~ Report of ZHPDiag v2015.6.16.57 - Nicolas Coolman  (6/16/2015)
~ Launched by d (6/23/2015 5:29:34 AM)
~ Facebook : https://www.facebook.com/nicolascoolman1
~ Web forum address : http://www.forum.nicolascoolman.fr
~ Translated by 
~ Version State : Updated version.
~ White List : Deactivate by user
~ Elevation of privilege : OK
~ User Account Control : Not Found


---\\ Internet browsers
MSIE: Internet Explorer v8.0.6001.18702
MFIE: Mozilla Firefox 8.0
GCIE: Google Chrome v43.0.2357.130 (Defaut)

---\\ Windows product information
~ Langage: Anglais
Windows Automatic Updates : OK
Windows Genuine Advantage : OK
Microsoft Windows XP, 32-bit Service Pack 3 (Build 2600)

---\\ System protection software
Avira AntiVir Personal - Free Antivirus v10.0.0.561

---\\ System optimization software

---\\ Sharing software PeerToPeer

---\\ Surveillance software
Adobe Flash Player 11 Plugin
Adobe Reader XI

---\\ Information on the system
~ Processor: x86 Family 15 Model 4 Stepping 3, GenuineIntel
~ Operating System: 32 Bits
Boot mode: Normal (Normal boot)
Total RAM: 2012.4 MB (58% free)
System Restore: Activé (Enable)
System drive C: has 22 GB (75%) free of 29 GB

---\\ Connection to the system mode
~ Computer Name: KO
~ User Name: d
~ All Users Names: SUPPORT_388945a0, HelpAssistant, Guest, d, Administrator, 
~ Unselected Option: None
Logged in as Administrator

---\\ Environment variables
~ System Unit : C:\
~ %AppZHP% : C:\Documents and Settings\d\Application Data\ZHP\
~ %AppData% : C:\Documents and Settings\d\Application Data\
~ %Desktop% : C:\Documents and Settings\d\Desktop\
~ %Favorites% : C:\Documents and Settings\d\Favorites\
~ %LocalAppData% : C:\Documents and Settings\d\Local Settings\Application Data\
~ %StartMenu% : C:\Documents and Settings\d\Start Menu\
~ %Windir% : C:\WINDOWS\
~ %System% : C:\WINDOWS\system32\

---\\ Enumeration of the disk units
C: Hard drive, Flash drive, Thumb drive (Free 22 Go of 29 Go)
D: Hard drive, Flash drive, Thumb drive (Free 1 Go of 122 Go)
E: Hard drive, Flash drive, Thumb drive (Free 5 Go of 122 Go)
F: Hard drive, Flash drive, Thumb drive (Free 129 Go of 192 Go)
G: CD-ROM drive (Not Inserted)



---\\ State of the Windows Security Center
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Associations] Application: OK
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Associations] Intl: OK
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Associations] XMLLookup: OK
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] Shell: OK
[HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] Load: OK
[HKLM\SYSTEM\CurrentControlSet\Services\COMSysApp] Type: OK
~ Security Center: 44 Scanned in 00mn AMs



---\\ Search Generic System Files
[MD5.2BB75B7F548D82A099125D0C5971DE7D] - (.Microsoft Corporation - Windows Explorer.) (.5/9/2012 - 5:00:31 AM.) -- C:\WINDOWS\Explorer.exe [1033728]
[MD5.4EC67FAB39F37626AD6D9895FC094ABF] - (.Microsoft Corporation - Internet Extensions for Win32.) (.5/9/2012 - 5:03:47 AM.) -- C:\WINDOWS\system32\wininet.dll [919552]
[MD5.53A8857723277B1D6D5EE60A9F85B117] - (.Microsoft Corporation - Windows NT Logon Application.) (.5/9/2012 - 5:01:58 AM.) -- C:\WINDOWS\system32\Winlogon.exe [509440]
[MD5.F6B7B1ECD7B41736BDB6FF4B092BCB79] - (.Microsoft Corporation - Ancillary Function Driver for WinSock.) (.5/9/2012 - 5:00:21 AM.) -- C:\WINDOWS\system32\Drivers\AFD.sys [138496]
[MD5.9F3A2F5AA6875C72BF062C712CFA2674] - (.Microsoft Corporation - IDE/ATAPI Port Driver.) (.4/13/2008 - 1:10:32 PM.) -- C:\WINDOWS\system32\Drivers\atapi.sys [96512]
[MD5.C885B02847F5D2FD45A24E219ED93B32] - (.Microsoft Corporation - CD-ROM File System Driver.) (.4/14/2008 - 4:00:00 AM.) -- C:\WINDOWS\system32\Drivers\Cdfs.sys [63744]
[MD5.4B0A100EAF5C49EF3CCA8C641431EACC] - (.Microsoft Corporation - SCSI CD-ROM Driver.) (.5/9/2012 - 5:00:25 AM.) -- C:\WINDOWS\system32\Drivers\Cdrom.sys [62976]
[MD5.D45926117EB9FA946A6AF572FBE1CAA3] - (.Microsoft Corporation - FIPS Crypto Driver.) (.4/14/2008 - 4:00:00 AM.) -- C:\WINDOWS\system32\Drivers\Fips.sys [44544]
[MD5.573C7D0A32852B48F3058CFD8026F511] - (.Windows (R) Server 2003 DDK provider - High Definition Audio Bus Driver v1.0a.) (.4/14/2008 - 4:00:00 AM.) -- C:\WINDOWS\system32\Drivers\HDAudBus.sys [144384]
[MD5.4A0B06AA8943C1E332520F7440C0AA30] - (.Microsoft Corporation - i8042 Port Driver.) (.4/14/2008 - 4:00:00 AM.) -- C:\WINDOWS\system32\Drivers\i8042prt.sys [52480]
[MD5.083A052659F5310DD8B6A6CB05EDCF8E] - (.Microsoft Corporation - IMAPI Kernel Driver.) (.4/14/2008 - 4:00:00 AM.) -- C:\WINDOWS\system32\Drivers\Imapi.sys [42112]
[MD5.CC748EA12C6EFFDE940EE98098BF96BB] - (.Microsoft Corporation - IP Network Address Translator.) (.4/14/2008 - 4:00:00 AM.) -- C:\WINDOWS\system32\Drivers\IpNat.sys [152832]
[MD5.23C74D75E36E7158768DD63D92789A91] - (.Microsoft Corporation - IPSec Driver.) (.4/14/2008 - 4:00:00 AM.) -- C:\WINDOWS\system32\Drivers\IPSec.sys [75264]
[MD5.FB2FCCC70F7174C7BF64F48E96D3ADF4] - (.Microsoft Corporation - Windows NT SMB Minirdr.) (.5/9/2012 - 5:00:52 AM.) -- C:\WINDOWS\system32\Drivers\MRxSmb.sys [457856]
[MD5.74B2B2F5BEA5E9A3DC021D685551BD3D] - (.Microsoft Corporation - MBT Transport driver.) (.4/14/2008 - 4:00:00 AM.) -- C:\WINDOWS\system32\Drivers\netBT.sys [162816]
[MD5.4C51D5275AE8A16999EDFE7E647D00DE] - (.Microsoft Corporation - NT File System Driver.) (.11/18/2008 - 7:02:08 AM.) -- C:\WINDOWS\system32\Drivers\ntfs.sys [576384]
[MD5.5575FAF8F97CE5E713D108C2A58D7C7C] - (.Microsoft Corporation - Parallel Port Driver.) (.5/9/2012 - 5:07:50 AM.) -- C:\WINDOWS\system32\Drivers\Parport.sys [80128]
[MD5.11B4A627BC9614B885C4969BFA5FF8A6] - (.Microsoft Corporation - RAS L2TP mini-port/call-manager driver.) (.4/14/2008 - 4:00:00 AM.) -- C:\WINDOWS\system32\Drivers\Rasl2tp.sys [51328]
[MD5.47EA20320E3D6FDC7B7BB22B2B881CA6] - (.Microsoft Corporation - Microsoft RDP Device redirector.) (.9/4/2009 - 3:43:46 PM.) -- C:\WINDOWS\system32\Drivers\rdpdr.sys [195712]
[MD5.F828DD7E1419B6653894A8F97A0094C5] - (.Microsoft Corporation - Redbook Audio Filter Driver.) (.4/13/2008 - 1:10:28 PM.) -- C:\WINDOWS\system32\Drivers\redbook.sys [57600]
[MD5.4C8FCB5CC53AAB716D810740FE59D025] - (.Microsoft Corporation - Volume Shadow Copy Driver.) (.4/14/2008 - 4:00:00 AM.) -- C:\WINDOWS\system32\Drivers\volsnap.sys [52352]
~ Generic Processes:  Scanned in 00mn AMs



