technologies.) - C:\Program Files\Skype\Updater\Updater.exe
SR - Auto [2015/01/26 08:48:10] [ 3408384] TechSmith Uploader Service (TechSmith Uploader Service) . (.TechSmith Corporation.) - C:\Program Files\Common Files\TechSmith Shared\Uploader\UploaderService.exe
SS - Demand [2009/10/12 14:32:24] [ 191024] VMware Agent Service (ufad-ws60) . (.VMware, Inc..) - E:\hamza\vmware-ufad.exe
SR - Auto [2009/10/22 04:44:18] [ 113200] VMware Authorization Service (VMAuthdService) . (.VMware, Inc..) - E:\hamza\vmware-authd.exe
SR - Auto [2009/10/22 04:44:08] [ 334384] VMware DHCP Service (VMnetDHCP) . (.VMware, Inc..) - C:\Windows\System32\vmnetdhcp.exe
SR - Auto [2009/10/22 03:47:54] [ 563760] VMware USB Arbitration Service (VMUSBArbService) . (.VMware, Inc..) - C:\Program Files\Common Files\VMware\USB\vmware-usbarbitrator.exe
SR - Auto [2009/10/22 04:44:24] [ 395824] VMware NAT Service (VMware NAT Service) . (.VMware, Inc..) - C:\Windows\System32\vmnat.exe
SR - Auto [2013/05/07 15:06:18] [ 96768] WPS2.0 HW PBC Service (WPSService20) . (.Copyright (C) 2012~2013.) - C:\Program Files\Edimax\Edimax AC1200 Wireless LAN Driver\WPSService20.exe

---\\ Additional Scan (O88) (22) - 0s
C:\Windows\AutoKMS\AutoKMS.exe =>HackTool.AutoKMS
C:\WINDOWS\Tasks\DriverNavigator Scheduled Scan.job =>HackTool.AutoKMS
C:\WINDOWS\Tasks\DriverToolkit Autorun.job =>HackTool.AutoKMS
C:\WINDOWS\System32\Tasks\AutoKMS =>HackTool.AutoKMS
C:\WINDOWS\System32\Tasks\Driver Booster SkipUAC (samy) =>HackTool.AutoKMS
C:\WINDOWS\System32\Tasks\DriverNavigator Scheduled Scan =>HackTool.AutoKMS
C:\WINDOWS\System32\Tasks\DriverToolkit Autorun =>HackTool.AutoKMS
HKLM\SOFTWARE\Tencent =>PUP.Optional.TencentAddressBar
HKCU\SOFTWARE\Tencent =>PUP.Optional.TencentAddressBar
C:\Program Files\CinemaP-1.9cV17.07 =>PUP.Optional.CrossRider
C:\Program Files\MixVideoPlayer =>PUP.Optional.MixVideoPlayer
C:\Program Files\OLBPre =>PUP.Optional.MyPCBackup
C:\Program Files\Tencent =>PUP.Optional.TencentAddressBar
C:\ProgramData\Tencent =>PUP.Optional.TencentAddressBar
C:\Users\samy\AppData\Roaming\istartsurf =>PUP.Optional.IsStart
C:\Users\samy\AppData\Roaming\Tencent =>PUP.Optional.TencentAddressBar
C:\Users\samy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Tencent =>PUP.Optional.TencentAddressBar
C:\WINDOWS\Prefetch\MIXVIDEOPLAYERSETUP.EXE-AC20AE3B.pf =>PUP.Optional.MixVideoPlayer
C:\WINDOWS\Prefetch\OLBPRE.EXE-5CC5F889.pf =>PUP.Optional.MyPCBackup
C:\WINDOWS\Prefetch\SPEEDUPMYPC.EXE-65B6E02C.pf =>PUP.Optional.SpeedUpMyPC
C:\WINDOWS\Prefetch\SPEEDUPMYPC.TMP-74DD751A.pf =>PUP.Optional.SpeedUpMyPC
C:\Users\samy\AppData\Roaming\IDM\DwnlData\samy\ReimageRepair_541\ReimageRepair.exe =>PUP.Optional.ReImageRepair

---\\ Summary of the elements found on your workstation (10) - 0s
http://www.nicolascoolman.fr/hijacker-trovigo/ =>PUP.Optional.Trovigo
http://www.nicolascoolman.fr/trojan-vonteera/ =>Trojan.Vonteera
http://www.nicolascoolman.fr/pup-isstart/ =>PUP.Optional.IsStart
http://www.nicolascoolman.fr/adware-tencentaddressbar/ =>PUP.Optional.TencentAddressBar
http://www.nicolascoolman.fr/trojan-autokms/ =>HackTool.AutoKMS
http://www.nicolascoolman.fr/pup-crossrider/ =>PUP.Optional.CrossRider
http://www.nicolascoolman.fr/blog =>PUP.Optional.MixVideoPlayer
http://www.nicolascoolman.fr/pup-mypcbackup/ =>PUP.Optional.MyPCBackup
http://www.nicolascoolman.fr/blog =>PUP.Optional.SpeedUpMyPC
http://www.nicolascoolman.fr/rogue-reimagerepair/ =>PUP.Optional.ReImageRepair

~ End of the scan, 33115 items in 280 seconds (774)(0)()