Publicité
Publicité
Format du document : text/plain
Prévisualisation
Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 26-10-2017
Ran by libya (administrator) on LIBYA-PC (01-11-2017 02:24:41)
Running from C:\Users\libya\Desktop
Loaded Profiles: libya (Available Profiles: libya)
Platform: Windows 7 Home Premium Service Pack 1 (X64) Language: English (United States)
Internet Explorer Version 9 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(ESET) C:\Program Files\ESET\ESET Security\ekrn.exe
(Stardock Corporation) C:\Program Files\Dell\DellDock\DockLogin.exe
(Microsoft Corporation) C:\WINDOWS\System32\wlanext.exe
(Andrea Electronics Corporation) C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Tonec Inc.) C:\Program Files (x86)\Internet Download Manager\IDMan.exe
(Dell, Inc.) C:\Program Files (x86)\Dell\Dell Datasafe Online\NOBuAgent.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(Microsoft Corp.) C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
(SoftThinks SAS) C:\Program Files (x86)\Dell DataSafe Local Backup\SftService.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiMAX\Bin\AppSrv.exe
(Red Bend Ltd.) C:\Program Files\Intel\WiMAX\Bin\DMAgent.exe
(Tonec Inc.) C:\Program Files (x86)\Internet Download Manager\IEMonitor.exe
(SoftThinks - Dell) C:\Program Files (x86)\Dell DataSafe Local Backup\Toaster.exe
() C:\Program Files (x86)\Dell DataSafe Local Backup\Components\Scheduler\STService.exe
(SoftThinks - Dell) C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpd.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(ESET) C:\Program Files\ESET\ESET Security\egui.exe
(IObit) C:\Program Files (x86)\IObit\IObit Uninstaller\UninstallMonitor.exe
(Microsoft Corporation) C:\WINDOWS\System32\wbem\WMIADAP.exe
==================== Registry (Whitelisted) ===========================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2095400 2010-04-15] (Synaptics Incorporated)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-2688118449-975825915-405778391-1000\...\Run: [IDMan] => C:\Program Files (x86)\Internet Download Manager\IDMan.exe [3952696 2016-08-05] (Tonec Inc.)
Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock First Run.lnk [2012-01-25]
ShortcutTarget: Dell Dock First Run.lnk -> C:\Program Files\Dell\DellDock\DellDock.exe (Stardock Corporation)
Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock First Run.lnk [2012-01-25]
ShortcutTarget: Dell Dock First Run.lnk -> C:\Program Files\Dell\DellDock\DellDock.exe (Stardock Corporation)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
Tcpip\Parameters: [DhcpNameServer] 62.68.60.6 62.240.32.5
Tcpip\..\Interfaces\{C2E9A2D4-337F-493F-97F4-396FA988B386}: [NameServer] 212.74.114.193,212.74.114.129,192.168.1.1
Tcpip\..\Interfaces\{C2E9A2D4-337F-493F-97F4-396FA988B386}: [DhcpNameServer] 62.68.60.6 62.240.32.5
Internet Explorer:
==================
HKU\S-1-5-21-2688118449-975825915-405778391-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://g.msn.com/USCON/1
HKU\S-1-5-21-2688118449-975825915-405778391-1000\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.msn.com/USCON/1
SearchScopes: HKLM -> DefaultScope {54471EE3-C061-4CA1-BDE9-A6C87258D332} URL = hxxp://www.bing.com/search?q={searchTerms}&form=DLCDF8&pc=MDDC&src=IE-SearchBox
SearchScopes: HKLM -> {54471EE3-C061-4CA1-BDE9-A6C87258D332} URL = hxxp://www.bing.com/search?q={searchTerms}&form=DLCDF8&pc=MDDC&src=IE-SearchBox
SearchScopes: HKLM-x32 -> DefaultScope {54471EE3-C061-4CA1-BDE9-A6C87258D332} URL = hxxp://www.bing.com/search?q={searchTerms}&form=DLCDF8&pc=MDDC&src=IE-SearchBox
SearchScopes: HKLM-x32 -> {54471EE3-C061-4CA1-BDE9-A6C87258D332} URL = hxxp://www.bing.com/search?q={searchTerms}&form=DLCDF8&pc=MDDC&src=IE-SearchBox
SearchScopes: HKU\S-1-5-21-2688118449-975825915-405778391-1000 -> DefaultScope {54471EE3-C061-4CA1-BDE9-A6C87258D332} URL =
BHO: IDM integration (IDMIEHlprObj Class) -> {0055C089-8582-441B-A0BF-17B458C2A3A8} -> C:\Program Files (x86)\Internet Download Manager\IDMIECC64.dll [2016-07-13] (Internet Download Manager, Tonec Inc.)
BHO: ExplorerWnd Helper -> {10921475-03CE-4E04-90CE-E2E7EF20C814} -> C:\Program Files (x86)\IObit\IObit Uninstaller\UninstallExplorer.dll [2017-05-22] (IObit)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll [2016-07-31] (Oracle Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll [2016-07-31] (Oracle Corporation)
BHO-x32: IDM integration (IDMIEHlprObj Class) -> {0055C089-8582-441B-A0BF-17B458C2A3A8} -> C:\Program Files (x86)\Internet Download Manager\IDMIECC.dll [2016-07-13] (Internet Download Manager, Tonec Inc.)
BHO-x32: No Name -> {5C255C8A-E604-49b4-9D64-90988571CECB} -> No File
BHO-x32: Search Helper -> {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} -> C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll [2009-01-14] (Microsoft Corp.)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll [2016-08-13] (Oracle Corporation)
BHO-x32: Windows Live Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-01-22] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll [2016-08-13] (Oracle Corporation)
BHO-x32: Windows Live Toolbar Helper -> {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} -> C:\Program Files (x86)\Windows Live\Toolbar\wltcore.dll [2009-02-06] (Microsoft Corporation)
Handler-x32: cozi - {5356518D-FE9C-4E08-9C1F-1E872ECD367F} - C:\Program Files (x86)\Cozi Express\CoziProtocolHandler.dll [2011-05-05] (Cozi Group, Inc.)
Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll [2009-07-26] (Microsoft Corporation)
Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll [2009-07-26] (Microsoft Corporation)
FireFox:
========
FF DefaultProfile: mr8pap3w.default
FF ProfilePath: C:\Users\libya\AppData\Roaming\Mozilla\Firefox\Profiles\mr8pap3w.default [2017-11-01]
FF Extension: (Emoji Keyboard) - C:\Users\libya\AppData\Roaming\Mozilla\Firefox\Profiles\mr8pap3w.default\Extensions\@emojikeyboard.xpi [2016-08-20]
FF Extension: (Emoji Cheatsheet for GitHub, Basecamp etc.) - C:\Users\libya\AppData\Roaming\Mozilla\Firefox\Profiles\mr8pap3w.default\Extensions\jid1-Xo5SuA6qc1DFpw@jetpack.xpi [2016-08-20]
FF Extension: (Adblock Plus) - C:\Users\libya\AppData\Roaming\Mozilla\Firefox\Profiles\mr8pap3w.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2016-08-20]
FF Extension: (IDM integration) - C:\Program Files (x86)\Internet Download Manager\idmmzcc2.xpi [2016-08-03]
FF HKU\S-1-5-21-2688118449-975825915-405778391-1000\...\Firefox\Extensions: [mozilla_cc2@internetdownloadmanager.com] - C:\Program Files (x86)\Internet Download Manager\idmmzcc2.xpi
FF HKU\S-1-5-21-2688118449-975825915-405778391-1000\...\SeaMonkey\Extensions: [mozilla_cc2@internetdownloadmanager.com] - C:\Program Files (x86)\Internet Download Manager\idmmzcc2.xpi
FF HKU\S-1-5-21-2688118449-975825915-405778391-1000\...\SeaMonkey\Extensions: [mozilla_cc@internetdownloadmanager.com] - C:\Users\libya\AppData\Roaming\IDM\idmmzcc5
FF Extension: (IDM CC) - C:\Users\libya\AppData\Roaming\IDM\idmmzcc5 [2017-11-01] [not signed]
FF Plugin: @java.com/DTPlugin,version=10.80.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll [2016-07-31] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.80.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll [2016-07-31] (Oracle Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=10.80.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll [2016-08-13] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.80.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll [2016-08-13] (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\3.0.40624.0\npctrl.dll [2009-06-23] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8081.0709 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2009-07-10] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.33.5\npGoogleUpdate3.dll [2017-10-27] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.33.5\npGoogleUpdate3.dll [2017-10-27] (Google Inc.)
FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 -> C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll [2010-12-07] ()
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll [2015-09-24] (Adobe Systems Inc.)
Chrome:
=======
CHR StartupUrls: Default -> "hxxps://www.google.com.ly/"
CHR Profile: C:\Users\libya\AppData\Local\Google\Chrome\User Data\Default [2017-11-01]
CHR Extension: (العروض التقديمية) - C:\Users\libya\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2017-10-27]
CHR Extension: (المستندات) - C:\Users\libya\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2017-10-27]
CHR Extension: (Google Drive) - C:\Users\libya\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2016-07-29]
CHR Extension: (Youtube) - C:\Users\libya\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2016-07-29]
CHR Extension: (uBlock Adblock Plus) - C:\Users\libya\AppData\Local\Google\Chrome\User Data\Default\Extensions\fdecnmmdccnkogcidionikojplkjfgie [2017-10-27]
CHR Extension: (جداول البيانات) - C:\Users\libya\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2017-10-27]
CHR Extension: (مستندات Google في وضع عدم الاتصال) - C:\Users\libya\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-07-29]
CHR Extension: (أدبلوك جينيسيس بلوس - أد بلوكر) - C:\Users\libya\AppData\Local\Google\Chrome\User Data\Default\Extensions\jacihiikpacjaggdldhcdfjpbibbfjmh [2017-10-27]
CHR Extension: (AdbIøck Plus) - C:\Users\libya\AppData\Local\Google\Chrome\User Data\Default\Extensions\jmcpapjghbamlgkgfachlfajnpmpjgnb [2016-09-05]
CHR Extension: (IDM Integration Module) - C:\Users\libya\AppData\Local\Google\Chrome\User Data\Default\Extensions\ngpampappnmepgilojfohadhhmbhlaek [2017-10-27]
CHR Extension: (وكيل VPN مجاني من Hotspot Shield – إلغاء حظر مواقع) - C:\Users\libya\AppData\Local\Google\Chrome\User Data\Default\Extensions\nlbejmccbhkncgokjcmghpfloaajcffj [2017-10-27]
CHR Extension: (Chrome Web Store Payments) - C:\Users\libya\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-10-27]
CHR Extension: (Gmail) - C:\Users\libya\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2016-07-29]
CHR Extension: (Chrome Media Router) - C:\Users\libya\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-10-28]
CHR HKLM\...\Chrome\Extension: [ngpampappnmepgilojfohadhhmbhlaek] - C:\Program Files (x86)\Internet Download Manager\IDMGCExt.crx [2016-08-05]