---\\ Hidden files state (Hidden/Total)
~ Mes images (My Pictures) : 1/2
~ Mes musiques (My Musics) : 1/2
~ Mes Videos (My Videos) : 0/0
~ Mes Favoris (My Favorites) : 1/9
~ Mes Documents (My Documents) : 1/6
~ Mon Bureau (My Desktop) : 0/8
~ Menu demarrer (Programs) : 1/42
~ Hidden Files:  Scanned in 00mn AMs



---\\ Process running
[MD5.2ADA28EE2FA3375DDCC0040522DF0144] - (.Avira GmbH - Antivirus On-Access Service.) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe   [267432] [PID.1276]
[MD5.8C91BD35AE9AA8B628EEC5E637BB1D0F] - (.Avira GmbH - AntiVir shadow copy service.) -- C:\Program Files\Avira\AntiVir Desktop\avshadow.exe   [76968] [PID.1300]
[MD5.703485A2C9EC94C35ED7EC56B13778B2] - (.Avira GmbH - Antivirus Scheduler.) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe   [135336] [PID.352]
[MD5.D87ACAED61E417BBA546CED5E7E36D9C] - (.Microsoft Corporation - .NET Runtime Optimization Service.) -- C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe   [69632] [PID.552]
[MD5.178196930A0E1047D83869F38B4BB19B] - (.WiseCleaner.com - Wise Care 365 Tray.) -- C:\Program Files\Wise\Wise Care 365\WiseTray.exe   [1177224] [PID.744]
[MD5.8475E746EB72D04F1015E6F091F50E09] - (.Splashtop Inc. - Splashtop Connect Back Service..) -- C:\Program Files\Splashtop\Splashtop Connect\BackService.exe   [477000] [PID.812]
[MD5.EECF1B86DC4E273ACB7531F360CF3ECE] - (.Filseclab Corporation - Twister Server.) -- C:\Program Files\Filseclab\Twister\twssrv.exe   [30536] [PID.872]
[MD5.DBF0D60BA1FB075A25884B65071B1B82] - (.Splashtop Inc. - Splashtop Connect Firefox Software Updater.) -- C:\Program Files\Splashtop\Splashtop Connect Firefox Software Updater\WCUService.exe   [493384] [PID.116]
[MD5.E7D75EC4BBD08FF5B16F875BA4EA810D] - (.Splashtop Inc. - Splashtop Connect ZyngaGames Agent..) -- C:\Program Files\Splashtop\Splashtop Connect\ZyngaGamesAgent.exe   [841544] [PID.1528]  =>Toolbar.Zynga
[MD5.EB7376A9F65736B659AAAF21F964BA89] - (.Intel Corporation - igfxTray Module.) -- C:\WINDOWS\system32\igfxtray.exe   [141848] [PID.1536]
[MD5.FB8FA36625FDEB6A056B11414ACFA552] - (.Splashtop Inc. - Splashtop Connect IE Software Updater Servi.) -- C:\Program Files\Splashtop\Splashtop Connect IE Software Updater\WCUService.exe   [493384] [PID.116]
[MD5.BD06FDEAC870D09856B965A88655D747] - (.Intel Corporation - hkcmd Module.) -- C:\WINDOWS\system32\hkcmd.exe   [174104] [PID.1564]
[MD5.756E7DACD8B6EDD26B8C62C2907CD845] - (.Intel Corporation - persistence Module.) -- C:\WINDOWS\system32\igfxpers.exe   [144920] [PID.1480]
[MD5.4CB7C0105E9BF50EF2C2F220FBEDBF49] - (.Realtek Semiconductor Corp. - Realtek HD Audio Control Panel.) -- C:\WINDOWS\RTHDCPL.exe   [20053608] [PID.1824]
[MD5.CF4A0E2C240501C826977ACC5F0E8411] - (.Avira GmbH - Antivirus System Tray Tool.) -- C:\Program Files\Avira\AntiVir Desktop\avgnt.exe   [282792] [PID.1916]
[MD5.B86005C322AF3FEC2E0A8047760F9179] - (.HiPlayer Inc. - HiPlayerPlayer.) -- C:\Program Files\Hi\HiPlayer\1.14.0.138\HiPlayer.exe   [2803128] [PID.2028]
[MD5.A1F86A5A0DA1BEC12B7DD19C6234BB15] - (...) -- C:\Documents and Settings\d\Local Settings\Apps\F.lux\flux.exe   [966656] [PID.2080]
[MD5.3BEB4320DB897E0963DD7863AEE01CAB] - (.Tonec Inc. - Internet Download Manager (IDM).) -- C:\Program Files\Internet Download Manager\IDMan.exe   [3882576] [PID.2320]
[MD5.16EA97E213A583A2211CFC182F95A535] - (.. - Media Streaming Service.) -- C:\Program Files\Hi\HiPlayer\1.14.0.138\HiP2PService.exe   [516096] [PID.2336]
[MD5.F26205EAF8553C2C2A3AAA04F3795A33] - (.AVM Software Inc. - Paltalk Messenger.) -- C:\Program Files\Paltalk Messenger\paltalk.exe   [9969760] [PID.2660]
[MD5.BD95E822E7A958BBCA842D078426A151] - (.Tonec Inc. - Internet Download Manager agent for click m.) -- C:\Program Files\Internet Download Manager\IEMonitor.exe   [269848] [PID.3312]
[MD5.0AC86947DC37B645CD29949D87F6830D] - (.Yahoo! Inc. - Yahoo! Messenger Tray.) -- C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe   [79160] [PID.3912]
[MD5.98FA788238E71D9563D4BF177A4FC22C] - (.Google Inc. - Google Chrome.) -- C:\Program Files\Google\Chrome\Application\chrome.exe   [813896] [PID.3960]
[MD5.E7B58CE9BD61BF575E2880088F4E5447] - (.Nicolas Coolman - ZHPDiag.) -- C:\Program Files\ZHPDiag\ZHPDiag.exe   [8218112] [PID.2988]
~ Processes Running:  Scanned in 00mn AMs



