~ Report of ZHPDiag v2015.5.31.53 - Nicolas Coolman (31/05/2015) ~ Launched by mohamed (02/06/2015 12:09:04 ص) ~ Facebook : https://www.facebook.com/nicolascoolman1 ~ Web forum address : http://forum.nicolascoolman.fr ~ Translated by ~ Version State : Updated version. ~ White List : Deactivate by user ~ Elevation of privilege : OK ~ User Account Control : Not Found ---\\ Internet browsers MSIE: Internet Explorer v8.0.6001.18702 (Defaut) MFIE: Mozilla Firefox 39.0 GCIE: Google Chrome v43.0.2357.81 OPIE: Opera Stable v29.0.1795.60 ---\\ Windows product information ~ Langage: Anglais Windows Automatic Updates : OK Windows Genuine Advantage : OK Microsoft Windows XP, 32-bit Service Pack 3 (Build 2600) ---\\ System protection software Avira Antivirus v15.0.10.434 ---\\ System optimization software CCleaner v3.00 ---\\ Sharing software PeerToPeer ---\\ Surveillance software ---\\ Information on the system ~ Processor: x86 Family 6 Model 15 Stepping 6, GenuineIntel ~ Operating System: 32 Bits Boot mode: Normal (Normal boot) Total RAM: 3292.4 MB (52% free) System Restore: Désactivé (Disabled) System drive C: has 19 GB (69%) free of 28 GB ---\\ Connection to the system mode ~ Computer Name: GERRARD-E4B94D2 ~ User Name: mohamed ~ All Users Names: SUPPORT_388945a0, mohamed, HelpAssistant, Guest, Administrator, ~ Unselected Option: None Logged in as Administrator ---\\ Environment variables ~ System Unit : C:\ ~ %AppZHP% : C:\Documents and Settings\mohamed\Application Data\ZHP\ ~ %AppData% : C:\Documents and Settings\mohamed\Application Data\ ~ %Desktop% : C:\Documents and Settings\mohamed\Desktop\ ~ %Favorites% : C:\Documents and Settings\mohamed\Favorites\ ~ %LocalAppData% : C:\Documents and Settings\mohamed\Local Settings\Application Data\ ~ %StartMenu% : C:\Documents and Settings\mohamed\Start Menu\ ~ %Windir% : C:\WINDOWS\ ~ %System% : C:\WINDOWS\system32\ ---\\ Enumeration of the disk units C: Hard drive, Flash drive, Thumb drive (Free 19 Go of 28 Go) D: Hard drive, Flash drive, Thumb drive (Free 50 Go of 140 Go) E: Hard drive, Flash drive, Thumb drive (Free 49 Go of 93 Go) F: Hard drive, Flash drive, Thumb drive (Free 58 Go of 93 Go) G: Hard drive, Flash drive, Thumb drive (Free 4 Go of 112 Go) ---\\ State of the Windows Security Center [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Associations] Application: OK [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Associations] Intl: OK [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Associations] XMLLookup: OK [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] Shell: OK [HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] Load: OK [HKLM\SYSTEM\CurrentControlSet\Services\COMSysApp] Type: OK [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install] LastSuccessTime : OK ~ Security Center: 45 Scanned in :0mn صs ---\\ Search Generic System Files [MD5.2BB75B7F548D82A099125D0C5971DE7D] - (.Microsoft Corporation - Windows Explorer.) (.03/07/2008 - 09:38:24 ص.) -- C:\WINDOWS\Explorer.exe [1033728] [MD5.E09551776D365BCA891BBFFB31EE4B4C] - (.Microsoft Corporation - Internet Extensions for Win32.) (.06/02/2014 - 01:26:52 ص.) -- C:\WINDOWS\system32\wininet.dll [920064] [MD5.53A8857723277B1D6D5EE60A9F85B117] - (.Microsoft Corporation - Windows NT Logon Application.) (.02/04/2009 - 12:56:36 م.) -- C:\WINDOWS\system32\Winlogon.exe [509440] [MD5.F6B7B1ECD7B41736BDB6FF4B092BCB79] - (.Microsoft Corporation - Ancillary Function Driver for WinSock.) (.17/08/2011 - 03:41:46 م.) -- C:\WINDOWS\system32\Drivers\AFD.sys [138496] [MD5.9F3A2F5AA6875C72BF062C712CFA2674] - (.Microsoft Corporation - IDE/ATAPI Port Driver.) (.13/04/2008 - 11:10:32 م.) -- C:\WINDOWS\system32\Drivers\atapi.sys [96512] [MD5.C885B02847F5D2FD45A24E219ED93B32] - (.Microsoft Corporation - CD-ROM File System Driver.) (.14/04/2008 - 10:00:00 ص.) -- C:\WINDOWS\system32\Drivers\Cdfs.sys [63744] [MD5.4B0A100EAF5C49EF3CCA8C641431EACC] - (.Microsoft Corporation - SCSI CD-ROM Driver.) (.02/05/2008 - 08:49:40 ص.) -- C:\WINDOWS\system32\Drivers\Cdrom.sys [62976] [MD5.D45926117EB9FA946A6AF572FBE1CAA3] - (.Microsoft Corporation - FIPS Crypto Driver.) (.14/04/2008 - 10:00:00 ص.) -- C:\WINDOWS\system32\Drivers\Fips.sys [44544] [MD5.573C7D0A32852B48F3058CFD8026F511] - (.Windows (R) Server 2003 DDK provider - High Definition Audio Bus Driver v1.0a.) (.14/04/2008 - 10:00:00 ص.) -- C:\WINDOWS\system32\Drivers\HDAudBus.sys [144384] [MD5.4A0B06AA8943C1E332520F7440C0AA30] - (.Microsoft Corporation - i8042 Port Driver.) (.14/04/2008 - 10:00:00 ص.) -- C:\WINDOWS\system32\Drivers\i8042prt.sys [52480] [MD5.083A052659F5310DD8B6A6CB05EDCF8E] - (.Microsoft Corporation - IMAPI Kernel Driver.) (.14/04/2008 - 10:00:00 ص.) -- C:\WINDOWS\system32\Drivers\Imapi.sys [42112] [MD5.CC748EA12C6EFFDE940EE98098BF96BB] - (.Microsoft Corporation - IP Network Address Translator.) (.14/04/2008 - 10:00:00 ص.) -- C:\WINDOWS\system32\Drivers\IpNat.sys [152832] [MD5.23C74D75E36E7158768DD63D92789A91] - (.Microsoft Corporation - IPSec Driver.) (.14/04/2008 - 10:00:00 ص.) -- C:\WINDOWS\system32\Drivers\IPSec.sys [75264] [MD5.FB2FCCC70F7174C7BF64F48E96D3ADF4] - (.Microsoft Corporation - Windows NT SMB Minirdr.) (.15/07/2011 - 03:29:36 م.) -- C:\WINDOWS\system32\Drivers\MRxSmb.sys [457856] [MD5.74B2B2F5BEA5E9A3DC021D685551BD3D] - (.Microsoft Corporation - MBT Transport driver.) (.14/04/2008 - 10:00:00 ص.) -- C:\WINDOWS\system32\Drivers\netBT.sys [162816] [MD5.4C51D5275AE8A16999EDFE7E647D00DE] - (.Microsoft Corporation - NT File System Driver.) (.18/11/2008 - 01:02:08 م.) -- C:\WINDOWS\system32\Drivers\ntfs.sys [576384] [MD5.5575FAF8F97CE5E713D108C2A58D7C7C] - (.Microsoft Corporation - Parallel Port Driver.) (.14/04/2008 - 10:00:00 ص.) -- C:\WINDOWS\system32\Drivers\Parport.sys [80128] [MD5.11B4A627BC9614B885C4969BFA5FF8A6] - (.Microsoft Corporation - RAS L2TP mini-port/call-manager driver.) (.14/04/2008 - 10:00:00 ص.) -- C:\WINDOWS\system32\Drivers\Rasl2tp.sys [51328] [MD5.47EA20320E3D6FDC7B7BB22B2B881CA6] - (.Microsoft Corporation - Microsoft RDP Device redirector.) (.04/09/2009 - 05:43:46 م.) -- C:\WINDOWS\system32\Drivers\rdpdr.sys [195712] [MD5.4C8FCB5CC53AAB716D810740FE59D025] - (.Microsoft Corporation - Volume Shadow Copy Driver.) (.14/04/2008 - 10:00:00 ص.) -- C:\WINDOWS\system32\Drivers\volsnap.sys [52352] ~ Generic Processes: Scanned in :0mn صs ---\\ Hidden files state (Hidden/Total) ~ Mes images (My Pictures) : 1/2 ~ Mes musiques (My Musics) : 1/2 ~ Mes Favoris (My Favorites) : 1/9 ~ Mes Documents (My Documents) : 1/8 ~ Mon Bureau (My Desktop) : 0/3 ~ Menu demarrer (Programs) : 1/29 ~ Hidden Files: Scanned in :0mn صs ---\\ Process running [MD5.5AC144F03B31AFAB6717AD3622D1680D] - (.Atheros - ACS.) -- C:\WINDOWS\system32\acs.exe [499796] [PID.208] [MD5.EC705D6ED3A7F3D9AE42F6239707D9FE] - (.Avira Operations GmbH & Co. KG - Antivirus Host Framework Service.) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe [434424] [PID.708] [MD5.7F4601AB692AD6707022CD61BA152348] - (...) -- C:\Program Files\TP-LINK\TP-LINK Wireless Client Utility\TWCU.exe [561263] [PID.1780] [MD5.EB7376A9F65736B659AAAF21F964BA89] - (.Intel Corporation - igfxTray Module.) -- C:\WINDOWS\system32\igfxtray.exe [141848] [PID.1788] [MD5.BD06FDEAC870D09856B965A88655D747] - (.Intel Corporation - hkcmd Module.) -- C:\WINDOWS\system32\hkcmd.exe [174104] [PID.1812] [MD5.756E7DACD8B6EDD26B8C62C2907CD845] - (.Intel Corporation - persistence Module.) -- C:\WINDOWS\system32\igfxpers.exe [144920] [PID.1804] [MD5.66177D4C99FD8B578C7C56DE445E4D5D] - (.Avira Operations GmbH & Co. KG - Avira system tray application.) -- C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [728312] [PID.1828] [MD5.0C03FB91E17987EED93F60007B08DAA0] - (.Google Inc. - Google Installer.) -- C:\Documents and Settings\mohamed\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [144200] [PID.1908] [MD5.4C2C4B30B67A695171822BC025D43DF5] - (.Skype Technologies S.A. - Skype.) -- C:\Program Files\Skype\Phone\Skype.exe [28920448] [PID.1964] [MD5.EC705D6ED3A7F3D9AE42F6239707D9FE] - (.Avira Operations GmbH & Co. KG - Antivirus Host Framework Service.) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe [434424] [PID.284] [MD5.0D32033DCB359FD98B4C3513EF849FE6] - (.Avira Operations GmbH & Co. KG - Avira.OE.ServiceHost.) -- C:\Program Files\Avira\My Avira\Avira.OE.ServiceHost.exe [201008] [PID.1460] [MD5.2E0B0A051FFAA86E358465BB0880D453] - (.Microsoft Corporation - Windows Update.) -- C:\WINDOWS\system32\wuauclt.exe [53784] [PID.3452] [MD5.C4EF32C1C0473392EF4204890AF8E457] - (.Google Inc. - Google Chrome.) -- C:\Documents and Settings\mohamed\Local Settings\Application Data\Google\Chrome\Application\chrome.exe [813896] [PID.3596] [MD5.E783984459E2992DCEBD32ADBDE28EE1] - (.Avira Operations GmbH & Co. KG - AntiVir shadow copy service.) -- C:\Program Files\Avira\AntiVir Desktop\avshadow.exe [428336] [PID.3568] [MD5.B654624161DD7C100ADAF1F0E7BBBF87] - (.Mozilla Corporation - Firefox.) -- C:\Program Files\Mozilla Firefox\firefox.exe [376944] [PID.2312] [MD5.F3198BA5BA8CC86D3F2DEA8C2ACA7385] - (.Nicolas Coolman - ZHPDiag.) -- C:\Program Files\ZHPDiag\ZHPDiag.exe [8212992] [PID.1548] [MD5.02FA2499A54B83581F72073853352B38] - (.Intel Corporation - igfxsrvc Module.) -- C:\WINDOWS\system32\igfxsrvc.exe [265752] [PID.2528] ~ Processes Running: Scanned in :0mn صs ---\\ Google Chrome, Start,Search,Extensions (G0,G1,G2) C:\Documents and Settings\mohamed\Local Settings\Application Data\Google\Chrome\User Data\Default\Preferences ---\\ Google Chrome Extension Folder G2 - EXT: C:\Documents and Settings\mohamed\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [__MSG_appName__] G2 - EXT: C:\Documents and Settings\mohamed\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [__MSG_appName__] G2 - EXT: C:\Documents and Settings\mohamed\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [__MSG_appName__] G2 - EXT: C:\Documents and Settings\mohamed\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [__MSG_appName__] G2 - EXT: C:\Documents and Settings\mohamed\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [__MSG_appName__] G2 - EXT: C:\Documents and Settings\mohamed\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [Chrome Hotword Shared Module] G2 - EXT: C:\Documents and Settings\mohamed\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [__MSG_APP_NAME__] G2 - EXT: C:\Documents and Settings\mohamed\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [__MSG_appName__] G2 - EXT: C:\Documents and Settings\mohamed\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [__MSG_appName__] G2 - EXT: C:\Documents and Settings\mohamed\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\gmlllbghnfkpflemihljekbapjopfjik [Bookmark Manager] G2 - EXT: C:\Documents and Settings\mohamed\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\nafaimnnclfjfedmmabolbppcngeolgf [iLivid] =>Adware.Bandoo G2 - EXT: C:\Documents and Settings\mohamed\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\mppnoffgpafgpgbaigljliadgbnhljfl [Ask App for iLivid] =>Adware.Bandoo ~ Google Lines Browser: 24 Scanned in :0mn صs ---\\ Mozilla Firefox,Plugins,Start,Search,Extensions (P2,M0,M1,M2,M3) P2 - FPN:Firefox Plugin Navigator . (...) -- C:\Program Files\Mozilla Firefox\browser\searchplugins\yahoo.xml P2 - FPN:Firefox Plugin Navigator . (...) -- C:\Program Files\Mozilla Firefox\browser\searchplugins\wikipedia.xml P2 - FPN:Firefox Plugin Navigator . (...) -- C:\Program Files\Mozilla Firefox\browser\searchplugins\twitter.xml P2 - FPN:Firefox Plugin Navigator . (...) -- C:\Program Files\Mozilla Firefox\browser\searchplugins\google.xml P2 - FPN:Firefox Plugin Navigator . (...) -- C:\Program Files\Mozilla Firefox\browser\searchplugins\eBay.xml P2 - FPN:Firefox Plugin Navigator . (...) -- C:\Program Files\Mozilla Firefox\browser\searchplugins\ddg.xml P2 - FPN:Firefox Plugin Navigator . (...) -- C:\Program Files\Mozilla Firefox\browser\searchplugins\bing.xml P2 - FPN:Firefox Plugin Navigator . (...) -- C:\Program Files\Mozilla Firefox\browser\searchplugins\amazondotcom.xml P2 - FPN: [HKLM] [@java.com/JavaPlugin] - (.Sun Microsystems, Inc. - Next Generation Java Plug-in 1.6.0_24 for Mozilla browsers.) -- C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll P2 - FPN: [HKLM] [@real.com/nppl3260;version=6.0.12.449] - (.RealNetworks, Inc. - RealPlayer(tm) LiveConnect-Enabled Plug-In.) -- C:\Program Files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll P2 - FPN: [HKLM] [@real.com/nprpjplug;version=6.0.12.448] - (.RealNetworks, Inc. - 6.0.12.448.) -- C:\Program Files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll P2 - FPN: [HKCU] [@tools.google.com/Google Update;version=3] - (.Google Inc. - Google Update.) -- C:\Documents and Settings\mohamed\Local Settings\Application Data\Google\Update\1.3.27.5\npGoogleUpdate3.dll P2 - FPN: [HKCU] [@tools.google.com/Google Update;version=9] - (.Google Inc. - Google Update.) -- C:\Documents and Settings\mohamed\Local Settings\Application Data\Google\Update\1.3.27.5\npGoogleUpdate3.dll ~ Firefox Browser: 13 Scanned in :0mn صs ---\\ Internet Explorer Extensions, Start, Search (R4,R3,R0,R1) R0 - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://ar.hao123.com R1 - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com R1 - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.com R1 - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com R1 - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com R1 - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com R1 - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:noadd-ons R1 - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:securityrisk R1 - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com R1 - HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURLs,Tabs = res://ieframe.dll/tabswelcome.htm R3 - URLSearchHook: Microsoft Url Search Hook - {CFBFAE00-17A6-11D0-99CB-00C04FD64497} . (.Google Inc. - Google Update.) (No version) -- (.not file.) R4 - HKLM\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter,EnabledV8 = 0 ~ IE Browser: 12 Scanned in :0mn صs ---\\ Internet Explorer, Proxy Management (R5) R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = no key R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyEnable = 0 R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,MigrateProxy = 1 R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,EnableHttp1_1 = 1 R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigProxy = wininet.dll ~ Proxy management: Scanned in :0mn صs ---\\ Line Analysis F0, F1, F2, F3 - IniFiles, Auto loading programs F2 - REG:system.ini: USERINIT=C:\WINDOWS\System32\Userinit.exe, F2 - REG:system.ini: Shell=C:\WINDOWS\explorer.exe F2 - REG:system.ini: VMApplet=rundll32 shell32,Control_RunDLL "sysdm.cpl" ~ Keys: Scanned in :0mn صs ---\\ Hosts file redirection (O1) ~ Le fichier hôte est sain (The hosts file is clean) (19) ~ Hosts File: Scanned in :0mn صs ---\\ Browser Helper Objects (O2) O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} . (.Sun Microsystems, Inc. - Java(TM) Platform SE binary.) -- C:\Program Files\Java\jre6\bin\jp2ssv.dll ~ BHO: 2 Scanned in :0mn صs ---\\ Auto loading programs from Registry and folders (O4) O4 - HKLM\..\Run: [IMJPMIG8.1] . (.Microsoft Corporation - Microsoft IME.) -- C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe O4 - HKLM\..\Run: [MSPY2002] . (...) -- C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe O4 - HKLM\..\Run: [PHIME2002ASync] . (.Microsoft Corporation - 微軟新注音輸入法 2002a.) -- C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe O4 - HKLM\..\Run: [PHIME2002A] . (.Microsoft Corporation - 微軟新注音輸入法 2002a.) -- C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe O4 - HKLM\..\Run: [TWCU] . (...) -- C:\Program Files\TP-LINK\TP-LINK Wireless Client Utility\TWCU.exe O4 - HKLM\..\Run: [IgfxTray] . (.Intel Corporation - igfxTray Module.) -- C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] . (.Intel Corporation - hkcmd Module.) -- C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [Persistence] . (.Intel Corporation - persistence Module.) -- C:\WINDOWS\system32\igfxpers.exe O4 - HKLM\..\Run: [avgnt] . (.Avira Operations GmbH & Co. KG - Avira system tray application.) -- C:\Program Files\Avira\AntiVir Desktop\avgnt.exe O4 - HKLM\..\Run: [Avira Systray] . (.Avira Operations GmbH & Co. KG - Avira.) -- C:\Program Files\Avira\My Avira\Avira.OE.Systray.exe O4 - HKCU\..\Run: [ctfmon.exe] . (.Microsoft Corporation - CTF Loader.) -- C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Google Update] . (.Google Inc. - Google Installer.) -- C:\Documents and Settings\mohamed\Local Settings\Application Data\Google\Update\GoogleUpdate.exe O4 - HKCU\..\Run: [Tango] . (.Tango Inc. - Tango.) -- C:\Program Files\Tango\Tango.exe O4 - HKCU\..\Run: [ares] . (.Ares Development Group - Ares p2p for windows.) -- C:\Program Files\Ares\Ares.exe O4 - HKCU\..\Run: [Skype] . (.Skype Technologies S.A. - Skype.) -- C:\Program Files\Skype\Phone\Skype.exe =>.Skype Technologies S.A. O4 - HKUS\.DEFAULT\..\Run: [ctfmon.exe] . (.Microsoft Corporation - CTF Loader.) -- C:\WINDOWS\system32\ctfmon.exe O4 - HKUS\S-1-5-18\..\Run: [ctfmon.exe] . (.Microsoft Corporation - CTF Loader.) -- C:\WINDOWS\system32\ctfmon.exe O4 - HKUS\S-1-5-19\..\Run: [ctfmon.exe] . (.Microsoft Corporation - CTF Loader.) -- C:\WINDOWS\system32\ctfmon.exe O4 - HKUS\S-1-5-20\..\Run: [ctfmon.exe] . (.Microsoft Corporation - CTF Loader.) -- C:\WINDOWS\system32\ctfmon.exe O4 - HKUS\.DEFAULT\..\RunOnce: [_nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N O4 - HKUS\S-1-5-18\..\RunOnce: [_nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N O4 - HKUS\S-1-5-19\..\RunOnce: [_nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N O4 - HKUS\S-1-5-20\..\RunOnce: [_nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N O4 - HKUS\S-1-5-21-436374069-73586283-1801674531-1003\..\Run: [ctfmon.exe] . (.Microsoft Corporation - CTF Loader.) -- C:\WINDOWS\system32\ctfmon.exe O4 - HKUS\S-1-5-21-436374069-73586283-1801674531-1003\..\Run: [Google Update] . (.Google Inc. - Google Installer.) -- C:\Documents and Settings\mohamed\Local Settings\Application Data\Google\Update\GoogleUpdate.exe O4 - HKUS\S-1-5-21-436374069-73586283-1801674531-1003\..\Run: [Tango] . (.Tango Inc. - Tango.) -- C:\Program Files\Tango\Tango.exe O4 - HKUS\S-1-5-21-436374069-73586283-1801674531-1003\..\Run: [ares] . (.Ares Development Group - Ares p2p for windows.) -- C:\Program Files\Ares\Ares.exe O4 - HKUS\S-1-5-21-436374069-73586283-1801674531-1003\..\Run: [Skype] . (.Skype Technologies S.A. - Skype.) -- C:\Program Files\Skype\Phone\Skype.exe =>.Skype Technologies S.A. ~ Application: Scanned in :0mn صs ---\\ Extra buttons on main IE button toolbar, or extra items in IE 'Tools' menu (O9) O9 - Extra button: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} -- Orphan key ~ IE Extra Buttons: Scanned in :0mn صs ---\\ Winsock hijacker (Layered Service Provider) (O10) O10 - WLSP:\000000000001\Winsock LSP File . (.Microsoft Corporation - Microsoft Windows Sockets 2.0 Service Provider.) -- C:\WINDOWS\system32\mswsock.dll O10 - WLSP:\000000000002\Winsock LSP File . (.Microsoft Corporation - LDAP RnR Provider DLL.) -- C:\WINDOWS\system32\winrnr.dll O10 - WLSP:\000000000003\Winsock LSP File . (.Microsoft Corporation - Microsoft Windows Sockets 2.0 Service Provider.) -- C:\WINDOWS\system32\mswsock.dll ~ Winsock: 3 Scanned in :0mn صs ---\\ Reset Web Settings' hijack (O14) O14 - IERESET.INF: SAFESITE_VALUE=SAFESITE_VALUE="ie.search.msn.com" ~ IE Paramètres WEB: Scanned in :0mn صs ---\\ Lop.com/Domain Hijackers (O17) O17 - HKLM\System\CCS\Services\Tcpip\..\{08AE567D-0397-4C07-B8E9-04970C9FEF33}: DhcpNameServer = 8.8.8.8 8.8.4.4 O17 - HKLM\System\CS1\Services\Tcpip\..\{08AE567D-0397-4C07-B8E9-04970C9FEF33}: DhcpNameServer = 8.8.8.8 8.8.4.4 O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 8.8.8.8 8.8.4.4 ~ Domain: Scanned in :0mn صs ---\\ Extra protocols (O18) O18 - Handler: wia - {13F3EA8B-91D7-4F0A-AD76-D2853AC8BECE} . (.Microsoft Corporation - WIA Scripting Layer.) -- C:\WINDOWS\system32\wiascr.dll O18 - Filter: text/webviewhtml - {733AC4CB-F1A4-11d0-B951-00A0C90312E1} . (.Microsoft Corporation - Windows Shell Common Dll.) -- C:\WINDOWS\system32\SHELL32.dll ~ Protocole Additionnel: Scanned in :0mn صs ---\\ AppInit_DLLs Registry value Autorun (O20) O20 - Winlogon Notify: crypt32chain . (.Microsoft Corporation - Crypto API32.) -- C:\WINDOWS\system32\crypt32.dll O20 - Winlogon Notify: cryptnet . (.Microsoft Corporation - Crypto Network Related API.) -- C:\WINDOWS\system32\cryptnet.dll O20 - Winlogon Notify: cscdll . (.Microsoft Corporation - Offline Network Agent.) -- C:\WINDOWS\system32\cscdll.dll O20 - Winlogon Notify: dimsntfy . (.Microsoft Corporation - DIMS Notification Handler.) -- C:\WINDOWS\system32\dimsntfy.dll O20 - Winlogon Notify: igfxcui . (.Intel Corporation - igfxdev Module.) -- C:\WINDOWS\system32\igfxdev.dll O20 - Winlogon Notify: ScCertProp . (.Microsoft Corporation - Common DLL to receive Winlogon notification.) -- C:\WINDOWS\system32\wlnotify.dll O20 - Winlogon Notify: Schedule . (.Microsoft Corporation - Common DLL to receive Winlogon notification.) -- C:\WINDOWS\system32\wlnotify.dll O20 - Winlogon Notify: sclgntfy . (.Microsoft Corporation - Secondary Logon Service Notification DLL.) -- C:\WINDOWS\system32\sclgntfy.dll O20 - Winlogon Notify: SensLogn . (.Microsoft Corporation - Common DLL to receive Winlogon notification.) -- C:\WINDOWS\system32\WlNotify.dll O20 - Winlogon Notify: termsrv . (.Microsoft Corporation - Common DLL to receive Winlogon notification.) -- C:\WINDOWS\system32\wlnotify.dll O20 - Winlogon Notify: wlballoon . (.Microsoft Corporation - Common DLL to receive Winlogon notification.) -- C:\WINDOWS\system32\wlnotify.dll ~ Winlogon: Scanned in :0mn صs ---\\ ShellServiceObjectDelayLoad (O21) O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} . (.Microsoft Corporation - Web Site Monitor.) -- C:\WINDOWS\system32\webcheck.dll O21 - SSODL: PostBootReminder - {7849596a-48ea-486e-8937-a2a3009f31a9} . (.Microsoft Corporation - Windows Shell Common Dll.) -- C:\WINDOWS\system32\SHELL32.dll O21 - SSODL: CDBurn - {fbeb8a05-beee-4442-804e-409d6c4515e9} . (.Microsoft Corporation - Windows Shell Common Dll.) -- C:\WINDOWS\system32\SHELL32.dll O21 - SSODL: SysTray - {35CEC8A3-2BE6-11D2-8773-92E220524153} . (.Microsoft Corporation - Systray shell service object.) -- C:\WINDOWS\system32\stobject.dll O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} . (.Microsoft Corporation - Windows Portable Device Shell Service Objec.) -- C:\WINDOWS\system32\WPDShServiceObj.dll ~ SSODL: 5 Scanned in :0mn صs ---\\ SharedTaskScheduler (O22) O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} . (.Microsoft Corporation - Shell Browser UI Library.) -- C:\WINDOWS\system32\browseui.dll O22 - SharedTaskScheduler: Browseui preloader - {8C7461EF-2B13-11d2-BE35-3078302C2030} . (.Microsoft Corporation - Shell Browser UI Library.) -- C:\WINDOWS\system32\browseui.dll ~ STS/SSO: Scanned in :0mn صs ---\\ Non Microsoft non disabled Windows XP/NT/2000 Services (O23) O23 - Service: TP-LINK Configuration Service (ACS) . (.Atheros - ACS.) - C:\WINDOWS\system32\acs.exe O23 - Service: Avira Mail Protection (AntiVirMailService) . (.Avira Operations GmbH & Co. KG - Antivirus MailScanner LSP Service.) - C:\Program Files\Avira\AntiVir Desktop\avmailc.exe O23 - Service: Avira Scheduler (AntiVirSchedulerService) . (.Avira Operations GmbH & Co. KG - Antivirus Host Framework Service.) - C:\Program Files\Avira\AntiVir Desktop\sched.exe O23 - Service: Avira Real-Time Protection (AntiVirService) . (.Avira Operations GmbH & Co. KG - Antivirus Host Framework Service.) - C:\Program Files\Avira\AntiVir Desktop\avguard.exe O23 - Service: Avira Web Protection (AntiVirWebService) . (.Avira Operations GmbH & Co. KG - AntiVir WebGuard Service.) - C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.exe O23 - Service: Avira Service Host (Avira.OE.ServiceHost) . (.Avira Operations GmbH & Co. KG - Avira.OE.ServiceHost.) - C:\Program Files\Avira\My Avira\Avira.OE.ServiceHost.exe O23 - Service: Skype Updater (SkypeUpdate) . (.Skype Technologies - Skype Updater Service.) - C:\Program Files\Skype\Updater\Updater.exe ~ Services: 7 Scanned in :0mn صs ---\\ Windows Active Desktop & MHTML Editor (O24) O24 - Desktop Component 0: My Current Home Page - file:About:Home O24 - Default MHTML Editor: Last - .(...) - (.not file.) O24 - Desktop General: BackupWallPaper - .(...) - C:\Documents and Settings\mohamed\Local Settings\Application Data\Microsoft\Wallpaper1.bmp O24 - Desktop General: WallPaper - .