==================== Services (Whitelisted) ====================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R2 DMAgent; C:\Program Files\Intel\WiMAX\Bin\DMAgent.exe [403456 2009-09-15] (Red Bend Ltd.) [File not signed]
R2 DockLoginService; C:\Program Files\Dell\DellDock\DockLogin.exe [155648 2009-06-09] (Stardock Corporation) [File not signed]
R2 ekrn; C:\Program Files\ESET\ESET Security\ekrn.exe [2625368 2017-06-13] (ESET)
S2 IObitUnSvr; C:\Program Files (x86)\IObit\IObit Uninstaller\IUService.exe [206112 2017-06-14] (IObit)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [315664 2009-09-21] ()
R2 WiMAXAppSrv; C:\Program Files\Intel\WiMAX\Bin\AppSrv.exe [907264 2009-09-15] (Intel(R) Corporation) [File not signed]
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2009-07-13] (Microsoft Corporation)
S2 Avira.ServiceHost; "C:\Program Files (x86)\Avira\Launcher\Avira.ServiceHost.exe" [X]
===================== Drivers (Whitelisted) ======================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
S3 bpenum; C:\Windows\System32\DRIVERS\bpenum.sys [84480 2016-07-30] (Intel Corporation) [File not signed]
S3 bpusb; C:\Windows\System32\Drivers\bpusb.sys [84992 2016-07-30] (Intel Corporation) [File not signed]
R1 eamonm; C:\Windows\System32\DRIVERS\eamonm.sys [132848 2017-11-01] (ESET)
R0 edevmon; C:\Windows\System32\DRIVERS\edevmon.sys [107344 2017-05-04] (ESET)
R1 ehdrv; C:\Windows\System32\DRIVERS\ehdrv.sys [180088 2017-11-01] (ESET)
R2 ekbdflt; C:\Windows\System32\DRIVERS\ekbdflt.sys [50752 2017-05-04] (ESET)
R1 epfw; C:\Windows\System32\DRIVERS\epfw.sys [78192 2017-05-04] (ESET)
R1 EpfwLWF; C:\Windows\System32\DRIVERS\EpfwLWF.sys [60544 2017-05-04] (ESET)
R1 epfwwfp; C:\Windows\System32\DRIVERS\epfwwfp.sys [102160 2017-11-01] (ESET)
R1 HWiNFO32; C:\Windows\SysWOW64\drivers\HWiNFO64A.SYS [27552 2016-07-30] (REALiX(tm))
R0 iaStorF; C:\Windows\System32\DRIVERS\iaStorF.sys [28008 2016-07-30] (Intel Corporation)
R3 IUFileFilter; C:\Program Files (x86)\IObit\IObit Uninstaller\drivers\win7_amd64\IUFileFilter.sys [21928 2017-06-06] (IObit.com)
R3 IURegProcessFilter; C:\Program Files (x86)\IObit\IObit Uninstaller\drivers\win7_amd64\IURegProcessFilter.sys [21872 2017-09-28] (IObit.com)
R3 L1C; C:\Windows\System32\DRIVERS\L1C62x64.sys [129224 2016-07-30] (Qualcomm Atheros Co., Ltd.)
R3 RTSUER; C:\Windows\System32\Drivers\RtsUer.sys [413912 2016-07-30] (Realsil Semiconductor Corporation)
R3 SmbDrvI; C:\Windows\System32\DRIVERS\Smb_driver_Intel.sys [33960 2016-07-30] (Synaptics Incorporated)
S3 taphss6; C:\Windows\System32\DRIVERS\taphss6.sys [42064 2016-08-05] (Anchorfree Inc.)
U3 TrueSight; C:\WINDOWS\System32\drivers\TrueSight.sys [28272 2017-10-31] ()
S3 vmci; \SystemRoot\system32\DRIVERS\vmci.sys [X]
S3 VMnetAdapter; system32\DRIVERS\vmnetadapter.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
==================== One Month Created files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2017-11-01 02:24 - 2017-11-01 02:25 - 000015999 _____ C:\Users\libya\Desktop\FRST.txt
2017-11-01 02:24 - 2017-11-01 02:24 - 000000000 ____D C:\FRST
2017-11-01 02:18 - 2017-11-01 02:19 - 002403328 _____ (Farbar) C:\Users\libya\Desktop\FRST64.exe
2017-11-01 00:55 - 2017-11-01 00:59 - 000000000 ____D C:\Users\libya\AppData\Local\Mirillis
2017-11-01 00:55 - 2017-11-01 00:55 - 000000000 ____D C:\Users\libya\AppData\Roaming\Mirillis
2017-11-01 00:55 - 2017-11-01 00:55 - 000000000 ____D C:\ProgramData\Mirillis
2017-11-01 00:54 - 2017-11-01 00:54 - 000002033 _____ C:\Users\libya\Desktop\Splash.lnk
2017-11-01 00:54 - 2017-11-01 00:54 - 000000000 ____D C:\Users\libya\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Mirillis
2017-11-01 00:53 - 2017-11-01 00:53 - 000000000 ____D C:\Program Files (x86)\Mirillis
2017-11-01 00:49 - 2017-11-01 00:49 - 000000000 ____D C:\Users\libya\AppData\Local\ESET
2017-11-01 00:46 - 2017-11-01 00:46 - 000001954 _____ C:\Users\Public\Desktop\حماية الدفع المصرفي.lnk
2017-11-01 00:46 - 2017-11-01 00:46 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ESET
2017-11-01 00:46 - 2017-11-01 00:46 - 000000000 ____D C:\ProgramData\ESET
2017-11-01 00:46 - 2017-11-01 00:46 - 000000000 ____D C:\Program Files\ESET
2017-11-01 00:23 - 2017-11-01 00:23 - 000001375 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\IObit Uninstaller.lnk
2017-11-01 00:23 - 2017-11-01 00:23 - 000001363 _____ C:\Users\Public\Desktop\IObit Uninstaller.lnk
2017-11-01 00:23 - 2017-11-01 00:23 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\IObit Uninstaller
2017-11-01 00:23 - 2017-11-01 00:23 - 000000000 ____D C:\Program Files (x86)\IObit
2017-11-01 00:00 - 2017-11-01 00:01 - 000001737 _____ C:\Users\libya\Desktop\ZHPCleaner.txt
2017-10-31 23:49 - 2017-10-31 23:49 - 000000801 _____ C:\Users\libya\Desktop\ZHPCleaner.lnk