---\\ Google Chrome, Start,Search,Extensions (G0,G1,G2)
C:\Documents and Settings\d\Local Settings\Application Data\Google\Chrome\User Data\Default\Preferences

---\\ Google Chrome Extension Folder
G2 - EXT: C:\Documents and Settings\d\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [__MSG_appName__]
G2 - EXT: C:\Documents and Settings\d\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [__MSG_appName__]
G2 - EXT: C:\Documents and Settings\d\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [__MSG_appName__]
G2 - EXT: C:\Documents and Settings\d\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [__MSG_appName__]
G2 - EXT: C:\Documents and Settings\d\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\jeaohhlajejodfjadcponpnjgkiikocn [IDM Integration Module]
G2 - EXT: C:\Documents and Settings\d\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [__MSG_APP_NAME__]
G2 - EXT: C:\Documents and Settings\d\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [__MSG_appName__]
~ Google Lines Browser: 14 Scanned in 00mn AMs



---\\ Mozilla Firefox,Plugins,Start,Search,Extensions (P2,M0,M1,M2,M3)
C:\Documents and Settings\d\Application Data\Mozilla\Firefox\Profiles\op9bbjnt.default\prefs.js
M3 - MFPP: Plugins - [d] -- C:\Program Files\Mozilla FireFox\searchplugins\amazondotcom.xml
M3 - MFPP: Plugins - [d] -- C:\Program Files\Mozilla FireFox\searchplugins\bing.xml
M3 - MFPP: Plugins - [d] -- C:\Program Files\Mozilla FireFox\searchplugins\eBay.xml
M3 - MFPP: Plugins - [d] -- C:\Program Files\Mozilla FireFox\searchplugins\google.xml
M3 - MFPP: Plugins - [d] -- C:\Program Files\Mozilla FireFox\searchplugins\twitter.xml
M3 - MFPP: Plugins - [d] -- C:\Program Files\Mozilla FireFox\searchplugins\wikipedia.xml
M3 - MFPP: Plugins - [d] -- C:\Program Files\Mozilla FireFox\searchplugins\yahoo.xml
M2 - MFEP: Extension [d - op9bbjnt.default] testpilot@labs.mozilla.com.xpi
P2 - FPN: [HKLM] [@adobe.com/FlashPlayer] - (...) -- C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll
P2 - FPN: [HKLM] [@hi.com/npxbdyy] - (.No owner - HiPlayer Browser Plugin.) -- C:\Program Files\Hi\HiPlayer\1.14.0.138\npxbdyy.dll
P2 - FPN: [HKLM] [@messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.6] - (.Yahoo! Inc. - Yahoo Application State Plugin version 1.0.0.7.) -- C:\Program Files\Yahoo!\Shared\npYState.dll
P2 - FPN: [HKLM] [@microsoft.com/WPF,version=3.5] - (.Microsoft Corporation - Windows Presentation Foundation (WPF) plug-in for Mozilla browsers.) -- C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
P2 - FPN: [HKLM] [@tools.google.com/Google Update;version=3] - (.Google Inc. - Google Update.) -- C:\Program Files\Google\Update\1.3.27.5\npGoogleUpdate3.dll
P2 - FPN: [HKLM] [@tools.google.com/Google Update;version=9] - (.Google Inc. - Google Update.) -- C:\Program Files\Google\Update\1.3.27.5\npGoogleUpdate3.dll
P2 - FPN: [HKLM] [Adobe Reader] - (.Adobe Systems Inc. - Adobe PDF Plug-In For Firefox and Netscape 11.0.0.) -- C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll
~ Firefox Browser: 15 Scanned in 00mn AMs