(...) - C:\Documents and Settings\mohamed\Local Settings\Application Data\Microsoft\Wallpaper1.bmp ~ Desktop Component: 4 Scanned in :0mn صs ---\\ BootExecute (BEX) (O34) O34 - HKLM BootExecute: (autocheck autochk *) - File not found ~ BEX: 1 Scanned in :0mn صs ---\\ Task Planned Automatically (039) [MD5.9765C6373A259BFE07BF281FE70EA66C] [APT] [Opera scheduled Autoupdate 1432568840] (.Opera Software.) -- C:\Program Files\Opera\launcher.exe [888440] [MD5.0C03FB91E17987EED93F60007B08DAA0] [APT] [GoogleUpdateTaskUserS-1-5-21-436374069-73586283-1801674531-1003Core] (.Google Inc..) -- C:\Documents and Settings\mohamed\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [144200] [MD5.0C03FB91E17987EED93F60007B08DAA0] [APT] [GoogleUpdateTaskUserS-1-5-21-436374069-73586283-1801674531-1003Core1d097026a3d4b38] (.Google Inc..) -- C:\Documents and Settings\mohamed\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [144200] O39 - APT: - (..) -- C:\WINDOWS\Tasks\User_Feed_Synchronization-{AE83B340-9C09-4A0B-B471-1C62F6E7EF7C}.job [426] O39 - APT: Opera scheduled Autoupdate 1432568840 - (.Opera Software.) -- C:\WINDOWS\Tasks\Opera scheduled Autoupdate 1432568840.job [402] O39 - APT: GoogleUpdateTaskUserS-1-5-21-436374069-73586283-1801674531-1003Core - (.Google Inc..) -- C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-436374069-73586283-1801674531-1003Core.job [878] O39 - APT: GoogleUpdateTaskUserS-1-5-21-436374069-73586283-1801674531-1003Core1d097026a3d4b38 - (.Google Inc..) -- C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-436374069-73586283-1801674531-1003Core1d097026a3d4b38.job [878] O39 - APT: - (..) -- C:\WINDOWS\Tasks\060184C3-9766-46a0-B258-F4518A0B2633.job [448] O39 - APT: - (..) -- C:\WINDOWS\Tasks\Microsoft Windows XP End of Service Notification Monthly.job [220] O39 - APT: - (..) -- C:\WINDOWS\Tasks\Microsoft Windows XP End of Service Notification Logon.job [226] ~ Scheduled Task: 11 Scanned in :0mn صs ---\\ ActiveSetup Installed Components (O40) O40 - ASIC: Windows Media Player - >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} . (.Microsoft Corporation - Microsoft Windows Media Player Setup Utility.) -- C:\WINDOWS\inf\unregmp2.exe =>.Microsoft Corporation O40 - ASIC: Outlook Express - >{881dd1c5-3dcf-431b-b061-f3f88e8be88a} . (.Microsoft Corporation - Windows NT User Data Migration Tool.) -- C:\WINDOWS\system32\shmgrate.exe =>.Microsoft Corporation O40 - ASIC: Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608500} . (.Sun Microsystems, Inc. - Java(TM) Platform SE binary.) -- C:\Program Files\Java\jre6\bin\regutils.dll O40 - ASIC: Internet Explorer Version Update - {12d0ed0d-0ee0-4f90-8827-78cefb8f4988} . (.Microsoft Corporation - IE Per User Active Setup Uninstall Utility.) -- C:\WINDOWS\system32\ieudinit.exe O40 - ASIC: Microsoft NetShow Player - {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} . (.Microsoft Corporation - Windows Media Player Extension.) -- C:\WINDOWS\system32\wmpdxm.dll =>.Microsoft Corporation O40 - ASIC: Microsoft Windows Media Player 6.4 - {22d6f312-b0f6-11d0-94ab-0080c74c7e95} . (.Microsoft Corporation - Windows Media Player Extension.) -- C:\WINDOWS\system32\wmpdxm.dll =>.Microsoft Corporation O40 - ASIC: Internet Explorer - {26923b43-4d38-484f-9b9e-de460746276c} . (.Microsoft Corporation - IE Per-User Initialization Utility.) -- C:\WINDOWS\system32\ie4uinit.exe.mui O40 - ASIC: Themes Setup - {2C7339CF-2B09-4501-B3F3-F3508C9228ED} . (.Microsoft Corporation - Windows Theme API.) -- C:\WINDOWS\system32\themeui.dll O40 - ASIC: Microsoft Outlook Express 6 - {44BBA840-CC51-11CF-AAFA-00AA00B6015C} . (.Microsoft Corporation - Outlook Express Setup Library.) -- C:\Program Files\Outlook Express\setup50.exe =>.Microsoft Corporation O40 - ASIC: NetMeeting 3.01 - {44BBA842-CC51-11CF-AAFA-00AA00B6015B} . (...) -- C:\WINDOWS\INF\msnetmtg.inf O40 - ASIC: Browser Customizations - {60B49E34-C7CC-11D0-8953-00A0C90347FF} . (.Microsoft Corporation - IEAK branding.) -- C:\WINDOWS\system32\iedkcs32.dll O40 - ASIC: Browsing Enhancements - {630b1da0-b465-11d1-9948-00c04f98bbc9} . (.Microsoft Corporation - Microsoft Internet Explorer FTP Folder Shell Extension.) -- C:\WINDOWS\system32\msieftp.dll O40 - ASIC: Microsoft Windows Media Player 11 - {6BF52A52-394A-11d3-B153-00C04F79FAA6} . (...) -- C:\WINDOWS\INF\wmp.inf =>.Microsoft Corporation O40 - ASIC: Address Book 6 - {7790769C-0471-11d2-AF11-00C04FA35D02} . (.Microsoft Corporation - Outlook Express Setup Library.) -- C:\Program Files\Outlook Express\setup50.exe =>.Microsoft Corporation O40 - ASIC: Windows Desktop Update - {89820200-ECBD-11cf-8B85-00AA005B4340} . (.Microsoft Corporation - Windows Shell Common Dll.) -- C:\WINDOWS\system32\shell32.dll O40 - ASIC: Internet Explorer - {89820200-ECBD-11cf-8B85-00AA005B4383} . (.Microsoft Corporation - IE Per-User Initialization Utility.) -- C:\WINDOWS\system32\ie4uinit.exe.mui O40 - ASIC: (no name) - {89B4C1CD-B018-4511-B0A1-5476DBF70820} . (.Microsoft Corporation - Microsoft .NET IE SECURITY REGISTRATION.) -- C:\WINDOWS\system32\mscories.dll O40 - ASIC: Adobe Flash Player - {D27CDB6E-AE6D-11cf-96B8-444553540000} . (.Adobe Systems, Inc. - Adobe Flash Player 10.2 r152.) -- C:\WINDOWS\system32\Macromed\Flash\Flash10n.ocx ~ Active Setup: 18 Scanned in :0mn صs ---\\ Drivers launched at startup (O41) O41 - Driver: (AFD) . (.Microsoft Corporation - Ancillary Function Driver for WinSock.) - C:\WINDOWS\system32\drivers\afd.sys O41 - Driver: (avipbb) . (.Avira Operations GmbH & Co. KG - Avira Driver for Security Enhancement.) - C:\WINDOWS\system32\DRIVERS\avipbb.sys O41 - Driver: (avkmgr) . (.Avira Operations GmbH & Co. KG - Avira Manager Driver.) - C:\WINDOWS\system32\DRIVERS\avkmgr.sys O41 - Driver: (i8042prt) . (.Microsoft Corporation - i8042 Port Driver.) - C:\WINDOWS\system32\DRIVERS\i8042prt.sys O41 - Driver: (intelppm) . (.Microsoft Corporation - Processor Device Driver.) - C:\WINDOWS\system32\DRIVERS\intelppm.sys O41 - Driver: (IPSec) . (.Microsoft Corporation - IPSec Driver.) - C:\WINDOWS\system32\DRIVERS\ipsec.sys O41 - Driver: (Kbdclass) . (.Microsoft Corporation - Keyboard Class Driver.) - C:\WINDOWS\system32\DRIVERS\kbdclass.sys O41 - Driver: (kbdhid) . (.Microsoft Corporation - HID Mouse Filter Driver.) - C:\WINDOWS\system32\DRIVERS\kbdhid.sys O41 - Driver: (Mouclass) . (.Microsoft Corporation - Mouse Class Driver.) - C:\WINDOWS\system32\DRIVERS\mouclass.sys O41 - Driver: (MRxSmb) . (.Microsoft Corporation - Windows NT SMB Minirdr.) - C:\WINDOWS\system32\DRIVERS\mrxsmb.sys O41 - Driver: (NetBIOS) . (.Microsoft Corporation - NetBIOS interface driver.) - C:\WINDOWS\system32\DRIVERS\netbios.sys O41 - Driver: (NetBT) . (.Microsoft Corporation - MBT Transport driver.) - C:\WINDOWS\system32\DRIVERS\netbt.sys O41 - Driver: (RasAcd) . (.Microsoft Corporation - RAS Automatic Connection Driver.) - C:\WINDOWS\system32\DRIVERS\rasacd.sys O41 - Driver: (Rdbss) . (.Microsoft Corporation - Redirected Drive Buffering SubSystem Driver.) - C:\WINDOWS\system32\DRIVERS\rdbss.sys O41 - Driver: (RDPCDD) . (.Microsoft Corporation - RDP Miniport.) - C:\WINDOWS\system32\DRIVERS\RDPCDD.sys O41 - Driver: (Serial) . (.Microsoft Corporation - Serial Device Driver.) - C:\WINDOWS\system32\DRIVERS\serial.sys O41 - Driver: (ssmdrv) . (.Avira GmbH - AVIRA SnapShot Driver.) - C:\WINDOWS\system32\DRIVERS\ssmdrv.sys O41 - Driver: (Tcpip) . (.Microsoft Corporation - TCP/IP Protocol Driver.) - C:\WINDOWS\system32\DRIVERS\tcpip.sys O41 - Driver: (TermDD) . (.Microsoft Corporation - Terminal Server Driver.) - C:\WINDOWS\system32\DRIVERS\termdd.sys O41 - Driver: (VgaSave) . (.Microsoft Corporation - VGA/Super VGA Video Driver.) - C:\WINDOWS\system32\drivers\vga.sys ~ Drivers: 40 Scanned in :0mn صs ---\\ Software installed (O42) O42 - Logiciel: Ares 2.1.7 - (.Ares Development Group.) [HKLM] -- Ares O42 - Logiciel: Avira Antivirus v15.0.10.434 - (.Avira Operations GmbH & Co. KG.) [HKLM] -- Avira Antivirus O42 - Logiciel: Avira v1.1.34.19732 - (.Avira Operations GmbH & Co. KG.) [HKLM] -- {316EB047-4627-4B63-B0A6-8CD32D07D962} O42 - Logiciel: Avira v1.1.34.19732 - (.Avira Operations GmbH & Co. KG.) [HKLM] -- {b5675cc4-ab8b-4945-8c1d-4c5479556d6a} O42 - Logiciel: CCleaner - (.Piriform.) [HKLM] -- CCleaner O42 - Logiciel: DFX for Winamp - (.Power Technology.) [HKLM] -- DFX for Winamp O42 - Logiciel: Google Chrome - (.Google Inc..) [HKCU] -- Google Chrome O42 - Logiciel: Intel(R) Graphics Media Accelerator Driver - (.Intel Corporation.) [HKLM] -- {F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA} O42 - Logiciel: Java(TM) 6 Update 24 - (.Oracle.) [HKLM] -- {26A24AE4-039D-4CA4-87B4-2F83216024FF} O42 - Logiciel: K-Lite Mega Codec Pack 5.4.4 - (...) [HKLM] -- KLiteCodecPack_is1 O42 - Logiciel: Mozilla Firefox 39.0 (x86 en-US) - (.Mozilla.) [HKLM] -- Mozilla Firefox 39.0 (x86 en-US) O42 - Logiciel: Mozilla Maintenance Service - (.Mozilla.) [HKLM] -- MozillaMaintenanceService O42 - Logiciel: Opera Stable 29.0.1795.60 - (.Opera Software ASA.) [HKLM] -- Opera 29.0.1795.60 O42 - Logiciel: Security Update for CAPICOM (KB931906) - (.Microsoft Corporation.) [HKLM] -- KB931906 O42 - Logiciel: Security Update for CAPICOM (KB931906) - (.Microsoft Corporation.) [HKLM] -- {0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A} O42 - Logiciel: Security Update for Windows Internet Explorer 8 (KB2510531) - (.Microsoft Corporation.) [HKLM] -- KB2510531-IE8 O42 - Logiciel: Security Update for Windows Internet Explorer 8 (KB2909210) - (.Microsoft Corporation.) [HKLM] -- KB2909210-IE8 O42 - Logiciel: Security Update for Windows Internet Explorer 8 (KB2909921) - (.Microsoft Corporation.) [HKLM] -- KB2909921-IE8 O42 - Logiciel: Skype™ 7.5 - (.Skype Technologies S.A..) [HKLM] -- {24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7} O42 - Logiciel: TP-LINK Wireless Client Utility - (.TP-LINK.) [HKLM] -- {3BD98AAF-61B5-46E0-A6C8-593C242C7C48} O42 - Logiciel: Tango - (.TangoMe, Inc..) [HKCU] -- Tango O42 - Logiciel: Unlocker 1.9.0 - (.Cedrick Collomb.) [HKLM] -- Unlocker O42 - Logiciel: WinRAR 4.00 (32-bit) - (.win.rar GmbH.) [HKLM] -- WinRAR archiver O42 - Logiciel: WinUtilities 10.32 Professional Edition - (.YL Computing, Inc.) [HKLM] -- {FC274982-5AAD-4C20-848D-4424A5043009}_is1 O42 - Logiciel: Winamp - (.Nullsoft, Inc.) [HKLM] -- Winamp ~ Logic: 32 Scanned in :0mn صs ---\\ HKCU & HKLM Software Keys [HKCU\Software\Ares] [HKCU\Software\Atheros] [HKCU\Software\Avira] [HKCU\Software\Baidu Security] [HKCU\Software\Baidu] [HKCU\Software\Classes] [HKCU\Software\Clients] [HKCU\Software\Cyberlink] [HKCU\Software\DFX] [HKCU\Software\DivXNetworks] [HKCU\Software\DownloadCenter] [HKCU\Software\DownloadManager] [HKCU\Software\GNU] [HKCU\Software\GSpot Appliance Corp] [HKCU\Software\Gabest] [HKCU\Software\Google] [HKCU\Software\Haali] [HKCU\Software\IM Providers] [HKCU\Software\Intel] [HKCU\Software\JavaSoft] [HKCU\Software\KasperskyLab] [HKCU\Software\Local AppWizard-Generated Applications] [HKCU\Software\MONOGRAM] [HKCU\Software\Macromedia] [HKCU\Software\MediaInfo] [HKCU\Software\MozillaPlugins] [HKCU\Software\Mozilla] [HKCU\Software\Netscape] [HKCU\Software\Opera Software] [HKCU\Software\Piriform] [HKCU\Software\Policies] [HKCU\Software\RealNetworks] [HKCU\Software\Skype] [HKCU\Software\WinRAR SFX] [HKCU\Software\WinRAR] [HKCU\Software\Winamp] [HKCU\Software\madFlac] [HKLM\Software\AVAST Software] [HKLM\Software\AthAppsCount] [HKLM\Software\Atheros] [HKLM\Software\Avira] [HKLM\Software\Baidu Security] [HKLM\Software\Baidu_Drp_pos] [HKLM\Software\BrowserChoice] [HKLM\Software\C07ft5Y] [HKLM\Software\CDDB] [HKLM\Software\Classes] [HKLM\Software\Clients] [HKLM\Software\Codec Tweak Tool] [HKLM\Software\Cyberlink] [HKLM\Software\DFX] [HKLM\Software\DivXNetworks] [HKLM\Software\DtsEncodeTools] [HKLM\Software\GNU] [HKLM\Software\Gabest] [HKLM\Software\Gemplus] [HKLM\Software\Google] [HKLM\Software\HaaliMkx] [HKLM\Software\IM Providers] [HKLM\Software\IMDrv] [HKLM\Software\Intel] [HKLM\Software\InterVideo] [HKLM\Software\Internet Download Manager] [HKLM\Software\JavaSoft] [HKLM\Software\KLCodecPack] [HKLM\Software\Macromedia] [HKLM\Software\MozillaPlugins] [HKLM\Software\Mozilla] [HKLM\Software\Nullsoft] [HKLM\Software\ODBC] [HKLM\Software\Opera Software] [HKLM\Software\Piriform] [HKLM\Software\Policies] [HKLM\Software\Program Groups] [HKLM\Software\RealNetworks] [HKLM\Software\RegisteredApplications] [HKLM\Software\S3R521] [HKLM\Software\Schlumberger] [HKLM\Software\Skype] [HKLM\Software\TP-LINK] [HKLM\Software\WinRAR] [HKLM\Software\Windows 3.1 Migration Status] [HKLM\Software\X-AVCSD] [HKLM\Software\baidu] [HKLM\Software\mozilla.org] ~ Key Software: 142 Scanned in :0mn صs ---\\ Contents of the Common Files folders (O43) O43 - CFD: 25/05/2015 - 05:23:20 م - [] ----D C:\Program Files\Common Files O43 - CFD: 25/05/2015 - 05:28:30 م - [] ----D C:\Program Files\Windows NT O43 - CFD: 25/05/2015 - 05:28:38 م - [] ----D C:\Program Files\MSN Gaming Zone O43 - CFD: 25/05/2015 - 05:28:46 م - [] ----D C:\Program Files\Unlocker O43 - CFD: 25/05/2015 - 05:28:54 م - [] ----D C:\Program Files\Windows Media Player =>.Microsoft Corporation O43 - CFD: 25/05/2015 - 05:29:38 م - [] ----D C:\Program Files\Internet Explorer O43 - CFD: 25/05/2015 - 05:29:38 م - [] ----D C:\Program Files\Outlook Express =>.Microsoft Corporation O43 - CFD: 25/05/2015 - 05:29:40 م - [] ----D C:\Program Files\NetMeeting O43 - CFD: 25/05/2015 - 05:29:44 م - [] ----D C:\Program Files\Movie Maker O43 - CFD: 25/05/2015 - 05:30:10 م - [0] --H-D C:\Program Files\WindowsUpdate O43 - CFD: 25/05/2015 - 05:31:22 م - [] ----D C:\Program Files\Java O43 - CFD: 25/05/2015 - 05:31:42 م - [] ----D C:\Program Files\WinRAR O43 - CFD: 25/05/2015 - 05:34:50 م - [0] --H-D C:\Program Files\Uninstall Information O43 - CFD: 25/05/2015 - 05:39:08 م - [] --H-D C:\Program Files\InstallShield Installation Information O43 - CFD: 25/05/2015 - 05:39:22 م - [] ----D C:\Program Files\TP-LINK O43 - CFD: 25/05/2015 - 05:42:46 م - [] ----D C:\Program Files\Intel O43 - CFD: 25/05/2015 - 06:38:20 م - [] ----D C:\Program Files\Ares O43 - CFD: 25/05/2015 - 06:38:36 م - [] ----D C:\Program Files\CCleaner O43 - CFD: 25/05/2015 - 06:39:06 م - [] ----D C:\Program Files\Avira O43 - CFD: 25/05/2015 - 06:41:32 م - [] ----D C:\Program Files\Tango O43 - CFD: 25/05/2015 - 06:42:40 م - [] ----D C:\Program Files\WinUtilities O43 - CFD: 25/05/2015 - 06:43:00 م - [] ----D C:\Program Files\Mozilla Maintenance Service O43 - CFD: 25/05/2015 - 06:43:24 م - [] ----D C:\Program Files\Winamp O43 - CFD: 25/05/2015 - 06:44:22 م - [] ----D C:\Program Files\DFX O43 - CFD: 25/05/2015 - 06:44:42 م - [] ----D C:\Program Files\K-Lite Codec Pack O43 - CFD: 25/05/2015 - 06:45:40 م - [] ----D C:\Program Files\Opera O43 - CFD: 25/05/2015 - 07:27:54 م - [] R---D C:\Program Files\Skype O43 - CFD: 26/05/2015 - 12:48:46 ص - [] ----D C:\Program Files\Microsoft.NET O43 - CFD: 29/05/2015 - 06:07:40 م - [] ----D C:\Program Files\Mozilla Firefox O43 - CFD: 31/05/2015 - 05:28:34 م - [] ----D C:\Program Files\Baidu Security O43 - CFD: 02/06/2015 - 12:06:38 ص - [] ----D C:\Program Files\ZHPDiag =>.Nicolas Coolman O43 - CFD: 25/05/2015 - 05:23:20 م - [] ----D C:\Program Files\Common Files\Microsoft Shared O43 - CFD: 25/05/2015 - 05:23:20 م - [] ----D C:\Program Files\Common Files\SpeechEngines O43 - CFD: 25/05/2015 - 05:23:20 م - [] ----D C:\Program Files\Common Files\ODBC O43 - CFD: 25/05/2015 - 05:29:38 م - [] ----D C:\Program Files\Common Files\System O43 - CFD: 25/05/2015 - 05:29:52 م - [] ----D C:\Program Files\Common Files\MSSoap O43 - CFD: 25/05/2015 - 05:29:52 م - [] ----D C:\Program Files\Common Files\Services O43 - CFD: 25/05/2015 - 06:44:22 م - [] ----D C:\Program Files\Common Files\DFX O43 - CFD: 25/05/2015 - 07:27:56 م - [] ----D C:\Program Files\Common Files\Skype O43 - CFD: 25/05/2015 - 05:22:50 م - [] -S--D C:\Documents and Settings\All Users\Application Data\Microsoft O43 - CFD: 25/05/2015 - 05:38:56 م - [] ----D C:\Documents and Settings\All Users\Application Data\TP-LINK O43 - CFD: 25/05/2015 - 05:39:32 م - [0] R-H-D C:\Documents and Settings\All Users\Application Data\Atheros O43 - CFD: 25/05/2015 - 06:38:30 م - [] ----D C:\Documents and Settings\All Users\Application Data\Google O43 - CFD: 25/05/2015 - 06:39:06 م - [] ----D C:\Documents and Settings\All Users\Application Data\Avira O43 - CFD: 25/05/2015 - 06:40:42 م - [] ----D C:\Documents and Settings\All Users\Application Data\APN O43 - CFD: 25/05/2015 - 06:43:00 م - [] ----D C:\Documents and Settings\All Users\Application Data\Mozilla O43 - CFD: 25/05/2015 - 06:44:22 م - [] ----D C:\Documents and Settings\All Users\Application Data\DFX O43 - CFD: 25/05/2015 - 06:47:46 م - [] ----D C:\Documents and Settings\All Users\Application Data\Skype O43 - CFD: 25/05/2015 - 06:48:46 م - [] ----D C:\Documents and Settings\All Users\Application Data\baidu O43 - CFD: 25/05/2015 - 06:48:54 م - [] ----D C:\Documents and Settings\All Users\Application Data\Baidu Security O43 - CFD: 25/05/2015 - 07:53:22 م - [] ----D C:\Documents and Settings\All Users\Application Data\AVAST Software O43 - CFD: 25/05/2015 - 09:02:32 م - [] ----D C:\Documents and Settings\All Users\Application Data\Package Cache O43 - CFD: 25/05/2015 - 05:23:04 م - [] R---D C:\Documents and Settings\All Users\Start Menu\Programs\Startup O43 - CFD: 25/05/2015 - 05:28:52 م - [] R---D C:\Documents and Settings\All Users\Start Menu\Programs\Accessories O43 - CFD: 25/05/2015 - 05:29:00 م - [] R---D C:\Documents and Settings\All Users\Start Menu\Programs\Administrative Tools O43 - CFD: 25/05/2015 - 05:29:18 م - [] R---D C:\Documents and Settings\All Users\Start Menu\Programs\Games O43 - CFD: 25/05/2015 - 05:31:42 م - [] ----D C:\Documents and Settings\All Users\Start Menu\Programs\WinRAR O43 - CFD: 25/05/2015 - 05:39:22 م - [] ----D C:\Documents and Settings\All Users\Start Menu\Programs\TP-LINK O43 - CFD: 25/05/2015 - 06:38:38 م - [] ----D C:\Documents and Settings\All Users\Start Menu\Programs\CCleaner O43 - CFD: 25/05/2015 - 06:41:34 م - [] ----D C:\Documents and Settings\All Users\Start Menu\Programs\Tango O43 - CFD: 25/05/2015 - 06:42:44 م - [] ----D C:\Documents and Settings\All Users\Start Menu\Programs\WinUtilities O43 - CFD: 25/05/2015 - 06:43:30 م - [] ----D C:\Documents and Settings\All Users\Start Menu\Programs\Winamp O43 - CFD: 25/05/2015 - 06:44:22 م - [] ----D C:\Documents and Settings\All Users\Start Menu\Programs\DFX Audio Enhancer O43 - CFD: 25/05/2015 - 06:44:48 م - [] ----D C:\Documents and Settings\All Users\Start Menu\Programs\K-Lite Codec Pack O43 - CFD: 25/05/2015 - 07:27:56 م - [] ----D C:\Documents and Settings\All Users\Start Menu\Programs\Skype O43 - CFD: 26/05/2015 - 12:45:46 ص - [] ----D C:\Documents and Settings\All Users\Start Menu\Programs\Avira O43 - CFD: 02/06/2015 - 12:06:40 ص - [] ----D C:\Documents and Settings\All Users\Start Menu\Programs\ZHP =>.Nicolas Coolman O43 - CFD: 25/05/2015 - 05:22:50 م - [] -S--D C:\Documents and Settings\mohamed\Application Data\Microsoft O43 - CFD: 25/05/2015 - 05:34:52 م - [] ----D C:\Documents and Settings\mohamed\Application Data\Identities O43 - CFD: 25/05/2015 - 05:34:58 م - [0] ----D C:\Documents and Settings\mohamed\Application Data\DMCache O43 - CFD: 25/05/2015 - 05:35:00 م - [] ----D C:\Documents and Settings\mohamed\Application Data\IDM O43 - CFD: 25/05/2015 - 06:41:00 م - [] ----D C:\Documents and Settings\mohamed\Application Data\Avira O43 - CFD: 25/05/2015 - 06:41:26 م - [] ----D C:\Documents and Settings\mohamed\Application Data\{7D39A975-0ED6-40C1-B29C-713A5A2816DC} O43 - CFD: 25/05/2015 - 06:43:24 م - [] ----D C:\Documents and Settings\mohamed\Application Data\Winamp O43 - CFD: 25/05/2015 - 06:43:58 م - [] ----D C:\Documents and Settings\mohamed\Application Data\Adobe O43 - CFD: 25/05/2015 - 06:45:24 م - [] ----D C:\Documents and Settings\mohamed\Application Data\RecLib O43 - CFD: 25/05/2015 - 06:47:26 م - [] ----D C:\Documents and Settings\mohamed\Application Data\Opera Software O43 - CFD: 25/05/2015 - 06:47:40 م - [] ----D C:\Documents and Settings\mohamed\Application Data\Mozilla O43 - CFD: 25/05/2015 - 06:48:48 م - [] ----D C:\Documents and Settings\mohamed\Application Data\Skype O43 - CFD: 27/05/2015 - 06:51:40 ص - [] ----D C:\Documents and Settings\mohamed\Application Data\Media Player Classic O43 - CFD: 27/05/2015 - 08:44:38 ص - [] ----D C:\Documents and Settings\mohamed\Application Data\Macromedia O43 - CFD: 02/06/2015 - 12:06:38 ص - [] ----D C:\Documents and Settings\mohamed\Application Data\ZHP =>.Nicolas Coolman O43 - CFD: 25/05/2015 - 05:30:40 م - [] -S--D C:\Documents and Settings\mohamed\Local Settings\Application Data\Microsoft O43 - CFD: 25/05/2015 - 06:38:36 م - [] ----D C:\Documents and Settings\mohamed\Local Settings\Application Data\Google O43 - CFD: 25/05/2015 - 06:38:38 م - [0] ----D C:\Documents and Settings\mohamed\Local Settings\Application Data\Temp O43 - CFD: 25/05/2015 - 06:41:30 م - [] ----D C:\Documents and Settings\mohamed\Local Settings\Application Data\tango O43 - CFD: 25/05/2015 - 06:45:30 م - [] ----D C:\Documents and Settings\mohamed\Local Settings\Application Data\Ares O43 - CFD: 25/05/2015 - 06:47:26 م - [] ----D C:\Documents and Settings\mohamed\Local Settings\Application Data\Opera Software O43 - CFD: 25/05/2015 - 06:47:40 م - [] ----D C:\Documents and Settings\mohamed\Local Settings\Application Data\Mozilla O43 - CFD: 25/05/2015 - 06:48:50 م - [] ----D C:\Documents and Settings\mohamed\Local Settings\Application Data\Skype O43 - CFD: 25/05/2015 - 07:10:12 م - [] ----D C:\Documents and Settings\mohamed\Local Settings\Application Data\DFX O43 - CFD: 28/05/2015 - 01:26:14 ص - [0] ----D C:\Documents and Settings\mohamed\Local Settings\Application Data\WMTools Downloaded Files O43 - CFD: 25/05/2015 - 05:31:42 م - [] ----D C:\WINDOWS\system32\Config\systemprofile\Start Menu\Programs\WinRAR O43 - CFD: 25/05/2015 - 05:30:06 م - [] R---D C:\WINDOWS\system32\Config\systemprofile\Start Menu\Programs\Accessories O43 - CFD: 25/05/2015 - 05:23:04 م - [] R---D C:\WINDOWS\system32\Config\systemprofile\Start Menu\Programs\Startup O43 - CFD: 25/05/2015 - 05:31:42 م - [] ----D C:\Documents and Settings\mohamed\Start Menu\Programs\WinRAR O43 - CFD: 25/05/2015 - 05:30:06 م - [] R---D C:\Documents and Settings\mohamed\Start Menu\Programs\Accessories O43 - CFD: 25/05/2015 - 05:23:04 م - [] R---D C:\Documents and Settings\mohamed\Start Menu\Programs\Startup O43 - CFD: 25/05/2015 - 06:38:22 م - [] ----D C:\Documents and Settings\mohamed\Start Menu\Programs\Ares O43 - CFD: 25/05/2015 - 06:40:28 م - [] ----D C:\Documents and Settings\mohamed\Start Menu\Programs\Google Chrome ~ Program Folder: 100 Scanned in :0mn صs ---\\ Last modified or created files under Windows and System32 (O44) O44 - LFC:[MD5.680E9E3564FE1326E735AEF3CB7CF7E4] - 01/06/2015 - 01:47:32 م ---A- . (...) -- C:\WINDOWS\setupapi.log [11550] O44 - LFC:[MD5.524D8D450622DB4A7875B111C299A76B] - 01/06/2015 - 08:55:12 م ---A- . (.No owner - AVZ Driver.) -- C:\WINDOWS\system32\Drivers\utqyoti2.sys [7168] O44 - LFC:[MD5.C680B7EDB94D24E9D8F073597E6EA0BC] - 01/06/2015 - 08:55:52 م ---A- . (...) -- C:\WINDOWS\SchedLgU.Txt [32604] O44 - LFC:[MD5.A1774AFBFFBC4F0B8E10EC1272A782A8] - 01/06/2015 - 08:55:52 م ---A- . (...) -- C:\WINDOWS\wiaservc.log [50] O44 - LFC:[MD5.6A2CB42966136854F4464516FBB4AE72] - 01/06/2015 - 09:52:20 م -S-A- . (...) -- C:\WINDOWS\bootstat.dat [2048] O44 - LFC:[MD5.AC014256CC68A2830D3D26FC9A7185E4] - 01/06/2015 - 09:53:26 م ---A- . (...) -- C:\WINDOWS\wiadebug.log [159] O44 - LFC:[MD5.B29BF0C1FA910980E0B08AA732FEBA17] - 01/06/2015 - 09:56:04 م ---A- . (...) -- C:\WINDOWS\system32\_WKERNEL.SYL [102] O44 - LFC:[MD5.4184EF9AB3E4B179D6CF700EA5992DA3] - 01/06/2015 - 09:58:04 م ---A- . (...) -- C:\WINDOWS\WindowsUpdate.log [1425581] O44 - LFC:[MD5.D41D8CD98F00B204E9800998ECF8427E] - 01/06/2015 - 09:59:06 م ---A- . (...) -- C:\WINDOWS\0.log [0] O44 - LFC:[MD5.392F6EECD24B54AD9FC0700127C61C4C] - 01/06/2015 - 10:50:10 م ---A- . (...) -- C:\DelFix.txt [270] O44 - LFC:[MD5.D28D6A13690AD54DB9C894EC56B9F26D] - 25/05/2015 - 04:21:50 م ---A- . (...) -- C:\WINDOWS\system32\$winnt$.0 [1318] O44 - LFC:[MD5.4D4FFA3DAD3C93478DD6B74A7FF09F36] - 25/05/2015 - 04:22:57 م R--A- . (...) -- C:\WINDOWS\SET3.tmp [1296669] O44 - LFC:[MD5.94CDD0FDE092E5893EB68AC3C183DF6D] - 25/05/2015 - 04:22:58 م R--A- . (...) -- C:\WINDOWS\SET4.tmp [1089593] O44 - LFC:[MD5.C88469E6A8796CD38BD931E18BFD6139] - 25/05/2015 - 04:22:59 م R--A- . (...) -- C:\WINDOWS\SET8.tmp [16535] O44 - LFC:[MD5.01C47C2ECED034EF6F8C1552A97CFF00] - 25/05/2015 - 04:23:08 م ----- . (...) -- C:\WINDOWS\system32\CONFIG.TMP [2577] O44 - LFC:[MD5.30475F091008E24550523515A023270D] - 25/05/2015 - 04:23:08 م ---A- . (...) -- C:\WINDOWS\system32\AUTOEXEC.NT [1688] O44 - LFC:[MD5.A956751EF995DF776F19831123868A83] - 25/05/2015 - 04:23:08 م ---A- . (.Microsoft Corporation - Battery Class Installer.) -- C:\WINDOWS\system32\batt.dll [8704] O44 - LFC:[MD5.C93C9FF7B04D772627A3646D89F7BF89] - 25/05/2015 - 04:23:08 م ---A- . (.Microsoft Corporation - Infra-Red Bus Enumerator.) -- C:\WINDOWS\system32\Drivers\irenum.sys [11264] O44 - LFC:[MD5.E8F945B7F0A938FEDB44AE9996898F6C] - 25/05/2015 - 04:23:08 م ---A- . (.Microsoft Corporation - Notepad.) -- C:\WINDOWS\NOTEPAD.EXE [69120] O44 - LFC:[MD5.3FE791B7714A592B17C4DD8C24B382AF] - 25/05/2015 - 04:23:08 م ---A- . (.Microsoft Corporation - Property Pages for Storage Devices.) -- C:\WINDOWS\system32\storprop.dll [74752] O44 - LFC:[MD5.F4DFD83153E8C9088AE2DB704107060D] - 25/05/2015 - 04:23:08 م ---A- . (.Microsoft Corporation - Task Manager.) -- C:\WINDOWS\TASKMAN.EXE [15360] O44 - LFC:[MD5.6CB26848BCDAA361B6EE21264FB362C3] - 25/05/2015 - 04:23:09 م ---A- . (...) -- C:\WINDOWS\system32\c_20127.nls [66082] O44 - LFC:[MD5.060110976C713D49CEFEE9A7291CE9D7] - 25/05/2015 - 04:23:09 م ---A- . (.Digi International - DGSETUP DLL.) -- C:\WINDOWS\system32\dgsetup.dll [85020] O44 - LFC:[MD5.1E8F9818D695F8759B125EE146BEB935] - 25/05/2015 - 04:23:09 م ---A- . (.Digi International, Inc. - Digi RealPort® Driver Upgrade.) -- C:\WINDOWS\system32\dgrpsetu.dll [176157] O44 - LFC:[MD5.5726CB81771655731D011ABD878CB65D] - 25/05/2015 - 04:23:09 م ---A- . (.Equinox Systems Inc. - Equinox Multiport Serial Coinstaller.) -- C:\WINDOWS\system32\EqnClass.Dll [103424] O44 - LFC:[MD5.FACEF4325FE4795647149DEC6FF728C7] - 25/05/2015 - 04:23:09 م ---A- . (.Microsoft Corporation - Infrared Class Coinstaller.) -- C:\WINDOWS\system32\irclass.dll [13312] O44 - LFC:[MD5.1C3C9B5B42A50D2D86CAF2EC05D34B3C] - 25/05/2015 - 04:23:09 م ---A- . (.Perle Systems Ltd. - Specialix MPS NT Upgrade CoInstaller.) -- C:\WINDOWS\system32\spxcoins.dll [24661] O44 - LFC:[MD5.6F8A509550FE8C92D07EE0143BF29BA1] - 25/05/2015 - 04:23:15 م ---A- . (...) -- C:\WINDOWS\system32\c_10010.nls [66082] O44 - LFC:[MD5.D2CA471D36A69D17F82D5C1B64FAEE39] - 25/05/2015 - 04:23:15 م ---A- . (...) -- C:\WINDOWS\system32\c_10029.nls [66082] O44 - LFC:[MD5.9CA501D2A8E6909C5B2E8C9274682BF1] - 25/05/2015 - 04:23:15 م ---A- . (...) -- C:\WINDOWS\system32\c_10082.nls [66082] O44 - LFC:[MD5.21E928C8E6ED8EEAB0D1AAEE82ACDD76] - 25/05/2015 - 04:23:15 م ---A- . (...) -- C:\WINDOWS\system32\c_852.nls [66594] O44 - LFC:[MD5.615DDBB5CBBAE8301C1E7FA95F1E66A3] - 25/05/2015 - 04:23:15 م R--A- . (.Microsoft Corporation - Albania Keyboard Layout.) -- C:\WINDOWS\system32\KBDAL.DLL [6656] O44 - LFC:[MD5.5B46568257EE49714564511D58E0DE53] - 25/05/2015 - 04:23:15 م R--A- . (.Microsoft Corporation - Croatian/Slovenian Keyboard Layout.) -- C:\WINDOWS\system32\kbdcr.dll [6656] O44 - LFC:[MD5.36E68E02AF2206FC4A8C73CAEABE1FB0] - 25/05/2015 - 04:23:15 م R--A- . (.Microsoft Corporation - Czech Keyboard Layout.) -- C:\WINDOWS\system32\kbdcz.dll [7168] O44 - LFC:[MD5.AFA30A44ED11A5F9A059A2767AB6A81A] - 25/05/2015 - 04:23:15 م