2017-10-31 23:13 - 2017-10-31 23:13 - 000004218 _____ C:\Users\libya\Documents\rk_84AF.tmp.txt
2017-10-31 23:07 - 2017-10-31 23:07 - 000004182 _____ C:\Users\libya\Desktop\rk_3335.tmp.txt
2017-10-31 18:53 - 2017-10-31 18:54 - 000028272 _____ C:\Windows\system32\Drivers\TrueSight.sys
2017-10-31 18:34 - 2017-10-31 18:34 - 000000827 _____ C:\Users\Public\Desktop\RogueKiller.lnk
2017-10-31 18:34 - 2017-10-31 18:34 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RogueKiller
2017-10-31 18:34 - 2017-10-31 18:34 - 000000000 ____D C:\Program Files\RogueKiller
2017-10-31 17:58 - 2017-10-31 17:58 - 000000000 ____D C:\ProgramData\RogueKiller
2017-10-31 17:29 - 2017-10-31 17:29 - 000109783 _____ C:\Users\libya\Desktop\ZHPDiag.txt
2017-10-31 17:06 - 2017-11-01 00:01 - 000000000 ____D C:\Users\libya\AppData\Roaming\ZHP
2017-10-31 17:06 - 2017-10-31 23:49 - 000000000 ____D C:\Users\libya\AppData\Local\ZHP
2017-10-31 17:06 - 2017-10-31 17:06 - 000000791 _____ C:\Users\libya\Desktop\ZHPDiag.lnk
2017-10-31 17:03 - 2017-10-31 17:04 - 002924416 _____ C:\Users\libya\Desktop\ZHPDiag3.exe
2017-10-28 04:37 - 2017-10-28 04:37 - 000003122 _____ C:\Windows\System32\Tasks\Avira SystrayStartTrigger
==================== One Month Modified files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2017-11-01 02:24 - 2009-07-14 00:13 - 000782470 _____ C:\Windows\system32\PerfStringBackup.INI
2017-11-01 02:24 - 2009-07-13 22:20 - 000000000 ____D C:\Windows\inf
2017-11-01 02:10 - 2017-06-22 16:01 - 000132848 _____ (ESET) C:\Windows\system32\Drivers\eamonm.sys
2017-11-01 02:10 - 2017-05-04 13:18 - 000180088 _____ (ESET) C:\Windows\system32\Drivers\ehdrv.sys
2017-11-01 02:10 - 2017-05-04 13:18 - 000102160 _____ (ESET) C:\Windows\system32\Drivers\epfwwfp.sys
2017-11-01 02:10 - 2016-07-30 06:11 - 000000830 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2017-11-01 02:03 - 2009-07-13 23:45 - 000028128 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2017-11-01 02:03 - 2009-07-13 23:45 - 000028128 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2017-11-01 01:31 - 2012-01-25 18:15 - 000000000 ____D C:\Users\Default\AppData\Local\SoftThinks
2017-11-01 01:31 - 2012-01-25 18:15 - 000000000 ____D C:\Users\Default User\AppData\Local\SoftThinks
2017-11-01 01:31 - 2012-01-25 17:58 - 000000000 ____D C:\Program Files (x86)\Dell DataSafe Local Backup
2017-11-01 01:30 - 2009-07-14 00:08 - 000000006 ____H C:\Windows\Tasks\SA.DAT
2017-11-01 01:27 - 2016-07-28 18:56 - 000000000 ____D C:\Users\libya\AppData\Roaming\DMCache
2017-11-01 00:40 - 2016-08-15 21:20 - 000000000 ____D C:\ProgramData\Avira
2017-11-01 00:39 - 2016-08-15 21:22 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2017-11-01 00:38 - 2016-08-13 17:56 - 000000000 ____D C:\ProgramData\Package Cache
2017-11-01 00:27 - 2016-07-30 05:41 - 000000000 ____D C:\ProgramData\ProductData
2017-11-01 00:24 - 2016-07-30 05:40 - 000000000 ____D C:\Users\libya\AppData\LocalLow\IObit
2017-11-01 00:24 - 2016-07-30 05:40 - 000000000 ____D C:\ProgramData\IObit
2017-11-01 00:23 - 2016-07-30 05:40 - 000000000 ____D C:\Users\libya\AppData\Roaming\IObit
2017-10-31 16:51 - 2009-07-13 22:20 - 000000000 ____D C:\Windows\system32\NDF
2017-10-31 16:45 - 2016-08-13 17:58 - 000000224 _____ C:\Users\libya\Desktop\New Text Document.txt
2017-10-28 04:46 - 2009-07-13 22:20 - 000000000 __RHD C:\Users\Public\Libraries
2017-10-28 04:43 - 2016-08-14 23:19 - 000000000 ____D C:\Users\libya\AppData\Local\BlueStacks
2017-10-27 23:21 - 2016-07-25 23:19 - 000000000 ____D C:\Program Files\CCleaner
2017-10-27 15:58 - 2016-07-29 10:41 - 000002204 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2017-10-27 15:57 - 2016-07-29 10:41 - 000002192 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2017-10-27 15:36 - 2016-07-29 10:20 - 000003330 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2017-10-27 15:36 - 2016-07-29 10:20 - 000003202 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2017-10-27 15:06 - 2016-07-28 18:45 - 000000000 ____D C:\Users\libya\AppData\Local\Google
Some files in TEMP:
====================
2016-08-15 21:26 - 2016-08-15 21:26 - 000000000 ____D () C:\Users\libya\AppData\Local\Temp\avgnt.exe
==================== Bamital & volsnap ======================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2017-10-31 20:03
==================== End of FRST.txt ============================
Ran by libya (administrator) on LIBYA-PC (01-11-2017 02:24:41)
Running from C:\Users\libya\Desktop
Loaded Profiles: libya (Available Profiles: libya)
Platform: Windows 7 Home Premium Service Pack 1 (X64) Language: English (United States)
Internet Explorer Version 9 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(ESET) C:\Program Files\ESET\ESET Security\ekrn.exe
(Stardock Corporation) C:\Program Files\Dell\DellDock\DockLogin.exe
(Microsoft Corporation) C:\WINDOWS\System32\wlanext.exe