---\\ Internet Explorer Extensions, Start, Search (R4,R3,R0,R1)
R0 - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://ar.hao123.com  =>Hijacker.Browser
R0 - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com
R1 - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com
R1 - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com
R1 - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com
R1 - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:noadd-ons
R1 - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:securityrisk
R1 - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com
R1 - HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURLs,Tabs = res://ieframe.dll/tabswelcome.htm
R3 - URLSearchHook: Splashtop Connect SearchHook - {0F3DC9E0-C459-4a40-BCF8-747BD9322E10} . (.Adobe Systems Inc. - Adobe PDF Plug-In For Firefox and Netscape 11.0.0.) (No version) -- (.not file.)
R3 - URLSearchHook: Microsoft Url Search Hook - {CFBFAE00-17A6-11D0-99CB-00C04FD64497} . (.Adobe Systems Inc. - Adobe PDF Plug-In For Firefox and Netscape 11.0.0.) (No version) -- (.not file.)
~ IE Browser: 11 Scanned in 00mn AMs



---\\ Internet Explorer, Proxy Management (R5)
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = no key
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyEnable = 0
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,MigrateProxy = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,EnableHttp1_1 = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigProxy = wininet.dll
~ Proxy management:  Scanned in 00mn AMs



---\\ Line Analysis F0, F1, F2, F3 - IniFiles, Auto loading programs
F2 - REG:system.ini: USERINIT=C:\WINDOWS\system32\userinit.exe,
F2 - REG:system.ini: Shell=C:\WINDOWS\explorer.exe
F2 - REG:system.ini: VMApplet=rundll32 shell32,Control_RunDLL "sysdm.cpl"
~ Keys:  Scanned in 00mn AMs



---\\ Hosts file redirection (O1)
~ Le fichier hôte est sain (The hosts file is clean) (19)
~ Hosts File:  Scanned in 00mn AMs



---\\ Browser Helper Objects (O2)
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} . (.Internet Download Manager, Tonec Inc. - IDM Browser Helper Object.) -- C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: Splashtop Connect VisualBookmark - {0E5680D1-BF44-4929-94AF-FD30D784AD1D} . (.Splashtop Inc. - Splashtop Connect IE Extension..) -- C:\Program Files\Splashtop\Splashtop Connect IE\STC.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} . (.Adobe Systems Incorporated - Adobe PDF Helper for Internet Explorer.) -- C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} . (...) -- C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (.not file.)
~ BHO: 8 Scanned in 00mn AMs



---\\ Internet Explorer toolbars (O3)
O3 - Toolbar: avast! Online Security - [HKLM]{8E5E2654-AD2D-48bf-AC2D-D17F00898D06} . (...) -- C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
~ Toolbar:  Scanned in 00mn AMs



---\\ Auto loading programs from Registry and folders (O4)
O4 - HKLM\..\Run: [STCAgent] . (.Splashtop Inc. - Splashtop Connect IE Agent..) -- C:\Program Files\Splashtop\Splashtop Connect IE\STCAgent.exe 
O4 - HKLM\..\Run: [ZyngaGamesAgent] . (.Splashtop Inc. - Splashtop Connect ZyngaGames Agent..) -- C:\Program Files\Splashtop\Splashtop Connect\ZyngaGamesAgent.exe   =>Toolbar.Zynga
O4 - HKLM\..\Run: [IgfxTray] . (.Intel Corporation - igfxTray Module.) -- C:\WINDOWS\system32\igfxtray.exe 
O4 - HKLM\..\Run: [HotKeysCmds] . (.Intel Corporation - hkcmd Module.) -- C:\WINDOWS\system32\hkcmd.exe 
O4 - HKLM\..\Run: [Persistence] . (.Intel Corporation - persistence Module.) -- C:\WINDOWS\system32\igfxpers.exe 
O4 - HKLM\..\Run: [RTHDCPL] . (.Realtek Semiconductor Corp. - Realtek HD Audio Control Panel.) -- C:\WINDOWS\RTHDCPL.exe   =>.Realtek Semiconductor Corp
O4 - HKLM\..\Run: [Adobe ARM] . (.Adobe Systems Incorporated - Adobe Reader and Acrobat Manager.) -- C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe   =>.Adobe Systems Incorporated
O4 - HKLM\..\Run: [avgnt] . (.Avira GmbH - Antivirus System Tray Tool.) -- C:\Program Files\Avira\AntiVir Desktop\avgnt.exe 
O4 - HKLM\..\Run: [MSConfig] . (.Microsoft Corporation - System Configuration Utility.) -- C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe 
O4 - HKCU\..\Run: [HiMEDIA] . (.HiPlayer Inc. - HiPlayerPlayer.) -- C:\Program Files\Hi\HiPlayer\1.14.0.138\HiPlayer.exe 
O4 - HKCU\..\Run: [F.lux] . (...) -- C:\Documents and Settings\d\Local Settings\Apps\F.lux\flux.exe 
O4 - HKCU\..\Run: [Messenger (Yahoo!)] . (.Yahoo! Inc. - Yahoo! Messenger.) -- C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe 
O4 - HKCU\..\Run: [IDMan] . (.Tonec Inc. - Internet Download Manager (IDM).) -- C:\Program Files\Internet Download Manager\IDMan.exe 
O4 - HKUS\S-1-5-21-299502267-1659004503-343818398-1007\..\Run: [HiMEDIA] . (.HiPlayer Inc. - HiPlayerPlayer.) -- C:\Program Files\Hi\HiPlayer\1.14.0.138\HiPlayer.exe 
O4 - HKUS\S-1-5-21-299502267-1659004503-343818398-1007\..\Run: [F.lux] . (...) -- C:\Documents and Settings\d\Local Settings\Apps\F.lux\flux.exe 
O4 - HKUS\S-1-5-21-299502267-1659004503-343818398-1007\..\Run: [Messenger (Yahoo!)] . (.Yahoo! Inc. - Yahoo! Messenger.) -- C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe 
O4 - HKUS\S-1-5-21-299502267-1659004503-343818398-1007\..\Run: [IDMan] . (.Tonec Inc. - Internet Download Manager (IDM).) -- C:\Program Files\Internet Download Manager\IDMan.exe 
~ Application:  Scanned in 00mn AMs