R--A- . (.Microsoft Corporation - Czech_101 Keyboard Layout.) -- C:\WINDOWS\system32\kbdcz1.dll [6656] O44 - LFC:[MD5.90535C13EB54E1F2C95478F1B99DCCEB] - 25/05/2015 - 04:23:15 م R--A- . (.Microsoft Corporation - Czech_Programmer's Keyboard Layout.) -- C:\WINDOWS\system32\kbdcz2.dll [6656] O44 - LFC:[MD5.F3D1EEC756847C70E65335E8CA1AE64B] - 25/05/2015 - 04:23:15 م R--A- . (.Microsoft Corporation - Hungarian 101-key Keyboard Layout.) -- C:\WINDOWS\system32\kbdhu1.dll [5632] O44 - LFC:[MD5.CF92D95B5CB6649CB9D7E8D7616487A7] - 25/05/2015 - 04:23:15 م R--A- . (.Microsoft Corporation - Hungarian Keyboard Layout.) -- C:\WINDOWS\system32\kbdhu.dll [6656] O44 - LFC:[MD5.D199B05901C2407FC0F87444A24A4F3C] - 25/05/2015 - 04:23:15 م R--A- . (.Microsoft Corporation - Polish Keyboard Layout.) -- C:\WINDOWS\system32\kbdpl.dll [6656] O44 - LFC:[MD5.897663C8606357A8E86E57CDEA8EE219] - 25/05/2015 - 04:23:15 م R--A- . (.Microsoft Corporation - Polish Programmer's Keyboard Layout.) -- C:\WINDOWS\system32\kbdpl1.dll [5632] O44 - LFC:[MD5.C2E62748C875A310A6D5B10498238A68] - 25/05/2015 - 04:23:15 م R--A- . (.Microsoft Corporation - Romanian Keyboard Layout.) -- C:\WINDOWS\system32\kbdro.dll [5632] O44 - LFC:[MD5.552221E92D6BF55F8358B927F00696C3] - 25/05/2015 - 04:23:15 م R--A- . (.Microsoft Corporation - Serbian_Latin Keyboard Layout.) -- C:\WINDOWS\system32\kbdycl.dll [6656] O44 - LFC:[MD5.DCCE231E5BDF1401AC0F770EE16902AA] - 25/05/2015 - 04:23:15 م R--A- . (.Microsoft Corporation - Slovak Keyboard Layout.) -- C:\WINDOWS\system32\kbdsl.dll [6656] O44 - LFC:[MD5.5D038EEABA8EA438F6B5ABD5E91BC851] - 25/05/2015 - 04:23:16 م ---A- . (...) -- C:\WINDOWS\system32\C_28594.NLS [66082] O44 - LFC:[MD5.E22D1B9AC7854C0A654E4C4232074E49] - 25/05/2015 - 04:23:16 م ---A- . (...) -- C:\WINDOWS\system32\C_28595.NLS [66082] O44 - LFC:[MD5.B537ACFAB9E70F0EF48DB696A08ADC81] - 25/05/2015 - 04:23:16 م ---A- . (...) -- C:\WINDOWS\system32\C_28597.NLS [66082] O44 - LFC:[MD5.0A206B5CACD3CA70D2044DA691304765] - 25/05/2015 - 04:23:16 م ---A- . (...) -- C:\WINDOWS\system32\c_10006.nls [66082] O44 - LFC:[MD5.AF4A866226BD04ACF06135088D75BB63] - 25/05/2015 - 04:23:16 م ---A- . (...) -- C:\WINDOWS\system32\c_10007.nls [66082] O44 - LFC:[MD5.314E85390BEBDAE5D1E11DB2D8CBC6E9] - 25/05/2015 - 04:23:16 م ---A- . (...) -- C:\WINDOWS\system32\c_10017.nls [66082] O44 - LFC:[MD5.EFFDFF60A38CF648811BBCDD722ECF5E] - 25/05/2015 - 04:23:16 م ---A- . (...) -- C:\WINDOWS\system32\c_10081.nls [66082] O44 - LFC:[MD5.C37A21EE1ADFDC13FC707D97073148ED] - 25/05/2015 - 04:23:16 م ---A- . (...) -- C:\WINDOWS\system32\c_28599.nls [66082] O44 - LFC:[MD5.BAC7072B365F9648CA318154BA7E03EC] - 25/05/2015 - 04:23:16 م ---A- . (...) -- C:\WINDOWS\system32\c_737.nls [66594] O44 - LFC:[MD5.3E969213F35127D83DAB48FF1283E8E4] - 25/05/2015 - 04:23:16 م ---A- . (...) -- C:\WINDOWS\system32\c_855.nls [66594] O44 - LFC:[MD5.A8764750B22B528D85A691A52CB21856] - 25/05/2015 - 04:23:16 م ---A- . (...) -- C:\WINDOWS\system32\c_857.nls [66594] O44 - LFC:[MD5.5CD475CA7B87844DE1E0483B536F9AAE] - 25/05/2015 - 04:23:16 م ---A- . (...) -- C:\WINDOWS\system32\c_866.nls [66594] O44 - LFC:[MD5.780C444EB16B65E6DE96F794A732DA12] - 25/05/2015 - 04:23:16 م ---A- . (...) -- C:\WINDOWS\system32\c_869.nls [66594] O44 - LFC:[MD5.8BE0D77A873730B4EB1DAB7C6622CD46] - 25/05/2015 - 04:23:16 م ---A- . (...) -- C:\WINDOWS\system32\c_875.nls [66082] O44 - LFC:[MD5.0304318F189E3CC4A99FCCCB0A68147F] - 25/05/2015 - 04:23:16 م R--A- . (.Microsoft Corporation - Azerbaijan_Cyrillic Keyboard Layout.) -- C:\WINDOWS\system32\kbdaze.dll [5632] O44 - LFC:[MD5.712A218557F99D136735E0545E5AE223] - 25/05/2015 - 04:23:16 م R--A- . (.Microsoft Corporation - Azeri-Latin Keyboard Layout.) -- C:\WINDOWS\system32\kbdazel.dll [5632] O44 - LFC:[MD5.A1FA7A83F9D98D84419A8E64286284F4] - 25/05/2015 - 04:23:16 م R--A- . (.Microsoft Corporation - Belarusian Keyboard Layout.) -- C:\WINDOWS\system32\kbdblr.dll [5632] O44 - LFC:[MD5.1DF6E4758611E1328567BFE4D1B28E27] - 25/05/2015 - 04:23:16 م R--A- . (.Microsoft Corporation - Bulgarian Keyboard Layout.) -- C:\WINDOWS\system32\kbdbu.dll [5632] O44 - LFC:[MD5.BBB6C3346064C6AECEE6AD9F144B1AEA] - 25/05/2015 - 04:23:16 م R--A- . (.Microsoft Corporation - Estonia Keyboard Layout.) -- C:\WINDOWS\system32\kbdest.dll [6144] O44 - LFC:[MD5.1E81E1F3D5ACB3371CF73C1DE8F800BF] - 25/05/2015 - 04:23:16 م R--A- . (.Microsoft Corporation - Greek IBM 220 Keyboard Layout.) -- C:\WINDOWS\system32\kbdhe220.dll [5632] O44 - LFC:[MD5.D26533FDF72381947F823882BBA4A196] - 25/05/2015 - 04:23:16 م R--A- . (.Microsoft Corporation - Greek IBM 220 Latin Keyboard Layout.) -- C:\WINDOWS\system32\kbdhela2.dll [6144] O44 - LFC:[MD5.AC81A176BA35D1D7A5CD53137F3160FE] - 25/05/2015 - 04:23:16 م R--A- . (.Microsoft Corporation - Greek IBM 319 Keyboard Layout.) -- C:\WINDOWS\system32\kbdhe319.dll [5632] O44 - LFC:[MD5.F2312B8A76FD584ACD1D956688BEB6F8] - 25/05/2015 - 04:23:16 م R--A- . (.Microsoft Corporation - Greek IBM 319 Latin Keyboard Layout.) -- C:\WINDOWS\system32\kbdhela3.dll [6656] O44 - LFC:[MD5.83C99B438B3D6DBE7B838DA783E173AC] - 25/05/2015 - 04:23:16 م R--A- . (.Microsoft Corporation - Greek Keyboard Layout.) -- C:\WINDOWS\system32\kbdhe.dll [5632] O44 - LFC:[MD5.A93447C87DDB6B1945F1F5F87EAB68DC] - 25/05/2015 - 04:23:16 م R--A- . (.Microsoft Corporation - Greek_Latin Keyboard Layout.) -- C:\WINDOWS\system32\kbdgkl.dll [6144] O44 - LFC:[MD5.90CC52E8B52F0EC3A41D14FFBE789324] - 25/05/2015 - 04:23:16 م R--A- . (.Microsoft Corporation - Greek_Polytonic Keyboard Layout.) -- C:\WINDOWS\system32\kbdhept.dll [8192] O44 - LFC:[MD5.95D9106D39AB410A7F7EE513F181F84C] - 25/05/2015 - 04:23:16 م R--A- . (.Microsoft Corporation - Kazak_Cyrillic Keyboard Layout.) -- C:\WINDOWS\system32\kbdkaz.dll [5632] O44 - LFC:[MD5.FA30D45301EE66C33C0BF0F053DD9268] - 25/05/2015 - 04:23:16 م R--A- . (.Microsoft Corporation - Kyrgyz Keyboard Layout.) -- C:\WINDOWS\system32\kbdkyr.dll [5632] O44 - LFC:[MD5.C047165ED75FF85DB5A89EFEE3DA1133] - 25/05/2015 - 04:23:16 م R--A- . (.Microsoft Corporation - Latvia Keyboard Layout.) -- C:\WINDOWS\system32\kbdlv.dll [6144] O44 - LFC:[MD5.27D72BCF2B495FCDA073DBA5F189D7A1] - 25/05/2015 - 04:23:16 م R--A- . (.Microsoft Corporation - Latvia-QWERTY Keyboard Layout.) -- C:\WINDOWS\system32\kbdlv1.dll [6144] O44 - LFC:[MD5.F5B3B152A1D2752BC88928EB1E031B7E] - 25/05/2015 - 04:23:16 م R--A- . (.Microsoft Corporation - Lithuania Keyboard Layout.) -- C:\WINDOWS\system32\kbdlt.dll [5632] O44 - LFC:[MD5.AF05A41DBD1B0424B5CB47092152C7F6] - 25/05/2015 - 04:23:16 م R--A- . (.Microsoft Corporation - Lithuanian Keyboard Layout.) -- C:\WINDOWS\system32\kbdlt1.dll [5632] O44 - LFC:[MD5.29F119AD63CE42E616E35792DB01A4E0] - 25/05/2015 - 04:23:16 م R--A- . (.Microsoft Corporation - Mongolian Keyboard Layout.) -- C:\WINDOWS\system32\kbdmon.dll [5632] O44 - LFC:[MD5.B6E962B7AC1CB4A78876953D369BE6DD] - 25/05/2015 - 04:23:16 م R--A- . (.Microsoft Corporation - Russia(Typewriter) Keyboard Layout.) -- C:\WINDOWS\system32\kbdru1.dll [5632] O44 - LFC:[MD5.C6F23BC1411E91C179B0635893BB40A1] - 25/05/2015 - 04:23:16 م R--A- . (.Microsoft Corporation - Russian Keyboard Layout.) -- C:\WINDOWS\system32\kbdru.dll [5632] O44 - LFC:[MD5.E5D4673C83271FEEE1ED73E1E281A42B] - 25/05/2015 - 04:23:16 م R--A- . (.Microsoft Corporation - Serbian_Cyrillic Keyboard Layout.) -- C:\WINDOWS\system32\kbdycc.dll [5632] O44 - LFC:[MD5.93033C3EA80FB24B198B24DDECA07D4A] - 25/05/2015 - 04:23:16 م R--A- . (.Microsoft Corporation - Slovak(QWERTY) Keyboard Layout.) -- C:\WINDOWS\system32\kbdsl1.dll [6656] O44 - LFC:[MD5.F2D1EEF5ADCD5995C015AB3CB15C9415] - 25/05/2015 - 04:23:16 م R--A- . (.Microsoft Corporation - Tatar_Cyrillic Keyboard Layout.) -- C:\WINDOWS\system32\kbdtat.dll [5632] O44 - LFC:[MD5.188E56B70419D8353B8D4F3E381D9E52] - 25/05/2015 - 04:23:16 م R--A- . (.Microsoft Corporation - Turkish F Keyboard Layout.) -- C:\WINDOWS\system32\kbdtuf.dll [6144] O44 - LFC:[MD5.5D569F2951F878EF01D7723DC08682E9] - 25/05/2015 - 04:23:16 م R--A- . (.Microsoft Corporation - Turkish Q Keyboard Layout.) -- C:\WINDOWS\system32\kbdtuq.dll [6144] O44 - LFC:[MD5.3DDE3DC57C54452A313DC20F3019F8E3] - 25/05/2015 - 04:23:16 م R--A- . (.Microsoft Corporation - Ukrainian Keyboard Layout.) -- C:\WINDOWS\system32\kbdur.dll [5632] O44 - LFC:[MD5.4F9CFFBF05831BB81833FC64A5329C36] - 25/05/2015 - 04:23:16 م R--A- . (.Microsoft Corporation - Uzbek_Cyrillic Keyboard Layout.) -- C:\WINDOWS\system32\kbduzb.dll [5632] O44 - LFC:[MD5.35448F3A71EBBECF8E997FAD3A99327D] - 25/05/2015 - 04:23:17 م ---A- . (...) -- C:\WINDOWS\system32\c_28603.nls [66082] O44 - LFC:[MD5.6CC47FB4FA6E17B76BA1AE7AB0931FD4] - 25/05/2015 - 04:23:24 م ---A- . (...) -- C:\WINDOWS\system32\pid.PNF [4444] O44 - LFC:[MD5.C2D7189CDD37453234A9BBCB58E50883] - 25/05/2015 - 04:24:03 م ---A- . (.Microsoft Corporation - USB UI Dll.) -- C:\WINDOWS\system32\usbui.dll [74240] O44 - LFC:[MD5.A55DD7D8CED5D2624A9EE2DDA7BE0319] - 25/05/2015 - 04:24:19 م ---A- . (.Creative Technology Ltd. - ENSONIQ AudioPCI 97 WDM Audio Miniport.) -- C:\WINDOWS\system32\Drivers\es1371mp.sys [40704] O44 - LFC:[MD5.6CB08593487F5701D2D2254E693EAFCE] - 25/05/2015 - 04:24:19 م ---A- . (.Microsoft Corporation - Microsoft Kernel DRM Descrambler Filter.) -- C:\WINDOWS\system32\Drivers\drmk.sys [60160] O44 - LFC:[MD5.AEF54BF915BF5C2ED1B856EF94E89721] - 25/05/2015 - 04:24:19 م ---A- . (.Microsoft Corporation - Port Class (Class Driver for Port/Miniport.) -- C:\WINDOWS\system32\Drivers\portcls.sys [146048] O44 - LFC:[MD5.9B9F1C38D559047B8AC0DBA2D5FEBDE9] - 25/05/2015 - 04:24:19 م ---A- . (.Microsoft Corporation - User CSA Library.) -- C:\WINDOWS\system32\ksuser.dll [4096] O44 - LFC:[MD5.F1941197A42F9F373CC70042FC82C950] - 25/05/2015 - 04:24:19 م ---A- . (.Microsoft Corporation - WDM Streaming ActiveMovie Proxy.) -- C:\WINDOWS\system32\ksproxy.ax [129536] O44 - LFC:[MD5.813236B1183CFCF289E367BD5DE6E29E] - 25/05/2015 - 04:24:36 م ---A- . (.Microsoft Corporation - USB Video Class Driver.) -- C:\WINDOWS\system32\Drivers\usbvideo.sys [123008] O44 - LFC:[MD5.BB8DC530B88F47DD2A37915480AA6CD2] - 25/05/2015 - 04:24:36 م ---A- . (.Microsoft Corporation - Universal Serial Bus Camera DShow Extension.) -- C:\WINDOWS\system32\dshowext.ax [20992] O44 - LFC:[MD5.E2A57AC21705D3A05BB89BE201FA5C0C] - 25/05/2015 - 04:24:36 م ---A- . (.Microsoft Corporation - VfW MM Driver for WDM Video Capture Devices.) -- C:\WINDOWS\system32\vfwwdm32.dll [53760] O44 - LFC:[MD5.94BA90C6AF5C50FF5F7A6392514C4642] - 25/05/2015 - 04:24:36 م ---A- . (.Microsoft Corporation - Video Capture Interface Server.) -- C:\WINDOWS\system32\vidcap.ax [28672] O44 - LFC:[MD5.D5C3D43D0616FF699DB771928AC0E2CD] - 25/05/2015 - 04:24:36 م ---A- . (.Microsoft Corporation - WDM Streaming Crossbar.) -- C:\WINDOWS\system32\ksxbar.ax [43008] O44 - LFC:[MD5.264C642770CB6269A67AC8E0ED74419F] - 25/05/2015 - 04:24:36 م ---A- . (.Microsoft Corporation - WDM Streaming TvTuner.) -- C:\WINDOWS\system32\kstvtune.ax [61952] O44 - LFC:[MD5.C9EF69B25DFA1C0E7932CB02FB8A7E91] - 25/05/2015 - 04:24:36 م ---A- . (.Microsoft Corporation - WDM Streaming Video Capture.) -- C:\WINDOWS\system32\kswdmcap.ax [91136] O44 - LFC:[MD5.D41D8CD98F00B204E9800998ECF8427E] - 25/05/2015 - 04:24:38 م ----- . (...) -- C:\WINDOWS\Sti_Trace.log [0] O44 - LFC:[MD5.065639773D8B03F33577F6CDAEA21063] - 25/05/2015 - 04:24:43 م ---A- . (.Microsoft Corporation - Game Port Enumerator.) -- C:\WINDOWS\system32\Drivers\gameenum.sys [10624] O44 - LFC:[MD5.D9F724AA26C010A217C97606B160ED68] - 25/05/2015 - 04:24:54 م ---A- . (.Microsoft Corporation - AudStub Driver.) -- C:\WINDOWS\system32\Drivers\audstub.sys [3072] O44 - LFC:[MD5.325BB26842FC7CCC1FCCE2C457317F3E] - 25/05/2015 - 04:24:56 م ---A- . (.Microsoft Corporation - MS Proxy Clock.) -- C:\WINDOWS\system32\Drivers\MSPCLOCK.sys [5376] O44 - LFC:[MD5.8B83F3ED0F1688B4958F77CD6D2BF290] - 25/05/2015 - 04:24:57 م ---A- . (.Microsoft Corporation - System Audio WDM Filter.) -- C:\WINDOWS\system32\Drivers\sysaudio.sys [60800] O44 - LFC:[MD5.692BCF44383D056AED41B045A323D378] - 25/05/2015 - 04:24:58 م ---A- . (.Microsoft Corporation - Kernel Mode Audio Mixer.) -- C:\WINDOWS\system32\Drivers\kmixer.sys [172416] O44 - LFC:[MD5.6768ACF64B18196494413695F0C3A00F] - 25/05/2015 - 04:24:59 م ---A- . (.Microsoft Corporation - MMSYSTEM Wave/Midi API mapper.) -- C:\WINDOWS\system32\Drivers\wdmaud.sys [83072] O44 - LFC:[MD5.77813007BA6265C4B6098187E6ED79D2] - 25/05/2015 - 04:24:59 م ---A- . (.Microsoft Corporation - Microsoft IP Test Driver.) -- C:\WINDOWS\system32\Drivers\StreamIP.sys [15232] O44 - LFC:[MD5.7366AF0CA5F98A7653851FC2C1D05B0D] - 25/05/2015 - 04:24:59 م ---A- . (.Microsoft Corporation - WDM Streaming IPSINK Property Set Interface.) -- C:\WINDOWS\system32\ipsink.ax [16384] O44 - LFC:[MD5.BAD59648BA099DA4A17680B39730CB3D] - 25/05/2015 - 04:25:00 م ---A- . (.Microsoft Corporation - MS Proxy Quality Manager.) -- C:\WINDOWS\system32\Drivers\MSPQM.sys [4992] O44 - LFC:[MD5.8F5FCFF8E8848AFAC920905FBD9D33C8] - 25/05/2015 - 04:25:01 م ---A- . (.Microsoft Corporation - Microsoft Kernel DRM Audio Descrambler Filt.) -- C:\WINDOWS\system32\Drivers\drmkaud.sys [2944] O44 - LFC:[MD5.7FF1F1FD8609C149AA432F95A8163D97] - 25/05/2015 - 04:25:02 م ---A- . (.Microsoft Corporation - Microsoft IP Driver.) -- C:\WINDOWS\system32\Drivers\NdisIP.sys [10880] O44 - LFC:[MD5.8A208DFCF89792A484E76C40E5F50B45] - 25/05/2015 - 04:25:03 م ---A- . (.Microsoft Corporation - Microsoft Kernel DLS Synthesizer.) -- C:\WINDOWS\system32\Drivers\DMusic.sys [52864] O44 - LFC:[MD5.8CE882BCC6CF8A62F2B2323D95CB3D01] - 25/05/2015 - 04:25:04 م ---A- . (.Microsoft Corporation - Microsoft GS Wavetable Synthesizer.) -- C:\WINDOWS\system32\Drivers\swmidi.sys [56576] O44 - LFC:[MD5.C98B39829C2BBD34E454150633C62C78] - 25/05/2015 - 04:25:04 م ---A- . (.Microsoft Corporation - WDM WST Codec Driver.) -- C:\WINDOWS\system32\Drivers\WSTCODEC.SYS [19200] O44 - LFC:[MD5.0BE5AEF125BE881C4F854C554F2B025C] - 25/05/2015 - 04:25:05 م ---A- . (.Microsoft Corporation - WDM Closed Caption VBI Codec.) -- C:\WINDOWS\system32\Drivers\CCDECODE.sys [17024] O44 - LFC:[MD5.866D538EBE33709A5C9F5C62B73B7D14] - 25/05/2015 - 04:25:06 م ---A- . (.Microsoft Corporation - Microsoft Slip Deframing Filter Minidriver.) -- C:\WINDOWS\system32\Drivers\SLIP.sys [11136] O44 - LFC:[MD5.5B50F1B2A2ED47D560577B221DA734DB] - 25/05/2015 - 04:25:07 م ---A- . (.Microsoft Corporation - WDM NABTS/FEC VBI Codec.) -- C:\WINDOWS\system32\Drivers\NABTSFEC.sys [85248] O44 - LFC:[MD5.AB8B92451ECB048A4D1DE7C3FFCB4A9F] - 25/05/2015 - 04:25:08 م ---A- . (.Microsoft Corporation - Microsoft Kernel Audio Splitter.) -- C:\WINDOWS\system32\Drivers\splitter.sys [6272] O44 - LFC:[MD5.D1575E71568F4D9E14CA56B7B0453BF1] - 25/05/2015 - 04:25:09 م ---A- . (.Microsoft Corporation - MS KS Server.) -- C:\WINDOWS\system32\Drivers\MSKSSRV.sys [7552] O44 - LFC:[MD5.8BED39E3C35D6A489438B8141717A557] - 25/05/2015 - 04:25:09 م ---A- . (.Microsoft Corporation - Microsoft Acoustic Echo Canceller.) -- C:\WINDOWS\system32\Drivers\aec.sys [142592] O44 - LFC:[MD5.E53736A9E30C45FA9E7B5EAC55056D1D] - 25/05/2015 - 04:25:12 م ---A- . (.Microsoft Corporation - WDM Tee/Communication Transform Filter.) -- C:\WINDOWS\system32\Drivers\MSTEE.sys [5504] O44 - LFC:[MD5.D41D8CD98F00B204E9800998ECF8427E] - 25/05/2015 - 04:27:40 م ---A- . (...) -- C:\WINDOWS\system32\h323log.txt [0] O44 - LFC:[MD5.509318A49163730F4F9EB1839F7E97F7] - 25/05/2015 - 04:27:42 م -SH-- . (...) -- C:\boot.ini [232] O44 - LFC:[MD5.47EA20320E3D6FDC7B7BB22B2B881CA6] - 25/05/2015 - 04:28:26 م ---A- . (.Microsoft Corporation - Microsoft RDP Device redirector.) -- C:\WINDOWS\system32\Drivers\rdpdr.sys [195712] O44 - LFC:[MD5.88155247177638048422893737429D9E] - 25/05/2015 - 04:28:26 م ---A- . (.Microsoft Corporation - Terminal Server Driver.) -- C:\WINDOWS\system32\Drivers\termdd.sys [40840] O44 - LFC:[MD5.56C0F2EF981F235AB011FBFE26D92088] - 25/05/2015 - 04:28:26 م ---A- . (.Microsoft Corporation - WMI Snapin Helpers.) -- C:\WINDOWS\system32\mmfutil.dll [17408] O44 - LFC:[MD5.1C2C0143333F9651F088E29344D3BD0F] - 25/05/2015 - 04:28:26 م ---A- . (.Microsoft Corporation - WMI Snapins.) -- C:\WINDOWS\system32\cmprops.dll [185344] O44 - LFC:[MD5.8E7C1B8BBA4070615D6E2F704F272255] - 25/05/2015 - 04:28:26 م ---A- . (.Microsoft Corporation - WMI Snapins.) -- C:\WINDOWS\system32\servdeps.dll [56320] O44 - LFC:[MD5.6895427873D6C37A6D6DA7C3DB37DA14] - 25/05/2015 - 04:28:26 م ---A- . (.Microsoft Corporation - Windows Product Activation Configuration WM.) -- C:\WINDOWS\system32\licwmi.dll [58880] O44 - LFC:[MD5.BCAB0BC4EDD47B54252D82D10A6EF5F5] - 25/05/2015 - 04:28:28 م ---A- . (.Microsoft Corporation - MS DTC OLE Transactions interface proxy DLL.) -- C:\WINDOWS\system32\msdtcprx.dll [428032] O44 - LFC:[MD5.A137F1470499A205ABBB9AAFB3B6F2B1] - 25/05/2015 - 04:28:28 م ---A- . (.Microsoft Corporation - MS DTC console program.) -- C:\WINDOWS\system32\msdtc.exe [6144] O44 - LFC:[MD5.AE3470D2BF8F16FD93FA54167B87172D] - 25/05/2015 - 04:28:28 م ---A- . (.Microsoft Corporation - MS DTC helper APIs DLL.) -- C:\WINDOWS\system32\xolehlp.dll [11776] O44 - LFC:[MD5.110C8A0FF284DA86E637FEC98F14D6BC] - 25/05/2015 - 04:28:28 م ---A- . (.Microsoft Corporation - MS DTC log manager DLL.) -- C:\WINDOWS\system32\msdtclog.dll [58880] O44 - LFC:[MD5.7C4F9779614844B1263246B81BA6685D] - 25/05/2015 - 04:28:28 م ---A- . (.Microsoft Corporation - MS DTC transaction manager DLL.) -- C:\WINDOWS\system32\msdtctm.dll [956928] O44 - LFC:[MD5.6B8A8B42D34A1D7279C2A948D5740B1D] - 25/05/2015 - 04:28:28 م ---A- . (.Microsoft Corporation - Microsoft database support DLL for Oracle.) -- C:\WINDOWS\system32\mtxoci.dll [91648] O44 - LFC:[MD5.28CDB50D882D3BAD993D25BE596307EA] - 25/05/2015 - 04:28:28 م ---A- . (.Microsoft Corporation - No Comment.) -- C:\WINDOWS\system32\catsrv.dll [226304] O44 - LFC:[MD5.5F5E83E18E9344BCD680704101CEA78A] - 25/05/2015 - 04:28:28 م ---A- . (.Microsoft Corporation - No Comment.) -- C:\WINDOWS\system32\catsrvps.dll [85504] O44 - LFC:[MD5.846300110A32ACDEE7CB60E54C7F693A] - 25/05/2015 - 04:28:28 م ---A- . (.Microsoft Corporation - No Comment.) -- C:\WINDOWS\system32\catsrvut.dll [625664] O44 - LFC:[MD5.33B37BB0C69F2DBD19277220435590BE] - 25/05/2015 - 04:28:28 م ---A- . (.Microsoft Corporation - No Comment.) -- C:\WINDOWS\system32\clbcatex.dll [110592] O44 - LFC:[MD5.F137A0CA70003DB20448D540651FA003] - 25/05/2015 - 04:28:28 م ---A- . (.Microsoft Corporation - No Comment.) -- C:\WINDOWS\system32\clbcatq.dll [498688] O44 - LFC:[MD5.690D97864735E8ECD87F55777E266690] - 25/05/2015 - 04:28:28 م ---A- . (.Microsoft Corporation - No Comment.) -- C:\WINDOWS\system32\colbact.dll [60416] O44 - LFC:[MD5.035FECD913735E843E95510D7CC89A4E] - 25/05/2015 - 04:28:28 م ---A- . (.Microsoft Corporation - No Comment.) -- C:\WINDOWS\system32\comaddin.dll [28160] O44 - LFC:[MD5.E7427B6BD2F2B32403C23A4FE15DF3B3] - 25/05/2015 - 04:28:28 م ---A- . (.Microsoft Corporation - No Comment.) -- C:\WINDOWS\system32\comrepl.dll [97792] O44 - LFC:[MD5.85A335171B8D56B09276D1C6DF2A63B2] - 25/05/2015 - 04:28:28 م ---A- . (.Microsoft Corporation - No Comment.) -- C:\WINDOWS\system32\comsnap.dll [167424] O44 - LFC:[MD5.ED0C0DF222209E43AD9AFBF3FE87DDE0] - 25/05/2015 - 04:28:28 م ---A- . (.Microsoft Corporation - No Comment.) -- C:\WINDOWS\system32\comsvcs.dll [1267200] O44 - LFC:[MD5.E0950A5B73350A26AB063EF6772FDCA4] - 25/05/2015 - 04:28:28 م ---A- . (.Microsoft Corporation - No Comment.) -- C:\WINDOWS\system32\comuid.dll [539648] O44 - LFC:[MD5.238BDCE83AF21A6C2C0FCF216D3260E3] - 25/05/2015 - 04:28:28 م ---A- . (.Microsoft Corporation - No Comment.) -- C:\WINDOWS\system32\dcomcnfg.exe [6144] O44 - LFC:[MD5.7827FB784D9B3029F3DAF73D3331A9CC] - 25/05/2015 - 04:28:28 م ---A- . (.Microsoft Corporation - No Comment.) -- C:\WINDOWS\system32\mtxdm.dll [30720] O44 - LFC:[MD5.BC958016A1F7A23A1A9282C82D73D074] - 25/05/2015 - 04:28:28 م ---A- . (.Microsoft Corporation - No Comment.) -- C:\WINDOWS\system32\mtxex.dll [4096] O44 - LFC:[MD5.2A516AC024EA9E34AE0F0297293EABAB] - 25/05/2015 - 04:28:28 م ---A- . (.Microsoft Corporation - No Comment.) -- C:\WINDOWS\system32\mtxlegih.dll [34304] O44 - LFC:[MD5.9089B700986B7A441F79FE68F96E5149] - 25/05/2015 - 04:28:28 م ---A- . (.Microsoft Corporation - No Comment.) -- C:\WINDOWS\system32\stclient.dll [59392] O44 - LFC:[MD5.277BDF16A94BE0D063988D692541650B] - 25/05/2015 - 04:28:29 م ---A- . (.Hilgraeve, Inc. - HyperTerminal Applet Library.) -- C:\WINDOWS\system32\hypertrm.dll [347136] O44 - LFC:[MD5.3EC3BC6E8A4ACB2B87270212D75C1C5F] - 25/05/2015 - 04:28:29 م ---A- . (.Microsoft Corporation - Anywhere access client.) -- C:\WINDOWS\system32\aaclient.dll [131584] O44 - LFC:[MD5.AA4A015E2ACAE6127FDF833F301C1FE4] - 25/05/2015 - 04:28:29 م ---A- . (.Microsoft Corporation - Configuration Backend Interface.) -- C:\WINDOWS\system32\cfgbkend.dll [38912] O44 - LFC:[MD5.841FB340ABC439B4557FBDD32B7BA11D] - 25/05/2015 - 04:28:29 م ---A- . (.Microsoft Corporation - Control Panel DLL.) -- C:\WINDOWS\system32\access.cpl [68608] O44 - LFC:[MD5.DF6551E4C4C46655A0C76194F1FCEA5D] - 25/05/2015 - 04:28:29 م ---A- . (.Microsoft Corporation - DLL Interface to TermDD Device Driver.) -- C:\WINDOWS\system32\icaapi.dll [11264] O44 - LFC:[MD5.8F3FFBB7890106572AC04EB9AD37417A] - 25/05/2015 - 04:28:29 م ---A- . (.Microsoft Corporation - MS DTC administrative component DLL.) -- C:\WINDOWS\system32\msdtcuiu.dll [161792] O44 - LFC:[MD5.954BD0D7C3CB90D23C136FEC90999377] - 25/05/2015 - 04:28:29 م ---A- . (.Microsoft Corporation - Media Player.) -- C:\WINDOWS\system32\mplay32.exe [123392] O44 - LFC:[MD5.D4B13D675DEC600C5A0ED2BB0EB301E6] - 25/05/2015 - 04:28:29 م ---A- . (.Microsoft Corporation - Microsoft Accessibility Wizard.) -- C:\WINDOWS\system32\accwiz.exe [184320] O44 - LFC:[MD5.C29AB058E20C56E8D1ECB44FEDEBC69F] - 25/05/2015 - 04:28:29 م ---A- . (.Microsoft Corporation - Microsoft Remote Desktop TSRDP Session Add-.) -- C:\WINDOWS\system32\rdsaddin.exe [13824] O44 - LFC:[MD5.3C37BF86641BDA977C3BF8A840F3B7FA] - 25/05/2015 - 04:28:29 م ---A- . (.Microsoft Corporation - Microsoft® Remote Desktop Help Session Mana.) -- C:\WINDOWS\system32\sessmgr.exe [141312] O44 - LFC:[MD5.6471A66807F5E104E4885F5B67349397] - 25/05/2015 - 04:28:29 م ---A- . (.Microsoft Corporation - Named Pipe Transport Driver.) -- C:\WINDOWS\system32\Drivers\tdpipe.sys [12040] O44 - LFC:[MD5.66711BAF72A538CFA790E6180549F567] - 25/05/2015 - 04:28:29 م ---A- . (.Microsoft Corporation - Paint.) -- C:\WINDOWS\system32\mspaint.exe [343040] O44 - LFC:[MD5.5AD00EED5722CAABDDAAC1CB92F68E57] - 25/05/2015 - 04:28:29 م ---A- . (.Microsoft Corporation - Query Process Utility.) -- C:\WINDOWS\system32\qprocess.exe [19968] O44 - LFC:[MD5.0779CEBD858DABA8DB5FBF3D64EE9B4C] - 25/05/2015 - 04:28:29 م ---A- . (.Microsoft Corporation - RD Gateway QEC.) -- C:\WINDOWS\system32\tsgqec.dll [36864] O44 - LFC:[MD5.DCCF6ED915BC05C244801B550AD12B17] - 25/05/2015 - 04:28:29 م ---A- . (.Microsoft Corporation - RDP Clip Monitor.) -- C:\WINDOWS\system32\rdpclip.exe [62976] O44 - LFC:[MD5.C7C84DF7233F4834CD190F3DCCAF50CA] - 25/05/2015 - 04:28:29 م ---A- . (.Microsoft Corporation - RDP Extension DLL.) -- C:\WINDOWS\system32\rdpwsx.dll [87176] O44 - LFC:[MD5.C7D9BC54354B8C706ABF172D48313F1B] - 25/05/2015 - 04:28:29 م ---A- . (.Microsoft Corporation - RDP Terminal Stack Driver (US/Canada Only,.) -- C:\WINDOWS\system32\Drivers\rdpwd.sys [139784] O44 - LFC:[MD5.B84AA6E863DE4A3BD9A0A39AEC207ECC] - 25/05/2015 - 04:28:29 م ---A- . (.Microsoft Corporation - RDSHost Client Module.) -- C:\WINDOWS\system32\rdchost.dll [147968] O44 - LFC:[MD5.57E036885A222D1A8EF237C7399BE98B] - 25/05/2015 - 04:28:29 م ---A- . (.Microsoft Corporation - RDSHost Server Module.) -- C:\WINDOWS\system32\rdshost.exe [67072] O44 - LFC:[MD5.28D9646A6B8DE72980B683AF06D9D981] - 25/05/2015 - 04:28:29 م ---A- . (.Microsoft Corporation - RPC/HTTP Downlevel Side-by-side Runtime.) -- C:\WINDOWS\system32\rhttpaa.dll [290304] O44 - LFC:[MD5.A2DC7DE0307D6DE1DF0E23B70B6CFDC7] - 25/05/2015 - 04:28:29 م ---A- . (.Microsoft Corporation - Remote Desktop Connection.) -- C:\WINDOWS\system32\mstsc.exe [1034752] O44 - LFC:[MD5.7398E4BF1FA653FFE86BACD18906E32B] - 25/05/2015 - 04:28:29 م ---A- . (.Microsoft Corporation - Remote Desktop Services ActiveX Client.) -- C:\WINDOWS\system32\mstscax.dll [2705408] O44 - LFC:[MD5.B30637E52CB169F89335119978BDBD3E] - 25/05/2015 - 04:28:29 م ---A- . (.Microsoft Corporation - Remote Sessions CPL Extension.) -- C:\WINDOWS\system32\remotepg.dll [60416] O44 - LFC:[MD5.B22332758A8293C14DB318748A928CC4] - 25/05/2015 - 04:28:29 م ---A- . (.Microsoft Corporation - Sound Recorder accessory.) -- C:\WINDOWS\system32\sndrec32.exe [131584] O44 - LFC:[MD5.8D1492DBE9A856EE306EDC5A103E0BF2] - 25/05/2015 - 04:28:29 م ---A- . (.Microsoft Corporation - Spider.) -- C:\WINDOWS\system32\spider.exe [538624] O44 - LFC:[MD5.C0578456F29E5F26285F81B7B71FE57D] - 25/05/2015 - 04:28:29 م ---A- . (.Microsoft Corporation - TCP Transport Driver.) -- C:\WINDOWS\system32\Drivers\tdtcp.sys [22024] O44 - LFC:[MD5.A125CBFE55C05735417786DD15A5BE76] - 25/05/2015 - 04:28:29 م ---A- . (.Microsoft Corporation - Terminal Server Configuration WMI provider.) -- C:\WINDOWS\system32\tscfgwmi.dll [93696] O44 - LFC:[MD5.31DD1EF4149B0F22AFB12A2DD360B34D] - 25/05/2015 - 04:28:29 م ---A- . (.Microsoft Corporation - Terminal Server MultiMedia Driver.) -- C:\WINDOWS\system32\rdpsnd.dll [19968] O44 - LFC:[MD5.5128852A18AE46C387F87BF27DA4C9DD] - 25/05/2015 - 04:28:29 م ---A- . (.Microsoft Corporation - Terminal Server Service.) -- C:\WINDOWS\system32\termsrv.dll [296960] O44 - LFC:[MD5.7A526169AC958E6602023A39734C8684] - 25/05/2015 - 04:28:29 م ---A- . (.Microsoft Corporation - Windows NT ClipBook Viewer.) -- C:\WINDOWS\system32\clipbrd.exe [102912] O44 - LFC:[MD5.2CE7B1EEB99C14032C0E2201B004F80E] - 25/05/2015 - 04:28:31 م ---A- . (...) -- C:\WINDOWS\system32\wmimgmt.msc [63488] O44 - LFC:[MD5.CDD932EDCB756FB5F7CE5E2F090BA838] - 25/05/2015 - 04:28:32 م ---A- . (...) -- C:\WINDOWS\system32\msdtcprf.h [768] O44 - LFC:[MD5.28E3647CBB608139AFB076103208552B] - 25/05/2015 - 04:28:32 م ---A- . (...) -- C:\WINDOWS\system32\msdtcprf.ini [1931] O44 - LFC:[MD5.DE60FA13A37BEA1EE44228DCB60F44BF] - 25/05/2015 - 04:28:32 م ---A- . (.Microsoft Corporation - Message Utility.) -- C:\WINDOWS\system32\msg.exe [20992] O44 - LFC:[MD5.0D72D44A333628B15288C69738583A2E] - 25/05/2015 - 04:28:32 م ---A- . (.Microsoft Corporation - Modem Connection Driver.) -- C:\WINDOWS\system32\cdmodem.dll [15872] O44 - LFC:[MD5.1317CB79629C34B5FF8260C297B09A1C] - 25/05/2015 - 04:28:32 م ---A- . (.Microsoft Corporation - Query Session Utility.) -- C:\WINDOWS\system32\qwinsta.exe [22016] O44 - LFC:[MD5.1556473E920CA676702516DA38DCAC86] - 25/05/2015 - 04:28:32 م ---A- . (.Microsoft Corporation - Query Terminal Server Utility.) -- C:\WINDOWS\system32\qappsrv.exe [16896] O44 - LFC:[MD5.4114B8D04AEE5FF6700A5CE1130D64FA] - 25/05/2015 - 04:28:32 م ---A- . (.Microsoft Corporation - Registry Initializer.) -- C:\WINDOWS\system32\regini.exe [33792] O44 - LFC:[MD5.4ED862390A8986E2423122FC6A326EC4] - 25/05/2015 - 04:28:32 م ---A- . (.Microsoft Corporation - Reset Session Utility.) -- C:\WINDOWS\system32\rwinsta.exe [15872] O44 - LFC:[MD5.900D05DAB18DA23083358D0839DC1134] - 25/05/2015 - 04:28:32 م ---A- . (.Microsoft Corporation - Session Connection Utility.) -- C:\WINDOWS\system32\tscon.exe [14848] O44 - LFC:[MD5.DC8AAE44CDB63F178BC7B993B43C3318] - 25/05/2015 - 04:28:32 م ---A- . (.Microsoft Corporation - Session Disconnection Utility.) -- C:\WINDOWS\system32\tsdiscon.exe [14848] O44 - LFC:[MD5.1497D0AB91183A5B51EF37CCFC88C6C5] - 25/05/2015 - 04:28:32 م ---A- . (.Microsoft Corporation - Session Logoff Utility.) -- C:\WINDOWS\system32\logoff.exe [15360] O44 - LFC:[MD5.A72C27CE68318023981A4E034F85131C] - 25/05/2015 - 04:28:32 م ---A- . (.Microsoft Corporation - Session Remote Control Utility.) -- C:\WINDOWS\system32\shadow.exe [14848] O44 - LFC:[MD5.092D468C0BDF67EC129C28692276AC88] - 25/05/2015 - 04:28:32 م ---A- . (.Microsoft Corporation - Terminal Server Connection Configuration Ex.) -- C:\WINDOWS\system32\rdpcfgex.dll [4096] O44 - LFC:[MD5.DAC71A10A6A71CB6E3F427AE3283734B] - 25/05/2015 - 04:28:33 م ---A- . (...) -- C:\WINDOWS\Blue Lace 16.bmp [1272] O44 - LFC:[MD5.73D70ED3EC3BBFD8FD35DF431C38F374] - 25/05/2015 - 04:28:33 م ---A- . (...) -- C:\WINDOWS\Coffee Bean.bmp [17062] O44 - LFC:[MD5.3A8B85AB7B415BF3F8AFE285DFE0CE29] - 25/05/2015 - 04:28:33 م ---A- . (...) -- C:\WINDOWS\FeatherTexture.bmp [16730] O44 - LFC:[MD5.203EF178BF8B0A8EC34E27E4DEDB6349] - 25/05/2015 - 04:28:33 م ---A- . (...) -- C:\WINDOWS\Gone Fishing.bmp [17336] O44 - LFC:[MD5.1AC5E83598D4F2143B59A2D893C3279A] - 25/05/2015 - 04:28:33 م ---A- . (...) -- C:\WINDOWS\Greenstone.bmp [26582] O44 - LFC:[MD5.280920B6773C74C3649A934257112BE1] - 25/05/2015 - 04:28:33 م ---A- . (...) -- C:\WINDOWS\Prairie Wind.bmp [65954] O44 - LFC:[MD5.927A66BD587E31CB12D3AB25381658DC] - 25/05/2015 - 04:28:33 م ---A- . (...) -- C:\WINDOWS\Rhododendron.bmp [17362] O44 - LFC:[MD5.5B4AC407E566076BB726BA91E067D313] - 25/05/2015 - 04:28:33 م ---A- . (...) -- C:\WINDOWS\River Sumida.bmp [26680] O44 - LFC:[MD5.EB3BFC14E41FBAA41B4FD4489AA82D39] - 25/05/2015 - 04:28:33 م ---A- . (...) -- C:\WINDOWS\Santa Fe Stucco.bmp [65832] O44 - LFC:[MD5.39F43DBCE366B2561DF073B4C0839299] - 25/05/2015 - 04:28:33 م ---A- . (...) -- C:\WINDOWS\Soap Bubbles.bmp [65978] O44 - LFC:[MD5.5290EA6951F4724259F423B12C8E1393] - 25/05/2015 - 04:28:33 م ---A- . (...) -- C:\WINDOWS\Zapotec.bmp [9522] O44 - LFC:[MD5.405E1EF8E3C88E9BCD2853382BB12430] - 25/05/2015 - 04:28:33 م ---A- . (...) -- C:\WINDOWS\system32\bopomofo.uce [22984] O44 - LFC:[MD5.4FDED87068052EEB9B72A97FDBC141DB] - 25/05/2015 - 04:28:33 م ---A- . (...) -- C:\WINDOWS\system32\gb2312.uce [24006] O44 - LFC:[MD5.038F6AD6CEE43585D814CDBC7CDFD3EC] - 25/05/2015 - 04:28:33 م ---A- . (...) -- C:\WINDOWS\system32\ideograf.uce [60458] O44 - LFC:[MD5.7C0C25F4BA1084C4ABBEEA2C74194C5F] - 25/05/2015 - 04:28:33 م ---A- . (...) -- C:\WINDOWS\system32\kanji_1.uce [6948] O44 - LFC:[MD5.529BBD63519BBD654EF328454019693F] - 25/05/2015 - 04:28:33 م ---A- . (...) -- C:\WINDOWS\system32\kanji_2.uce [8484] O44 - LFC:[MD5.7A7A04370A6030B9B0E8178DAD4A6E41] - 25/05/2015 - 04:28:33 م ---A- . (...) -- C:\WINDOWS\system32\korean.uce [12876] O44 - LFC:[MD5.8CA32E9D986FA76F60EFBCFCD9D80A58] - 25/05/2015 - 04:28:33 م ---A- . (...) -- C:\WINDOWS\system32\shiftjis.uce [16740] O44 - LFC:[MD5.30F5568679A54042F99CA9EC1102EBCD] - 25/05/2015 - 04:28:33 م ---A- . (...) -- C:\WINDOWS\system32\subrange.uce [93702] O44 - LFC:[MD5.4A547D74B435E78418BE06406250C1D3] - 25/05/2015 - 04:28:33 م ---A- . (...) -- C:\WINDOWS\system32\tslabels.h [3286] O44 - LFC:[MD5.03C361FAB5AD67924C5150A384C62BE6] - 25/05/2015 - 04:28:33 م ---A- . (...) -- C:\WINDOWS\system32\tslabels.ini [13223] O44 - LFC:[MD5.F463BC45CD34ADE54F801746B6D322B1] - 25/05/2015 - 04:28:33 م ---A- . (...) -- C:\WINDOWS\system32\usrlogon.cmd [1161] O44 - LFC:[MD5.AC9FA2BA34225342A8897930503AE12F] - 25/05/2015 - 04:28:33 م ---A- . (.Microsoft Corporation - Character Map.) -- C:\WINDOWS\system32\charmap.exe [80384] O44 - LFC:[MD5.4D9B5E540158BF8E9B1BCAC1AEDD8C60] - 25/05/2015 - 04:28:33 م ---A- . (.Microsoft Corporation - Entertainment Pack FreeCell Game.) -- C:\WINDOWS\system32\freecell.exe [55296] O44 - LFC:[MD5.9C45D38B74634C9DED60BEC640C5C3CA] - 25/05/2015 - 04:28:33 م ---A- . (.Microsoft Corporation - Entertainment Pack Minesweeper Game.) -- C:\WINDOWS\system32\winmine.exe [119808] O44 - LFC:[MD5.373E7A863A1A345C60EDB9E20EC32311] - 25/05/2015 - 04:28:33 م ---A- . (.Microsoft Corporation - Solitaire Game Applet.) -- C:\WINDOWS\system32\sol.exe [56832] O44 - LFC:[MD5.725902D25A3B8F234F729CA057052C41] - 25/05/2015 - 04:28:33 م ---A- . (.Microsoft Corporation - System Shutdown Utility.) -- C:\WINDOWS\system32\tsshutdn.exe [16896] O44 - LFC:[MD5.F5FE756927FEF0F4A069DE0A832B5F0F] - 25/05/2015 - 04:28:33 م ---A- . (.Microsoft Corporation - Terminal Services End Process Utility.) -- C:\WINDOWS\system32\tskill.exe [16384] O44 - LFC:[MD5.88F105251EE261ACF11AD88E7567258C] - 25/05/2015 - 04:28:33 م ---A- . (.Microsoft Corporation - Terminal Services Reset Utility.) -- C:\WINDOWS\system32\reset.exe [9728] O44 - LFC:[MD5.BE1B85306352E0AC901EC08506792B6B] - 25/05/2015 - 04:28:33 م ---A- . (.Microsoft Corporation - The Microsoft Hearts Network.) -- C:\WINDOWS\system32\mshearts.exe [126976] O44 - LFC:[MD5.60B9959D333C3D11255D8695D2685430] - 25/05/2015 - 04:28:33 م ---A- . (.Microsoft Corporation - Unicode name Dll for UCE.) -- C:\WINDOWS\system32\getuname.dll [605696] O44 - LFC:[MD5.829E4805B0E12B383EE09ABDC9E2DC3C] - 25/05/2015 - 04:28:33 م ---A- . (.Microsoft Corporation - Windows Calculator application file.) -- C:\WINDOWS\system32\calc.exe [114688] O44 - LFC:[MD5.399495998BCEEA80F23E57CCAB074508] - 25/05/2015 - 04:28:34 م ---A- . (.Microsoft Corporation - Metering Controls.) -- C:\WINDOWS\system32\avmeter.dll [16384] O44 - LFC:[MD5.B82C4535E430DDC631FEC10D63390ECA] - 25/05/2015 - 04:28:34 م ---A- . (.Microsoft Corporation - TAPI 3.0 Dialer and IP Multicast Conference.) -- C:\WINDOWS\system32\avtapi.dll [227840] O44 - LFC:[MD5.F415ACC27107AA6DADABE339949EE670] - 25/05/2015 - 04:28:34 م ---A- . (.Microsoft Corporation - Wave Manipulation Component.) -- C:\WINDOWS\system32\avwav.dll [73216] O44 - LFC:[MD5.FEFC52216D2787EA1DE42BABA01AF9BF] - 25/05/2015 - 04:28:34 م ---A- . (.Microsoft Corporation - Windows for Workgroups Chat (NT).) -- C:\WINDOWS\system32\winchat.exe [35328] O44 - LFC:[MD5.F759A6E14403BC3D7A55CCAD1B8F7B4A] - 25/05/2015 - 04:28:35 م ---A- . (.Hilgraeve, Inc. - HyperTerminal Applet Library.) -- C:\WINDOWS\system32\hticons.dll [44544] O44 - LFC:[MD5.7DF33946B5911E75320CCA9AC1A3492B] - 25/05/2015 - 04:28:35 م ---A- . (.Microsoft Corporation - Volume Control.) -- C:\WINDOWS\system32\sndvol32.exe [138752] O44 - LFC:[MD5.BB75ED2CEA65D2DE97E88FDE1B1A0BF8] - 25/05/2015 - 04:28:37 م ---A- . (.Microsoft Corporation - Windows Write.) -- C:\WINDOWS\system32\write.exe [5632] O44 - LFC:[MD5.F70BD9892CE40A97866825897B1B292A] - 25/05/2015 - 04:28:38 م ---A- . (.AutoIt Team - AutoIt v3 ActiveX Control.) -- C:\WINDOWS\system32\AutoItX3.dll [317320] O44 - LFC:[MD5.7E04D46B430873BA2DB5DBE92B567CCB] - 25/05/2015 - 04:28:38 م ---A- . (.Microsoft Corporation - ATL Module for Windows (Unicode).) -- C:\WINDOWS\system32\atl70.dll [86016] O44 - LFC:[MD5.4EDD8D74EA48F58D3ECA7E9297F19221] - 25/05/2015 - 04:28:38 م ---A- . (.Microsoft Corporation - ATL Module for Windows (Unicode).) -- C:\WINDOWS\system32\atl71.dll [90112] O44 - LFC:[MD5.2648D9081FDD9BAF5E0667D6B319DACC] - 25/05/2015 - 04:28:38 م ---A- . (.Microsoft Corporation - Microsoft Common Controls 2 ActiveX Control.) -- C:\WINDOWS\system32\comct232.ocx [170080] O44 - LFC:[MD5.DB7AABF38D66B4F8152F12E0F313D00C] - 25/05/2015 - 04:28:39 م ---A- . (.GNU - GetText: library and tools for native langu.) -- C:\WINDOWS\system32\libintl3.dll [101888] O44 - LFC:[MD5.331F570AA7C20BC93DEB7B237B21CC9C] - 25/05/2015 - 04:28:39 م ---A- . (.GNU - LibIconv: convert between character encodin.) -- C:\WINDOWS\system32\libiconv2.dll [898048] O44 - LFC:[MD5.4AE28E2FB7DEDFD5F725CDBC0EC05959] - 25/05/2015 - 04:28:39 م ---A- . (.Intel Corporation - Math Library for Intel(r) Compilers (thread.) -- C:\WINDOWS\system32\libmmd.dll [2887680] O44 - LFC:[MD5.AC9BD4138BA1CECE3C25F62166B0BA70] - 25/05/2015 - 04:28:39 م ---A- . (.Microsoft Corporation - CMDialog ActiveX Control DLL.) -- C:\WINDOWS\system32\comdlg32.ocx [155984] O44 - LFC:[MD5.7D3AF30690DB750ED82C4B71C1E6677E] - 25/05/2015 - 04:28:39 م ---A- . (.Microsoft Corporation - DBList.) -- C:\WINDOWS\system32\dblist32.ocx [222528] O44 - LFC:[MD5.C24F1E7C15C6D47ECED9DBD3E9B90D52] - 25/05/2015 - 04:28:39 م ---A- . (.Microsoft Corporation - Microsoft Common Controls 3 ActiveX Control.) -- C:\WINDOWS\system32\comct332.ocx [415552] O44 - LFC:[MD5.FC9FEF25CD6620D5691375F392B0FDC8] - 25/05/2015 - 04:28:39 م ---A- . (.Microsoft Corporation - Windows Common Controls ActiveX Control DLL.) -- C:\WINDOWS\system32\comctl32.ocx [614992] O44 - LFC:[MD5.F08F19FEAA26FB2DAC62E4AA4C44020C] - 25/05/2015 - 04:28:39 م ---A- . (.Red Hat - Cygwin® POSIX Emulation DLL.) -- C:\WINDOWS\system32\cygwin1.dll [1872666] O44 - LFC:[MD5.B5EFB909E157DD6A0395184A4084A6A3] - 25/05/2015 - 04:28:39 م ---A- . (.The OpenSSL Project, http://www.openssl.org - OpenSSL Shared Library.) -- C:\WINDOWS\system32\libeay32.dll [1017344] O44 - LFC:[MD5.3EC5E74205EBB0AFE3C3EF873B0C47EE] - 25/05/2015 - 04:28:40 م ---A- . (.Microsoft Corporation - MCI OLE Control DLL.) -- C:\WINDOWS\system32\mci32.ocx [215880] O44 - LFC:[MD5.6DCFA4BB657ABE4BC90789F55F5FC893] - 25/05/2015 - 04:28:40 م ---A- . (.No owner - PNG image compression library.) -- C:\WINDOWS\system32\libpng13.dll [162304] O44 - LFC:[MD5.38594B5A24E153424DE9C2AD1BE37E06] - 25/05/2015 - 04:28:40 م ---A- . (.The OpenSSL Project, http://www.openssl.org - OpenSSL Shared Library.) -- C:\WINDOWS\system32\libssl32.dll [189440] O44 - LFC:[MD5.A4CCA3F3145BA93383DFB126EC61C695] - 25/05/2015 - 04:28:41 م ---A- . (.Microsoft Corporation - MFC Language Specific Resources.) -- C:\WINDOWS\system32\mfc70CHS.dll [40960] O44 - LFC:[MD5.A0502BCED5C98A51E7E305029BD4009B] - 25/05/2015 - 04:28:41 م ---A- . (.Microsoft Corporation - MFC Language Specific Resources.) -- C:\WINDOWS\system32\mfc70CHT.dll [45056] O44 - LFC:[MD5.054809EA25F0110122B17835E94848F2] - 25/05/2015 - 04:28:41 م ---A- . (.Microsoft Corporation - MFC Language Specific Resources.) -- C:\WINDOWS\system32\mfc70DEU.dll [61440] O44 - LFC:[MD5.3F0E5AD6604D6585C2219D6688514817] - 25/05/2015 - 04:28:41 م ---A- . (.Microsoft Corporation - MFC Language Specific Resources.) -- C:\WINDOWS\system32\mfc70ENU.dll [57344] O44 - LFC:[MD5.D88BE83455C13B80B1AB103E82052F33] - 25/05/2015 - 04:28:41 م ---A- . (.Microsoft Corporation - MFC Language Specific Resources.) -- C:\WINDOWS\system32\mfc70ESP.dll [61440] O44 - LFC:[MD5.8F59C1FB4C18F08C0D4D24550E2F7375] - 25/05/2015 - 04:28:41 م ---A- . (.Microsoft Corporation - MFC Language Specific Resources.) -- C:\WINDOWS\system32\mfc70FRA.dll [61440] O44 - LFC:[MD5.78C3F9FFBC860D2153D6470BC65556FE] - 25/05/2015 - 04:28:41 م ---A- . (.Microsoft Corporation - MFC Language Specific Resources.) -- C:\WINDOWS\system32\mfc70ITA.dll [61440] O44 - LFC:[MD5.8448C67B7FF7A65AEAA25747D0E861B7] - 25/05/2015 - 04:28:41 م ---A- . (.Microsoft Corporation - MFC Language Specific Resources.) -- C:\WINDOWS\system32\mfc70JPN.dll [49152] O44 - LFC:[MD5.E83773E9ED198BB59C072B453AF4F797] - 25/05/2015 - 04:28:41 م ---A- . (.Microsoft Corporation - MFC Language Specific Resources.) -- C:\WINDOWS\system32\mfc70KOR.dll [49152] O44 - LFC:[MD5.5D3C0F40336B490EDE971C394CFB8F78] - 25/05/2015 - 04:28:41 م ---A- . (.Microsoft Corporation - MFCDLL Shared Library - Retail Version.) -- C:\WINDOWS\system32\mfc70.dll [1024000] O44 - LFC:[MD5.820147A592C9A7C07FCFC0CE610A4340] - 25/05/2015 - 04:28:42 م ---A- . (.Microsoft Corporation - MFC Language Specific Resources.) -- C:\WINDOWS\system32\mfc71CHS.dll [40960] O44 - LFC:[MD5.C28FA8A04D697D470380D8E1484D99A0] - 25/05/2015 - 04:28:42 م ---A- . (.Microsoft Corporation - MFC Language Specific Resources.) -- C:\WINDOWS\system32\mfc71CHT.dll [45056] O44 - LFC:[MD5.0C073883D3AB204898CCCFB7215F2FD0] - 25/05/2015 - 04:28:42 م ---A- . (.Microsoft Corporation - MFC Language Specific Resources.) -- C:\WINDOWS\system32\mfc71DEU.dll [65536] O44 - LFC:[MD5.4629FF72D025B61142A1A00EF1F15B62] - 25/05/2015 - 04:28:42 م ---A- . (.Microsoft Corporation - MFC Language Specific Resources.) -- C:\WINDOWS\system32\mfc71ENU.dll [57344] O44 - LFC:[MD5.13AC985B1CB8CF117B235D2FFE2E0C60] - 25/05/2015 - 04:28:42 م ---A- . (.Microsoft Corporation - MFC Language Specific Resources.) -- C:\WINDOWS\system32\mfc71ESP.dll [61440] O44 - LFC:[MD5.82BC410144F09B0A6295C8FCE69BDD46] - 25/05/2015 - 04:28:42 م ---A- . (.Microsoft Corporation - MFC Language Specific Resources.) -- C:\WINDOWS\system32\mfc71FRA.dll [61440] O44 - LFC:[MD5.A20B1B180BB592EFC4783145869F0620] - 25/05/2015 - 04:28:42 م ---A- . (.Microsoft Corporation - MFC Language Specific Resources.) -- C:\WINDOWS\system32\mfc71ITA.dll [61440] O44 - LFC:[MD5.F03CEAE486075AD78A094F47B5E39B0A] - 25/05/2015 - 04:28:42 م ---A- . (.Microsoft Corporation - MFC Language Specific Resources.) -- C:\WINDOWS\system32\mfc71JPN.dll [49152] O44 - LFC:[MD5.E8205768BE4AED356A07224BD7248137] - 25/05/2015 - 04:28:42 م ---A- . (.Microsoft Corporation - MFC Language Specific Resources.) -- C:\WINDOWS\system32\mfc71KOR.dll [49152] O44 - LFC:[MD5.C440493ABF8CF179FF3351357C1EB426] - 25/05/2015 - 04:28:42 م ---A- . (.Microsoft Corporation - MFCDLL Shared Library - Retail Version.) -- C:\WINDOWS\system32\mfc70u.dll [1017344] O44 - LFC:[MD5.D7DFA8924DD20C8562060F4BBD8DEAB4] - 25/05/2015 - 04:28:42 م ---A- . (.Microsoft Corporation - MFCDLL Shared Library - Retail Version.) -- C:\WINDOWS\system32\mfc71.dll [1060864] O44 - LFC:[MD5.6F47D505CA749076D9507175B71C8812] - 25/05/2015 - 04:28:42 م ---A- . (.Microsoft Corporation - MFCDLL Shared Library - Retail Version.) -- C:\WINDOWS\system32\mfc71u.dll [1053696] O44 - LFC:[MD5.3973673288371C24056FEDA47AD3CF96] - 25/05/2015 - 04:28:42 م ---A- . (.Microsoft Corporation - Microsoft Common Controls 2 ActiveX Control.) -- C:\WINDOWS\system32\mscomct2.ocx [659264] O44 - LFC:[MD5.A2514F76118A631B13632A2B58023514] - 25/05/2015 - 04:28:43 م ---A- . (.Microsoft Corporation - MSComm.) -- C:\WINDOWS\system32\mscomm32.ocx [119616] O44 - LFC:[MD5.39BBA51C9D8C3E79E8A40F2821BBA5CA] - 25/05/2015 - 04:28:43 م ---A- . (.Microsoft Corporation - MSDatGrd.OCX.) -- C:\WINDOWS\system32\msdatgrd.ocx [278352] O44 - LFC:[MD5.C8054E6E5FCA4D8E7DBC3B78185202CD] - 25/05/2015 - 04:28:43 م ---A- . (.Microsoft Corporation - MSDatLst.) -- C:\WINDOWS\system32\msdatlst.ocx [252240] O44 - LFC:[MD5.20E06689D038E05795863694B5E1DCD7] - 25/05/2015 - 04:28:43 م ---A- . (.Microsoft Corporation - MSFlexGrid.) -- C:\WINDOWS\system32\msflxgrd.ocx [258880] O44 - LFC:[MD5.90C69F8DAD5EC6DE50DF96A5D330939B] - 25/05/2015 - 04:28:43 م ---A- . (.Microsoft Corporation - MSMask.) -- C:\WINDOWS\system32\msmask32.ocx [178512] O44 - LFC:[MD5.363B11116347A85219AF5DD2B7CB2A41] - 25/05/2015 - 04:28:43 م ---A- . (.Microsoft Corporation - Microsoft Hierarchical FlexGrid Control.) -- C:\WINDOWS\system32\MShflxgd.ocx [443488] O44 - LFC:[MD5.B920865C9C2F4F28151B269B3A8B11AA] - 25/05/2015 - 04:28:43 م ---A- . (.Microsoft Corporation - Microsoft Internet Transfer Control DLL.) -- C:\WINDOWS\system32\msinet.ocx [136008] O44 - LFC:[MD5.3E62CF18441A03A440B280182E4B6935] - 25/05/2015 - 04:28:43 م ---A- . (.Microsoft Corporation - Microsoft Standard Data Formating Object DL.) -- C:\WINDOWS\system32\msstdfmt.dll [129872] O44 - LFC:[MD5.E5F7C30EDF0892667933BE879F067D67] - 25/05/2015 - 04:28:43 م ---A- . (.Microsoft Corporation - Microsoft® C Runtime Library.) -- C:\WINDOWS\system32\msvcr100_clr0400.dll [771424] O44 - LFC:[MD5.07B8A966FA4D08B797DE3FCC5C67EAB6] - 25/05/2015 - 04:28:43 م ---A- . (.Microsoft Corporation - Microsoft® C++ Runtime Library.) -- C:\WINDOWS\system32\msvci70.dll [54784] O44 - LFC:[MD5.D04F7AACA2319A3BCDB2C5D5DD6F6026] - 25/05/2015 - 04:28:43 م ---A- . (.Microsoft Corporation - Microsoft® C++ Runtime Library.) -- C:\WINDOWS\system32\msvcp70.dll [487424] O44 - LFC:[MD5.1874BBAD9AE4C993B74B7ABAA8B9D535] - 25/05/2015 - 04:28:43 م ---A- . (.Microsoft Corporation - Microsoft® C++ Runtime Library.) -- C:\WINDOWS\system32\msvcp71.dll [503808] O44 - LFC:[MD5.AAC7ED76E8DE83F80D866EFE99121F2A] - 25/05/2015 - 04:28:43 م ---A- . (.Microsoft Corporation - Microsoft® Debug Information Accessor.) -- C:\WINDOWS\system32\msdia100.dll [799568] O44 - LFC:[MD5.520980110B0AC4854EAC5219A10FA7D8] - 25/05/2015 - 04:28:43 م ---A- . (.Microsoft Corporation - Windows Common Controls ActiveX Control DLL.) -- C:\WINDOWS\system32\mscomctl.ocx [1069376] O44 - LFC:[MD5.714CF24FC19A20AE0DC701B48DED2CF6] - 25/05/2015 - 04:28:43 م ---A- . (.Microsoft Corporation - Windows Common Controls ActiveX Control DLL.) -- C:\WINDOWS\system32\mscomctl32.ocx [1066176] O44 - LFC:[MD5.FC997A9D29A5662BCB9EDEF5133E4EE6] - 25/05/2015 - 04:28:43 م ---A- . (.Microsoft Corporation - msprop32.ocx.) -- C:\WINDOWS\system32\msstkprp.dll [107840] O44 - LFC:[MD5.40FCE4BE52F6015C23FD96A4B3351357] - 25/05/2015 - 04:28:44 م ---A- . (.Microsoft Corporation - Microsoft Winsock Control DLL.) -- C:\WINDOWS\system32\mswinsck.ocx [127808] O44 - LFC:[MD5.8D8A3965D5D4CCBBE4489DA028CEF6FC] - 25/05/2015 - 04:28:44 م ---A- . (.Microsoft Corporation - Microsoft® C Runtime Library.) -- C:\WINDOWS\system32\msvcr70.dll [339968] O44 - LFC:[MD5.837B1E310F2AA8B20F07A9B1CE90AC4F] - 25/05/2015 - 04:28:44 م ---A- . (.Microsoft Corporation - Microsoft® C Runtime Library.) -- C:\WINDOWS\system32\msvcr71.dll [344064] O44 - LFC:[MD5.0BEFC40200EDAEC3A9D0FB072013DA6D] - 25/05/2015 - 04:28:44 م ---A- . (.Microsoft Corporation - PicClip.) -- C:\WINDOWS\system32\picclp32.ocx [100160] O44 - LFC:[MD5.4231528316B2ACB6D40E797F55CCC1FB] - 25/05/2015 - 04:28:44 م ---A- . (.Microsoft Corporation - RichTx32.OCX.) -- C:\WINDOWS\system32\richtx32.ocx [218432] O44 - LFC:[MD5.F0CB83F058E3A84DC58FBABAF7B0533A] - 25/05/2015 - 04:28:44 م ---A- . (.Microsoft Corporation - SysInfo.) -- C:\WINDOWS\system32\sysinfo.ocx [80208] O44 - LFC:[MD5.79ED276AAE03D4F62551871D8094F09A] - 25/05/2015 - 04:28:44 م ---A- . (.Microsoft Corporation - TABCTL32 OLE Control DLL.) -- C:\WINDOWS\system32\tabctl32.ocx [221504] O44 - LFC:[MD5.73978DD6DD93DFD1FDD83620AE604DD4] - 25/05/2015 - 04:28:44 م ---A- . (.Microsoft Corporation - Visual Basic 4.0 runtime library.) -- C:\WINDOWS\system32\vb40032.dll [722192] O44 - LFC:[MD5.235355A8DD26903E75D5E812ECF50E53] - 25/05/2015 - 04:28:44 م ---A- . (.Portions (C) Creative Labs Inc. and NVIDIA - Standard OpenAL(TM) Implementation.) -- C:\WINDOWS\system32\openal32.dll [109080] O44 - LFC:[MD5.586EE669B2027A162AD68C29B8BC12E3] - 25/05/2015 - 04:28:44 م ---A- . (.The OpenSSL Project, http://www.openssl.org - OpenSSL Shared Library.) -- C:\WINDOWS\system32\ssleay32.dll [200704] O44 - LFC:[MD5.D494267BC169604FAC5E3679B9A97FED] - 25/05/2015 - 04:28:45 م ---A- . (.Creative Labs - OpenAL32.) -- C:\WINDOWS\system32\wrap_oal.dll [444952] O44 - LFC:[MD5.D90DAD5EEA33A178BAC56FFF2847D4C2] - 25/05/2015 - 04:28:45 م ---A- . (.No owner - zlib data compression library.) -- C:\WINDOWS\system32\zlib1.dll [100352] O44 - LFC:[MD5.487403459F0B2F1A3ADEEF02496BD80E] - 25/05/2015 - 04:29:02 م ---A- . (...) -- C:\WINDOWS\vb.ini [36] O44 - LFC:[MD5.6C2F0BA210C2B53EF07653ABAC6C2490] - 25/05/2015 - 04:29:02 م ---A- . (...) -- C:\WINDOWS\vbaddin.ini [37] O44 - LFC:[MD5.A7222AD000699E28AFDAAC454E6FF7CC] - 25/05/2015 - 04:29:16 م ---A- . (...) -- C:\WINDOWS\system32\emptyregdb.dat [21640] O44 - LFC:[MD5.009F0BE67B62150904D266A1D5BDC95B] - 25/05/2015 - 04:29:37 م ---A- . (.Microsoft Corporation - Internet Connection Wizard Autodialer.) -- C:\WINDOWS\system32\icwdial.dll [73728] O44 - LFC:[MD5.474EABDCA846408BB854EE6542888D29] - 25/05/2015 - 04:29:37 م ---A- . (.Microsoft Corporation - Internet Connection Wizard Library.) -- C:\WINDOWS\system32\inetcfg.dll [274432] O44 - LFC:[MD5.922ED2C991F4D05107467C854D38BB71] - 25/05/2015 - 04:29:37 م ---A- . (.Microsoft Corporation - Internet Connection Wizard.) -- C:\WINDOWS\system32\icwphbk.dll [65536] O44 - LFC:[MD5.E135606BD22651CB8A8136B4141A56B5] - 25/05/2015 - 04:29:37 م ---A- . (.Microsoft Corporation - Internet Signup.) -- C:\WINDOWS\system32\isign32.dll [81920] O44 - LFC:[MD5.0A9A7365A1CA4319AA7C1D6CD8E4EAFA] - 25/05/2015 - 04:29:37 م ---A- . (.Microsoft Corporation - Task Scheduler Engine.) -- C:\WINDOWS\system32\schedsvc.dll [192512] O44 - LFC:[MD5.D5788A5243D1DD160E0F97AA4808B2BE] - 25/05/2015 - 04:29:37 م ---A- . (.Microsoft Corporation - Task Scheduler Setup.) -- C:\WINDOWS\system32\mstinit.exe [12288] O44 - LFC:[MD5.4044E880593FE1AC9942190FCE414BE7] - 25/05/2015 - 04:29:37 م ---A- . (.Microsoft Corporation - Task Scheduler interface DLL.) -- C:\WINDOWS\system32\mstask.dll [274944] O44 - LFC:[MD5.871888B4AA0CA343E73C81E94AD4ED93] - 25/05/2015 - 04:29:38 م ---A- . (.Microsoft Corporation - Microsoft Internet Account Manager.) -- C:\WINDOWS\system32\msoeacct.dll [252928] O44 - LFC:[MD5.A6F6923B46802785B9A47A03AE3CD8BF] - 25/05/2015 - 04:29:38 م ---A- . (.Microsoft Corporation - Microsoft Internet Messaging API Resources.) -- C:\WINDOWS\system32\inetres.dll [48128] O44 - LFC:[MD5.3B438284E0F22B154E9ECC27FE0EC3AE] - 25/05/2015 - 04:29:38 م ---A- . (.Microsoft Corporation - Microsoft Internet Messaging API.) -- C:\WINDOWS\system32\inetcomm.dll [692736] O44 - LFC:[MD5.0485AB01B862FB91C21D39BD60BDF2AC] - 25/05/2015 - 04:29:38 م ---A- . (.Microsoft Corporation - Microsoft Outlook Express RT Lib.) -- C:\WINDOWS\system32\msoert2.dll [105984] O44 - LFC:[MD5.0C56AFBBDFA19694CA03F159A5724EA6] - 25/05/2015 - 04:29:39 م ---A- . (.Intel Corporation - ISR Debug 32-bit Engine.) -- C:\WINDOWS\system32\isrdbg32.dll [32768] O44 - LFC:[MD5.621822F2F2BDE521D3FC687B62659B76] - 25/05/2015 - 04:29:39 م ---A- . (.Microsoft Corporation - Application Sharing Display Driver.) -- C:\WINDOWS\system32\mnmdd.dll [34560] O44 - LFC:[MD5.BBF115327F043F0BD46C58393261E6DD] - 25/05/2015 - 04:29:39 م ---A- . (.Microsoft Corporation - Conferencing Utility Dll.) -- C:\WINDOWS\system32\msconf.dll [69632] O44 - LFC:[MD5.5D43C9A33F18C707BA169AFDA88BDF30] - 25/05/2015 - 04:29:39 م ---A- . (.Microsoft Corporation - Filter Library.) -- C:\WINDOWS\system32\fltlib.dll [16896] O44 - LFC:[MD5.1DE61BAEDE3FD349B7AE86F428C25482] - 25/05/2015 - 04:29:39 م ---A- . (.Microsoft Corporation - Filter Manager Control Program.) -- C:\WINDOWS\system32\fltMc.exe [23040] O44 - LFC:[MD5.B2CF4B0786F8212CB92ED2B50C6DB6B0] - 25/05/2015 - 04:29:39 م ---A- . (.Microsoft Corporation - Microsoft Filesystem Filter Manager.) -- C:\WINDOWS\system32\Drivers\fltMgr.sys [129792] O44 - LFC:[MD5.C6FD300A6100AC89BC4CB944C19FA2A9] - 25/05/2015 - 04:29:39 م ---A- . (.Microsoft Corporation - Microsoft H.261 ICM Driver.) -- C:\WINDOWS\system32\msh261.drv [188416] O44 - LFC:[MD5.14E333392A7C41AF18F21849AEE1741E] - 25/05/2015 - 04:29:39 م ---A- . (.Microsoft Corporation - NMMKCERT Library.) -- C:\WINDOWS\system32\nmmkcert.dll [28672] O44 - LFC:[MD5.D18F1F0C101D06A1C1ADF26EED16FCDD] - 25/05/2015 - 04:29:39 م ---A- . (.Microsoft Corporation - NetMeeting Remote Desktop Sharing.) -- C:\WINDOWS\system32\mnmsrvc.exe [32768] O44 - LFC:[MD5.77A54BDFBAD4604E6131AE68E3CF76D6] - 25/05/2015 - 04:29:39 م ---A- . (.Microsoft Corporation - SR CLIENT DLL.) -- C:\WINDOWS\system32\srclient.dll [67584] O44 - LFC:[MD5.76BB022C2FB6902FD5BDD4F78FC13A5D] - 25/05/2015 - 04:29:39 م ---A- . (.Microsoft Corporation - System Restore Filesystem Filter Driver.) -- C:\WINDOWS\system32\Drivers\sr.sys [73472] O44 - LFC:[MD5.92E2A2574186BCBB7027A6048E1B8B1B] - 25/05/2015 - 04:29:39 م ---A- . (.Microsoft Corporation - System Restore Restore Operation Library.) -- C:\WINDOWS\system32\srrstr.dll [239104] O44 - LFC:[MD5.3805DF0AC4296A34BA4BF93B346CC378] - 25/05/2015 - 04:29:39 م ---A- . (.Microsoft Corporation - System Restore Service.) -- C:\WINDOWS\system32\srsvc.dll [171008] O44 - LFC:[MD5.A1E481512C1602C36D3384FEB7DDEC12] - 25/05/2015 - 04:29:39 م ---A- . (.Microsoft Corporation - User Location Services Component Module.) -- C:\WINDOWS\system32\ils.dll [81920] O44 - LFC:[MD5.482A0A0E3AE3F6A2564F8BE32767DCDB] - 25/05/2015 - 04:29:40 م ---A- . (.Microsoft Corporation - Microsoft Help Center Desktop Manager.) -- C:\WINDOWS\system32\safrdm.dll [29696] O44 - LFC:[MD5.62A9B35C335A85311DC1280568CE9D89] - 25/05/2015 - 04:29:40 م ---A- . (.Microsoft Corporation - Microsoft Help Center Session Resolver.) -- C:\WINDOWS\system32\safrslv.dll [45568] O44 - LFC:[MD5.CC8E648AE54B18037F7D0A91D196FE91] - 25/05/2015 - 04:29:40 م ---A- . (.Microsoft Corporation - Microsoft PCHealth Remote Assistance File O.) -- C:\WINDOWS\system32\safrcdlg.dll [43520] O44 - LFC:[MD5.59AD4CEDBFCD1EEFCAC19E25BA15E2F3] - 25/05/2015 - 04:29:40 م ---A- . (.Microsoft Corporation - Microsoft Remote Assistance.) -- C:\WINDOWS\system32\racpldlg.dll [43520] O44 - LFC:[MD5.C31DD4CEC06D2908AE5F212A0B13805B] - 25/05/2015 - 04:29:44 م ---A- . (.Microsoft Corporation - Automatic Updates Control Panel.) -- C:\WINDOWS\system32\wuaucpl.cpl [219160] O44 - LFC:[MD5.08763C1AE79D88D122207D0471E834DB] - 25/05/2015 - 04:29:44 م ---A- . (.Microsoft Corporation - Background Intelligent Transfer