(Andrea Electronics Corporation) C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Tonec Inc.) C:\Program Files (x86)\Internet Download Manager\IDMan.exe
(Dell, Inc.) C:\Program Files (x86)\Dell\Dell Datasafe Online\NOBuAgent.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(Microsoft Corp.) C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
(SoftThinks SAS) C:\Program Files (x86)\Dell DataSafe Local Backup\SftService.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiMAX\Bin\AppSrv.exe
(Red Bend Ltd.) C:\Program Files\Intel\WiMAX\Bin\DMAgent.exe
(Tonec Inc.) C:\Program Files (x86)\Internet Download Manager\IEMonitor.exe
(SoftThinks - Dell) C:\Program Files (x86)\Dell DataSafe Local Backup\Toaster.exe
() C:\Program Files (x86)\Dell DataSafe Local Backup\Components\Scheduler\STService.exe
(SoftThinks - Dell) C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpd.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(ESET) C:\Program Files\ESET\ESET Security\egui.exe
(IObit) C:\Program Files (x86)\IObit\IObit Uninstaller\UninstallMonitor.exe
(Microsoft Corporation) C:\WINDOWS\System32\wbem\WMIADAP.exe
==================== Registry (Whitelisted) ===========================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2095400 2010-04-15] (Synaptics Incorporated)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-2688118449-975825915-405778391-1000\...\Run: [IDMan] => C:\Program Files (x86)\Internet Download Manager\IDMan.exe [3952696 2016-08-05] (Tonec Inc.)
Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock First Run.lnk [2012-01-25]
ShortcutTarget: Dell Dock First Run.lnk -> C:\Program Files\Dell\DellDock\DellDock.exe (Stardock Corporation)
Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock First Run.lnk [2012-01-25]
ShortcutTarget: Dell Dock First Run.lnk -> C:\Program Files\Dell\DellDock\DellDock.exe (Stardock Corporation)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
Tcpip\Parameters: [DhcpNameServer] 62.68.60.6 62.240.32.5
Tcpip\..\Interfaces\{C2E9A2D4-337F-493F-97F4-396FA988B386}: [NameServer] 212.74.114.193,212.74.114.129,192.168.1.1
Tcpip\..\Interfaces\{C2E9A2D4-337F-493F-97F4-396FA988B386}: [DhcpNameServer] 62.68.60.6 62.240.32.5
Internet Explorer:
==================
HKU\S-1-5-21-2688118449-975825915-405778391-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://g.msn.com/USCON/1
HKU\S-1-5-21-2688118449-975825915-405778391-1000\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.msn.com/USCON/1
SearchScopes: HKLM -> DefaultScope {54471EE3-C061-4CA1-BDE9-A6C87258D332} URL = hxxp://www.bing.com/search?q={searchTerms}&form=DLCDF8&pc=MDDC&src=IE-SearchBox
SearchScopes: HKLM -> {54471EE3-C061-4CA1-BDE9-A6C87258D332} URL = hxxp://www.bing.com/search?q={searchTerms}&form=DLCDF8&pc=MDDC&src=IE-SearchBox
SearchScopes: HKLM-x32 -> DefaultScope {54471EE3-C061-4CA1-BDE9-A6C87258D332} URL = hxxp://www.bing.com/search?q={searchTerms}&form=DLCDF8&pc=MDDC&src=IE-SearchBox
SearchScopes: HKLM-x32 -> {54471EE3-C061-4CA1-BDE9-A6C87258D332} URL = hxxp://www.bing.com/search?q={searchTerms}&form=DLCDF8&pc=MDDC&src=IE-SearchBox
SearchScopes: HKU\S-1-5-21-2688118449-975825915-405778391-1000 -> DefaultScope {54471EE3-C061-4CA1-BDE9-A6C87258D332} URL =
BHO: IDM integration (IDMIEHlprObj Class) -> {0055C089-8582-441B-A0BF-17B458C2A3A8} -> C:\Program Files (x86)\Internet Download Manager\IDMIECC64.dll [2016-07-13] (Internet Download Manager, Tonec Inc.)
BHO: ExplorerWnd Helper -> {10921475-03CE-4E04-90CE-E2E7EF20C814} -> C:\Program Files (x86)\IObit\IObit Uninstaller\UninstallExplorer.dll [2017-05-22] (IObit)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll [2016-07-31] (Oracle Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll [2016-07-31] (Oracle Corporation)
BHO-x32: IDM integration (IDMIEHlprObj Class) -> {0055C089-8582-441B-A0BF-17B458C2A3A8} -> C:\Program Files (x86)\Internet Download Manager\IDMIECC.dll [2016-07-13] (Internet Download Manager, Tonec Inc.)
BHO-x32: No Name -> {5C255C8A-E604-49b4-9D64-90988571CECB} -> No File
BHO-x32: Search Helper -> {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} -> C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll [2009-01-14] (Microsoft Corp.)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll [2016-08-13] (Oracle Corporation)
BHO-x32: Windows Live Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-01-22] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll [2016-08-13] (Oracle Corporation)
BHO-x32: Windows Live Toolbar Helper -> {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} -> C:\Program Files (x86)\Windows Live\Toolbar\wltcore.dll [2009-02-06] (Microsoft Corporation)
Handler-x32: cozi - {5356518D-FE9C-4E08-9C1F-1E872ECD367F} - C:\Program Files (x86)\Cozi Express\CoziProtocolHandler.dll [2011-05-05] (Cozi Group, Inc.)
Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll [2009-07-26] (Microsoft Corporation)
Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll [2009-07-26] (Microsoft Corporation)
FireFox:
========
FF DefaultProfile: mr8pap3w.default
FF ProfilePath: C:\Users\libya\AppData\Roaming\Mozilla\Firefox\Profiles\mr8pap3w.default [2017-11-01]
FF Extension: (Emoji Keyboard) - C:\Users\libya\AppData\Roaming\Mozilla\Firefox\Profiles\mr8pap3w.default\Extensions\@emojikeyboard.xpi [2016-08-20]
FF Extension: (Emoji Cheatsheet for GitHub, Basecamp etc.) - C:\Users\libya\AppData\Roaming\Mozilla\Firefox\Profiles\mr8pap3w.default\Extensions\jid1-Xo5SuA6qc1DFpw@jetpack.xpi [2016-08-20]
FF Extension: (Adblock Plus) - C:\Users\libya\AppData\Roaming\Mozilla\Firefox\Profiles\mr8pap3w.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2016-08-20]
FF Extension: (IDM integration) - C:\Program Files (x86)\Internet Download Manager\idmmzcc2.xpi [2016-08-03]
FF HKU\S-1-5-21-2688118449-975825915-405778391-1000\...\Firefox\Extensions: [mozilla_cc2@internetdownloadmanager.com] - C:\Program Files (x86)\Internet Download Manager\idmmzcc2.xpi
FF HKU\S-1-5-21-2688118449-975825915-405778391-1000\...\SeaMonkey\Extensions: [mozilla_cc2@internetdownloadmanager.com] - C:\Program Files (x86)\Internet Download Manager\idmmzcc2.xpi
FF HKU\S-1-5-21-2688118449-975825915-405778391-1000\...\SeaMonkey\Extensions: [mozilla_cc@internetdownloadmanager.com] - C:\Users\libya\AppData\Roaming\IDM\idmmzcc5
FF Extension: (IDM CC) - C:\Users\libya\AppData\Roaming\IDM\idmmzcc5 [2017-11-01] [not signed]
FF Plugin: @java.com/DTPlugin,version=10.80.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll [2016-07-31] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.80.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll [2016-07-31] (Oracle Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=10.80.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll [2016-08-13] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.80.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll [2016-08-13] (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\3.0.40624.0\npctrl.dll [2009-06-23] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8081.0709 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2009-07-10] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.33.5\npGoogleUpdate3.dll [2017-10-27] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.33.5\npGoogleUpdate3.dll [2017-10-27] (Google Inc.)
FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 -> C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll [2010-12-07] ()
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll [2015-09-24] (Adobe Systems Inc.)
Chrome:
=======
CHR StartupUrls: Default -> "hxxps://www.google.com.ly/"
CHR Profile: C:\Users\libya\AppData\Local\Google\Chrome\User Data\Default [2017-11-01]
CHR Extension: (العروض التقديمية) - C:\Users\libya\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2017-10-27]
CHR Extension: (المستندات) - C:\Users\libya\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2017-10-27]
CHR Extension: (Google Drive) - C:\Users\libya\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2016-07-29]
CHR Extension: (Youtube) - C:\Users\libya\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2016-07-29]
CHR Extension: (uBlock Adblock Plus) - C:\Users\libya\AppData\Local\Google\Chrome\User Data\Default\Extensions\fdecnmmdccnkogcidionikojplkjfgie [2017-10-27]
CHR Extension: (جداول البيانات) - C:\Users\libya\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2017-10-27]
CHR Extension: (مستندات Google في وضع عدم الاتصال) - C:\Users\libya\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-07-29]
CHR Extension: (أدبلوك جينيسيس بلوس - أد بلوكر) - C:\Users\libya\AppData\Local\Google\Chrome\User Data\Default\Extensions\jacihiikpacjaggdldhcdfjpbibbfjmh [2017-10-27]
CHR Extension: (AdbIøck Plus) - C:\Users\libya\AppData\Local\Google\Chrome\User Data\Default\Extensions\jmcpapjghbamlgkgfachlfajnpmpjgnb [2016-09-05]
CHR Extension: (IDM Integration Module) - C:\Users\libya\AppData\Local\Google\Chrome\User Data\Default\Extensions\ngpampappnmepgilojfohadhhmbhlaek [2017-10-27]
CHR Extension: (وكيل VPN مجاني من Hotspot Shield – إلغاء حظر مواقع) - C:\Users\libya\AppData\Local\Google\Chrome\User Data\Default\Extensions\nlbejmccbhkncgokjcmghpfloaajcffj [2017-10-27]
CHR Extension: (Chrome Web Store Payments) - C:\Users\libya\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-10-27]
CHR Extension: (Gmail) - C:\Users\libya\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2016-07-29]
CHR Extension: (Chrome Media Router) - C:\Users\libya\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-10-28]