---\\ Extra buttons on main IE button toolbar, or extra items in IE 'Tools' menu (O9)
O9 - Extra button: PalTalk - {4EAFEF58-EEFA-4116-983D-03B49BCBFFFE} . (.AVM Software Inc. - Paltalk Messenger.) -- C:\Program Files\Paltalk Messenger\Paltalk.exe
O9 - Extra button: بحث - {92780B25-18CC-41C8-B9BE-3C9C571A8263} . (...) -- C:\Program Files\Microsoft Office\OFFICE11\REFBARH.ICO
O9 - Extra button: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} -- Orphan key
~ IE Extra Buttons:  Scanned in 00mn AMs



---\\ Winsock hijacker (Layered Service Provider) (O10)
O10 - WLSP:\000000000001\Winsock LSP File . (.Microsoft Corporation - Microsoft Windows Sockets 2.0 Service Provider.) -- C:\WINDOWS\system32\mswsock.dll
O10 - WLSP:\000000000002\Winsock LSP File . (.Microsoft Corporation - LDAP RnR Provider DLL.) -- C:\WINDOWS\system32\winrnr.dll
O10 - WLSP:\000000000003\Winsock LSP File . (.Microsoft Corporation - Microsoft Windows Sockets 2.0 Service Provider.) -- C:\WINDOWS\system32\mswsock.dll
~ Winsock: 3 Scanned in 00mn AMs



---\\ Reset Web Settings' hijack (O14)
O14 - IERESET.INF: SAFESITE_VALUE=SAFESITE_VALUE="ie.search.msn.com"
~ IE Paramètres WEB:  Scanned in 00mn AMs



---\\ Lop.com/Domain Hijackers (O17)
O17 - HKLM\System\CCS\Services\Tcpip\..\{4F600489-8837-4699-80CD-B3AC9925AF78}: DhcpNameServer = 192.168.168.1 208.67.222.123 208.67.220.123
O17 - HKLM\System\CS1\Services\Tcpip\..\{4F600489-8837-4699-80CD-B3AC9925AF78}: DhcpNameServer = 192.168.168.1 208.67.222.123 208.67.220.123
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.168.1 208.67.222.123 208.67.220.123
~ Domain:  Scanned in 00mn AMs



---\\ Extra protocols (O18)
O18 - Handler: wia - {13F3EA8B-91D7-4F0A-AD76-D2853AC8BECE} . (.Microsoft Corporation - WIA Scripting Layer.) -- C:\WINDOWS\system32\wiascr.dll
O18 - Filter: text/xml - {807553E5-5146-11D5-A672-00B0D022E945} . (.Microsoft Corporation - Microsoft Office XML MIME Filter.) -- C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.dll  =>.Microsoft Corporation
~ Protocole Additionnel:  Scanned in 00mn AMs



---\\ AppInit_DLLs Registry value Autorun (O20)
O20 - Winlogon Notify: crypt32chain . (.Microsoft Corporation - Crypto API32.) -- C:\WINDOWS\system32\crypt32.dll
O20 - Winlogon Notify: cryptnet . (.Microsoft Corporation - Crypto Network Related API.) -- C:\WINDOWS\system32\cryptnet.dll
O20 - Winlogon Notify: cscdll . (.Microsoft Corporation - Offline Network Agent.) -- C:\WINDOWS\system32\cscdll.dll
O20 - Winlogon Notify: dimsntfy . (.Microsoft Corporation - DIMS Notification Handler.) -- C:\WINDOWS\system32\dimsntfy.dll
O20 - Winlogon Notify: igfxcui . (.Intel Corporation - igfxdev Module.) -- C:\WINDOWS\system32\igfxdev.dll
O20 - Winlogon Notify: ScCertProp . (.Microsoft Corporation - Common DLL to receive Winlogon notification.) -- C:\WINDOWS\system32\wlnotify.dll
O20 - Winlogon Notify: Schedule . (.Microsoft Corporation - Common DLL to receive Winlogon notification.) -- C:\WINDOWS\system32\wlnotify.dll
O20 - Winlogon Notify: sclgntfy . (.Microsoft Corporation - Secondary Logon Service Notification DLL.) -- C:\WINDOWS\system32\sclgntfy.dll
O20 - Winlogon Notify: SensLogn . (.Microsoft Corporation - Common DLL to receive Winlogon notification.) -- C:\WINDOWS\system32\WlNotify.dll
O20 - Winlogon Notify: termsrv . (.Microsoft Corporation - Common DLL to receive Winlogon notification.) -- C:\WINDOWS\system32\wlnotify.dll
O20 - Winlogon Notify: wlballoon . (.Microsoft Corporation - Common DLL to receive Winlogon notification.) -- C:\WINDOWS\system32\wlnotify.dll
~ Winlogon:  Scanned in 00mn AMs



---\\ ShellServiceObjectDelayLoad (O21)
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} . (.Microsoft Corporation - Web Site Monitor.) -- C:\WINDOWS\system32\webcheck.dll
O21 - SSODL: PostBootReminder - {7849596a-48ea-486e-8937-a2a3009f31a9} . (.Microsoft Corporation - Windows Shell Common Dll.) -- C:\WINDOWS\system32\SHELL32.dll
O21 - SSODL: CDBurn - {fbeb8a05-beee-4442-804e-409d6c4515e9} . (.Microsoft Corporation - Windows Shell Common Dll.) -- C:\WINDOWS\system32\SHELL32.dll
O21 - SSODL: SysTray - {35CEC8A3-2BE6-11D2-8773-92E220524153} . (.Microsoft Corporation - Systray shell service object.) -- C:\WINDOWS\system32\stobject.dll
~ SSODL: 4 Scanned in 00mn AMs