Service 2.0.) -- C:\WINDOWS\system32\bitsprx3.dll [7168] O44 - LFC:[MD5.97AE3A4180CAB360F44F7F03E5E0F409] - 25/05/2015 - 04:29:44 م ---A- . (.Microsoft Corporation - Background Intelligent Transfer Service 2.5.) -- C:\WINDOWS\system32\bitsprx4.dll [7168] O44 - LFC:[MD5.9B2E14F4D66A59306584566A705F8CDD] - 25/05/2015 - 04:29:44 م ---A- . (.Microsoft Corporation - Background Intelligent Transfer Service Pro.) -- C:\WINDOWS\system32\bitsprx2.dll [8192] O44 - LFC:[MD5.F1DAC7969C1337AF790BD1D981AA780C] - 25/05/2015 - 04:29:44 م ---A- . (.Microsoft Corporation - Background Intelligent Transfer Service Pro.) -- C:\WINDOWS\system32\qmgrprxy.dll [18944] O44 - LFC:[MD5.574738F61FCA2935F5265DC4E5691314] - 25/05/2015 - 04:29:44 م ---A- . (.Microsoft Corporation - Background Intelligent Transfer Service.) -- C:\WINDOWS\system32\qmgr.dll [409088] O44 - LFC:[MD5.FC3EC24FCE372C89423E015A2AC1A31E] - 25/05/2015 - 04:29:44 م ---A- . (.Microsoft Corporation - Windows Update Agent.) -- C:\WINDOWS\system32\wuaueng.dll [1933848] O44 - LFC:[MD5.09201D6BAEF7984633270D347B5C215E] - 25/05/2015 - 04:29:44 م ---A- . (.Microsoft Corporation - Windows Update AutoUpdate Client.) -- C:\WINDOWS\system32\wuauclt1.exe [172504] O44 - LFC:[MD5.F0EA9AE7565345467B3E45AC1A4B5A1E] - 25/05/2015 - 04:29:44 م ---A- . (.Microsoft Corporation - Windows Update AutoUpdate Engine.) -- C:\WINDOWS\system32\wuaueng1.dll [194520] O44 - LFC:[MD5.FC1E3B06AE8D160B686C5D04B5E85371] - 25/05/2015 - 04:29:44 م ---A- . (.Microsoft Corporation - Windows Update AutoUpdate Service.) -- C:\WINDOWS\system32\wuauserv.dll [22520] O44 - LFC:[MD5.1A617835452EEE5060976C9B9F5FE635] - 25/05/2015 - 04:29:44 م ---A- . (.Microsoft Corporation - Windows Update Client API.) -- C:\WINDOWS\system32\wuapi.dll [577048] O44 - LFC:[MD5.C88C65DF1ED4DFD34CFBD11CDFE519A3] - 25/05/2015 - 04:29:44 م ---A- . (.Microsoft Corporation - Windows Update Client UI Plugin.) -- C:\WINDOWS\system32\wucltui.dll [329240] O44 - LFC:[MD5.C31DCE575EE43CFE5EE1BD1B5FB29A8D] - 25/05/2015 - 04:29:44 م ---A- . (.Microsoft Corporation - Windows Update Web Control.) -- C:\WINDOWS\system32\wuweb.dll [210968] O44 - LFC:[MD5.3458EDA96E30FBD0477A2800D3FB1909] - 25/05/2015 - 04:29:44 م ---A- . (.Microsoft Corporation - Windows Update client proxy stub.) -- C:\WINDOWS\system32\wups.dll [35864] O44 - LFC:[MD5.2E0B0A051FFAA86E358465BB0880D453] - 25/05/2015 - 04:29:44 م ---A- . (.Microsoft Corporation - Windows Update.) -- C:\WINDOWS\system32\wuauclt.exe [53784] O44 - LFC:[MD5.D5F37A37B59E7490F7EDBAB56CCEB856] - 25/05/2015 - 04:29:46 م ---A- . (.Microsoft Corporation - ADVPACK.) -- C:\WINDOWS\system32\advpack.dll.mui [10240] O44 - LFC:[MD5.BCF1FE50EDB865115DB2BBE8B62FD8F0] - 25/05/2015 - 04:29:46 م ---A- . (.Microsoft Corporation - IE Per-User Initialization Utility.) -- C:\WINDOWS\system32\ie4uinit.exe.mui [4096] O44 - LFC:[MD5.39D3A7E1CF6F9F17EFEEA96751172736] - 25/05/2015 - 04:29:46 م ---A- . (.Microsoft Corporation - IEAK branding.) -- C:\WINDOWS\system32\iedkcs32.dll.mui [81920] O44 - LFC:[MD5.332650FEC1768B87180F16EFA2767F89] - 25/05/2015 - 04:29:46 م ---A- . (.Microsoft Corporation - Internet Explorer.) -- C:\WINDOWS\system32\ieframe.dll.mui [1241088] O44 - LFC:[MD5.5895E11854382F5DBF7DC9DA893C5D33] - 25/05/2015 - 04:29:47 م ---A- . (.Microsoft Corporation - Internet Ratings and Local User Management.) -- C:\WINDOWS\system32\msrating.dll.mui [49152] O44 - LFC:[MD5.64D68F1F2B4B2B0A04FCB46FDCFDE155] - 25/05/2015 - 04:29:47 م ---A- . (.Microsoft Corporation - Microsoft (R) HTML Application host.) -- C:\WINDOWS\system32\mshta.exe.mui [2560] O44 - LFC:[MD5.E5FA1B044DAC5F6F600A1742D73F6936] - 25/05/2015 - 04:29:48 م ---A- . (.Microsoft Corporation - IE PNG plugin image decoder.) -- C:\WINDOWS\system32\pngfilt.dll [46592] O44 - LFC:[MD5.42B928FC8518D793BF7A5EAFC57B1D8B] - 25/05/2015 - 04:29:48 م ---A- . (.Microsoft Corporation - IE plugin image decoder support DLL.) -- C:\WINDOWS\system32\imgutil.dll [34816] O44 - LFC:[MD5.8FAAFF28147935E5847F980607965FFE] - 25/05/2015 - 04:29:48 م ---A- . (.Microsoft Corporation - Install engine.) -- C:\WINDOWS\system32\inseng.dll [94720] O44 - LFC:[MD5.0DF848598862E2306937F64A3605C8F7] - 25/05/2015 - 04:29:48 م ---A- . (.Microsoft Corporation - Internet Control Panel.) -- C:\WINDOWS\system32\inetcpl.cpl [1469440] O44 - LFC:[MD5.29BD913D8FD1FEB6728DC9B43B55C1D2] - 25/05/2015 - 04:29:48 م ---A- . (.Microsoft Corporation - Internet Ratings and Local User Management.) -- C:\WINDOWS\system32\msrating.dll [193536] O44 - LFC:[MD5.516E371CC348141277A73EB9D3C25951] - 25/05/2015 - 04:29:48 م ---A- . (.Microsoft Corporation - Microsoft (R) HTML Viewer.) -- C:\WINDOWS\system32\mshtml.dll [6021120] O44 - LFC:[MD5.DF701A1ABFFE789920E9D7E69EE73F00] - 25/05/2015 - 04:29:48 م ---A- . (.Microsoft Corporation - Object Control Viewer.) -- C:\WINDOWS\system32\occache.dll [206848] O44 - LFC:[MD5.CC8915DB4E33E8FB29CA0D2DBF75306E] - 25/05/2015 - 04:29:48 م ---A- . (.Microsoft Corporation - Web Site Monitor.) -- C:\WINDOWS\system32\webcheck.dll [236544] O44 - LFC:[MD5.BE085C746EA903B38204053FF709C634] - 25/05/2015 - 04:29:51 م ---A- . (.Microsoft Corporation - Internet Connection Wizard.) -- C:\WINDOWS\system32\icfgnt5.dll [16384] O44 - LFC:[MD5.B87F759738C52E8D6FBCDAAA84C6486F] - 25/05/2015 - 04:29:51 م ---A- . (.Microsoft Corporation - Microsoft G.723.1 CODEC for MSACM.) -- C:\WINDOWS\system32\msg723.acm [118784] O44 - LFC:[MD5.441086F355F0DEA94621984C9A3BE765] - 25/05/2015 - 04:29:51 م ---A- . (.Microsoft Corporation - Microsoft Internet Account Manager Resource.) -- C:\WINDOWS\system32\acctres.dll [64512] O44 - LFC:[MD5.3C891D38FF07120FD926F51A37568646] - 25/05/2015 - 04:29:51 م ---A- . (.Microsoft Corporation - NetMeeting Event Logging DLL.) -- C:\WINDOWS\system32\nmevtmsg.dll [12288] O44 - LFC:[MD5.81051BCC2CF1BEDF378224B0A93E2877] - 25/05/2015 - 04:29:52 م ---A- . (...) -- C:\WINDOWS\desktop.ini [2] O44 - LFC:[MD5.81051BCC2CF1BEDF378224B0A93E2877] - 25/05/2015 - 04:29:52 م ---A- . (...) -- C:\WINDOWS\system32\desktop.ini [2] O44 - LFC:[MD5.1204FA2AB2A5F321125F777E8D061B22] - 25/05/2015 - 04:29:52 م ---A- . (.Microsoft Corporation - Async Trace DLL.) -- C:\WINDOWS\system32\atrace.dll [11264] O44 - LFC:[MD5.2F3CDC1D898FD25B2547F5BFEB01FD0D] - 25/05/2015 - 04:29:52 م -SH-- . (...) -- C:\WINDOWS\winnt.bmp [48680] O44 - LFC:[MD5.2F3CDC1D898FD25B2547F5BFEB01FD0D] - 25/05/2015 - 04:29:52 م -SH-- . (...) -- C:\WINDOWS\winnt256.bmp [48680] O44 - LFC:[MD5.5A5CFF37F1BD0F86B9BDAAD7A9445882] - 25/05/2015 - 04:30:14 م R-HA- . (...) -- C:\WINDOWS\WindowsShell.Manifest [749] O44 - LFC:[MD5.5A5CFF37F1BD0F86B9BDAAD7A9445882] - 25/05/2015 - 04:30:14 م R-HA- . (...) -- C:\WINDOWS\system32\cdplayer.exe.manifest [749] O44 - LFC:[MD5.5A5CFF37F1BD0F86B9BDAAD7A9445882] - 25/05/2015 - 04:30:14 م R-HA- . (...) -- C:\WINDOWS\system32\ncpa.cpl.manifest [749] O44 - LFC:[MD5.5A5CFF37F1BD0F86B9BDAAD7A9445882] - 25/05/2015 - 04:30:14 م R-HA- . (...) -- C:\WINDOWS\system32\nwc.cpl.manifest [749] O44 - LFC:[MD5.5A5CFF37F1BD0F86B9BDAAD7A9445882] - 25/05/2015 - 04:30:14 م R-HA- . (...) -- C:\WINDOWS\system32\sapi.cpl.manifest [749] O44 - LFC:[MD5.5A5CFF37F1BD0F86B9BDAAD7A9445882] - 25/05/2015 - 04:30:14 م R-HA- . (...) -- C:\WINDOWS\system32\wuaucpl.cpl.manifest [749] O44 - LFC:[MD5.5D76C3FB736514E1D7C88791E7322784] - 25/05/2015 - 04:30:16 م R-HA- . (...) -- C:\WINDOWS\system32\WindowsLogon.manifest [488] O44 - LFC:[MD5.5D76C3FB736514E1D7C88791E7322784] - 25/05/2015 - 04:30:16 م R-HA- . (...) -- C:\WINDOWS\system32\logonui.exe.manifest [488] O44 - LFC:[MD5.E81BBE78A8EF85ACD490B3E64EF63A7C] - 25/05/2015 - 04:30:48 م ---A- . (.Microsoft Corporation - Extended MAPI 1.0 for Windows NT.) -- C:\WINDOWS\system32\mapi32.dll [112128] O44 - LFC:[MD5.53D7F47255085310F50604FDE3076F97] - 25/05/2015 - 04:30:52 م ---A- . (...) -- C:\WINDOWS\ODBCINST.INI [4161] O44 - LFC:[MD5.6D6F4B1886E91EB37ABCCAD19C561EE0] - 25/05/2015 - 04:30:56 م ---A- . (...) -- C:\WINDOWS\system32\amcompat.tlb [16832] O44 - LFC:[MD5.A32B14BE5EDAE794FCE1A9E970827509] - 25/05/2015 - 04:30:56 م ---A- . (...) -- C:\WINDOWS\system32\nscompat.tlb [23392] O44 - LFC:[MD5.DC17DD0189B0C36D863B4DD0A036C10F] - 25/05/2015 - 04:30:58 م ---A- . (...) -- C:\WINDOWS\WMSysPr9.prx [316640] O44 - LFC:[MD5.2A44570770236D602FF1C0B51B61FBA1] - 25/05/2015 - 04:31:00 م ---A- . (...) -- C:\WINDOWS\win.ini [507] O44 - LFC:[MD5.D41D8CD98F00B204E9800998ECF8427E] - 25/05/2015 - 04:31:02 م ---A- . (...) -- C:\AUTOEXEC.BAT [0] O44 - LFC:[MD5.D41D8CD98F00B204E9800998ECF8427E] - 25/05/2015 - 04:31:02 م ---A- . (...) -- C:\CONFIG.SYS [0] O44 - LFC:[MD5.D41D8CD98F00B204E9800998ECF8427E] - 25/05/2015 - 04:31:02 م ---A- . (...) -- C:\WINDOWS\control.ini [0] O44 - LFC:[MD5.01C47C2ECED034EF6F8C1552A97CFF00] - 25/05/2015 - 04:31:02 م ---A- . (...) -- C:\WINDOWS\system32\CONFIG.NT [2577] O44 - LFC:[MD5.D41D8CD98F00B204E9800998ECF8427E] - 25/05/2015 - 04:31:02 م RSHA- . (...) -- C:\IO.SYS [0] O44 - LFC:[MD5.D41D8CD98F00B204E9800998ECF8427E] - 25/05/2015 - 04:31:02 م RSHA- . (...) -- C:\MSDOS.SYS [0] O44 - LFC:[MD5.5B01AF89D16D562825C4DB4530F20CBB] - 25/05/2015 - 04:31:17 م ---A- . (.Adaptec - ASPI for WIN32 Kernel Driver.) -- C:\WINDOWS\system32\Drivers\ASPI32.SYS [16877] O44 - LFC:[MD5.F49EF597B831BCE9132D597B6857681C] - 25/05/2015 - 04:31:17 م ---A- . (.Adaptec - ASPI for Win32 (95/NT) DLL.) -- C:\WINDOWS\system32\WNASPI32.DLL [45056] O44 - LFC:[MD5.3FD411DF4A9999EA848615DEF336E905] - 25/05/2015 - 04:31:22 م ---A- . (.Sun Microsystems, Inc. - Java(TM) Control Panel.) -- C:\WINDOWS\system32\javacpl.cpl [73728] O44 - LFC:[MD5.F87BA06FE22C81CDE563761DDFBAB267] - 25/05/2015 - 04:31:22 م ---A- . (.Sun Microsystems, Inc. - Java(TM) Platform SE binary.) -- C:\WINDOWS\system32\deployJava1.dll [472808] O44 - LFC:[MD5.68288DA42BC798992A42CD59061B199D] - 25/05/2015 - 04:31:22 م ---A- . (.Sun Microsystems, Inc. - Java(TM) Platform SE binary.) -- C:\WINDOWS\system32\java.exe [145184] O44 - LFC:[MD5.5BF8BA1B854D7DFCE1F47E58852B3D8F] - 25/05/2015 - 04:31:22 م ---A- . (.Sun Microsystems, Inc. - Java(TM) Platform SE binary.) -- C:\WINDOWS\system32\javaw.exe [145184] O44 - LFC:[MD5.58DC5CBDC930AF070B177843810F2C85] - 25/05/2015 - 04:31:22 م ---A- . (.Sun Microsystems, Inc. - Java(TM) Web Start Launcher.) -- C:\WINDOWS\system32\javaws.exe [157472] O44 - LFC:[MD5.3384134EEB8F223178C2EB8323003EC0] - 25/05/2015 - 04:31:29 م ---A- . (.Microsoft Corporation - Direct3D HLSL Compiler.) -- C:\WINDOWS\system32\D3DCompiler_40.dll [2036576] O44 - LFC:[MD5.781E8B5B6FDB3C9B4E4A4A9FB019960D] - 25/05/2015 - 04:31:29 م ---A- . (.Microsoft Corporation - Direct3D HLSL Compiler.) -- C:\WINDOWS\system32\D3DCompiler_41.dll [1846632] O44 - LFC:[MD5.B33B21DB610116262D906305CE65C354] - 25/05/2015 - 04:31:29 م ---A- . (.Microsoft Corporation - Direct3D HLSL Compiler.) -- C:\WINDOWS\system32\D3DCompiler_42.dll [1974616] O44 - LFC:[MD5.1C9B45E87528B8BB8CFA884EA0099A85] - 25/05/2015 - 04:31:29 م ---A- . (.Microsoft Corporation - Direct3D HLSL Compiler.) -- C:\WINDOWS\system32\D3DCompiler_43.dll [2106216] O44 - LFC:[MD5.FAE7E1D578C42A7C3D9D61A99D178BD5] - 25/05/2015 - 04:31:29 م ---A- . (.Microsoft Corporation - Microsoft Direct3D.) -- C:\WINDOWS\system32\D3DCompiler_33.dll [1123696] O44 - LFC:[MD5.75F206C195BBACA6EF28565B1C0CD75C] - 25/05/2015 - 04:31:29 م ---A- . (.Microsoft Corporation - Microsoft Direct3D.) -- C:\WINDOWS\system32\D3DCompiler_34.dll [1124720] O44 - LFC:[MD5.5B441670A4F5F8BCCE76741902B8AF56] - 25/05/2015 - 04:31:29 م ---A- . (.Microsoft Corporation - Microsoft Direct3D.) -- C:\WINDOWS\system32\D3DCompiler_35.dll [1358192] O44 - LFC:[MD5.FB4299688A0D3A37687C015AC2B9922D] - 25/05/2015 - 04:31:29 م ---A- . (.Microsoft Corporation - Microsoft Direct3D.) -- C:\WINDOWS\system32\D3DCompiler_36.dll [1374232] O44 - LFC:[MD5.EA752DBCE35045D3C830DC16578CC8AB] - 25/05/2015 - 04:31:29 م ---A- . (.Microsoft Corporation - Microsoft Direct3D.) -- C:\WINDOWS\system32\D3DCompiler_37.dll [1420824] O44 - LFC:[MD5.103CBFC5591008AD33046E20E8E1EEBE] - 25/05/2015 - 04:31:29 م ---A- . (.Microsoft Corporation - Microsoft Direct3D.) -- C:\WINDOWS\system32\D3DCompiler_38.dll [1491992] O44 - LFC:[MD5.C4F1972497FE2CEB7D900938C97FCF91] - 25/05/2015 - 04:31:29 م ---A- . (.Microsoft Corporation - Microsoft Direct3D.) -- C:\WINDOWS\system32\D3DCompiler_39.dll [1493528] O44 - LFC:[MD5.B337306DFB508A1BCEF1974BFBB8D924] - 25/05/2015 - 04:31:30 م ---A- . (.Microsoft Corporation - Direct3D 10.1 Extensions.) -- C:\WINDOWS\system32\d3dcsx_42.dll [5501792] O44 - LFC:[MD5.83EBA442F07AAB8D6375D2EEC945C46C] - 25/05/2015 - 04:31:30 م ---A- . (.Microsoft Corporation - Direct3D 10.1 Extensions.) -- C:\WINDOWS\system32\d3dcsx_43.dll [1868128] O44 - LFC:[MD5.91B4AAD4412BB223B466F3DFB43E86DA] - 25/05/2015 - 04:31:30 م ---A- . (.Microsoft Corporation - Direct3D 10.1 Extensions.) -- C:\WINDOWS\system32\d3dx10_40.dll [452440] O44 - LFC:[MD5.1AA571774936717EE776DBED51E9EDF4] - 25/05/2015 - 04:31:30 م ---A- . (.Microsoft Corporation - Direct3D 10.1 Extensions.) -- C:\WINDOWS\system32\d3dx10_41.dll [453456] O44 - LFC:[MD5.501AC862517C5445742BEE8A2B88414E] - 25/05/2015 - 04:31:30 م ---A- . (.Microsoft Corporation - Direct3D 10.1 Extensions.) -- C:\WINDOWS\system32\d3dx10_42.dll [453456] O44 - LFC:[MD5.20C835843FCEC4DEDFCD7BFFA3B91641] - 25/05/2015 - 04:31:30 م ---A- . (.Microsoft Corporation - Direct3D 10.1 Extensions.) -- C:\WINDOWS\system32\d3dx10_43.dll [470880] O44 - LFC:[MD5.D09AC80A4B5312239852836C84DF3392] - 25/05/2015 - 04:31:30 م ---A- . (.Microsoft Corporation - Direct3D 10.1 Extensions.) -- C:\WINDOWS\system32\d3dx11_42.dll [235344] O44 - LFC:[MD5.8E0BB968FF41D80E5F2C747C04DB79AE] - 25/05/2015 - 04:31:30 م ---A- . (.Microsoft Corporation - Direct3D 10.1 Extensions.) -- C:\WINDOWS\system32\d3dx11_43.dll [248672] O44 - LFC:[MD5.6F34F7405807DCBF0B9BF6811C94C6D9] - 25/05/2015 - 04:31:30 م ---A- . (.Microsoft Corporation - Microsoft Direct3D.) -- C:\WINDOWS\system32\d3dx10.dll [440080] O44 - LFC:[MD5.37A8171ACCF46A9C196054066C28827F] - 25/05/2015 - 04:31:30 م ---A- . (.Microsoft Corporation - Microsoft Direct3D.) -- C:\WINDOWS\system32\d3dx10_33.dll [443752] O44 - LFC:[MD5.5AA9987F2E62B56D7661B6901901F927] - 25/05/2015 - 04:31:30 م ---A- . (.Microsoft Corporation - Microsoft Direct3D.) -- C:\WINDOWS\system32\d3dx10_34.dll [443752] O44 - LFC:[MD5.F3764552E45880DC49B82F38699AA87C] - 25/05/2015 - 04:31:30 م ---A- . (.Microsoft Corporation - Microsoft Direct3D.) -- C:\WINDOWS\system32\d3dx10_35.dll [444776] O44 - LFC:[MD5.D9158E78A368B08D9133043EB3058C12] - 25/05/2015 - 04:31:30 م ---A- . (.Microsoft Corporation - Microsoft Direct3D.) -- C:\WINDOWS\system32\d3dx10_36.dll [444776] O44 - LFC:[MD5.4A43E9A2B17E4CAFA9CB5FEC0B5B686B] - 25/05/2015 - 04:31:30 م ---A- . (.Microsoft Corporation - Microsoft Direct3D.) -- C:\WINDOWS\system32\d3dx10_37.dll [462864] O44 - LFC:[MD5.A2650B27472C21CDD817EEEDE65648E1] - 25/05/2015 - 04:31:30 م ---A- . (.Microsoft Corporation - Microsoft Direct3D.) -- C:\WINDOWS\system32\d3dx10_38.dll [467984] O44 - LFC:[MD5.E6C2F1D8B667DDC04CB55B9F0159EF97] - 25/05/2015 - 04:31:30 م ---A- . (.Microsoft Corporation - Microsoft Direct3D.) -- C:\WINDOWS\system32\d3dx10_39.dll [467984] O44 - LFC:[MD5.BC831661963763AC4D504C5CABB1FDD9] - 25/05/2015 - 04:31:30 م ---A- . (.Microsoft Corporation - No Comment.) -- C:\WINDOWS\system32\d3dx9_24.dll [2222800] O44 - LFC:[MD5.5B48FE9D6686F0D54B26A005ACE24D1D] - 25/05/2015 - 04:31:30 م ---A- . (.Microsoft Corporation - No Comment.) -- C:\WINDOWS\system32\d3dx9_25.dll [2337488] O44 - LFC:[MD5.523AB607EEF81CC4D909E7FEBD8A788E] - 25/05/2015 - 04:31:30 م ---A- . (.Microsoft Corporation - No Comment.) -- C:\WINDOWS\system32\d3dx9_26.dll [2297552] O44 - LFC:[MD5.852EDC778A7A50077694F84D8E601234] - 25/05/2015 - 04:31:30 م ---A- . (.Microsoft Corporation - No Comment.) -- C:\WINDOWS\system32\d3dx9_27.dll [2319568] O44 - LFC:[MD5.BE19B603DFBAA829EE5B7749B3BA97DB] - 25/05/2015 - 04:31:30 م ---A- . (.Microsoft Corporation - No Comment.) -- C:\WINDOWS\system32\d3dx9_28.dll [2323664] O44 - LFC:[MD5.99F4FC172A5ACE36CF00AA7038D23F2C] - 25/05/2015 - 04:31:30 م ---A- . (.Microsoft Corporation - No Comment.) -- C:\WINDOWS\system32\d3dx9_29.dll [2332368] O44 - LFC:[MD5.E415862612E65F10D7D888443ECD7594] - 25/05/2015 - 04:31:30 م ---A- . (.Microsoft Corporation - No Comment.) -- C:\WINDOWS\system32\d3dx9_30.dll [2388176] O44 - LFC:[MD5.797E24743937D67D69F28F2CF5052EE8] - 25/05/2015 - 04:31:30 م ---A- . (.Microsoft Corporation - No Comment.) -- C:\WINDOWS\system32\d3dx9_31.dll [2414360] O44 - LFC:[MD5.26AF232140C88B42D92A88F2198EDF6A] - 25/05/2015 - 04:31:30 م ---A- . (.Microsoft Corporation - No Comment.) -- C:\WINDOWS\system32\d3dx9_32.dll [3426072] O44 - LFC:[MD5.EEA5E428CE63804F9B12D21C97B5968F] - 25/05/2015 - 04:31:31 م ---A- . (.Microsoft Corporation - Direct3D 9 Extensions.) -- C:\WINDOWS\system32\d3dx9_40.dll [4379984] O44 - LFC:[MD5.3FA06CF5079B84155D18B05C08F7131B] - 25/05/2015 - 04:31:31 م ---A- . (.Microsoft Corporation - Direct3D 9 Extensions.) -- C:\WINDOWS\system32\d3dx9_41.dll [4178264] O44 - LFC:[MD5.C6A44FC3CF2F5801561804272217B14D] - 25/05/2015 - 04:31:31 م ---A- . (.Microsoft Corporation - Direct3D 9 Extensions.) -- C:\WINDOWS\system32\d3dx9_42.dll [1892184] O44 - LFC:[MD5.CDB1CD22BAFF21F48606B3C1A18B000B] - 25/05/2015 - 04:31:31 م ---A- . (.Microsoft Corporation - No Comment.) -- C:\WINDOWS\system32\d3dx9_33.dll [3495784] O44 - LFC:[MD5.1CA939918ED1B930059B3A882DE6F648] - 25/05/2015 - 04:31:31 م ---A- . (.Microsoft Corporation - No Comment.) -- C:\WINDOWS\system32\d3dx9_34.dll [3497832] O44 - LFC:[MD5.3EF18B78D17C962F2B71AC1CB7757684] - 25/05/2015 - 04:31:31 م ---A- . (.Microsoft Corporation - No Comment.) -- C:\WINDOWS\system32\d3dx9_35.dll [3727720] O44 - LFC:[MD5.44BFEC5C9C82A2EE9871D88FD3B9A0E2] - 25/05/2015 - 04:31:31 م ---A- . (.Microsoft Corporation - No Comment.) -- C:\WINDOWS\system32\d3dx9_36.dll [3734536] O44 - LFC:[MD5.AC3C517FB0FBBE45FE44007BCD3625A7] - 25/05/2015 - 04:31:31 م ---A- . (.Microsoft Corporation - No Comment.) -- C:\WINDOWS\system32\d3dx9_37.dll [3786760] O44 - LFC:[MD5.8F3EB548AC4ED90252394F60C77E3196] - 25/05/2015 - 04:31:31 م ---A- . (.Microsoft Corporation - No Comment.) -- C:\WINDOWS\system32\d3dx9_38.dll [3850760] O44 - LFC:[MD5.8CB3DEFB8887C4F0846DB1FC1304D6D2] - 25/05/2015 - 04:31:31 م ---A- . (.Microsoft Corporation - No Comment.) -- C:\WINDOWS\system32\d3dx9_39.dll [3851784] O44 - LFC:[MD5.E763798CAD2A90B6AB61854F50CD47DD] - 25/05/2015 - 04:31:32 م ---A- . (.Microsoft Corporation - 3D Audio Library.) -- C:\WINDOWS\system32\X3DAudio1_6.dll [22360] O44 - LFC:[MD5.C811E70C8804CFFF719038250A43B464] - 25/05/2015 - 04:31:32 م ---A- . (.Microsoft Corporation - 3D Audio Library.) -- C:\WINDOWS\system32\X3DAudio1_7.dll [22360] O44 - LFC:[MD5.C4479A4547390E3C5EF28D453ABDE4F5] - 25/05/2015 - 04:31:32 م ---A- . (.Microsoft Corporation - Audio Effect Library.) -- C:\WINDOWS\system32\XAPOFX1_3.dll [69448] O44 - LFC:[MD5.E4CE2AF32F501A7F7DDDD908704A0EE6] - 25/05/2015 - 04:31:32 م ---A- . (.Microsoft Corporation - Audio Effect Library.) -- C:\WINDOWS\system32\XAPOFX1_4.dll [74072] O44 - LFC:[MD5.8A4CEBF34370D689E198E6673C1F2C40] - 25/05/2015 - 04:31:32 م ---A- . (.Microsoft Corporation - Audio Effect Library.) -- C:\WINDOWS\system32\XAPOFX1_5.dll [74072] O44 - LFC:[MD5.86E39E9161C3D930D93822F1563C280D] - 25/05/2015 - 04:31:32 م ---A- . (.Microsoft Corporation - Direct3D 9 Extensions.) -- C:\WINDOWS\system32\d3dx9_43.dll [1998168] O44 - LFC:[MD5.F1726346E583442541FE73429F8E9C10] - 25/05/2015 - 04:31:32 م ---A- . (.Microsoft Corporation - Microsoft Common Controller API.) -- C:\WINDOWS\system32\XInput1_1.dll [62672] O44 - LFC:[MD5.33B62BE226934E1B01F5043870C70427] - 25/05/2015 - 04:31:32 م ---A- . (.Microsoft Corporation - Microsoft Common Controller API.) -- C:\WINDOWS\system32\XInput1_2.dll [62744] O44 - LFC:[MD5.77F595DEE5FFACEA72B135B1FCE1312E] - 25/05/2015 - 04:31:32 م ---A- . (.Microsoft Corporation - Microsoft Common Controller API.) -- C:\WINDOWS\system32\XInput1_3.dll [81768] O44 - LFC:[MD5.ADFB6D7B61E301761C700652B6FE7CCD] - 25/05/2015 - 04:31:32 م ---A- . (.Microsoft Corporation - Microsoft Common Controller API.) -- C:\WINDOWS\system32\XInput9_1_0.dll [61136] O44 - LFC:[MD5.4E961525CC7FF0E5D7DA19E170B7C14C] - 25/05/2015 - 04:31:32 م ---A- . (.Microsoft Corporation - X3DAudio.) -- C:\WINDOWS\system32\X3DAudio1_0.dll [14032] O44 - LFC:[MD5.121B131EAA369D8F58DACC5C39A77D80] - 25/05/2015 - 04:31:32 م ---A- . (.Microsoft Corporation - X3DAudio.) -- C:\WINDOWS\system32\X3DAudio1_1.dll [15128] O44 - LFC:[MD5.F6A9FC2AD2F9111372B5AB3BBA3707EC] - 25/05/2015 - 04:31:32 م ---A- . (.Microsoft Corporation - X3DAudio.) -- C:\WINDOWS\system32\X3DAudio1_2.dll [17928] O44 - LFC:[MD5.C593FD0A96EE4B6390B653C4C641313F] - 25/05/2015 - 04:31:32 م ---A- . (.Microsoft Corporation - X3DAudio.) -- C:\WINDOWS\system32\X3DAudio1_3.dll [25608] O44 - LFC:[MD5.E3832514BD21236067B7227F6165EF95] - 25/05/2015 - 04:31:32 م ---A- . (.Microsoft Corporation - X3DAudio.) -- C:\WINDOWS\system32\X3DAudio1_4.dll [25608] O44 - LFC:[MD5.350FEFE18B86BD4D9AB2A96D00215A49] - 25/05/2015 - 04:31:32 م ---A- . (.Microsoft Corporation - X3DAudio.) -- C:\WINDOWS\system32\X3DAudio1_5.dll [23376] O44 - LFC:[MD5.2112FE0C46662D429347A7D7B49E3ECE] - 25/05/2015 - 04:31:32 م ---A- . (.Microsoft Corporation - XACT Engine API.) -- C:\WINDOWS\system32\XactEngine2_0.dll [230096] O44 - LFC:[MD5.7C9952111F4C743B9F0D8B68B6ED93C9] - 25/05/2015 - 04:31:32 م ---A- . (.Microsoft Corporation - XACT Engine API.) -- C:\WINDOWS\system32\XactEngine2_1.dll [229584] O44 - LFC:[MD5.73E055AF78A64F9B2779D44407CA2AB6] - 25/05/2015 - 04:31:32 م ---A- . (.Microsoft Corporation - XACT Engine API.) -- C:\WINDOWS\system32\XactEngine2_10.dll [267272] O44 - LFC:[MD5.5C4D3843B491C047B7A619901FBD2EC1] - 25/05/2015 - 04:31:32 م ---A- . (.Microsoft Corporation - XACT Engine API.) -- C:\WINDOWS\system32\XactEngine2_2.dll [230168] O44 - LFC:[MD5.69D841744B2BAE38FBB2D40A230A549C] - 25/05/2015 - 04:31:32 م ---A- . (.Microsoft Corporation - XACT Engine API.) -- C:\WINDOWS\system32\XactEngine2_3.dll [236824] O44 - LFC:[MD5.6550E1A0A7BE611592C31222FCB981FB] - 25/05/2015 - 04:31:32 م ---A- . (.Microsoft Corporation - XACT Engine API.) -- C:\WINDOWS\system32\XactEngine2_4.dll [237848] O44 - LFC:[MD5.86C93789E9006F1AC47ED9DD47D4C8A1] - 25/05/2015 - 04:31:32 م ---A- . (.Microsoft Corporation - XACT Engine API.) -- C:\WINDOWS\system32\XactEngine2_5.dll [251672] O44 - LFC:[MD5.39000E033D39D19CCCE21AEAFCCE2476] - 25/05/2015 - 04:31:32 م ---A- . (.Microsoft Corporation - XACT Engine API.) -- C:\WINDOWS\system32\XactEngine2_6.dll [255848] O44 - LFC:[MD5.7FEBB8CE2233CBAE738B16D42ED29674] - 25/05/2015 - 04:31:32 م ---A- . (.Microsoft Corporation - XACT Engine API.) -- C:\WINDOWS\system32\XactEngine2_7.dll [261480] O44 - LFC:[MD5.499210C45AFEAADEE8CF4DCF7D5E570B] - 25/05/2015 - 04:31:32 م ---A- . (.Microsoft Corporation - XACT Engine API.) -- C:\WINDOWS\system32\XactEngine2_8.dll [266088] O44 - LFC:[MD5.46EE68F04A75A1CCF40235EA6F1CBA05] - 25/05/2015 - 04:31:32 م ---A- . (.Microsoft Corporation - XACT Engine API.) -- C:\WINDOWS\system32\XactEngine2_9.dll [267112] O44 - LFC:[MD5.8A83673F0AB001870583FDE2B004FA59] - 25/05/2015 - 04:31:32 م ---A- . (.Microsoft Corporation - XACT Engine API.) -- C:\WINDOWS\system32\XactEngine3_0.dll [238088] O44 - LFC:[MD5.2E0E25252E1D41752876E9FE12ADE175] - 25/05/2015 - 04:31:32 م ---A- . (.Microsoft Corporation - XACT Engine API.) -- C:\WINDOWS\system32\XactEngine3_1.dll [238088] O44 - LFC:[MD5.F3C6BE26949CAADB11DBF0086082FAC9] - 25/05/2015 - 04:31:32 م ---A- . (.Microsoft Corporation - XACT Engine API.) -- C:\WINDOWS\system32\XactEngine3_2.dll [238088] O44 - LFC:[MD5.8BA296419AF3417D1E9806B83166E472] - 25/05/2015 - 04:31:32 م ---A- . (.Microsoft Corporation - XACT Engine API.) -- C:\WINDOWS\system32\XactEngine3_3.dll [235856] O44 - LFC:[MD5.686F8D1B4926D48227A06ACD4D41CD1E] - 25/05/2015 - 04:31:32 م ---A- . (.Microsoft Corporation - XACT Engine API.) -- C:\WINDOWS\system32\XactEngine3_4.dll [235352] O44 - LFC:[MD5.DB3C93E87452B8DAB4F58ED1FD2B1998] - 25/05/2015 - 04:31:32 م ---A- . (.Microsoft Corporation - XACT Engine API.) -- C:\WINDOWS\system32\Xactengine3_5.dll [238936] O44 - LFC:[MD5.F81C4678A55FFEE585AC75825FAF5582] - 25/05/2015 - 04:31:32 م ---A- . (.Microsoft Corporation - XACT Engine API.) -- C:\WINDOWS\system32\xactengine3_6.dll [238936] O44 - LFC:[MD5.4FD7BCB9D8AF6A165E9BA0C2EB702E7C] - 25/05/2015 - 04:31:32 م ---A- . (.Microsoft Corporation - XACT Engine API.) -- C:\WINDOWS\system32\xactengine3_7.dll [239960] O44 - LFC:[MD5.DD165760F1B95200A3DA2D9DFDB84234] - 25/05/2015 - 04:31:32 م ---A- . (.Microsoft Corporation - XAPOFX.) -- C:\WINDOWS\system32\XAPOFX1_0.dll [65032] O44 - LFC:[MD5.D95EAABF5D277EF91D9CA70151209E56] - 25/05/2015 - 04:31:32 م ---A- . (.Microsoft Corporation - XAPOFX.) -- C:\WINDOWS\system32\XAPOFX1_1.dll [68616] O44 - LFC:[MD5.295E47A75F278580F9441041EAAEA3D2] - 25/05/2015 - 04:31:32 م ---A- . (.Microsoft Corporation - XAPOFX.) -- C:\WINDOWS\system32\XAPOFX1_2.dll [70992] O44 - LFC:[MD5.418CDC57E55EE79C3F86C13A19B3D5E3] - 25/05/2015 - 04:31:32 م ---A- . (.Microsoft Corporation - XAudio2 Game Audio API.) -- C:\WINDOWS\system32\XAudio2_0.dll [479752] O44 - LFC:[MD5.E34FF0115B1EE3B4E03D22AE9840EE03] - 25/05/2015 - 04:31:32 م ---A- . (.Microsoft Corporation - XAudio2 Game Audio API.) -- C:\WINDOWS\system32\XAudio2_1.dll [507400] O44 - LFC:[MD5.50F4A0D5E6A0BAFEFA78F353533B8E06] - 25/05/2015 - 04:31:32 م ---A- . (.Microsoft Corporation - XAudio2 Game Audio API.) -- C:\WINDOWS\system32\XAudio2_2.dll [509448] O44 - LFC:[MD5.47ED15DC87AE334C13C4DACD1BE2CCED] - 25/05/2015 - 04:31:32 م ---A- . (.Microsoft Corporation - XAudio2 Game Audio API.) -- C:\WINDOWS\system32\XAudio2_3.dll [514384] O44 - LFC:[MD5.E684C5FA18ADF9EA14737757413BF727] - 25/05/2015 - 04:31:32 م ---A- . (.Microsoft Corporation - XAudio2 Game Audio API.) -- C:\WINDOWS\system32\XAudio2_4.dll [517448] O44 - LFC:[MD5.8B01FB723F3B30AB3DEBDDBF97CFE577] - 25/05/2015 - 04:31:32 م ---A- . (.Microsoft Corporation - XAudio2 Game Audio API.) -- C:\WINDOWS\system32\XAudio2_5.dll [515416] O44 - LFC:[MD5.4976243BD70FAE3D1D24E49739AB2710] - 25/05/2015 - 04:31:32 م ---A- . (.Microsoft Corporation - XAudio2 Game Audio API.) -- C:\WINDOWS\system32\XAudio2_6.dll [528216] O44 - LFC:[MD5.81DFDDFB401D663BA7E6AD1C80364216] - 25/05/2015 - 04:31:32 م ---A- . (.Microsoft Corporation - XAudio2 Game Audio API.) -- C:\WINDOWS\system32\XAudio2_7.dll [527192] O44 - LFC:[MD5.49C1AF91B8E840A037B2391A12CA7154] - 25/05/2015 - 04:33:06 م ---A- . (...) -- C:\WINDOWS\system32\$winnt$.inf [1177] O44 - LFC:[MD5.0829D8D2989424B4D486D2C029025CF0] - 25/05/2015 - 04:34:04 م ---A- . (...) -- C:\WINDOWS\REGLOCS.OLD [8192] O44 - LFC:[MD5.F3C139AD492C4F73353057442E6995CE] - 25/05/2015 - 04:35:58 م ---A- . (...) -- C:\WINDOWS\system32\c_10021.nls [66082] O44 - LFC:[MD5.E7B5FBCE2684A6AF661AEDEB2D6C741C] - 25/05/2015 - 04:35:58 م ---A- . (.Microsoft Corporation - Thai Wordbreaker.) -- C:\WINDOWS\system32\ftlx041e.dll [6144] O44 - LFC:[MD5.797C5AF6A1558AF3EDF134B2591D8CE2] - 25/05/2015 - 04:35:58 م R--A- . (.Microsoft Corporation - Thai Kedmanee (non-ShiftLock) Keyboard Layo.) -- C:\WINDOWS\system32\kbdth2.dll [6144] O44 - LFC:[MD5.0E3F96C13EE88880860E5F542A54EE6B] - 25/05/2015 - 04:35:58 م R--A- . (.Microsoft Corporation - Thai Kedmanee Keyboard Layout.) -- C:\WINDOWS\system32\kbdth0.dll [5632] O44 - LFC:[MD5.ECFC16BFAB5537D9542AB9365796F25B] - 25/05/2015 - 04:35:58 م R--A- . (.Microsoft Corporation - Thai Pattachote (non-ShiftLock) Keyboard La.) -- C:\WINDOWS\system32\kbdth3.dll [6144] O44 - LFC:[MD5.6C7CFEEA3BCE3D6CC7548580FE4DEF1C] - 25/05/2015 - 04:35:58 م R--A- . (.Microsoft Corporation - Thai Pattachote Keyboard Layout.) -- C:\WINDOWS\system32\kbdth1.dll [5632] O44 - LFC:[MD5.72233F1A1D788A84D4687A258CC97CBF] - 25/05/2015 - 04:36:01 م ---A- . (...) -- C:\WINDOWS\system32\c_10005.nls [66082] O44 - LFC:[MD5.A99203A3397A9DB352C5D8DFBDA230A8] - 25/05/2015 - 04:36:01 م ---A- . (...) -- C:\WINDOWS\system32\c_862.nls [66594] O44 - LFC:[MD5.CD5DDA84167F24446183126083EE6C19] - 25/05/2015 - 04:36:01 م R--A- . (.Microsoft Corporation - KBDHEB Keyboard Layout.) -- C:\WINDOWS\system32\kbdheb.dll [5632] O44 - LFC:[MD5.4D4C7CED88E5621F21A4911A44CADACC] - 25/05/2015 - 04:36:02 م ---A- . (...) -- C:\WINDOWS\system32\C_28596.NLS [66082] O44 - LFC:[MD5.1DBBCC1B712C2674BDF29A05A5DD366E] - 25/05/2015 - 04:36:02 م ---A- . (...) -- C:\WINDOWS\system32\c_10004.nls [66082] O44 - LFC:[MD5.77F127766D758EB2C6451E221A0C7F7D] - 25/05/2015 - 04:36:02 م ---A- . (...) -- C:\WINDOWS\system32\c_708.nls [66082] O44 - LFC:[MD5.C050215D8D21DF5658E94187973FB89C] - 25/05/2015 - 04:36:02 م ---A- . (...) -- C:\WINDOWS\system32\c_720.nls [66594] O44 - LFC:[MD5.C58563DF50115E935BC811FFBCE1FC89] - 25/05/2015 - 04:36:02 م ---A- . (...) -- C:\WINDOWS\system32\c_864.nls [66594] O44 - LFC:[MD5.DF209C6F4CB8C10FA5DAB828A4164045] - 25/05/2015 - 04:36:02 م R--A- . (.Microsoft Corporation - Arabic_2 Keyboard Layout.) -- C:\WINDOWS\system32\kbda2.dll [5632] O44 - LFC:[MD5.B6B5F451810EA14F9447BB5BB96B22F0] - 25/05/2015 - 04:36:02 م R--A- . (.Microsoft Corporation - Arabic_English_101 Keyboard Layout.) -- C:\WINDOWS\system32\kbda1.dll [5632] O44 - LFC:[MD5.465E698788EC46B5E59A755CB0DE850A] - 25/05/2015 - 04:36:03 م ---A- . (.Microsoft Corporation - US IBM Arabic 238_L Keyboard Layout.) -- C:\WINDOWS\system32\kbdusa.dll [5632] O44 - LFC:[MD5.D43F274BDC082FD86EFB72719DD8ECDB] - 25/05/2015 - 04:36:03 م R--A- . (.Microsoft Corporation - Arabic_French_102 Keyboard Layout.) -- C:\WINDOWS\system32\kbda3.dll [5632] O44 - LFC:[MD5.93D31B209FEFDC09431E8EFB708E7028] - 25/05/2015 - 04:36:03 م R--A- . (.Microsoft Corporation - Divehi Phonetic Keyboard Layout.) -- C:\WINDOWS\system32\kbddiv1.dll [5632] O44 - LFC:[MD5.80E27279675CF29517DD0B6CFBE05504] - 25/05/2015 - 04:36:03 م R--A- . (.Microsoft Corporation - Divehi Typewriter Keyboard Layout.) -- C:\WINDOWS\system32\kbddiv2.dll [5632] O44 - LFC:[MD5.B04DB738D62A7469C634FF9CD73402BF] - 25/05/2015 - 04:36:03 م R--A- . (.Microsoft Corporation - Farsi Keyboard Layout.) -- C:\WINDOWS\system32\kbdfa.dll [5632] O44 - LFC:[MD5.315CFD150C86E55FD62475C91BE0BA8E] - 25/05/2015 - 04:36:03 م R--A- . (.Microsoft Corporation - Syriac Phoenetic Keyboard Layout.) -- C:\WINDOWS\system32\kbdsyr2.dll [5632] O44 - LFC:[MD5.02DC4BC9DB5980B5E7E911681E67ACF3] - 25/05/2015 - 04:36:03 م R--A- . (.Microsoft Corporation - Syriac Standard Keyboard Layout.) -- C:\WINDOWS\system32\kbdsyr1.dll [5632] O44 - LFC:[MD5.CCB32FB83707777CF590170EC69F0643] - 25/05/2015 - 04:36:03 م R--A- . (.Microsoft Corporation - Urdu Keyboard Layout.) -- C:\WINDOWS\system32\kbdurdu.dll [5632] O44 - LFC:[MD5.89FD6D6E233393794FB75CF79DDC1E06] - 25/05/2015 - 04:36:04 م R--A- . (.Microsoft Corporation - Vietnamese Keyboard Layout.) -- C:\WINDOWS\system32\kbdvntc.dll [5632] O44 - LFC:[MD5.E36A034E3E54682477808BA92FECB075] - 25/05/2015 - 04:36:06 م ---A- . (.Microsoft Corporation - ISCII Code Page Translation DLL.) -- C:\WINDOWS\system32\c_iscii.dll [10752] O44 - LFC:[MD5.835B4EF731C6FD35720C380B6A5B6F22] - 25/05/2015 - 04:36:06 م R--A- . (.Microsoft Corporation - Devanagari Keyboard Layout.) -- C:\WINDOWS\system32\kbdindev.dll [5632] O44 - LFC:[MD5.7FE7B02305737B8367ECF5F3A462991E] - 25/05/2015 - 04:36:06 م R--A- . (.Microsoft Corporation - Gujarati Keyboard Layout.) -- C:\WINDOWS\system32\kbdinguj.dll [5632] O44 - LFC:[MD5.1FADCB5933564255A49614520B44B98E] - 25/05/2015 - 04:36:06 م R--A- . (.Microsoft Corporation - Hindi Keyboard Layout.) -- C:\WINDOWS\system32\kbdinhin.dll [5632] O44 - LFC:[MD5.D52F3380C21BA600BCFE9F45BCA6E887] - 25/05/2015 - 04:36:06 م R--A- . (.Microsoft Corporation - Kannada Keyboard Layout.) -- C:\WINDOWS\system32\kbdinkan.dll [5632] O44 - LFC:[MD5.F74D447B49E790BC96C6420EFBC49C4A] - 25/05/2015 - 04:36:06 م R--A- . (.Microsoft Corporation - Marathi Keyboard Layout.) -- C:\WINDOWS\system32\kbdinmar.dll [5632] O44 - LFC:[MD5.970A761FF57216E83AB852050CE4F6BF] - 25/05/2015 - 04:36:06 م R--A- . (.Microsoft Corporation - Punjabi/Gurmukhi Keyboard Layout.) -- C:\WINDOWS\system32\kbdinpun.dll [6144] O44 - LFC:[MD5.5490159446E337B474BEA2C7E20F3E00] - 25/05/2015 - 04:36:06 م R--A- . (.Microsoft Corporation - Tamil Keyboard Layout.) -- C:\WINDOWS\system32\kbdintam.dll [5632] O44 - LFC:[MD5.6C8CDF20DA9962616506E99BC293E153] - 25/05/2015 - 04:36:06 م R--A- . (.Microsoft Corporation - Telugu Keyboard Layout.) -- C:\WINDOWS\system32\kbdintel.dll [5632] O44 - LFC:[MD5.804B09FA1E3A86E729ABCCA7F30AE53C] - 25/05/2015 - 04:36:07 م ---A- . (.Microsoft Corporation - JP Japanese Keyboard Layout Stub driver.) -- C:\WINDOWS\system32\kbdjpn.dll [8704] O44 - LFC:[MD5.C33B3ED4BEF24BAC604FF97FF2D97C49] - 25/05/2015 - 04:36:07 م ---A- . (.Microsoft Corporation - JP Japanese Keyboard Layout for 106.) -- C:\WINDOWS\system32\kbd106.dll [6144] O44 - LFC:[MD5.3244B59A0EB07E7B181F52D80D5E7385] - 25/05/2015 - 04:36:07 م ---A- . (.Microsoft Corporation - KO Hangeul Keyboard Layout Stub driver.) -- C:\WINDOWS\system32\kbdkor.dll [8192] O44 - LFC:[MD5.15CC5E30A8CFFFAC6056EC7CF2070187] - 25/05/2015 - 04:36:07 م ---A- . (.Microsoft Corporation - KO Hangeul Keyboard Layout for 101(Type B).) -- C:\WINDOWS\system32\kbd101b.dll [6144] O44 - LFC:[MD5.E1CB8EE6C0DC70E0DBCFA8D32C849E91] - 25/05/2015 - 04:36:07 م ---A- . (.Microsoft Corporation - KO Hangeul Keyboard Layout for 101(Type C).) -- C:\WINDOWS\system32\kbd101c.dll [6144] O44 - LFC:[MD5.1AB5B6C627EBC61883EA311367F51130] - 25/05/2015 - 04:36:07 م ---A- . (.Microsoft Corporation - KO Hangeul Keyboard Layout for 103.) -- C:\WINDOWS\system32\kbd103.dll [5632] O44 - LFC:[MD5.9970B6B4D37DA8D541537AA51068462D] - 25/05/2015 - 04:36:07 م ---A- . (.Microsoft Corporation - Thai Word Breaker.) -- C:\WINDOWS\system32\Thawbrkr.dll [185344] O44 - LFC:[MD5.0EC03162E932B49E635A79445CCE1E4C] - 25/05/2015 - 04:36:07 م R--A- . (.Microsoft Corporation - Eastern Armenian Keyboard Layout.) -- C:\WINDOWS\system32\kbdarme.dll [5120] O44 - LFC:[MD5.E98DC261A6D62610293FF0CBDA8CAF65] - 25/05/2015 - 04:36:07 م R--A- . (.Microsoft Corporation - Georgian Keyboard Layout.) -- C:\WINDOWS\system32\kbdgeo.dll [5120] O44 - LFC:[MD5.1004B259E77BEF2033CAF435760D95A6] - 25/05/2015 - 04:36:07 م R--A- . (.Microsoft Corporation - Western Armenian Keyboard Layout.) -- C:\WINDOWS\system32\kbdarmw.dll [5120] O44 - LFC:[MD5.6E358B0063B7D26BF43B1E7C8574BF45] - 25/05/2015 - 04:36:09 م ---A- . (.Microsoft Corporation - DEC LK411-AJ Keyboard Layout.) -- C:\WINDOWS\system32\kbdlk41a.dll [6656] O44 - LFC:[MD5.9DBAD0AC31691E224FE2C175A13066C6] - 25/05/2015 - 04:36:09 م ---A- . (.Microsoft Corporation - DEC LK411-JJ Keyboard Layout.) -- C:\WINDOWS\system32\kbdlk41j.dll [6144] O44 - LFC:[MD5.3B479B92A1159A2CFF613B3FAA2AD9CD] - 25/05/2015 - 04:36:09 م ---A- . (.Microsoft Corporation - JP Japanese Keyboard Layout for 101.) -- C:\WINDOWS\system32\kbd101.dll [6144] O44 - LFC:[MD5.4A191F7F95107D19582F242223FA4F02] - 25/05/2015 - 04:36:09 م ---A- . (.Microsoft Corporation - JP Japanese Keyboard Layout for 106.) -- C:\WINDOWS\system32\kbd106n.dll [6144] O44 - LFC:[MD5.377BE6FC749019B820392FD006351063] - 25/05/2015 - 04:36:09 م ---A- . (.Microsoft Corporation - JP Japanese Keyboard Layout for AX2.) -- C:\WINDOWS\system32\kbdax2.dll [6144] O44 - LFC:[MD5.0CB0A3BE2B48345085710D842C1BBC05] - 25/05/2015 - 04:36:09 م ---A- . (.Microsoft Corporation - JP Japanese Keyboard Layout for Fujitsu FMV.) -- C:\WINDOWS\system32\f3ahvoas.dll [7168] O44 - LFC:[MD5.60D7FA4362D56730A6513DEC866E8489] - 25/05/2015 - 04:36:09 م ---A- . (.Microsoft Corporation - JP Japanese Keyboard Layout for IBM 5576-00.) -- C:\WINDOWS\system32\kbdibm02.dll [7168] O44 - LFC:[MD5.5510BBA7190C545610597F0A109E0CA0] - 25/05/2015 - 04:36:09 م ---A- . (.Microsoft Corporation - Microsoft IME Standard.) -- C:\WINDOWS\system32\imjp81.ime [340023] O44 - LFC:[MD5.2FA3AA17542825F837E119CC669943BC] - 25/05/2015 - 04:36:09 م ---A- . (.Microsoft Corporation - Microsoft IME.) -- C:\WINDOWS\system32\imjp81k.dll [811064] O44 - LFC:[MD5.0BE4186EF76AED034FE43A0797F963FA] - 25/05/2015 - 04:36:10 م ---A- . (.Microsoft Corporation - Microsoft Korean IME 2002.) -- C:\WINDOWS\system32\imekr61.ime [94720] O44 - LFC:[MD5.4F210DE49BA0BDE0CA42AB74563D103C] - 25/05/2015 - 04:36:11 م ---A- . (.Microsoft Corporation - GB18030 DBCS-Unicode Conversion DLL.) -- C:\WINDOWS\system32\c_g18030.dll [218112] O44 - LFC:[MD5.AFED5A91A1E3B2B3B6574F44C53193E2] - 25/05/2015 - 04:36:11 م ---A- . (.Microsoft Corporation - 全拼输入法 5.0 版.) -- C:\WINDOWS\system32\WINPY.IME [156672] O44 - LFC:[MD5.9A75DC3DB95E811634D26A23E52325D3] - 25/05/2015 - 04:36:11 م ---A- . (.Microsoft Corporation - 区位输入法 5.0 版.) -- C:\WINDOWS\system32\WINGB.IME [72704] O44 - LFC:[MD5.B81F91F69E20AA4593ABBB77343BD83E] - 25/05/2015 - 04:36:11 م ---A- . (.Microsoft Corporation - 双拼输入法 5.0 版.) -- C:\WINDOWS\system32\WINSP.IME [156672] O44 - LFC:[MD5.7E0B8C97043388405471FD76E8F189FD] - 25/05/2015 - 04:36:11 م ---A- . (.Microsoft Corporation - 微软拼音输入法 3.0.) -- C:\WINDOWS\system32\PINTLGNT.IME [482304] O44 - LFC:[MD5.5A4640E1F033110B095A4649664864DB] - 25/05/2015 - 04:36:11 م ---A- . (.Microsoft Corporation - 郑码输入法 5.0 版.) -- C:\WINDOWS\system32\WINZM.IME [156672] O44 - LFC:[MD5.4B1C1F9A10CE47FEA5407DAC4C1F4EF8] - 25/05/2015 - 04:36:13 م ---A- . (.Microsoft Corporation - Generic IME 5.0 version.) -- C:\WINDOWS\system32\uniime.dll [76288] O44 - LFC:[MD5.0419BC2473FA62BF61F615B4893CA299] - 25/05/2015 - 04:36:13 م ---A- . (.Microsoft Corporation - 倉頡輸入法 5.0 版.) -- C:\WINDOWS\system32\chajei.ime [78336] O44 - LFC:[MD5.2CC6DF8577A8648C6C802C067862443E] - 25/05/2015 - 04:36:13 م ---A- . (.Microsoft Corporation - 內碼輸入法 5.0 版.) -- C:\WINDOWS\system32\winime.ime [65536] O44 - LFC:[MD5.21EE9664CB49C1C797E751FE13675B10] - 25/05/2015 - 04:36:13 م ---A- . (.Microsoft Corporation - 單碼輸入法 5.0 版.) -- C:\WINDOWS\system32\unicdime.ime [65024] O44 - LFC:[MD5.DC47D5147C07FE214380FC866963C8C0] - 25/05/2015 - 04:36:13 م ---A- . (.Microsoft Corporation - 大易輸入法 5.0 版.) -- C:\WINDOWS\system32\dayi.ime [78848] O44 - LFC:[MD5.BB665DCB93104E4D81678E55A765F4FF] - 25/05/2015 - 04:36:13 م ---A- . (.Microsoft Corporation - 注音輸入法 5.0 版.) -- C:\WINDOWS\system32\phon.ime [79360] O44 - LFC:[MD5.2F15D7D52D74C84172EC3440BBF543FC] - 25/05/2015 - 04:36:13 م ---A- . (.Microsoft Corporation - 英數輸入法 5.0 版.) -- C:\WINDOWS\system32\romanime.ime [26112] O44 - LFC:[MD5.56948CD822AAD728895A74CC8EC0D735] - 25/05/2015 - 04:36:13 م ---A- . (.Microsoft Corporation - 行列輸入法 5.0 版.) -- C:\WINDOWS\system32\winar30.ime [79360] O44 - LFC:[MD5.C40CF89D7E855DE1FCDA27DB5F3CE424] - 25/05/2015 - 04:36:13 م ---A- . (.Microsoft Corporation - 通用輸入法 5.0 版.) -- C:\WINDOWS\system32\miniime.tpl [11776] O44 - LFC:[MD5.FA97615A0C79C51FAD96911D2D946B77] - 25/05/2015 - 04:36:13 م ---A- . (.Microsoft Corporation - 速成輸入法 5.0 版.) -- C:\WINDOWS\system32\quick.ime [77824] O44 - LFC:[MD5.157A2706E78D7B581642F6F787EC37E5] - 25/05/2015 - 04:36:14 م ---A- . (...) -- C:\WINDOWS\system32\c_10001.nls [162850] O44 - LFC:[MD5.AAB0740BCBDCE107E0BABEE466905EB4] - 25/05/2015 - 04:36:14 م ---A- . (...) -- C:\WINDOWS\system32\c_20000.nls [180258] O44 - LFC:[MD5.B2B3B6A63D9A1837673A2B2C44455A20] - 25/05/2015 - 04:36:14 م ---A- . (...) -- C:\WINDOWS\system32\c_20290.nls [66082] O44 - LFC:[MD5.3FEF4EEFC8827A03B19124575B17205E] - 25/05/2015 - 04:36:14 م ---A- . (...) -- C:\WINDOWS\system32\c_20932.nls [180770] O44 - LFC:[MD5.32919D0DA9A834E8197203C4858ABCF6] - 25/05/2015 - 04:36:14 م ---A- . (...) -- C:\WINDOWS\system32\c_20936.nls [173602] O44 - LFC:[MD5.232094E602642181A5A508975665D11B] - 25/05/2015 - 04:36:14 م ---A- . (...) -- C:\WINDOWS\system32\c_20949.nls [177698] O44 - LFC:[MD5.07CD5D103AEB4AD2B624EE1ADBFAA456] - 25/05/2015 - 04:36:14 م ---A- . (...) -- C:\WINDOWS\system32\c_21027.nls [66082] O44 - LFC:[MD5.09E420F90A329BDA68477FA4AF43CB28] - 25/05/2015 - 04:36:14 م ---A- . (...) -- C:\WINDOWS\system32\xjis.nls [28288] O44 - LFC:[MD5.2D51049B3DCE322880D9BC577677C225] - 25/05/2015 - 04:36:14 م ---A- . (.Microsoft Corporation - ISO-2022 Code Page Translation DLL.) -- C:\WINDOWS\system32\c_is2022.dll [6656] O44 - LFC:[MD5.96DDB1E61337B7BE52F650C9B570FC46] - 25/05/2015 - 04:36:14 م ---A- . (.Microsoft Corporation - 微軟新倉頡輸入法 98b.) -- C:\WINDOWS\system32\CINTLGNT.IME [21504] O44 - LFC:[MD5.ED0ABFC1B16BD862BDA52480C7A88A58] - 25/05/2015 - 04:36:14 م ---A- . (.Microsoft Corporation - 微軟新注音輸入法 2002a.) -- C:\WINDOWS\system32\TINTLGNT.IME [571392] O44 - LFC:[MD5.1855E6398A2E937E47809FD8B83647E4] - 25/05/2015 - 04:36:20 م ---A- . (...) -- C:\WINDOWS\system32\c_10003.nls [177698] O44 - LFC:[MD5.A337491EA01F4BE0779A981CB7ACB999] - 25/05/2015 - 04:36:20 م ---A- . (...) -- C:\WINDOWS\system32\c_1361.nls [189986] O44 - LFC:[MD5.DB4F8D50EDA4C0C51BDD0753880FA20B] - 25/05/2015 - 04:36:20 م ---A- . (...) -- C:\WINDOWS\system32\ksc.nls [47066] O44 - LFC:[MD5.C4674F556D1C0B797DD5BADB7A64F7E6] - 25/05/2015 - 04:36:20 م ---A- . (.Microsoft Corporation - JP Japanese Keyboard Layout for (NEC PC-980.) -- C:\WINDOWS\system32\kbdnec95.dll [7168] O44 - LFC:[MD5.33356389C4760487E71D24D4F3083D18] - 25/05/2015 - 04:36:20 م ---A- . (.Microsoft Corporation - JP Japanese Keyboard Layout for (NEC PC-980.) -- C:\WINDOWS\system32\kbdnecAT.dll [9216] O44 - LFC:[MD5.664285630FD21995F24A2551E34A7237] - 25/05/2015 - 04:36:20 م ---A- . (.Microsoft Corporation - JP Japanese Keyboard Layout for (NEC PC-980.) -- C:\WINDOWS\system32\kbdnecNT.dll [7680] O44 - LFC:[MD5.AAF2CFDFCEAE84151060465A4C4506DA] - 25/05/2015 - 04:36:22 م ---A- . (...) -- C:\WINDOWS\system32\WINPY.MB [1783864] O44 - LFC:[MD5.FBA8EDF2418C8754D7199B7DCAD9F159] - 25/05/2015 - 04:36:22 م ---A- . (...) -- C:\WINDOWS\system32\WINSP.MB [1564868] O44 - LFC:[MD5.5A651B76C819817A2B992F34C3A8BC8D] - 25/05/2015 - 04:36:22 م ---A- . (...) -- C:\WINDOWS\system32\WINZM.MB [1223500] O44 - LFC:[MD5.23C1E8F026FB81824388E8EC457CF75E] - 25/05/2015 - 04:36:22 م ---A- . (...) -- C:\WINDOWS\system32\c_10008.nls [173602] O44 - LFC:[MD5.54144F43EDF5AA8F504A30E7C1D1A7B5] - 25/05/2015 - 04:36:22 م ---A- . (...) -- C:\WINDOWS\system32\prc.nls [83748] O44 - LFC:[MD5.901863C68E6523336CAC602FE9320ABC] - 25/05/2015 - 04:36:22 م ---A- . (...) -- C:\WINDOWS\system32\prcp.nls [83748] O44 - LFC:[MD5.22757DEB6FC0968F5B10270DBBA7DB05] - 25/05/2015 - 04:36:22 م ---A- . (.Microsoft Corporation - KO Hangeul Keyboard Layout for 101 (Type A).) -- C:\WINDOWS\system32\kbd101a.dll [6144] O44 - LFC:[MD5.EA2A501A6EE240361FA42FBA90E93611] - 25/05/2015 - 04:36:24 م ---A- . (...) -- C:\WINDOWS\system32\PINTLPAD.HLP [14821] O44 - LFC:[MD5.6D62961C6936709C4FE55CE5F7BE4AC1] - 25/05/2015 - 04:36:24 م ---A- . (...) -- C:\WINDOWS\system32\PINTLPAE.HLP [16254] O44 - LFC:[MD5.6556B40EBEB0879DB90B7AC32B41379B] - 25/05/2015 - 04:36:24 م ---A- . (...) -- C:\WINDOWS\system32\a15.tbl [1460] O44 - LFC:[MD5.9CF1E26D5CFC4747AF8BA76297353523] - 25/05/2015 - 04:36:24 م ---A- . (...) -- C:\WINDOWS\system32\a234.tbl [44370] O44 - LFC:[MD5.FF0ABF80940C1A6A9E0DB36EB431EB8E] - 25/05/2015 - 04:36:24 م ---A- . (...) -- C:\WINDOWS\system32\acode.tbl [44370] O44 - LFC:[MD5.C01B81BB10AD14DBC5C4ECD350638096] - 25/05/2015 - 04:36:24 م ---A- . (...) -- C:\WINDOWS\system32\big5.nls [66728] O44 - LFC:[MD5.EE1F60F8774D74BED8B13498F3FE737A] - 25/05/2015 - 04:36:24 م ---A- . (...) -- C:\WINDOWS\system32\bopomofo.nls [82172] O44 - LFC:[MD5.05C0B7F8FA403E6DA75671685A58A940] - 25/05/2015 - 04:36:24 م ---A- . (...) -- C:\WINDOWS\system32\c_10002.nls [195618] O44 - LFC:[MD5.2511B0F32128156F4C7F9F1164D5A108] - 25/05/2015 - 04:36:24 م ---A- . (...) -- C:\WINDOWS\system32\dayiphr.tbl [520] O44 - LFC:[MD5.F649C69497F99AA0E87EE81A1E140D0A] - 25/05/2015 - 04:36:24 م ---A- . (...) -- C:\WINDOWS\system32\dayiptr.tbl [700] O44 - LFC:[MD5.805EE17EB45B370D75BD8DE1986EE0D5] - 25/05/2015 - 04:36:24 م ---A- . (...) -- C:\WINDOWS\system32\msdayi.tbl [116285] O44 - LFC:[MD5.87027AC38E50D8185F83F27F92C41330] - 25/05/2015 - 04:36:24 م ---A- . (...) -- C:\WINDOWS\system32\phon.tbl [4071] O44 - LFC:[MD5.217BC5677C19491A22846324300A363C] - 25/05/2015 - 04:36:25 م ---A- . (...) -- C:\WINDOWS\system32\arphr.tbl [110566] O44 - LFC:[MD5.BB30616600212D6EA337441AAC516F22] - 25/05/2015 - 04:36:25 م ---A- . (...) -- C:\WINDOWS\system32\arptr.tbl [16312] O44 - LFC:[MD5.2D37D46049C16DEDCF89BF76EC734877] - 25/05/2015 - 04:36:25 م ---A- . (...) -- C:\WINDOWS\system32\array30.tab [146126] O44 - LFC:[MD5.1924C588038F922AAB8CB66DF42EA4D6] - 25/05/2015 - 04:36:25 م ---A- . (...) -- C:\WINDOWS\system32\arrayhw.tab [18600] O44 - LFC:[MD5.531FE5A2634D87A078017259F21D9736] - 25/05/2015 - 04:36:25 م ---A- . (...) -- C:\WINDOWS\system32\lcphrase.tbl [211938] O44 - LFC:[MD5.D3C85593F8C4576FCF9B42AC48CA4368] - 25/05/2015 - 04:36:25 م ---A- . (...) -- C:\WINDOWS\system32\lcptr.tbl [24114] O44 - LFC:[MD5.84E0FC05489B2E05B1F7CD41B3E7FD3B] - 25/05/2015 - 04:36:25 م ---A- . (...) -- C:\WINDOWS\system32\phoncode.tbl [43242] O44 - LFC:[MD5.1C47CF06E760E1865C9AAF04710D517C] - 25/05/2015 - 04:36:25 م ---A- . (...) -- C:\WINDOWS\system32\phonptr.tbl [2714] O44 - LFC:[MD5.55DCED5F0946C03E70B255A3AFC932B1] - 25/05/2015 - 04:36:28 م ---A- . (...) -- C:\WINDOWS\system32\korwbrkr.lex [1158818] O44 - LFC:[MD5.C04D36BBEF5B9BAA8D8DA0B57F22BE20] - 25/05/2015 - 04:36:28 م ---A- . (...) -- C:\WINDOWS\system32\noise.jpn [2060] O44 - LFC:[MD5.1C96B3DA6ABE5E18B63C64DF75884F6A] - 25/05/2015 - 04:36:28 م ---A- . (...) -- C:\WINDOWS\system32\noise.kor [1486] O44 - LFC:[MD5.ECC48F386F8B79D809AEDA327ACA7B0B] - 25/05/2015 - 04:36:28 م ---A- . (.Microsoft Corporation - Japanese Word Breaker.) -- C:\WINDOWS\system32\msir3jp.lex [1875968] O44 - LFC:[MD5.EC57AD860A8BFBE497B03F017DA29CF1] - 25/05/2015 - 04:36:28 م ---A- . (.Microsoft Corporation - Japanese Wordbreaker and Stemmer.) -- C:\WINDOWS\system32\msir3jp.dll [98304] O44 - LFC:[MD5.952E2F1C32F2A18C8922D35AF98B035B] - 25/05/2015 - 04:36:28 م ---A- . (.Microsoft Corporation - Korean WordBreaker.) -- C:\WINDOWS\system32\korwbrkr.dll [70656] O44 - LFC:[MD5.91F6765610FDE0F2B46FB448DDA19408] - 25/05/2015 - 04:36:28 م ---A- . (.Microsoft Corporation - Microsoft Chinese_Simplified Word Breaker C.) -- C:\WINDOWS\system32\chsbrkr.dll [1677824] O44 - LFC:[MD5.10EDEF25D19C0123943FDD1CB9A0E36A] - 25/05/2015 - 04:36:28 م ---A- . (.Microsoft Corporation - Microsoft Traditional Chinese Word Breaker.) -- C:\WINDOWS\system32\chtbrkr.dll [838144] O44 - LFC:[MD5.1D13436E6E07CC475031FB9CAF9C49D0] - 25/05/2015 - 04:36:32 م ---A- . (...) -- C:\WINDOWS\system.ini [231] O44 - LFC:[MD5.64902DF790B4B58EB747A6479BDB1CAC] - 25/05/2015 - 04:39:07 م ---A- . (...) -- C:\WINDOWS\system32\netathuw.cat [7518] O44 - LFC:[MD5.2753B07824EDC6D1769C8C2DBE8FFC08] - 25/05/2015 - 04:39:07 م R--A- . (...) -- C:\WINDOWS\system32\netathuw.inf [35335] O44 - LFC:[MD5.8E2257584B2C52D44B4CB1949947D885] - 25/05/2015 - 04:39:07 م R--A- . (.Atheros Communications, Inc. - Driver for Atheros Wireless Network Adapter.) -- C:\WINDOWS\system32\athuw.sys [1714176] O44 - LFC:[MD5.8E2257584B2C52D44B4CB1949947D885] - 25/05/2015 - 04:39:15 م R--A- . (.Atheros Communications, Inc. - Driver for Atheros Wireless Network Adapter.) -- C:\WINDOWS\system32\Drivers\athuw.sys [1714176] O44 - LFC:[MD5.CF7C86AAAAB593A6D2153F6FD5D2ACC5] - 25/05/2015 - 04:39:20 م ---A- . (...) -- C:\WINDOWS\system32\wgapi.dll [422000] O44 - LFC:[MD5.CE4F6C93742EFC80CD5E595D055DC0E2] - 25/05/2015 - 04:39:20 م ---A- . (...) -- C:\WINDOWS\system32\wgapiloc.dll [77824] O44 - LFC:[MD5.FCF48A83DB9E29819D36356F9F784B5B] - 25/05/2015 - 04:39:20 م ---A- . (...) -- C:\WINDOWS\system32\wsimd.cat [42052] O44 - LFC:[MD5.0C89906E764FBEE328ABFE21F171C6DA] - 25/05/2015 - 04:39:20 م ---A- . (...) -- C:\WINDOWS\system32\wsimd.inf [2179] O44 - LFC:[MD5.0058900BD86FD2C0A41C8242A742C34B] - 25/05/2015 - 04:39:20 م ---A- . (...) -- C:\WINDOWS\system32\wsimdp.cat [42067] O44 - LFC:[MD5.D47C6B587843B255CBF8C1DF0CD94C4D] - 25/05/2015 - 04:39:20 م ---A- . (...) -- C:\WINDOWS\system32\wsimdp.inf [5363] O44 - LFC:[MD5.C78FA8030855193A63ADC64E8FC8B1FD] - 25/05/2015 - 04:39:20 م ---A- . (.Atheros - ACAPI DLL.) -- C:\WINDOWS\system32\athcfg20.dll [237568] O44 - LFC:[MD5.765C5D415CF6054526CCD00B1FBB2325] - 25/05/2015 - 04:39:20 م ---A- . (.Atheros - ACAPI DLL.) -- C:\WINDOWS\system32\athcfg20U.dll [311390] O44 - LFC:[MD5.110D45B9D46FB04189A9E1EE863706B6] - 25/05/2015 - 04:39:20 م ---A- . (.Atheros - WCAPI DLL.) -- C:\WINDOWS\system32\wcapi.dll [405504] O44 - LFC:[MD5.9F25CBA39DD38347479A38AC8612A93B] - 25/05/2015 - 04:39:20 م ---A- . (.Atheros - WCAPI DLL.) -- C:\WINDOWS\system32\wcapiU.dll [360539] O44 - LFC:[MD5.5DC38FE671AF2E314B846BBB451E5AD3] - 25/05/2015 - 04:39:20 م ---A- . (.Atheros Communications, Inc. - ACAPI RES DLL.) -- C:\WINDOWS\system32\athcfg20res.dll [127053] O44 - LFC:[MD5.073DD9B9B9A6BDFF47465141F708F26B] - 25/05/2015 - 04:39:20 م ---A- . (.Atheros Communications, Inc. - ACAPI RES DLL.) -- C:\WINDOWS\system32\athcfg20resU.dll [127079] O44 - LFC:[MD5.175AECCD3A08223B3D6902E6EEE5B66C] - 25/05/2015 - 04:39:20 م ---A- . (.Atheros Communications, Inc. - Atheros Intermediate Driver Interface.) -- C:\WINDOWS\system32\wsimd.dll [249924] O44 - LFC:[MD5.4D2CF321256AFE32D6875285A34F1C2C] - 25/05/2015 - 04:39:20 م ---A- . (.Atheros Communications, Inc. - Atheros Wireless Supplicant Framework(DS).) -- C:\WINDOWS\system32\wsfwDS.dll [254022] O44 - LFC:[MD5.0091D78C5F8FDE0CDF2B214823DE6E48] - 25/05/2015 - 04:39:20 م ---A- . (.Atheros Communications, Inc. - Wireless Intermediate Miniport Driver.) -- C:\WINDOWS\system32\Drivers\wsimd.sys [58208] O44 - LFC:[MD5.0091D78C5F8FDE0CDF2B214823DE6E48] - 25/05/2015 - 04:39:20 م ---A- . (.Atheros Communications, Inc. - Wireless Intermediate Miniport Driver.) -- C:\WINDOWS\system32\wsimd.sys [58208] O44 - LFC:[MD5.BE90AD430CECC63102CACE16EB4826C9] - 25/05/2015 - 04:39:20 م ---A- . (.Devicescape - Devicescape Windows Supplicant DLL.) -- C:\WINDOWS\system32\dsa.dll [1269854] O44 - LFC:[MD5.31328A47CEB9FCB0CEA065ACEB596F85] - 25/05/2015 - 04:39:20 م ---A- . (.Devicescape, Inc. - dsaNac.) -- C:\WINDOWS\system32\dsaNac.dll [82017] O44 - LFC:[MD5.46E77AB5E91094D6C1EE518CA4626972] - 25/05/2015 - 04:39:20 م ---A- . (.No owner - GSetup MFC Application.) -- C:\WINDOWS\GSetup.exe [207400] O44 - LFC:[MD5.5AC144F03B31AFAB6717AD3622D1680D] - 25/05/2015 - 04:39:26 م ---A- . (.Atheros - ACS.) -- C:\WINDOWS\system32\acs.exe [499796] O44 - LFC:[MD5.EFD841BB0EBFDF633B80246B5993C5A4] - 25/05/2015 - 04:39:26 م ---A- . (.No owner - IPTests Module.) -- C:\WINDOWS\system32\IPTests.dll [262216] O44 - LFC:[MD5.15DB3F171F60556312611A11C65A0E3A] - 25/05/2015 - 04:42:38 م ---A- . (...) -- C:\WINDOWS\system32\Gfxres.cs-CZ.resources [117179] O44 - LFC:[MD5.2AF503A3EFB9324E7799CB1CC80C23B7] - 25/05/2015 - 04:42:38 م ---A- . (.Intel Corporation - igfxres Module.) -- C:\WINDOWS\system32\igfxrplk.lrc [284160] O44 - LFC:[MD5.60BBCF7E2423079AE449A8EC5872E7E1] - 25/05/2015 - 04:42:38 م ---A- . (.Intel Corporation - igfxress Module.) -- C:\WINDOWS\system32\igfxress.dll [9030656] O44 - LFC:[MD5.FFB49EE58EF3E271AA25F847D3299047] - 25/05/2015 - 04:42:39 م ---A- . (...) -- C:\WINDOWS\system32\GfxUI.exe.config [151] O44 - LFC:[MD5.3C5333479F789D7674D0AEAB479710A6] - 25/05/2015 - 04:42:39 م ---A- . (...) -- C:\WINDOWS\system32\Gfxres.da-DK.resources [112667] O44 - LFC:[MD5.31C514B2A60538FF1D10174161600C5E] - 25/05/2015 - 04:42:39 م ---A- . (...) -- C:\WINDOWS\system32\Gfxres.de-DE.resources [121140] O44 - LFC:[MD5.50961D38C00943C26F318ECE90987D88] - 25/05/2015 - 04:42:39 م ---A- . (...) -- C:\WINDOWS\system32\Gfxres.en-US.resources [108636] O44 - LFC:[MD5.83868404E44265F2665F678E2DBA5BC0] - 25/05/2015 - 04:42:39 م ---A- . (...) -- C:\WINDOWS\system32\Gfxres.es-ES.resources [121375] O44 - LFC:[MD5.15A04D3D23964D9A4BF930C16B9F65F5] - 25/05/2015 - 04:42:39 م ---A- . (...) -- C:\WINDOWS\system32\Gfxres.fr-FR.resources [119204] O44 - LFC:[MD5.D7F71FD90C19811EB6CE6F20BAC02714] - 25/05/2015 - 04:42:39 م ---A- . (...) -- C:\WINDOWS\system32\Gfxres.hu-HU.resources [117981] O44 - LFC:[MD5.D021EBF8B89CB40E3DBC78FE317FA187] - 25/05/2015 - 04:42:39 م ---A- . (...) -- C:\WINDOWS\system32\Gfxres.it-IT.resources [123983] O44 - LFC:[MD5.3EEC2B24C6DBB703C2CD1291B23DA56E] - 25/05/2015 - 04:42:39 م ---A- . (...) -- C:\WINDOWS\system32\Gfxres.ja-JP.resources [134852] O44 - LFC:[MD5.8B25E299A8A6C7A53863BF9A8616FD8A] - 25/05/2015 - 04:42:39 م ---A- . (...) -- C:\WINDOWS\system32\Gfxres.ko-KR.resources [121696] O44 - LFC:[MD5.7745AC55F01A5540B5242E964A353BCE] - 25/05/2015 - 04:42:39 م ---A- . (...) -- C:\WINDOWS\system32\Gfxres.nb-NO.resources [113272] O44 - LFC:[MD5.80F8E5E0DC5F1B8AA63721CB9327B1F5] - 25/05/2015 - 04:42:39 م ---A- . (...) -- C:\WINDOWS\system32\Gfxres.nl-NL.resources [118003] O44 - LFC:[MD5.02BFBA030CCDB1807B7A4571835E8D0F] - 25/05/2015 - 04:42:39 م ---A- . (...) -- C:\WINDOWS\system32\Gfxres.pl-PL.resources [116862] O44 - LFC:[MD5.A4BF9256FEE75B06C8645A5C39BF7625] - 25/05/2015 - 04:42:39 م ---A- . (...) -- C:\WINDOWS\system32\Gfxres.pt-BR.resources [118800] O44 - LFC:[MD5.9EF9456992C6F0F7894898A12EE201EC] - 25/05/2015 - 04:42:39 م ---A- . (...) -- C:\WINDOWS\system32\Gfxres.pt-PT.resources [117466] O44 - LFC:[MD5.D0CB8CD5C7A630A586EB8FB6320E546C] - 25/05/2015 - 04:42:39 م ---A- . (...) -- C:\WINDOWS\system32\Gfxres.sv-SE.resources [117770] O44 - LFC:[MD5.E9E02E3AEA6CDA7BA2FC09A0A41047B3] - 25/05/2015 - 04:42:39 م ---A- . (...) -- C:\WINDOWS\system32\Gfxres.th-TH.resources [188114] O44 - LFC:[MD5.78B88D1E9546846B0D9D4151910B86B3] - 25/05/2015 - 04:42:39 م ---A- . (...) -- C:\WINDOWS\system32\Gfxres.tr-TR.resources [119560] O44 - LFC:[MD5.B2918F4685A44D3CE5FE656274CC5E67] - 25/05/2015 - 04:42:39 م ---A- . (...) -- C:\WINDOWS\system32\Gfxres.zh-TW.resources [102448] O44 - LFC:[MD5.AE5AF8F3A173AD32D845CD3029011E63] - 25/05/2015 - 04:42:39 م ---A- . (...) -- C:\WINDOWS\system32\IGFXDEVLib.dll [4096] O44 - LFC:[MD5.93DF26C93F4D7504771B839D8A502843] - 25/05/2015 - 04:42:39 م ---A- . (...) -- C:\WINDOWS\system32\igcompkrng500.bin [439336] O44 - LFC:[MD5.983A1A854E4F19D934390DAD2E256D30] - 25/05/2015 - 04:42:39 م ---A- . (...) -- C:\WINDOWS\system32\igxpxk32.vp [58558] O44 - LFC:[MD5.E8CC824020E67414CEC938513272F894] - 25/05/2015 - 04:42:39 م ---A- . (...) -- C:\WINDOWS\system32\igxpxs32.vp [33280] O44 - LFC:[MD5.B059A48DF3E3FD8EE51E06C83B2687C0] - 25/05/2015 - 04:42:39 م ---A- . (.Intel Corporation - Component GHAL Driver.) -- C:\WINDOWS\system32\igxpdv32.dll [3226048] O44 - LFC:[MD5.F1D94B8A7DCB226ACDD7640CA2CF5F5D] - 25/05/2015 - 04:42:39 م ---A- . (.Intel Corporation - DirectDraw(R) Driver for Intel(R) Graphics.) -- C:\WINDOWS\system32\igxpdx32.dll [3767808] O44 - LFC:[MD5.023DAAAFFC9870AADD6382539AA38F76] - 25/05/2015 - 04:42:39 م ---A- . (.Intel Corporation - GfxUI.) -- C:\WINDOWS\system32\GfxUI.exe [3118104] O44 - LFC:[MD5.479B74464BC0C4003A392661D6C3E241] - 25/05/2015 - 04:42:39 م ---A- . (.Intel Corporation - Intel Graphics 2D Driver.) -- C:\WINDOWS\system32\igxpgd32.dll [183808] O44 - LFC:[MD5.BDFC5E1B8D8DC6A14A27BE92D71DC62C] - 25/05/2015 - 04:42:39 م ---A- . (.Intel Corporation - Intel(R) Graphics Media Accelerator Driver.) -- C:\WINDOWS\system32\igfxCoIn_v5259.dll [81920] O44 - LFC:[MD5.518B651EFC4568B8154655921F2F62F4] - 25/05/2015 - 04:42:39 م ---A- . (.Intel Corporation - No Comment.) -- C:\WINDOWS\system32\gfxSrvc.dll [120832] O44 - LFC:[MD5.6B2EEF2346E68B1FCB7F98F777BCB838] - 25/05/2015 - 04:42:39 م ---A- . (.Intel Corporation - OpenGL(R) Device Driver for Intel(R) Graphi.) -- C:\WINDOWS\system32\ig4dev32.dll [4018688] O44 - LFC:[MD5.A72BE0086CCF38FE35B76107AC0B58EE] - 25/05/2015 - 04:42:39 م ---A- . (.Intel Corporation - OpenGL(R) Driver for Intel(R) Graphics Acce.) -- C:\WINDOWS\system32\ig4icd32.dll [6057984] O44 - LFC:[MD5.439FB74DDA66C421A147FD437809AEE8] - 25/05/2015 - 04:42:39 م ---A- . (.Intel Corporation - hccutils Module.) -- C:\WINDOWS\system32\hccutils.dll [94720] O44 - LFC:[MD5.BD06FDEAC870D09856B965A88655D747] - 25/05/2015 - 04:42:39 م ---A- . (.Intel Corporation - hkcmd Module.) -- C:\WINDOWS\system32\hkcmd.exe [174104] O44 - LFC:[MD5.6F50B638B73C6158A715B6F1DE4BA6F7] - 25/05/2015 - 04:42:39 م ---A- . (.Intel Corporation - igfxcpl Module.) -- C:\WINDOWS\system32\igfxcpl.cpl [119808] O44 - LFC:[MD5.7C78761F437973750C72DF26779A507E] - 25/05/2015 - 04:42:39 م ---A- . (.Intel Corporation - igfxdev Module.) -- C:\WINDOWS\system32\igfxdev.dll [213504] O44 - LFC:[MD5.C885B80105E68A2CFD89019B584F016F] - 25/05/2015 - 04:42:39 م ---A- . (.Intel Corporation - igfxdo Module.) -- C:\WINDOWS\system32\igfxdo.dll [130048] O44 - LFC:[MD5.B84855D91BF8E82B6A853B1495C96C3D] - 25/05/2015 - 04:42:39 م ---A- . (.Intel Corporation - igfxpph Module.) -- C:\WINDOWS\system32\igfxpph.dll [199680] O44 - LFC:[MD5.294E373168B19BDCEED7B21B98C8F565] - 25/05/2015 - 04:42:39 م ---A- . (.Intel Corporation - igfxres Module.) -- C:\WINDOWS\system32\igfxrara.lrc [282624] O44 - LFC:[MD5.D68B5D863D69C7E7EC4C90CD96F8C59C] - 25/05/2015 - 04:42:39 م ---A- . (.Intel Corporation - igfxres Module.) -- C:\WINDOWS\system32\igfxrchs.lrc [279552] O44 - LFC:[MD5.4E9B5EC2E08EE5FC62A32095CD1687BE] - 25/05/2015 - 04:42:39 م ---A- . (.Intel Corporation - igfxres Module.) -- C:\WINDOWS\system32\igfxrcht.lrc [279552] O44 - LFC:[MD5.37A17AF1FBD3A1C9FA39DF2EFE6AC8C9] - 25/05/2015 - 04:42:39 م ---A- . (.Intel Corporation - igfxres Module.) -- C:\WINDOWS\system32\igfxrdeu.lrc [284160] O44 - LFC:[MD5.EBE738E124DC9742B4539A3CE8EC0C86] - 25/05/2015 - 04:42:39 م ---A- . (.Intel Corporation - igfxres Module.) -- C:\WINDOWS\system32\igfxrell.lrc [284672] O44 - LFC:[MD5.1168C9855A401994843CA23F3F15845B] - 25/05/2015 - 04:42:39 م ---A- . (.Intel Corporation - igfxres Module.) -- C:\WINDOWS\system32\igfxrenu.lrc [283136] O44 - LFC:[MD5.3C24B0E10D76FBD3B9CEF4A1C5D08D9D] - 25/05/2015 - 04:42:39 م ---A- . (.Intel Corporation - igfxres Module.) -- C:\WINDOWS\system32\igfxresn.lrc [284672] O44 - LFC:[MD5.D78D10D20BE4E1BABFDC13C7751A0A52] - 25/05/2015 - 04:42:39 م ---A- . (.Intel Corporation - igfxres Module.) -- C:\WINDOWS\system32\igfxrfin.lrc [283648] O44 - LFC:[MD5.BA39C06210809E2D8F4D3A2BAAB06C35] - 25/05/2015 - 04:42:39 م ---A- . (.Intel Corporation - igfxres Module.) -- C:\WINDOWS\system32\igfxrhun.lrc [283648] O44 - LFC:[MD5.F5BA94BC9973EEE96C077114BFC7BD7F] - 25/05/2015 - 04:42:39 م ---A- . (.Intel Corporation - igfxres Module.) -- C:\WINDOWS\system32\igfxrnld.lrc [283648] O44 - LFC:[MD5.15C12A7CFBEB7553D461ADEF87817FDC] - 25/05/2015 - 04:42:39 م ---A- . (.Intel Corporation - igfxres Module.) -- C:\WINDOWS\system32\igfxrnor.lrc [283648] O44 - LFC:[MD5.1D96E4A000C4D69AF8CE5EF136B466FA] - 25/05/2015 - 04:42:39 م ---A- . (.Intel Corporation - igfxres Module.) -- C:\WINDOWS\system32\igfxrptb.lrc [283648] O44 - LFC:[MD5.7E0088D69276898E4F5DA2201CC323B0] - 25/05/2015 - 04:42:39 م ---A- . (.Intel Corporation - igfxres Module.) -- C:\WINDOWS\system32\igfxrptg.lrc [284160] O44 - LFC:[MD5.90A72F522CAA4DD1C1CE8FF46E5AB14F] - 25/05/2015 - 04:42:39 م ---A- . (.Intel Corporation - igfxres Module.) -- C:\WINDOWS\system32\igfxrrus.lrc [284160] O44 - LFC:[MD5.EC00C1A14250882BCAA4E784259D0490] - 25/05/2015 - 04:42:39 م ---A- . (.Intel Corporation - igfxres Module.) -- C:\WINDOWS\system32\igfxrsky.lrc [284160] O44 - LFC:[MD5.9C1B47790F110F4BA316BFD868556776] - 25/05/2015 - 04:42:39 م ---A- . (.Intel Corporation - igfxres Module.) -- C:\WINDOWS\system32\igfxrslv.lrc [283648] O44 - LFC:[MD5.528F422D2E141F21B456E2C19265164E] - 25/05/2015 - 04:42:39 م ---A- . (.Intel Corporation - igfxsrvc Module.) -- C:\WINDOWS\system32\igfxsrvc.dll [56832] O44 - LFC:[MD5.02FA2499A54B83581F72073853352B38] - 25/05/2015 - 04:42:39 م ---A- . (.Intel Corporation - igfxsrvc Module.) -- C:\WINDOWS\system32\igfxsrvc.exe [265752] O44 - LFC:[MD5.DF458591A7CDF9BE72D85F726ACD8A1F] - 25/05/2015 - 04:42:40 م ---A- . (...) -- C:\WINDOWS\system32\Gfxres.ar-SA.resources [138355] O44 - LFC:[MD5.800D832071ED8BAB83BD3CC9721941F9] - 25/05/2015 - 04:42:40 م ---A- . (...) -- C:\WINDOWS\system32\Gfxres.el-GR.resources [176824] O44 - LFC:[MD5.6D890CFE858C70E339F5C16F3B1F3076] - 25/05/2015 - 04:42:40 م ---A- . (...) -- C:\WINDOWS\system32\Gfxres.fi-FI.resources [117094] O44 - LFC:[MD5.AED18317AC7A6415739EAB370B0182D7] - 25/05/2015 - 04:42:40 م ---A- . (...) -- C:\WINDOWS\system32\Gfxres.he-IL.resources [132174] O44 - LFC:[MD5.995024357CCCE89D5A59ED87281B0A18] - 25/05/2015 - 04:42:40 م ---A- . (...) -- C:\WINDOWS\system32\Gfxres.ru-RU.resources [163864] O44 - LFC:[MD5.684D2D04901E9B2268E176778DAF22BC] - 25/05/2015 - 04:42:40 م ---A- . (...) -- C:\WINDOWS\system32\Gfxres.sk-SK.resources [116472] O44 - LFC:[MD5.11D0F87BA3FBE2C10D919152DB559FDB] - 25/05/2015 - 04:42:40 م ---A- . (...) -- C:\WINDOWS\system32\Gfxres.sl-SI.resources [112763] O44 - LFC:[MD5.C64F56E3474775545541B961024179F8] - 25/05/2015 - 04:42:40 م ---A- . (...) -- C:\WINDOWS\system32\Gfxres.zh-CN.resources [101329] O44 - LFC:[MD5.B7CE3863C74EB5DA2F2158432616C9C1] - 25/05/2015 - 04:42:40 م ---A- . (...) -- C:\WINDOWS\system32\igkrng500.bin [982224] O44 - LFC:[MD5.F8697BCCCEA973DCAEEDE7FD2A3A17C7] - 25/05/2015 - 04:42:40 م ---A- . (...) -- C:\WINDOWS\system32\igxpxa32.cpa [1674683] O44 - LFC:[MD5.9A4D45EE7D8D9BA81366C2A243A7E27B] - 25/05/2015 - 04:42:40 م ---A- . (...) -- C:\WINDOWS\system32\igxpxa32.vp [1023] O44 - LFC:[MD5.A7B7B61825879F272B30E89E390234A3] - 25/05/2015 - 04:42:40 م ---A- . (.Intel Corporation - Intel Graphics 2D Rotation Driver.) -- C:\WINDOWS\system32\igxprd32.dll [57344] O44 - LFC:[MD5.0A50599E2AFECC2142329BDD7A137463] - 25/05/2015 - 04:42:40 م ---A- . (.Intel Corporation - Intel Graphics Miniport Driver.) -- C:\WINDOWS\system32\Drivers\igxpmp32.sys [1917344] O44 - LFC:[MD5.EB7376A9F65736B659AAAF21F964BA89] - 25/05/2015 - 04:42:40 م ---A- . (.Intel Corporation - igfxTray Module.) -- C:\WINDOWS\system32\igfxtray.exe [141848] O44 - LFC:[MD5.6730A1E1FFB59F1CBD86405E4A114450] - 25/05/2015 - 04:42:40 م ---A- . (.Intel Corporation - igfxext Module.) -- C:\WINDOWS\system32\igfxexps.dll [23552] O44 - LFC:[MD5.AD0C05D6C0FEBC888D017B58E961D5E2] - 25/05/2015 - 04:42:40 م ---A- . (.Intel Corporation - igfxext Module.) -- C:\WINDOWS\system32\igfxext.exe [177688] O44 - LFC:[MD5.07695A736881F8218FD219981714E13E] - 25/05/2015 - 04:42:40 م ---A- . (.Intel Corporation - igfxres Module.) -- C:\WINDOWS\system32\igfxrcsy.lrc [283648] O44 - LFC:[MD5.A40BC6A4DE9AF5B71A9DC4BD83EAF016] - 25/05/2015 - 04:42:40 م ---A- . (.Intel Corporation - igfxres Module.) -- C:\WINDOWS\system32\igfxrdan.lrc [283136] O44 - LFC:[MD5.40DFCA390328D606C11411AE479565AD] - 25/05/2015 - 04:42:40 م ---A- . (.Intel Corporation - igfxres Module.) -- C:\WINDOWS\system32\igfxrfra.lrc [284672] O44 - LFC:[MD5.5FAEA0F4B53325AC648BE06BE3FEB5BE] - 25/05/2015 - 04:42:40 م ---A- . (.Intel Corporation - igfxres Module.) -- C:\WINDOWS\system32\igfxrheb.lrc [282624] O44 - LFC:[MD5.A1190BFFFBDFA081D364B61672039182] - 25/05/2015 - 04:42:40 م ---A- . (.Intel Corporation - igfxres Module.) -- C:\WINDOWS\system32\igfxrita.lrc [284160] O44 - LFC:[MD5.F331DED3B6DC0A14A10308AF6308CBD7] - 25/05/2015 - 04:42:40 م ---A- . (.Intel Corporation - igfxres Module.) -- C:\WINDOWS\system32\igfxrjpn.lrc [280576] O44 - LFC:[MD5.D40346048CFBF1362CCABE4736E12E27] - 25/05/2015 - 04:42:40 م ---A- . (.Intel Corporation - igfxres Module.) -- C:\WINDOWS\system32\igfxrkor.lrc [280576] O44 - LFC:[MD5.7B7177D490211A64CBE748DF1C149D58] - 25/05/2015 - 04:42:40 م ---A- . (.Intel Corporation - igfxres Module.) -- C:\WINDOWS\system32\igfxrsve.lrc [283648] O44 - LFC:[MD5.D450CF7D20DB4749D2A8C1F7B04DA075] - 25/05/2015 - 04:42:40 م ---A- . (.Intel Corporation - igfxres Module.) -- C:\WINDOWS\system32\igfxrtha.lrc [283136] O44 - LFC:[MD5.8385B3CDB5796B01801804B5B3547BF4] - 25/05/2015 - 04:42:40 م ---A- . (.Intel Corporation - igfxres Module.) -- C:\WINDOWS\system32\igfxrtrk.lrc [283648] O44 - LFC:[MD5.756E7DACD8B6EDD26B8C62C2907CD845] - 25/05/2015 - 04:42:40 م ---A- . (.Intel Corporation - persistence Module.) -- C:\WINDOWS\system32\igfxpers.exe [144920] O44 - LFC:[MD5.1BD976DD77B31FE0F25708AD5C1351AE] - 25/05/2015 - 04:42:46 م ---A- . (.Microsoft Corporation - Driver Install Frameworks for API library m.) -- C:\WINDOWS\system32\difxapi.dll [319456] O44 - LFC:[MD5.9EF487A186DEA361AA06913A75B3FA99] - 25/05/2015 - 05:36:42 م ---A- . (.Microsoft Corporation - HID Mouse Filter Driver.) -- C:\WINDOWS\system32\Drivers\kbdhid.sys [14592] O44 - LFC:[MD5.DEB04DA35CC871B6D309B77E1443C796] - 25/05/2015 - 05:36:43 م ---A- . (.Microsoft Corporation - HID Audio Service.) -- C:\WINDOWS\system32\hidserv.dll [21504] O44 - LFC:[MD5.A36EE93698802CD899F98BFD553D8185] - 25/05/2015 - 05:39:07 م ---A- . (.Avira GmbH - AVIRA SnapShot Driver.) -- C:\WINDOWS\system32\Drivers\ssmdrv.sys [28520] O44 - LFC:[MD5.CF295F9A323B1EC8B196E598636E78E4] - 25/05/2015 - 05:42:38 م ---A- . (...) -- C:\WINDOWS\system32\shfolder.inf [439] O44 - LFC:[MD5.3317698F2090DD811F0AA93190E13C82] - 25/05/2015 - 05:42:38 م ---A- . (.Microsoft Corporation - Microsoft GDI+.) -- C:\WINDOWS\system32\gdiplus.dll [1706800] O44 - LFC:[MD5.F8D176DB5B14AED7C9B25E0640226BD1] - 25/05/2015 - 05:42:38 م ---A- . (.Microsoft Corporation - Microsoft Layer for Unicode on Win9x System.) -- C:\WINDOWS\system32\unicows.dll [258352] O44 - LFC:[MD5.7D4A0D6C685107AC1B5089806CD4273B] - 25/05/2015 - 05:42:38 م ---A- . (.Microsoft Corporation - W95INF32.) -- C:\WINDOWS\system32\W95INF32.DLL [4608] O44 - LFC:[MD5.7210D5407A2D2F52E851604666403024] - 25/05/2015 - 05:42:38 م ---A- . (.Microsoft Corporation - WExtract 16bit Library.) -- C:\WINDOWS\system32\W95INF16.DLL [2272] O44 - LFC:[MD5.B9C2EB1291BACAF8D979D7DF06D1E4EE] - 25/05/2015 - 05:42:38 م ---A- . (.Neil Banfield - Animation Core.) -- C:\WINDOWS\system32\anim.dll [33968] O44 - LFC:[MD5.4BAF561A4819F0EDF96C6FD903A5694F] - 25/05/2015 - 05:42:38 م ---A- . (.Stardock Corporation - WindowBlinds : DirectSkin.) -- C:\WINDOWS\system32\wbocx.ocx [544768] O44 - LFC:[MD5.7BDB3B1F1303F0370D7E4CE82AD73D37] - 25/05/2015 - 05:42:38 م ---A- . (.Stardock.Net, Inc - WindowBlinds Helper DLL.) -- C:\WINDOWS\system32\wbhelp2.dll [56496] O44 - LFC:[MD5.9714B7C918C6543D69074EC101F86AC4] - 25/05/2015 - 05:43:24 م ----- . (.Sonic Solutions - CDR4 CD and DVD Place Holder Driver (see Px.) -- C:\WINDOWS\system32\Drivers\cdr4_xp.sys [9072] O44 - LFC:[MD5.0D856D16C08440BFB566D6CDD9948D4E] - 25/05/2015 - 05:43:24 م ----- . (.Sonic Solutions - CDRAL Place Holder Driver (see PxHelp).) -- C:\WINDOWS\system32\Drivers\cdralw2k.sys [9200] O44 - LFC:[MD5.09132A1DA77EF78D06421C871B3B92C5] - 25/05/2015 - 05:43:24 م ----- . (.Sonic Solutions - PX Install Application.) -- C:\WINDOWS\system32\pxcpya64.exe [66544] O44 - LFC:[MD5.51598A4CD5BFC25C8D4FB1A740A43583] - 25/05/2015 - 05:43:24 م ----- . (.Sonic Solutions - PX Install Application.) -- C:\WINDOWS\system32\pxhpinst.exe [72176] O44 - LFC:[MD5.B36F01A58631341310C6D4116F2EDF5F] - 25/05/2015 - 05:43:24 م ----- . (.Sonic Solutions - PX Install Application.) -- C:\WINDOWS\system32\pxinsa64.exe [66032] O44 - LFC:[MD5.153D02480A0A2F45785522E814C634B6] - 25/05/2015 - 05:43:24 م ----- . (.Sonic Solutions - Px Engine Device Driver for Windows 2000/XP.) -- C:\WINDOWS\system32\Drivers\PxHelp20.sys [44944] O44 - LFC:[MD5.B248A451721CF86A6CDBA18B379EC80C] - 25/05/2015 - 05:43:24 م ----- . (.Sonic Solutions - Px Unit Table.) -- C:\WINDOWS\system32\pxdrv.dll [551408] O44 - LFC:[MD5.174D2EB772E843B6175EED45D8FA11E7] - 25/05/2015 - 05:43:24 م ----- . (.Sonic Solutions - Px.) -- C:\WINDOWS\system32\px.dll [670192] O44 - LFC:[MD5.9555982C980B760398C09EEFAE6FCF01] - 25/05/2015 - 05:43:24 م ----- . (.Sonic Solutions - PxAFS Dynamic Link Library.) -- C:\WINDOWS\system32\pxafs.dll [129520] O44 - LFC:[MD5.D4BFF8B48CD9A212B45C425F2A1C9B77] - 25/05/2015 - 05:43:24 م ----- . (.Sonic Solutions - PxMas.) -- C:\WINDOWS\system32\pxmas.dll [219632] O44 - LFC:[MD5.5420BAFE4BEFBC64452DEE6AF8782A20] - 25/05/2015 - 05:43:24 م ----- . (.Sonic Solutions - PxSfs.) -- C:\WINDOWS\system32\pxsfs.dll [1858032] O44 - LFC:[MD5.DFC64F80CBC171FB0631E7F15D79C998] - 25/05/2015 - 05:43:24 م ----- . (.Sonic Solutions - PxWave.) -- C:\WINDOWS\system32\pxwave.dll [436720] O44 - LFC:[MD5.23C98662461CA549487676E3E4E16C4F] - 25/05/2015 - 05:43:24 م ----- . (.Sonic Solutions - VxBlock.) -- C:\WINDOWS\system32\vxblock.dll [96752] O44 - LFC:[MD5.C88867D13BB34AA5E01FC8A522AD7401] - 25/05/2015 - 05:44:41 م ---A- . (...) -- C:\WINDOWS\system32\ff_vfw.dll [85504] O44 - LFC:[MD5.AB90E3453839235FD759A854203B948E] - 25/05/2015 - 05:44:41 م ---A- . (...) -- C:\WINDOWS\system32\ff_vfw.dll.manifest [547] O44 - LFC:[MD5.02CE4DF5C0ED4024775F8C908B271638] - 25/05/2015 - 05:44:42 م ---A- . (...) -- C:\WINDOWS\system32\qt-dx331.dll [3596288] O44 - LFC:[MD5.EA2A7A4E96087395C92F669BC316D592] - 25/05/2015 - 05:44:42 م ---A- . (...) -- C:\WINDOWS\system32\xvidcore.dll [881664] O44 - LFC:[MD5.FDB6EA5F8D7F75173ECA24C661C28F88] - 25/05/2015 - 05:44:42 م ---A- . (...) -- C:\WINDOWS\system32\xvidvfw.dll [205824] O44 - LFC:[MD5.D27755D9382CBE6B96ECED9341BBD120] - 25/05/2015 - 05:44:42 م ---A- . (.DivX, Inc. - DivX.) -- C:\WINDOWS\system32\divx.dll [685056] O44 - LFC:[MD5.FA73E857397F44A63F245CB2298A24DD] - 25/05/2015 - 05:44:42 م ---A- . (.DivX, Inc. - dpl100.) -- C:\WINDOWS\system32\dpl100.dll [90112] O44 - LFC:[MD5.5B7F4F0976BE76D8F0A8BFA8714BD1C8] - 25/05/2015 - 05:44:43 م ---A- . (...) -- C:\WINDOWS\system32\lame_acm.xml [414] O44 - LFC:[MD5.D95393B383FB3DB265836C84B53892A3] - 25/05/2015 - 05:44:43 م ---A- . (.fccHandler - AC-3 ACM Codec.) -- C:\WINDOWS\system32\ac3acm.acm [118784] O44 - LFC:[MD5.22722B4E887BB95AB071542DE5A42C80] - 25/05/2015 - 05:44:43 م ---A- . (.http://www.mp3dev.org/ - Lame MP3 codec engine.) -- C:\WINDOWS\system32\lameACM.acm [839680] O44 - LFC:[MD5.DD602C1FBA3A3E962627569C9E10AF7C] - 25/05/2015 - 05:44:43 م ---A- . (.www.helixcommunity.org - Helix YV12 YUV Codec.) -- C:\WINDOWS\system32\yv12vfw.dll [217088] O44 - LFC:[MD5.8B138ED363128BFF2C2E1E7FEA9793B4] - 25/05/2015 - 05:44:44 م ---A- . (...) -- C:\WINDOWS\avisplitter.ini [38] O44 - LFC:[MD5.8CDC0717D3537B71B5447EF9CA930EB1] - 25/05/2015 - 05:44:44 م ---A- . (...) -- C:\WINDOWS\system32\unrar.dll [178176] O44 - LFC:[MD5.13001EB0A58B4DE96126B16AB15FD8CC] - 25/05/2015 - 05:44:44 م ---A- . (.Real Networks, Inc - Real Networks C/C++ Runtime Library.) -- C:\WINDOWS\system32\pncrt.dll [278528] O44 - LFC:[MD5.33833B3EDA1B07EBD367FA9B38B23E60] - 25/05/2015 - 05:44:44 م ---A- . (.RealNetworks, Inc. - 16 bit DirectX helper DLL.) -- C:\WINDOWS\system32\pndx5016.dll [6656] O44 - LFC:[MD5.B74E422BC81236042529DC8A42A18423] - 25/05/2015 - 05:44:44 م ---A- . (.RealNetworks, Inc. - 32 bit DirectX helper DLL.) -- C:\WINDOWS\system32\pndx5032.dll [5632] O44 - LFC:[MD5.ADE9CF5CACD26425854C343997F021E4] - 25/05/2015 - 05:44:44 م ---A- . (.RealNetworks, Inc. - Real Player(tm) ActiveX Control.) -- C:\WINDOWS\system32\rmoc3260.dll [185920] O44 - LFC:[MD5.EC840A6B2FA4375F540A36CE6CE1E678] - 25/05/2015 - 08:33:12 م ---A- . (...) -- C:\WINDOWS\GSetup.ini [61] O44 - LFC:[MD5.41DAD411A4D83C5671BB89961726040B] - 25/05/2015 - 08:34:20 م ---A- . (...) -- C:\WINDOWS\wininit.ini [218] O44 - LFC:[MD5.C30B851A482C4549125F4209788791E6] - 25/05/2015 - 10:02:15 م ----- . (.No owner - Microsoft Audio Codec Placeholder.) -- C:\WINDOWS\system32\iacenc.dll [3072] O44 - LFC:[MD5.FE2571A8C9FFAB1D45502D6B0BF472AA] - 25/05/2015 - 10:16:23 م ----- . (.Microsoft Corporation - Windows XP End of Service notification.) -- C:\WINDOWS\system32\xp_eos.exe [13312] O44 - LFC:[MD5.7BAA36ED6C6098899D9E1269A61085C3] - 25/05/2015 - 11:44:26 م ---A- . (.Avira Operations GmbH & Co. KG - Avira Driver for Security Enhancement.) -- C:\WINDOWS\system32\Drivers\avipbb.sys [136216] O44 - LFC:[MD5.F80F5DCA8A5D9D93CC5BE933D20CAF05] - 25/05/2015 - 11:44:26 م ---A- . (.Avira Operations GmbH & Co. KG - Avira Manager Driver.) -- C:\WINDOWS\system32\Drivers\avkmgr.sys [37896] O44 - LFC:[MD5.EC17E91BC9026C5ED580FB2B13E341AB] - 25/05/2015 - 11:44:26 م ---A- . (.Avira Operations GmbH & Co. KG - Avira Minifilter Driver.) -- C:\WINDOWS\system32\Drivers\avgntflt.sys [107400] O44 - LFC:[MD5.96C9A439DCDA7643DCB20D88F6DB66F3] - 26/05/2015 - 02:00:58 ص ----- . (.Microsoft Corporation - Service Pack Messages.) -- C:\WINDOWS\system32\spmsg.dll [17272] O44 - LFC:[MD5.CBF14132DCD7B1C70CD0959AA82E9A17] - 26/05/2015 - 02:05:54 ص ---A- . (...) -- C:\WINDOWS\system32\TZLog.log [6618] O44 - LFC:[MD5.5329079D8726DE34A58C2EF0BD2AC8B9] - 26/05/2015 - 02:09:57 ص ---A- . (.Microsoft Corporation - Update RunOnce Service.) -- C:\WINDOWS\system32\spupdsvc.exe [26488] O44 - LFC:[MD5.AF1F07AB8AB4E7E04913A9C7CED4ABE9] - 26/05/2015 - 06:29:10 م ---A- . (...) -- C:\WINDOWS\system32\PerfStringBackup.INI [511492] O44 - LFC:[MD5.2F3ED9B3C7CAAE85161B64B637E32ABE] - 26/05/2015 - 06:29:10 م ---A- . (...) -- C:\WINDOWS\system32\perfc009.dat [67682] O44 - LFC:[MD5.E96EF5AA8B26F82A1062C5F1345F428C] - 26/05/2015 - 06:29:10 م ---A- . (...) -- C:\WINDOWS\system32\perfh009.dat [437072] O44 - LFC:[MD5.488D7C65E94EF3BEEC8269909B95EF02] - 26/05/2015 - 11:40:14 ص ---A- . (...) -- C:\WINDOWS\system32\FNTCACHE.DAT [160344] O44 - LFC:[MD5.B1E18AE6E7CF5834753D6857395619C1] - 27/05/2015 - 12:23:42 م ---A- . (...) -- C:\WINDOWS\system32\wpa.dbl [2206] ~ Files: 784 Scanned in :2mn صs ---\\ Export authorized application key (O47) O47 - AAKE:Key Export SP - "C:\Documents and Settings\mohamed\Local Settings\Application Data\Google\Chrome\Application\chrome.exe" [Enabled] .(.Google Inc..) -- C:\Documents and Settings\mohamed\Local Settings\Application Data\Google\Chrome\Application\chrome.exe O47 - AAKE:Key Export SP - "C:\Program Files\Tango\Tango.exe" [Enabled] .(.Tango Inc..) -- C:\Program Files\Tango\Tango.exe O47 - AAKE:Key Export SP - "C:\Program Files\Skype\Phone\Skype.exe" [Enabled] .(.Skype Technologies S.A..) -- C:\Program Files\Skype\Phone\Skype.exe O47 - AAKE:Key Export SP - "C:\Program Files\Mozilla Firefox\firefox.exe" [Enabled] .(.Mozilla Corporation.) -- C:\Program Files\Mozilla Firefox\firefox.exe O47 - AAKE:Key Export DP - "%windir%\Network Diagnostic\xpnetdiag.exe" [Enabled] .(.Microsoft Corporation.) -- C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O47 - AAKE:Key Export DP - "%windir%\system32\sessmgr.exe" [Enabled] .(.Microsoft Corporation.) -- C:\WINDOWS\system32\sessmgr.exe ~ Keys Export: 6 Scanned in :0mn صs ---\\ Local Security Authority-LSA Deny (O48) O48 - LSA:Local Security Authority Authentication Packages . (.Microsoft Corporation - Microsoft Authentication Package v1.0.) -- C:\WINDOWS\system32\msv1_0.dll O48 - LSA:Local Security Authority Notification Packages . (.Microsoft Corporation - Windows Security Configuration Editor Client Engine.) -- C:\WINDOWS\system32\scecli.dll O48 - LSA:Local Security Authority Security Packages . (.Microsoft Corporation - Kerberos Security Package.) -- C:\WINDOWS\system32\kerberos.dll O48 - LSA:Local Security Authority Security Packages . (.Microsoft Corporation - Microsoft Authentication Package v1.0.) -- C:\WINDOWS\system32\msv1_0.dll O48 - LSA:Local Security Authority Security Packages . (.Microsoft Corporation - TLS / SSL Security Provider.) -- C:\WINDOWS\system32\schannel.dll O48 - LSA:Local Security Authority Security Packages . (.Microsoft Corporation - Microsoft Digest Access.) -- C:\WINDOWS\system32\wdigest.dll O48 - LSA:Local Security Authority Security Packages . (.Microsoft Corporation - Web Service Security Package.) -- C:\WINDOWS\system32\tspkg.dll ~ LSA: 7 Scanned in :0mn صs ---\\ Safe Boot Control (O49) O49 - CSB:Control Safe Boot HKLM\...\CCS\Minimal\dmboot.sys . (.Microsoft Corp., Veritas Software - NT Disk Manager Startup Driver.) -- C:\WINDOWS\system32\Drivers\dmboot.sys O49 - CSB:Control Safe Boot HKLM\...\CCS\Minimal\dmio.sys . (.Microsoft Corp., Veritas Software - NT Disk Manager I/O Driver.) -- C:\WINDOWS\system32\Drivers\dmio.sys O49 - CSB:Control Safe Boot HKLM\...\CCS\Minimal\dmload.sys . (.Microsoft Corp., Veritas Software. - NT Disk Manager Startup Driver.) -- C:\WINDOWS\system32\Drivers\dmload.sys O49 - CSB:Control Safe Boot HKLM\...\CCS\Minimal\sermouse.sys . (...) -- C:\WINDOWS\system32\Drivers\sermouse.sys (.not file.) O49 - CSB:Control Safe Boot HKLM\...\CCS\Minimal\sr.sys . (.Microsoft Corporation - System Restore Filesystem Filter Driver.) -- C:\WINDOWS\system32\Drivers\sr.sys O49 - CSB:Control Safe Boot HKLM\...\CCS\Minimal\vga.sys . (.Microsoft Corporation - VGA/Super VGA Video Driver.) -- C:\WINDOWS\system32\Drivers\vga.sys O49 - CSB:Control Safe Boot HKLM\...