CHR HKLM\...\Chrome\Extension: [ngpampappnmepgilojfohadhhmbhlaek] - C:\Program Files (x86)\Internet Download Manager\IDMGCExt.crx [2016-08-05]
==================== Services (Whitelisted) ====================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R2 DMAgent; C:\Program Files\Intel\WiMAX\Bin\DMAgent.exe [403456 2009-09-15] (Red Bend Ltd.) [File not signed]
R2 DockLoginService; C:\Program Files\Dell\DellDock\DockLogin.exe [155648 2009-06-09] (Stardock Corporation) [File not signed]
R2 ekrn; C:\Program Files\ESET\ESET Security\ekrn.exe [2625368 2017-06-13] (ESET)
S2 IObitUnSvr; C:\Program Files (x86)\IObit\IObit Uninstaller\IUService.exe [206112 2017-06-14] (IObit)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [315664 2009-09-21] ()
R2 WiMAXAppSrv; C:\Program Files\Intel\WiMAX\Bin\AppSrv.exe [907264 2009-09-15] (Intel(R) Corporation) [File not signed]
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2009-07-13] (Microsoft Corporation)
S2 Avira.ServiceHost; "C:\Program Files (x86)\Avira\Launcher\Avira.ServiceHost.exe" [X]
===================== Drivers (Whitelisted) ======================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
S3 bpenum; C:\Windows\System32\DRIVERS\bpenum.sys [84480 2016-07-30] (Intel Corporation) [File not signed]
S3 bpusb; C:\Windows\System32\Drivers\bpusb.sys [84992 2016-07-30] (Intel Corporation) [File not signed]
R1 eamonm; C:\Windows\System32\DRIVERS\eamonm.sys [132848 2017-11-01] (ESET)
R0 edevmon; C:\Windows\System32\DRIVERS\edevmon.sys [107344 2017-05-04] (ESET)
R1 ehdrv; C:\Windows\System32\DRIVERS\ehdrv.sys [180088 2017-11-01] (ESET)
R2 ekbdflt; C:\Windows\System32\DRIVERS\ekbdflt.sys [50752 2017-05-04] (ESET)
R1 epfw; C:\Windows\System32\DRIVERS\epfw.sys [78192 2017-05-04] (ESET)
R1 EpfwLWF; C:\Windows\System32\DRIVERS\EpfwLWF.sys [60544 2017-05-04] (ESET)
R1 epfwwfp; C:\Windows\System32\DRIVERS\epfwwfp.sys [102160 2017-11-01] (ESET)
R1 HWiNFO32; C:\Windows\SysWOW64\drivers\HWiNFO64A.SYS [27552 2016-07-30] (REALiX(tm))
R0 iaStorF; C:\Windows\System32\DRIVERS\iaStorF.sys [28008 2016-07-30] (Intel Corporation)
R3 IUFileFilter; C:\Program Files (x86)\IObit\IObit Uninstaller\drivers\win7_amd64\IUFileFilter.sys [21928 2017-06-06] (IObit.com)
R3 IURegProcessFilter; C:\Program Files (x86)\IObit\IObit Uninstaller\drivers\win7_amd64\IURegProcessFilter.sys [21872 2017-09-28] (IObit.com)
R3 L1C; C:\Windows\System32\DRIVERS\L1C62x64.sys [129224 2016-07-30] (Qualcomm Atheros Co., Ltd.)
R3 RTSUER; C:\Windows\System32\Drivers\RtsUer.sys [413912 2016-07-30] (Realsil Semiconductor Corporation)
R3 SmbDrvI; C:\Windows\System32\DRIVERS\Smb_driver_Intel.sys [33960 2016-07-30] (Synaptics Incorporated)
S3 taphss6; C:\Windows\System32\DRIVERS\taphss6.sys [42064 2016-08-05] (Anchorfree Inc.)
U3 TrueSight; C:\WINDOWS\System32\drivers\TrueSight.sys [28272 2017-10-31] ()
S3 vmci; \SystemRoot\system32\DRIVERS\vmci.sys [X]
S3 VMnetAdapter; system32\DRIVERS\vmnetadapter.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
==================== One Month Created files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2017-11-01 02:24 - 2017-11-01 02:25 - 000015999 _____ C:\Users\libya\Desktop\FRST.txt
2017-11-01 02:24 - 2017-11-01 02:24 - 000000000 ____D C:\FRST
2017-11-01 02:18 - 2017-11-01 02:19 - 002403328 _____ (Farbar) C:\Users\libya\Desktop\FRST64.exe
2017-11-01 00:55 - 2017-11-01 00:59 - 000000000 ____D C:\Users\libya\AppData\Local\Mirillis
2017-11-01 00:55 - 2017-11-01 00:55 - 000000000 ____D C:\Users\libya\AppData\Roaming\Mirillis
2017-11-01 00:55 - 2017-11-01 00:55 - 000000000 ____D C:\ProgramData\Mirillis
2017-11-01 00:54 - 2017-11-01 00:54 - 000002033 _____ C:\Users\libya\Desktop\Splash.lnk
2017-11-01 00:54 - 2017-11-01 00:54 - 000000000 ____D C:\Users\libya\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Mirillis
2017-11-01 00:53 - 2017-11-01 00:53 - 000000000 ____D C:\Program Files (x86)\Mirillis
2017-11-01 00:49 - 2017-11-01 00:49 - 000000000 ____D C:\Users\libya\AppData\Local\ESET
2017-11-01 00:46 - 2017-11-01 00:46 - 000001954 _____ C:\Users\Public\Desktop\حماية الدفع المصرفي.lnk
2017-11-01 00:46 - 2017-11-01 00:46 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ESET
2017-11-01 00:46 - 2017-11-01 00:46 - 000000000 ____D C:\ProgramData\ESET
2017-11-01 00:46 - 2017-11-01 00:46 - 000000000 ____D C:\Program Files\ESET
2017-11-01 00:23 - 2017-11-01 00:23 - 000001375 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\IObit Uninstaller.lnk
2017-11-01 00:23 - 2017-11-01 00:23 - 000001363 _____ C:\Users\Public\Desktop\IObit Uninstaller.lnk
2017-11-01 00:23 - 2017-11-01 00:23 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\IObit Uninstaller