---\\ SharedTaskScheduler (O22)
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} . (.Microsoft Corporation - Shell Browser UI Library.) -- C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Browseui preloader - {8C7461EF-2B13-11d2-BE35-3078302C2030} . (.Microsoft Corporation - Shell Browser UI Library.) -- C:\WINDOWS\system32\browseui.dll
~ STS/SSO:  Scanned in 00mn AMs



---\\ Non Microsoft non disabled Windows XP/NT/2000 Services (O23)
O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) . (.Avira GmbH - Antivirus Scheduler.) - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) . (.Avira GmbH - Antivirus On-Access Service.) - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: avast! Firewall (avast! Firewall) . (...) - C:\Program Files\AVAST Software\Avast\afwServ.exe (.not file.)
O23 - Service: Google Update Service (gupdate) (gupdate) . (.Google Inc. - Google Installer.) - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Splashtop Connect Service (SCBackService) . (.Splashtop Inc. - Splashtop Connect Back Service..) - C:\Program Files\Splashtop\Splashtop Connect\BackService.exe
O23 - Service: Twister Services (twssrv) . (.Filseclab Corporation - Twister Server.) - C:\Program Files\Filseclab\Twister\twssrv.exe
O23 - Service: Splashtop Connect Firefox Software Updater Service (WCUService_STC_FF) . (.Splashtop Inc. - Splashtop Connect Firefox Software Updater.) - C:\Program Files\Splashtop\Splashtop Connect Firefox Software Updater\WCUService.exe
O23 - Service: Splashtop Connect IE Software Updater Service (WCUService_STC_IE) . (.Splashtop Inc. - Splashtop Connect IE Software Updater Servi.) - C:\Program Files\Splashtop\Splashtop Connect IE Software Updater\WCUService.exe
O23 - Service: Wise Boot Assistant (WiseBootAssistant) . (.WiseCleaner.com - Wise BootTime Service.) - C:\Program Files\Wise\Wise Care 365\BootTime.exe
~ Services: 8 Scanned in 06mn AMs



---\\ Windows Active Desktop & MHTML Editor (O24)
O24 - Desktop Component 0: My Current Home Page - file:About:Home
O24 - Default MHTML Editor: Last - .(...) -  (.not file.)
O24 - Desktop General: BackupWallPaper - .(...) - C:\WINDOWS\web\wallpaper\Bliss.bmp
O24 - Desktop General: WallPaper - .(...) - C:\WINDOWS\web\wallpaper\Bliss.bmp
~ Desktop Component: 4 Scanned in 00mn AMs



---\\ BootExecute (BEX) (O34)
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
~ BEX: 1 Scanned in 00mn AMs



---\\ Task Planned Automatically (039)
[MD5.00000000000000000000000000000000] [APT] [avast! Emergency Update] (...) -- C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe (.not file.)   [0]
[MD5.0C03FB91E17987EED93F60007B08DAA0] [APT] [GoogleUpdateTaskMachineCore] (.Google Inc..) -- C:\Program Files\Google\Update\GoogleUpdate.exe   [144200]
[MD5.0C03FB91E17987EED93F60007B08DAA0] [APT] [GoogleUpdateTaskMachineUA] (.Google Inc..) -- C:\Program Files\Google\Update\GoogleUpdate.exe   [144200]
[MD5.178196930A0E1047D83869F38B4BB19B] [APT] [Wise Care 365] (.WiseCleaner.com.) -- C:\Program Files\Wise\Wise Care 365\WiseTray.exe   [1177224]
[MD5.FE0268AAB74B9115A94E2B4C5EE49859] [APT] [Wise Turbo Checker] (.WiseCleaner.COM.) -- C:\Program Files\Wise\Wise Care 365\WiseTurbo.exe   [1168520]
O39 - APT: avast! Emergency Update - (...) -- C:\WINDOWS\Tasks\avast! Emergency Update.job   [306]
O39 - APT: GoogleUpdateTaskMachineCore - (.Google Inc..) -- C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job   [872]
O39 - APT: GoogleUpdateTaskMachineUA - (.Google Inc..) -- C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job   [876]
O39 - APT: Wise Care 365 - (.WiseCleaner.com.) -- C:\WINDOWS\Tasks\Wise Care 365.job   [390]
O39 - APT: Wise Turbo Checker - (.WiseCleaner.COM.) -- C:\WINDOWS\Tasks\Wise Turbo Checker.job   [370]
~ Scheduled Task: 12 Scanned in 00mn AMs