\CCS\Minimal\vgasave.sys . (...) -- C:\WINDOWS\system32\Drivers\vgasave.sys (.not file.) O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\dmboot.sys . (.Microsoft Corp., Veritas Software - NT Disk Manager Startup Driver.) -- C:\WINDOWS\system32\Drivers\dmboot.sys O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\dmio.sys . (.Microsoft Corp., Veritas Software - NT Disk Manager I/O Driver.) -- C:\WINDOWS\system32\Drivers\dmio.sys O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\dmload.sys . (.Microsoft Corp., Veritas Software. - NT Disk Manager Startup Driver.) -- C:\WINDOWS\system32\Drivers\dmload.sys O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\ip6fw.sys . (.Microsoft Corporation - IPv6 Windows Firewall Driver.) -- C:\WINDOWS\system32\Drivers\ip6fw.sys O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\ipnat.sys . (.Microsoft Corporation - IP Network Address Translator.) -- C:\WINDOWS\system32\Drivers\ipnat.sys O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\rdpcdd.sys . (.Microsoft Corporation - RDP Miniport.) -- C:\WINDOWS\system32\Drivers\rdpcdd.sys O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\rdpdd.sys . (...) -- C:\WINDOWS\system32\Drivers\rdpdd.sys (.not file.) O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\rdpwd.sys . (.Microsoft Corporation - RDP Terminal Stack Driver (US/Canada Only, Not for Export).) -- C:\WINDOWS\system32\Drivers\rdpwd.sys O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\sermouse.sys . (...) -- C:\WINDOWS\system32\Drivers\sermouse.sys (.not file.) O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\sr.sys . (.Microsoft Corporation - System Restore Filesystem Filter Driver.) -- C:\WINDOWS\system32\Drivers\sr.sys O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\tdpipe.sys . (.Microsoft Corporation - Named Pipe Transport Driver.) -- C:\WINDOWS\system32\Drivers\tdpipe.sys O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\tdtcp.sys . (.Microsoft Corporation - TCP Transport Driver.) -- C:\WINDOWS\system32\Drivers\tdtcp.sys O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\vga.sys . (.Microsoft Corporation - VGA/Super VGA Video Driver.) -- C:\WINDOWS\system32\Drivers\vga.sys O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\vgasave.sys . (...) -- C:\WINDOWS\system32\Drivers\vgasave.sys (.not file.) ~ CSB: 21 Scanned in :0mn صs ---\\ Image File Execution Options (IFEO) (O50) O50 - IFEO:Image File Execution Options - Your Image File Name Here without a path - ntsd -d ~ IFEO: Scanned in :0mn صs ---\\ Trojan Driver Search Data (HKLM)(TDSD) (O52) O52 - TDSD: \Drivers32\"msacm.trspch"="tssoft32.acm" . (.DSP GROUP, INC. - DSP Group TrueSpeech(TM) Audio Codec for MSACM V3.50.) -- C:\WINDOWS\system32\tssoft32.acm O52 - TDSD: \Drivers32\"vidc.cvid"="iccvid.dll" . (.Radius Inc. - Cinepak® Codec.) -- C:\WINDOWS\system32\iccvid.dll O52 - TDSD: \Drivers32\"vidc.iv31"="ir32_32.dll" . (...) -- C:\WINDOWS\system32\ir32_32.dll O52 - TDSD: \Drivers32\"vidc.iv32"="ir32_32.dll" . (...) -- C:\WINDOWS\system32\ir32_32.dll O52 - TDSD: \Drivers32\"vidc.iv41"="ir41_32.ax" . (.Intel Corporation - Intel Indeo® Video 4.5.) -- C:\WINDOWS\system32\ir41_32.ax O52 - TDSD: \Drivers32\"msacm.sl_anet"="sl_anet.acm" . (.Sipro Lab Telecom Inc. - Audio codec for MS ACM.) -- C:\WINDOWS\system32\sl_anet.acm O52 - TDSD: \Drivers32\"msacm.l3acm"="l3codecp.acm" . (.Fraunhofer Institut Integrierte Schaltungen - MPEG Audio Layer-3 Codec for MSACM.) -- C:\WINDOWS\system32\l3codecp.acm O52 - TDSD: \Drivers32\"msacm.iac2"="C:\WINDOWS\system32\iac25_32.ax" . (.Intel Corporation - Indeo® audio software.) -- C:\WINDOWS\system32\iac25_32.ax O52 - TDSD: \Drivers32\"vidc.iv50"="ir50_32.dll" . (.Intel Corporation - Intel Indeo® video 5.10.) -- C:\WINDOWS\system32\ir50_32.dll O52 - TDSD: \Drivers32\"VIDC.DIVX"="divx.dll" . (.DivX, Inc. - DivX.) -- C:\WINDOWS\system32\divx.dll O52 - TDSD: \Drivers32\"VIDC.XVID"="xvidvfw.dll" . (...) -- C:\WINDOWS\system32\xvidvfw.dll O52 - TDSD: \Drivers32\"VIDC.YV12"="yv12vfw.dll" . (.www.helixcommunity.org - Helix YV12 YUV Codec.) -- C:\WINDOWS\system32\yv12vfw.dll O52 - TDSD: \Drivers32\"msacm.ac3acm"="ac3acm.acm" . (.fccHandler - AC-3 ACM Codec.) -- C:\WINDOWS\system32\ac3acm.acm O52 - TDSD: \Drivers32\"msacm.lameacm"="lameACM.acm" . (.http://www.mp3dev.org/ - Lame MP3 codec engine.) -- C:\WINDOWS\system32\lameACM.acm O52 - TDSD: \Drivers32\"VIDC.FFDS"="ff_vfw.dll" . (...) -- C:\WINDOWS\system32\ff_vfw.dll O52 - TDSD: \drivers.desc\"sl_anet.acm"="Sipro Lab Telecom Audio Codec" . (.Sipro Lab Telecom Inc. - Audio codec for MS ACM.) -- C:\WINDOWS\system32\sl_anet.acm O52 - TDSD: \drivers.desc\"C:\WINDOWS\system32\iac25_32.ax"="Indeo® audio software" . (.Intel Corporation - Indeo® audio software.) -- C:\WINDOWS\system32\iac25_32.ax O52 - TDSD: \drivers.desc\"ac3acm.acm"="AC-3 ACM Codec" . (.fccHandler - AC-3 ACM Codec.) -- C:\WINDOWS\system32\ac3acm.acm O52 - TDSD: \drivers.desc\"ff_vfw.dll"="ffdshow video encoder" . (...) -- C:\WINDOWS\system32\ff_vfw.dll ~ TDSD: 19 Scanned in :0mn صs ---\\ Microsoft Control Security Providers (MCSP) (O54) O54 - MCSP:[HKLM\...\CurrentControlSet\Control] - (SecurityProviders) - (.Microsoft Corporation - TLS / SSL Security Provider.) -- C:\WINDOWS\system32\schannel.dll O54 - MCSP:[HKLM\...\CurrentControlSet\Control] - (SecurityProviders) - (.Microsoft Corporation - TS Single Sign On Security Package.) -- C:\WINDOWS\system32\credssp.dll O54 - MCSP:[HKLM\...\ControlSet001\Control] - (SecurityProviders) - (.Microsoft Corporation - TLS / SSL Security Provider.) -- C:\WINDOWS\system32\schannel.dll O54 - MCSP:[HKLM\...\ControlSet001\Control] - (SecurityProviders) - (.Microsoft Corporation - TS Single Sign On Security Package.) -- C:\WINDOWS\system32\credssp.dll ~ MSCP: 4 Scanned in :0mn صs ---\\ Microsoft Windows Policies System (MWPS) (O55) O55 - MWPS:[HKLM\...\Policies\System] - "dontdisplaylastusername"=0 O55 - MWPS:[HKLM\...\Policies\System] - "legalnoticecaption"=0 O55 - MWPS:[HKLM\...\Policies\System] - "legalnoticetext"=0 O55 - MWPS:[HKLM\...\Policies\System] - "shutdownwithoutlogon"=1 O55 - MWPS:[HKLM\...\Policies\System] - "undockwithoutlogon"=1 O55 - MWPS:[HKLM\...\Policies\System] - "DisableStatusMessages"=0 O55 - MWPS:[HKLM\...\Policies\System] - "VerboseStatus"=0 O55 - MWPS:[HKCU\...\Policies\System] - "DisableTaskMgr"=0 ~ MWPS: 8 Scanned in :0mn صs ---\\ Microsoft Windows Policies Explorer (MWPE) (O56) O56 - MWPE:[HKCU\...\policies\Explorer] - "NoDriveTypeAutoRun"=145 O56 - MWPE:[HKCU\...\policies\Explorer] - "ForceClassicControlPanel"=1 O56 - MWPE:[HKCU\...\policies\Explorer] - "NoResolveTrack"=1 O56 - MWPE:[HKCU\...\policies\Explorer] - "LinkResolveIgnoreLinkInfo"=1 O56 - MWPE:[HKCU\...\policies\Explorer] - "NoResolveSearch"=1 O56 - MWPE:[HKCU\...\policies\Explorer] - "NoLowDiskSpaceChecks"=1 O56 - MWPE:[HKCU\...\policies\Explorer] - "NoInstrumentation"=1 O56 - MWPE:[HKCU\...\policies\Explorer] - "NoStartMenuMFUprogramsList"=1 O56 - MWPE:[HKCU\...\policies\Explorer] - "NoInternetOpenWith"=1 O56 - MWPE:[HKCU\...\policies\Explorer] - "NoRecentDocsNetHood"=1 O56 - MWPE:[HKCU\...\policies\Explorer] - "NoDesktopCleanupWizard"=1 O56 - MWPE:[HKCU\...\policies\Explorer] - "NoRecentDocsHistory"=1 O56 - MWPE:[HKCU\...\policies\Explorer] - "ClearRecentDocsOnExit"=0 O56 - MWPE:[HKCU\...\policies\Explorer] - "NoUserNameInStartMenu"=0 O56 - MWPE:[HKCU\...\policies\Explorer] - "NoViewContextMenu"=0 O56 - MWPE:[HKCU\...\policies\Explorer] - "NoFolderOptions"=0 O56 - MWPE:[HKCU\...\policies\Explorer] - "NoRecentDocsMenu"=0 O56 - MWPE:[HKCU\...\policies\Explorer] - "NoSMHelp"=0 O56 - MWPE:[HKCU\...\policies\Explorer] - "NoSaveSettings"=0 O56 - MWPE:[HKLM\...\policies\Explorer] - "HonorAutoRunSetting"=1 O56 - MWPE:[HKLM\...\policies\Explorer] - "NoDesktopCleanupWizard"=1 O56 - MWPE:[HKLM\...\policies\Explorer] - "NoRecentDocsHistory"=1 O56 - MWPE:[HKLM\...\policies\Explorer] - "NoSharedDocuments"=1 O56 - MWPE:[HKLM\...\policies\Explorer] - "NoClose"=0 ~ MWPE Keys: 24 Scanned in :0mn صs ---\\ System Drivers List (SDL) (O58) O58 - SDL:14/04/2008 - 10:00:00 ص ---A- . (.RAVISENT Technologies Inc. - CineMaster C 1.2 WDM Main Driver.) -- C:\WINDOWS\system32\Drivers\cinemst2.sys [262528] O58 - SDL:14/04/2008 - 10:00:00 ص ---A- . (.Compaq Computer Corporation - Compaq PA-1 Player Driver.) -- C:\WINDOWS\system32\Drivers\cpqdap01.sys [11776] O58 - SDL:14/04/2008 - 10:00:00 ص ---A- . (.Microsoft Corp., Veritas Software. - NT Disk Manager Startup Driver.) -- C:\WINDOWS\system32\Drivers\dmload.sys [5888] O58 - SDL:14/04/2008 - 10:00:00 ص ---A- . (.S3/Diamond Multimedia Systems - NikeDrv Usb Driver.) -- C:\WINDOWS\system32\Drivers\nikedrv.sys [12032] O58 - SDL:14/04/2008 - 10:00:00 ص ---A- . (.Parallel Technologies, Inc. - Parallel Technologies DirectParallel IO Library.) -- C:\WINDOWS\system32\Drivers\ptilink.sys [17792] O58 - SDL:14/04/2008 - 10:00:00 ص ---A- . (.S3/Diamond Multimedia Systems - Rio8Drv.sys Usb Driver.) -- C:\WINDOWS\system32\Drivers\rio8drv.sys [12032] O58 - SDL:14/04/2008 - 10:00:00 ص ---A- . (.S3/Diamond Multimedia Systems - RioDrv Usb Driver.) -- C:\WINDOWS\system32\Drivers\riodrv.sys [12032] O58 - SDL:14/04/2008 - 10:00:00 ص ---A- . (.Toshiba Corporation - WDM Toshiba Tecra Video Capture Driver.) -- C:\WINDOWS\system32\Drivers\tsbvcap.sys [21376] O58 - SDL:14/04/2008 - 10:00:00 ص ---A- . (.RAVISENT Technologies Inc. - CineMaster C WDM DVD Minidriver.) -- C:\WINDOWS\system32\Drivers\vdmindvd.sys [58112] O58 - SDL:09/03/2011 - 06:30:14 ص ---A- . (.Silicon Image, Inc - Serial ATA miniport driver.) -- C:\WINDOWS\system32\Drivers\si3112.sys [74280] O58 - SDL:14/04/2008 - 10:00:00 ص ---A- . (.Microsoft Corp., Veritas Software - NT Disk Manager Startup Driver.) -- C:\WINDOWS\system32\Drivers\dmboot.sys [799744] O58 - SDL:14/04/2008 - 10:00:00 ص ---A- . (.Microsoft Corp., Veritas Software - NT Disk Manager I/O Driver.) -- C:\WINDOWS\system32\Drivers\dmio.sys [153344] O58 - SDL:14/04/2008 - 10:00:00 ص ---A- . (.Windows (R) Server 2003 DDK provider - High Definition Audio Bus Driver v1.0a.) -- C:\WINDOWS\system32\Drivers\hdaudbus.sys [144384] O58 - SDL:14/04/2008 - 10:00:00 ص ---A- . (.Macrovision Corporation, Macrovision Europe - Macrovision SECURITY Driver.) -- C:\WINDOWS\system32\Drivers\secdrv.sys [20480] O58 - SDL:17/08/2001 - 11:19:34 ص ---A- . (.Creative Technology Ltd. - ENSONIQ AudioPCI 97 WDM Audio Miniport.) -- C:\WINDOWS\system32\Drivers\es1371mp.sys [40704] O58 - SDL:02/01/1601 - 10:00:00 م ---A- . (...) -- C:\WINDOWS\system32\Drivers\sptd.sys [428088] O58 - SDL:17/07/2002 - 07:53:02 ص ---A- . (.Adaptec - ASPI for WIN32 Kernel Driver.) -- C:\WINDOWS\system32\Drivers\ASPI32.SYS [16877] O58 - SDL:05/01/2010 - 02:31:32 ص R--A- . (.Atheros Communications, Inc. - Driver for Atheros Wireless Network Adapter.) -- C:\WINDOWS\system32\Drivers\athuw.sys [1714176] O58 - SDL:21/05/2010 - 12:41:48 م ---A- . (.Atheros Communications, Inc. - Wireless Intermediate Miniport Driver.) -- C:\WINDOWS\system32\Drivers\wsimd.sys [58208] O58 - SDL:21/04/2010 - 02:42:38 ص ---A- . (.Intel Corporation - Intel Graphics Miniport Driver.) -- C:\WINDOWS\system32\Drivers\igxpmp32.sys [1917344] O58 - SDL:25/05/2015 - 11:44:26 م ---A- . (.Avira Operations GmbH & Co. KG - Avira Minifilter Driver.) -- C:\WINDOWS\system32\Drivers\avgntflt.sys [107400] =>.Avira Operations GmbH O58 - SDL:25/05/2015 - 11:44:26 م ---A- . (.Avira Operations GmbH & Co. KG - Avira Driver for Security Enhancement.) -- C:\WINDOWS\system32\Drivers\avipbb.sys [136216] =>.Avira Operations GmbH O58 - SDL:25/05/2015 - 11:44:26 م ---A- . (.Avira Operations GmbH & Co. KG - Avira Manager Driver.) -- C:\WINDOWS\system32\Drivers\avkmgr.sys [37896] =>.Avira Operations GmbH O58 - SDL:14/02/2014 - 10:00:52 ص ---A- . (.Avira GmbH - AVIRA SnapShot Driver.) -- C:\WINDOWS\system32\Drivers\ssmdrv.sys [28520] O58 - SDL:20/08/2008 - 07:58:58 م ----- . (.Sonic Solutions - CDRAL Place Holder Driver (see PxHelp).) -- C:\WINDOWS\system32\Drivers\cdralw2k.sys [9200] O58 - SDL:20/08/2008 - 07:58:58 م ----- . (.Sonic Solutions - CDR4 CD and DVD Place Holder Driver (see PxHelp).) -- C:\WINDOWS\system32\Drivers\cdr4_xp.sys [9072] O58 - SDL:20/08/2008 - 07:58:58 م ----- . (.Sonic Solutions - Px Engine Device Driver for Windows 2000/XP.) -- C:\WINDOWS\system32\Drivers\PxHelp20.sys [44944] O58 - SDL:01/06/2015 - 08:55:12 م ---A- . (.No owner - AVZ Driver.) -- C:\WINDOWS\system32\Drivers\utqyoti2.sys [7168] O58 - SDL:14/04/2008 - 10:00:00 ص ---A- . (...) -- C:\WINDOWS\system32\ansi.sys [9029] O58 - SDL:14/04/2008 - 10:00:00 ص ---A- . (...) -- C:\WINDOWS\system32\country.sys [27097] O58 - SDL:14/04/2008 - 10:00:00 ص ---A- . (...) -- C:\WINDOWS\system32\himem.sys [4768] O58 - SDL:14/04/2008 - 10:00:00 ص ---A- . (...) -- C:\WINDOWS\system32\key01.sys [42809] O58 - SDL:14/04/2008 - 10:00:00 ص ---A- . (...) -- C:\WINDOWS\system32\ntdos404.sys [29146] O58 - SDL:14/04/2008 - 10:00:00 ص ---A- . (...) -- C:\WINDOWS\system32\ntdos411.sys [29370] O58 - SDL:14/04/2008 - 10:00:00 ص ---A- . (...) -- C:\WINDOWS\system32\ntdos412.sys [29274] O58 - SDL:14/04/2008 - 10:00:00 ص ---A- . (...) -- C:\WINDOWS\system32\ntdos804.sys [29146] O58 - SDL:14/04/2008 - 10:00:00 ص ---A- . (...) -- C:\WINDOWS\system32\ntdos.sys [27866] O58 - SDL:14/04/2008 - 10:00:00 ص ---A- . (...) -- C:\WINDOWS\system32\keyboard.sys [42537] O58 - SDL:14/04/2008 - 10:00:00 ص ---A- . (...) -- C:\WINDOWS\system32\ntio404.sys [34560] O58 - SDL:14/04/2008 - 10:00:00 ص ---A- . (...) -- C:\WINDOWS\system32\ntio411.sys [35648] O58 - SDL:14/04/2008 - 10:00:00 ص ---A- . (...) -- C:\WINDOWS\system32\ntio412.sys [35424] O58 - SDL:14/04/2008 - 10:00:00 ص ---A- . (...) -- C:\WINDOWS\system32\ntio804.sys [34560] O58 - SDL:14/04/2008 - 10:00:00 ص ---A- . (...) -- C:\WINDOWS\system32\ntio.sys [33840] O58 - SDL:05/01/2010 - 02:31:32 ص R--A- . (.Atheros Communications, Inc. - Driver for Atheros Wireless Network Adapter.) -- C:\WINDOWS\system32\athuw.sys [1714176] O58 - SDL:21/05/2010 - 12:41:48 م ---A- . (.Atheros Communications, Inc. - Wireless Intermediate Miniport Driver.) -- C:\WINDOWS\system32\wsimd.sys [58208] ~ Drivers: 45 Scanned in :0mn صs ---\\ Last modified or created user files (O61) O61 - LFC: 01/06/2015 - 12:11:53 ص ---A- . (...) -- C:\Documents and Settings\mohamed\Local Settings\Application Data\Google\Chrome\User Data\ev_hashes_whitelist.bin [1113849] O61 - LFC: 01/06/2015 - 12:11:54 ص ---A- . (.Nicolas Coolman.) -- C:\Documents and Settings\mohamed\My Documents\Downloads\ZHPDiag2.exe [6880236] =>.Nicolas Coolman O61 - LFC: 29/05/2015 - 12:11:53 ص ---A- . (.Google.) -- C:\Documents and Settings\mohamed\Local Settings\Application Data\Google\Chrome\User Data\SwReporter\3.21.0\software_reporter_tool.exe [873800] ~ 24 Fichiers temporaires (Temporary files) ~ 42 Fichiers cookies (Cookies files) ~ Files: 3 Scanned in :0mn صs ---\\ List all tools cleaner (LATC) (O63) O63 - Logiciel: ZHPDiag 2015 - (.Nicolas Coolman.) [HKLM] -- ZHPDiag_is1 =>.Nicolas Coolman ~ ADS: Scanned in :0mn صs ---\\ List all legacy services(LALS) (O64) O64 - Services: CurCS - 21/05/2010 - C:\WINDOWS\system32\acs.exe (ACS) .(.Atheros - ACS.) - LEGACY_ACS O64 - Services: CurCS - 25/05/2015 - C:\Program Files\Avira\AntiVir Desktop\sched.exe (AntiVirSchedulerService) .(.Avira Operations GmbH & Co. KG - Antivirus Host Framework Service.) - LEGACY_ANTIVIRSCHEDULERSERVICE O64 - Services: CurCS - 25/05/2015 - C:\Program Files\Avira\AntiVir Desktop\avguard.exe (AntiVirService) .(.Avira Operations GmbH & Co. KG - Antivirus Host Framework Service.) - LEGACY_ANTIVIRSERVICE O64 - Services: CurCS - 25/05/2015 - C:\WINDOWS\system32\DRIVERS\avgntflt.sys (avgntflt) .(.Avira Operations GmbH & Co. KG - Avira Minifilter Driver.) - LEGACY_AVGNTFLT O64 - Services: CurCS - 25/05/2015 - C:\WINDOWS\system32\DRIVERS\avipbb.sys (avipbb) .(.Avira Operations GmbH & Co. KG - Avira Driver for Security Enhancement.) - LEGACY_AVIPBB O64 - Services: CurCS - 16/03/2015 - C:\Program Files\Avira\My Avira\Avira.OE.ServiceHost.exe (Avira.OE.ServiceHost) .(.Avira Operations GmbH & Co. KG - Avira.OE.ServiceHost.) - LEGACY_AVIRA.OE.SERVICEHOST O64 - Services: CurCS - 25/05/2015 - C:\WINDOWS\system32\DRIVERS\avkmgr.sys (avkmgr) .(.Avira Operations GmbH & Co. KG - Avira Manager Driver.) - LEGACY_AVKMGR O64 - Services: CurCS - 14/04/2008 - C:\WINDOWS\system32\drivers\dmload.sys (dmload) .(.Microsoft Corp., Veritas Software. - NT Disk Manager Startup Driver.) - LEGACY_DMLOAD O64 - Services: CurCS - 21/02/1746 - C:\WINDOWS\system32\Drivers\sptd.sys (sptd) .(...) - LEGACY_SPTD O64 - Services: CurCS - 14/02/2014 - C:\WINDOWS\system32\DRIVERS\ssmdrv.sys (ssmdrv) .(.Avira GmbH - AVIRA SnapShot Driver.) - LEGACY_SSMDRV ~ Legacy: 133 Scanned in :0mn صs ---\\ File Associations Shell Spawning (O67) O67 - Shell Spawning: <.bat> [HKLM\..\open\Command] (...) -- "%1" %* O67 - Shell Spawning: <.cpl> [HKLM\..\cplopen\Command] (.Microsoft Corporation - Windows Shell Common Dll.) -- C:\WINDOWS\system32\shell32.dll O67 - Shell Spawning: <.cmd> [HKLM\..\open\Command] (...) -- "%1" %* O67 - Shell Spawning: <.com> [HKLM\..\open\Command] (...) -- "%1" %* O67 - Shell Spawning: <.exe> [HKLM\..\open\Command] (...) -- "%1" %* O67 - Shell Spawning: <.html> [HKLM\..\open\Command] (.Opera Software - Opera Internet Browser.) -- C:\Program Files\Opera\Launcher.exe O67 - Shell Spawning: <.js> [HKLM\..\open\Command] (.Microsoft Corporation - Microsoft (R) Windows Based Script Host.) -- C:\WINDOWS\system32\WScript.exe O67 - Shell Spawning: <.reg> [HKLM\..\open\Command] (.Microsoft Corporation - Registry Editor.) -- C:\WINDOWS\regedit.exe O67 - Shell Spawning: <.scr> [HKLM\..\open\Command] (...) -- "%1" /S O67 - Shell Spawning: <.html> [HKCU\..\open\Command] (.Not Key.) ~ FASS Keys: 10 Scanned in :0mn صs ---\\ Start Menu Internet (SMI) (O68) O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Mozilla Corporation - Firefox.) -- C:\Program Files\Mozilla Firefox\firefox.exe O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Google Inc. - Google Chrome.) -- C:\Documents and Settings\mohamed\Local Settings\Application Data\Google\Chrome\Application\chrome.exe O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe O68 - StartMenuInternet: <>[HKLM\..\Shell\open\Command] (.Opera Software - Opera Internet Browser.) -- C:\Program Files\Opera\launcher.exe O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Opera Software - Opera Internet Browser.) -- C:\Program Files\Opera\Launcher.exe ~ Keys: Scanned in :0mn صs ---\\ Search Svchost Services (SSS) (O83) O83 - Search Svchost Services: AppMgmt (AppMgmt) . (.Microsoft Corporation - Software installation Service.) -- C:\WINDOWS\system32\appmgmts.dll [167936] O83 - Search Svchost Services: AudioSrv (AudioSrv) . (.Microsoft Corporation - Windows Audio Service.) -- C:\WINDOWS\system32\audiosrv.dll [42496] O83 - Search Svchost Services: Browser (Browser) . (.Microsoft Corporation - Computer Browser Service DLL.) -- C:\WINDOWS\system32\browser.dll [78336] O83 - Search Svchost Services: CryptSvc (CryptSvc) . (.Microsoft Corporation - Cryptographic Services.) -- C:\WINDOWS\system32\cryptsvc.dll [62464] O83 - Search Svchost Services: DMServer (DMServer) . (.Microsoft Corp. - Logical Disk Manager service dll.) -- C:\WINDOWS\system32\dmserver.dll [23552] O83 - Search Svchost Services: DHCP (DHCP) . (.Microsoft Corporation - DHCP Client Service.) -- C:\WINDOWS\system32\dhcpcsvc.dll [126976] O83 - Search Svchost Services: EventSystem (EventSystem) . (.Microsoft Corporation - No Comment.) -- C:\WINDOWS\system32\es.dll [253952] O83 - Search Svchost Services: FastUserSwitchingCompatibility (FastUserSwitchingCompatibility) . (.Microsoft Corporation - Windows Shell Services Dll.) -- C:\WINDOWS\system32\shsvcs.dll [135168] O83 - Search Svchost Services: HidServ (HidServ) . (.Microsoft Corporation - HID Audio Service.) -- C:\WINDOWS\system32\hidserv.dll [21504] O83 - Search Svchost Services: LanmanServer (LanmanServer) . (.Microsoft Corporation - Server Service DLL.) -- C:\WINDOWS\system32\srvsvc.dll [99840] O83 - Search Svchost Services: LanmanWorkstation (LanmanWorkstation) . (.Microsoft Corporation - Workstation Service DLL.) -- C:\WINDOWS\system32\wkssvc.dll [134144] O83 - Search Svchost Services: Messenger (Messenger) . (.Microsoft Corporation - NT Messenger Service.) -- C:\WINDOWS\system32\msgsvc.dll [33792] O83 - Search Svchost Services: Netman (Netman) . (.Microsoft Corporation - Network Connections Manager.) -- C:\WINDOWS\system32\netman.dll [198144] O83 - Search Svchost Services: Nla (Nla) . (.Microsoft Corporation - Microsoft Windows Sockets 2.0 Service Provider.) -- C:\WINDOWS\system32\mswsock.dll [245248] O83 - Search Svchost Services: Ntmssvc (Ntmssvc) . (.Microsoft Corporation - Removable Storage Manager.) -- C:\WINDOWS\system32\ntmssvc.dll [435200] O83 - Search Svchost Services: Rasauto (Rasauto) . (.Microsoft Corporation - Remote Access AutoDial Manager.) -- C:\WINDOWS\system32\rasauto.dll [88576] O83 - Search Svchost Services: Rasman (Rasman) . (.Microsoft Corporation - Remote Access Connection Manager.) -- C:\WINDOWS\system32\rasmans.dll [186368] O83 - Search Svchost Services: Remoteaccess (Remoteaccess) . (.Microsoft Corporation - Dynamic Interface Manager.) -- C:\WINDOWS\system32\mprdim.dll [53248] O83 - Search Svchost Services: Schedule (Schedule) . (.Microsoft Corporation - Task Scheduler Engine.) -- C:\WINDOWS\system32\schedsvc.dll [192512] O83 - Search Svchost Services: Seclogon (Seclogon) . (.Microsoft Corporation - Secondary Logon Service DLL.) -- C:\WINDOWS\system32\seclogon.dll [18944] O83 - Search Svchost Services: SENS (SENS) . (.Microsoft Corporation - System Event Notification Service (SENS).) -- C:\WINDOWS\system32\sens.dll [39424] O83 - Search Svchost Services: Sharedaccess (Sharedaccess) . (.Microsoft Corporation - Microsoft NAT Helper Components.) -- C:\WINDOWS\system32\ipnathlp.dll [330752] O83 - Search Svchost Services: SRService (SRService) . (.Microsoft Corporation - System Restore Service.) -- C:\WINDOWS\system32\srsvc.dll [171008] O83 - Search Svchost Services: Tapisrv (Tapisrv) . (.Microsoft Corporation - Microsoft® Windows(TM) Telephony Server.) -- C:\WINDOWS\system32\tapisrv.dll [249856] O83 - Search Svchost Services: Themes (Themes) . (.Microsoft Corporation - Windows Shell Services Dll.) -- C:\WINDOWS\system32\shsvcs.dll [135168] O83 - Search Svchost Services: TrkWks (TrkWks) . (.Microsoft Corporation - Distributed Link Tracking Client.) -- C:\WINDOWS\system32\trkwks.dll [90112] O83 - Search Svchost Services: W32Time (W32Time) . (.Microsoft Corporation - Windows Time Service.) -- C:\WINDOWS\system32\w32time.dll [175616] O83 - Search Svchost Services: WZCSVC (WZCSVC) . (.Microsoft Corporation - Wireless Zero Configuration Service.) -- C:\WINDOWS\system32\wzcsvc.dll [483328] O83 - Search Svchost Services: Wmi (Wmi) . (.Microsoft Corporation - Advanced Windows 32 Base API.) -- C:\WINDOWS\system32\advapi32.dll [617472] O83 - Search Svchost Services: winmgmt (winmgmt) . (.Microsoft Corporation - WMI.) -- C:\WINDOWS\system32\wbem\WMIsvc.dll [144896] O83 - Search Svchost Services: xmlprov (xmlprov) . (.Microsoft Corporation - Network Provisioning Service.) -- C:\WINDOWS\system32\xmlprov.dll [129024] O83 - Search Svchost Services: napagent (napagent) . (.Microsoft Corporation - Quarantine Agent Service Run-Time.) -- C:\WINDOWS\system32\qagentrt.dll [291328] O83 - Search Svchost Services: hkmsvc (hkmsvc) . (.Microsoft Corporation - Key Management Service.) -- C:\WINDOWS\system32\kmsvc.dll [61440] O83 - Search Svchost Services: BITS (BITS) . (.Microsoft Corporation - Background Intelligent Transfer Service.) -- C:\WINDOWS\system32\qmgr.dll [409088] O83 - Search Svchost Services: wuauserv (wuauserv) . (.Microsoft Corporation - Windows Update AutoUpdate Service.) -- C:\WINDOWS\system32\wuauserv.dll [22520] O83 - Search Svchost Services: ShellHWDetection (ShellHWDetection) . (.Microsoft Corporation - Windows Shell Services Dll.) -- C:\WINDOWS\system32\shsvcs.dll [135168] O83 - Search Svchost Services: helpsvc (helpsvc) . (.Microsoft Corporation - Microsoft PCHealth Service Holder.) -- C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll [38400] O83 - Search Svchost Services: WmdmPmSN (WmdmPmSN) . (.Microsoft Corporation - Microsoft Media Device Service Provider.) -- C:\WINDOWS\system32\mspmsnsv.dll [27136] ~ Services: 38 Scanned in :0mn صs ---\\ MyComputer Name Space (MNS) (O92) O92 - MNS: My Network Places - {208D2C60-3AEA-1069-A2D7-08002B30309D} O92 - MNS: Recycle Bin - {645FF040-5081-101B-9F08-00AA002F954E} O92 - MNS: Network Connections - {7007ACC7-3202-11D1-AAD2-00805FC1270E} ~ MNS: 3 Scanned in :0mn صs ---\\ Search CLSID Registry Key (O101) [HKCR\CLSID\{30E7F2A0-EC4C-11ce-8865-00805F742EF6}] (SpeedDial) =>PUP.SpeedDial ~ BCK: 3759 Scanned in :0mn صs ---\\ General States of Services not Microsoft (EGS) (SR=Running, SS=Stopped) SS - | Auto 25/05/2015 825856 | (AntiVirMailService) . (.Avira Operations GmbH & Co. KG.) - C:\Program Files\Avira\AntiVir Desktop\avmailc.exe SS - | Auto 25/05/2015 1186040 | (AntiVirWebService) . (.Avira Operations GmbH & Co. KG.) - C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.exe SS - | Demand 14/04/2008 224768 | (dmadmin) . (.Microsoft Corp., Veritas Software.) - C:\WINDOWS\system32\dmadmin.exe SS - | Demand 29/05/2015 148080 | (MozillaMaintenance) . (.Mozilla Foundation.) - C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe SS - | Auto 18/02/2015 315488 | (SkypeUpdate) . (.Skype Technologies.) - C:\Program Files\Skype\Updater\Updater.exe SR - | Auto 21/05/2010 499796 | (ACS) . (.Atheros.) - C:\WINDOWS\system32\acs.exe SR - | Auto 25/05/2015 434424 | (AntiVirSchedulerService) . (.Avira Operations GmbH & Co. KG.) - C:\Program Files\Avira\AntiVir Desktop\sched.exe SR - | Auto 25/05/2015 434424 | (AntiVirService) . (.Avira Operations GmbH & Co. KG.) - C:\Program Files\Avira\AntiVir Desktop\avguard.exe SR - | Auto 16/03/2015 201008 | (Avira.OE.ServiceHost) . (.Avira Operations GmbH & Co. KG.) - C:\Program Files\Avira\My Avira\Avira.OE.ServiceHost.exe ~ Services: Scanned in :0mn صs ---\\ Search Master Boot Record Infection (MBR)(O80) Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net Run by mohamed at 02/06/2015 12:13:21 ص device: opened successfully user: MBR read successfully Disk trace: called modules: ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys sptd.sys pciide.sys C:\WINDOWS\system32\drivers\sptd.sys 1 nt!IofCallDriver[0x804E1311] >> \Device\Harddisk0\DR0[0x8A22FAB8] 3 CLASSPNP[0xF7637FD7] >> nt!IofCallDriver[0x804E1311] >> \Device\00000061[0x8A27E3B8] 5 ACPI[0xF7487620] >> nt!IofCallDriver[0x804E1311] >> \Device\Ide\IdeDeviceP1T0L0-5[0x8A277940] kernel: MBR read successfully user & kernel MBR OK ~ MBR: 14 Scanned in :0mn صs ---\\ Search Master Boot Record Infection (MBRCheck)(O80) Written by ad13, http://ad13.geekstog Run by mohamed at 02/06/2015 12:13:23 ص ********* Dump file Name ********* C:\PhysicalDisk0_MBR.bin ~ MBR: Scanned in :0mn صs ---\\ List of CD/DVD Emulators (MBR Hook) O58 - SDL:02/01/1601 - 10:00:00 م ---A- . (...) -- C:\WINDOWS\system32\Drivers\sptd.sys [428088] ~ Emulateurs: Scanned in :0mn صs ---\\ Scan Additionnel (O88) Database Version : 13008 - (31/05/2015) Clés trouvées (Keys found) : 0 Valeurs trouvées (Values found) : 0 Dossiers trouvés (Folders found) : 0 Fichiers trouvés (Files found) : 1 [HKCR\CLSID\{30E7F2A0-EC4C-11ce-8865-00805F742EF6}] (SpeedDial) =>PUP.SpeedDial^ ~ Additionnel Scan: 113036 Items scanned in :1mn صs ---\\ Additional information about modules ~ http://nicolascoolman.fr/g2-google-chrome-extensions/ =>.Google Chrome, Start,Search,Extensions (G0,G1,G2) ~ http://nicolascoolman.fr/r5-internet-explorer-proxy-management-iepm/ =>.Internet Explorer, Proxy Management (R5) ~ http://nicolascoolman.fr/o2-browser-helper-objects-de-navigateur/ =>.Browser Helper Objects (O2) ~ http://nicolascoolman.fr/o4-applications-demarrees-par-le-registre/ =>.Auto loading programs from Registry and folders (O4) ~ http://nicolascoolman.fr/o50-image-file-execution-options-zhpdiag/ =>.Image File Execution Options (IFEO) (O50) ~ AMI: 5 Scanned in :0mn صs ---\\ Summary of the detections found on your workstation http://nicolascoolman.fr/adware-bandoo =>Adware.Bandoo http://nicolascoolman.fr/32720552-pup-speeddial =>PUP.SpeedDial ~ MSI: 2 link(s) detected in :0mn صs End of the scan (1795 lines in :4mn صs)(0.4)