2017-11-01 00:23 - 2017-11-01 00:23 - 000000000 ____D C:\Program Files (x86)\IObit
2017-11-01 00:00 - 2017-11-01 00:01 - 000001737 _____ C:\Users\libya\Desktop\ZHPCleaner.txt
2017-10-31 23:49 - 2017-10-31 23:49 - 000000801 _____ C:\Users\libya\Desktop\ZHPCleaner.lnk
2017-10-31 23:13 - 2017-10-31 23:13 - 000004218 _____ C:\Users\libya\Documents\rk_84AF.tmp.txt
2017-10-31 23:07 - 2017-10-31 23:07 - 000004182 _____ C:\Users\libya\Desktop\rk_3335.tmp.txt
2017-10-31 18:53 - 2017-10-31 18:54 - 000028272 _____ C:\Windows\system32\Drivers\TrueSight.sys
2017-10-31 18:34 - 2017-10-31 18:34 - 000000827 _____ C:\Users\Public\Desktop\RogueKiller.lnk
2017-10-31 18:34 - 2017-10-31 18:34 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RogueKiller
2017-10-31 18:34 - 2017-10-31 18:34 - 000000000 ____D C:\Program Files\RogueKiller
2017-10-31 17:58 - 2017-10-31 17:58 - 000000000 ____D C:\ProgramData\RogueKiller
2017-10-31 17:29 - 2017-10-31 17:29 - 000109783 _____ C:\Users\libya\Desktop\ZHPDiag.txt
2017-10-31 17:06 - 2017-11-01 00:01 - 000000000 ____D C:\Users\libya\AppData\Roaming\ZHP
2017-10-31 17:06 - 2017-10-31 23:49 - 000000000 ____D C:\Users\libya\AppData\Local\ZHP
2017-10-31 17:06 - 2017-10-31 17:06 - 000000791 _____ C:\Users\libya\Desktop\ZHPDiag.lnk
2017-10-31 17:03 - 2017-10-31 17:04 - 002924416 _____ C:\Users\libya\Desktop\ZHPDiag3.exe
2017-10-28 04:37 - 2017-10-28 04:37 - 000003122 _____ C:\Windows\System32\Tasks\Avira SystrayStartTrigger
==================== One Month Modified files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2017-11-01 02:24 - 2009-07-14 00:13 - 000782470 _____ C:\Windows\system32\PerfStringBackup.INI
2017-11-01 02:24 - 2009-07-13 22:20 - 000000000 ____D C:\Windows\inf
2017-11-01 02:10 - 2017-06-22 16:01 - 000132848 _____ (ESET) C:\Windows\system32\Drivers\eamonm.sys
2017-11-01 02:10 - 2017-05-04 13:18 - 000180088 _____ (ESET) C:\Windows\system32\Drivers\ehdrv.sys
2017-11-01 02:10 - 2017-05-04 13:18 - 000102160 _____ (ESET) C:\Windows\system32\Drivers\epfwwfp.sys
2017-11-01 02:10 - 2016-07-30 06:11 - 000000830 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2017-11-01 02:03 - 2009-07-13 23:45 - 000028128 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2017-11-01 02:03 - 2009-07-13 23:45 - 000028128 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2017-11-01 01:31 - 2012-01-25 18:15 - 000000000 ____D C:\Users\Default\AppData\Local\SoftThinks
2017-11-01 01:31 - 2012-01-25 18:15 - 000000000 ____D C:\Users\Default User\AppData\Local\SoftThinks
2017-11-01 01:31 - 2012-01-25 17:58 - 000000000 ____D C:\Program Files (x86)\Dell DataSafe Local Backup
2017-11-01 01:30 - 2009-07-14 00:08 - 000000006 ____H C:\Windows\Tasks\SA.DAT
2017-11-01 01:27 - 2016-07-28 18:56 - 000000000 ____D C:\Users\libya\AppData\Roaming\DMCache
2017-11-01 00:40 - 2016-08-15 21:20 - 000000000 ____D C:\ProgramData\Avira
2017-11-01 00:39 - 2016-08-15 21:22 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2017-11-01 00:38 - 2016-08-13 17:56 - 000000000 ____D C:\ProgramData\Package Cache
2017-11-01 00:27 - 2016-07-30 05:41 - 000000000 ____D C:\ProgramData\ProductData
2017-11-01 00:24 - 2016-07-30 05:40 - 000000000 ____D C:\Users\libya\AppData\LocalLow\IObit
2017-11-01 00:24 - 2016-07-30 05:40 - 000000000 ____D C:\ProgramData\IObit
2017-11-01 00:23 - 2016-07-30 05:40 - 000000000 ____D C:\Users\libya\AppData\Roaming\IObit
2017-10-31 16:51 - 2009-07-13 22:20 - 000000000 ____D C:\Windows\system32\NDF
2017-10-31 16:45 - 2016-08-13 17:58 - 000000224 _____ C:\Users\libya\Desktop\New Text Document.txt
2017-10-28 04:46 - 2009-07-13 22:20 - 000000000 __RHD C:\Users\Public\Libraries
2017-10-28 04:43 - 2016-08-14 23:19 - 000000000 ____D C:\Users\libya\AppData\Local\BlueStacks
2017-10-27 23:21 - 2016-07-25 23:19 - 000000000 ____D C:\Program Files\CCleaner
2017-10-27 15:58 - 2016-07-29 10:41 - 000002204 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2017-10-27 15:57 - 2016-07-29 10:41 - 000002192 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2017-10-27 15:36 - 2016-07-29 10:20 - 000003330 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2017-10-27 15:36 - 2016-07-29 10:20 - 000003202 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2017-10-27 15:06 - 2016-07-28 18:45 - 000000000 ____D C:\Users\libya\AppData\Local\Google
Some files in TEMP:
====================
2016-08-15 21:26 - 2016-08-15 21:26 - 000000000 ____D () C:\Users\libya\AppData\Local\Temp\avgnt.exe
==================== Bamital & volsnap ======================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2017-10-31 20:03
==================== End of FRST.txt ============================