---\\ ActiveSetup Installed Components (O40)
O40 - ASIC: Internet Explorer Version Update - <{12d0ed0d-0ee0-4f90-8827-78cefb8f4988} . (.Microsoft Corporation - IE Per User Active Setup Uninstall Utility.) -- C:\WINDOWS\system32\ieudinit.exe
O40 - ASIC: Microsoft Windows Media Player - >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} . (.Microsoft Corporation - Microsoft Windows Media Player Setup Utility.) -- C:\WINDOWS\inf\unregmp2.exe  =>.Microsoft Corporation
O40 - ASIC: Internet Explorer - >{26923b43-4d38-484f-9b9e-de460746276c} . (.Microsoft Corporation - IE Per-User Initialization Utility.) -- C:\WINDOWS\system32\ie4uinit.exe.mui
O40 - ASIC: Browser Customizations - >{60B49E34-C7CC-11D0-8953-00A0C90347FF} . (.Microsoft Corporation - IEAK branding.) -- C:\WINDOWS\system32\iedkcs32.dll
O40 - ASIC: Outlook Express - >{881dd1c5-3dcf-431b-b061-f3f88e8be88a} . (.Microsoft Corporation - Windows NT User Data Migration Tool.) -- C:\WINDOWS\system32\shmgrate.exe  =>.Microsoft Corporation
O40 - ASIC: Windows Desktop Update - >{99820200-ECBD-11cf-8B85-00AA005B4340} . (.Microsoft Corporation - Windows Shell Common Dll.) -- C:\WINDOWS\system32\shell32.dll
O40 - ASIC: Microsoft NetShow Player - {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} . (.Microsoft Corporation - Windows Media 6.4 Player Shim.) -- C:\WINDOWS\system32\wmpdxm.dll
O40 - ASIC: Microsoft Windows Media Player 6.4 - {22d6f312-b0f6-11d0-94ab-0080c74c7e95} . (.Microsoft Corporation - Windows Media 6.4 Player Shim.) -- C:\WINDOWS\system32\wmpdxm.dll  =>.Microsoft Corporation
O40 - ASIC: Themes Setup - {2C7339CF-2B09-4501-B3F3-F3508C9228ED} . (.Microsoft Corporation - Windows Theme API.) -- C:\WINDOWS\system32\themeui.dll
O40 - ASIC: Microsoft Outlook Express 6 - {44BBA840-CC51-11CF-AAFA-00AA00B6015C} . (.Microsoft Corporation - Outlook Express Setup Library.) -- C:\Program Files\Outlook Express\setup50.exe  =>.Microsoft Corporation
O40 - ASIC: NetMeeting 3.01 - {44BBA842-CC51-11CF-AAFA-00AA00B6015B} . (...) -- C:\WINDOWS\INF\msnetmtg.inf
O40 - ASIC: Browsing Enhancements - {630b1da0-b465-11d1-9948-00c04f98bbc9} . (.Microsoft Corporation - Microsoft Internet Explorer FTP Folder Shell Extension.) -- C:\WINDOWS\system32\msieftp.dll
O40 - ASIC: Microsoft Windows Media Player - {6BF52A52-394A-11d3-B153-00C04F79FAA6} . (...) -- C:\WINDOWS\INF\wmp.inf  =>.Microsoft Corporation
O40 - ASIC: Address Book 6 - {7790769C-0471-11d2-AF11-00C04FA35D02} . (.Microsoft Corporation - Outlook Express Setup Library.) -- C:\Program Files\Outlook Express\setup50.exe  =>.Microsoft Corporation
O40 - ASIC: Windows Desktop Update - {89820200-ECBD-11cf-8B85-00AA005B4340} . (.Microsoft Corporation - Windows Shell Common Dll.) -- C:\WINDOWS\system32\shell32.dll
O40 - ASIC: Internet Explorer - {89820200-ECBD-11cf-8B85-00AA005B4383} . (.Microsoft Corporation - IE Per-User Initialization Utility.) -- C:\WINDOWS\system32\ie4uinit.exe.mui
O40 - ASIC: (no name) - {89B4C1CD-B018-4511-B0A1-5476DBF70820} . (.Microsoft Corporation - Microsoft .NET IE SECURITY REGISTRATION.) -- C:\WINDOWS\system32\mscories.dll
O40 - ASIC: Google Chrome - {8A69D345-D564-463c-AFF1-A69D9E530F96} . (.Google Inc. - Google Chrome Installer.) -- C:\Program Files\Google\Chrome\Application\43.0.2357.130\Installer\chrmstp.exe
O40 - ASIC: Adobe Flash Player - {D27CDB6E-AE6D-11cf-96B8-444553540000} . (.Adobe Systems, Inc. - Adobe Flash Player 11.2 r202.) -- C:\WINDOWS\system32\Macromed\Flash\Flash32_11_2_202_235.ocx
O40 - ASIC: Installed Component - S-1-5-21-299502267-1659004503-343818398-1007 - <{12d0ed0d-0ee0-4f90-8827-78cefb8f4988} -- Not Hexadécimal CLSID
O40 - ASIC: Installed Component - S-1-5-21-299502267-1659004503-343818398-1007 - >{X9B49E34-C7CC-11D0-8953-00A0C90347FF} -- Not Hexadécimal CLSID
~ Active Setup: 21 Scanned in 00mn AMs



---\\ Drivers launched at startup (O41)
O41 - Driver:  (AFD) . (.Microsoft Corporation - Ancillary Function Driver for WinSock.) - C:\WINDOWS\system32\drivers\afd.sys
O41 - Driver:  (AppleCharger) . (...) - C:\WINDOWS\system32\DRIVERS\AppleCharger.sys
O41 - Driver:  (aswFW) . (.AVAST Software - avast! Filtering TDI driver.) - C:\WINDOWS\system32\drivers\aswFW.sys
O41 - Driver:  (avgio) . (.Avira GmbH - Avira AntiVir Support for Minifilter.) - C:\Program Files\Avira\AntiVir Desktop\avgio.sys
O41 - Driver:  (avipbb) . (.Avira GmbH - Avira Driver for Security Enhancement.) - C:\WINDOWS\system32\DRIVERS\avipbb.sys
O41 - Driver:  (Cdrom) . (.Microsoft Corporation - SCSI CD-ROM Driver.) - C:\WINDOWS\system32\DRIVERS\cdrom.sys
O41 - Driver:  (i8042prt) . (.Microsoft Corporation - i8042 Port Driver.) - C:\WINDOWS\system32\DRIVERS\i8042prt.sys
O41 - Driver:  (IDMTDI) . (.Tonec Inc. - Internet Download Manager TDI Driver.) - C:\WINDOWS\system32\DRIVERS\idmtdi.sys
O41 - Driver:  (Imapi) . (.Microsoft Corporation - IMAPI Kernel Driver.) - C:\WINDOWS\system32\DRIVERS\imapi.sys
O41 - Driver:  (intelppm) . (.Microsoft Corporation - Processor Device Driver.) - C:\WINDOWS\system32\DRIVERS\intelppm.sys
O41 - Driver:  (IPSec) . (.Microsoft Corporation - IPSec Driver.) - C:\WINDOWS\system32\DRIVERS\ipsec.sys
O41 - Driver:  (Kbdclass) . (.Microsoft Corporation - Keyboard Class Driver.) - C:\WINDOWS\system32\DRIVERS\kbdclass.sys
O41 - Driver:  (Mouclass) . (.Microsoft Corporation - Mouse Class Driver.) - C:\WINDOWS\system32\DRIVERS\mouclass.sys
O41 - Driver:  (MRxSmb) . (.Microsoft Corporation - Windows NT SMB Minirdr.) - C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
O41 - Driver:  (NetBIOS) . (.Microsoft Corporation - NetBIOS interface driver.) - C:\WINDOWS\system32\DRIVERS\netbios.sys
O41 - Driver:  (NetBT) . (.Microsoft Corporation - MBT Transport driver.) - C:\WINDOWS\system32\DRIVERS\netbt.sys
O41 - Driver:  (RasAcd) . (.Microsoft Corporation - RAS Automatic Connection Driver.) - C:\WINDOWS\system32\DRIVERS\rasacd.sys
O41 - Driver:  (Rdbss) . (.Microsoft Corporation - Redirected Drive Buffering SubSystem Driver.) - C:\WINDOWS\system32\DRIVERS\rdbss.sys
O41 - Driver: (RDPCDD) . (.Microsoft Corporation - RDP Miniport.) - C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
O41 - Driver:  (redbook) . (.Microsoft Corporation - Redbook Audio Filter Driver.) - C:\WINDOWS\system32\DRIVERS\redbook.sys
O41 - Driver:  (Serial) . (.Microsoft Corporation - Serial Device Driver.) - C:\WINDOWS\system32\DRIVERS\serial.sys
O41 - Driver:  (ssmdrv) . (.Avira GmbH - AVIRA SnapShot Driver.) - C:\WINDOWS\system32\DRIVERS\ssmdrv.sys
O41 - Driver:  (Tcpip) . (.Microsoft Corporation - TCP/IP Protocol Driver.) - C:\WINDOWS\system32\DRIVERS\tcpip.sys
O41 - Driver:  (TermDD) . (.Microsoft Corporation - Terminal Server Driver.) - C:\WINDOWS\system32\DRIVERS\termdd.sys
O41 - Driver: (VgaSave) . (.Microsoft Corporation - VGA/Super VGA Video Driver.) - C:\WINDOWS\system32\drivers\vga.sys
~ Drivers: 75 Scanned in 00mn AMs



---\\ Software installed (O42)
O42 - Logiciel: Adobe Flash Player 11 Plugin - (.Adobe Systems Incorporated.) [HKLM] -- Adobe Flash Player Plugin
O42 - Logiciel: Adobe Reader XI - (.Adobe Systems Incorporated.) [HKLM] -- {AC76BA86-7AD7-1033-7B44-AB0000000001}
O42 - Logiciel: Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver - (.Atheros Communications Inc..) [HKLM] -- {3108C217-BE83-42E4-AE9E-A56A2A92E549}
O42 - Logiciel: Avira AntiVir Personal - Free Antivirus v10.0.0.561 - (.Avira GmbH.) [HKLM] -- Avira AntiVir Desktop
O42 - Logiciel: F.lux - (...) [HKCU] -- Flux
O42 - Logiciel: Google Chrome - (.Google Inc‎.‎.) [HKLM] -- Google Chrome
O42 - Logiciel: Hao123-Client - (.Baidu Online Network Technology (Beijing) Co., Ltd..) [HKCU] -- hao123desk
O42 - Logiciel: HiPlayer1.14.0.138 - (.http://www.hi-player.com.) [HKLM] -- HiPlayer
O42 - Logiciel: Hotfix for Windows XP (KB954550-v5) - (.Microsoft Corporation.) [HKLM] -- KB954550-v5
O42 - Logiciel: Intel(R) Graphics Media Accelerator Driver - (.Intel Corporation.) [HKLM] -- {F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}
O42 - Logiciel: Internet Download Manager - (.Tonec Inc..) [HKLM] -- Internet Download Manager
O42 - Logiciel: K-Lite Codec Pack 8.1.0 (Full) - (...) [HKLM] -- KLiteCodecPack_is1
O42 - Logiciel: Mozilla Firefox 8.0 (x86 en-US) - (.Mozilla.) [HKLM] -- Mozilla Firefox 8.0 (x86 en-US)
O42 - Logiciel: ON_OFF Charge B11.0110.1 - (.GIGABYTE.) [HKLM] -- {3DECD372-76A1-4483-BF10-B547790A3261}
O42 - Logiciel: Paltalk Messenger  10.4 - (.AVM Software Inc..) [HKLM] -- Paltalk Messenger
O42 - Logiciel: Realtek High Definition Audio Driver - (.Realtek Semiconductor Corp..) [HKLM] -- {F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}
O42 - Logiciel: Splashtop Connect IE - (.Splashtop Inc..) [HKLM] -- {418D77E2-7B60-48F8-B016-30A32699EE74}
O42 - Logiciel: Splashtop Connect for Firefox - (.Splashtop Inc..) [HKLM] -- {D2BF4F2C-BDF3-41C3-8D38-185F6342EC47}
O42 - Logiciel: WinRAR 5.00 beta 4 (32-bit) - (.win.rar GmbH.) [HKLM] -- WinRAR archiver
O42 - Logiciel: Winamp - (.Nullsoft, Inc.) [HKLM] -- Winamp
O42 - Logiciel: Winamp Detector Plug-in - (.Nullsoft, Inc.) [HKCU] -- Winamp Detect
O42 - Logiciel: Wise Care 365 version 2.66 - (.WiseCleaner.com, Inc..) [HKLM] -- {E864A1C8-EEE1-47D0-A7F8-00CC86D26D5E}_is1
O42 - Logiciel: Yahoo! Messenger - (.Yahoo! Inc..) [HKLM] -- Yahoo! Messenger
~ Logic: 42 Scanned in 00mn AMs



---\\ HKCU & HKLM Software Keys
[HKCU\Software\APN PIP]
[HKCU\Software\AVAST Software]
[HKCU\Software\Adobe]
[HKCU\Software\Baidu]
[HKCU\Software\Classes]
[HKCU\Software\Clients]
[HKCU\Software\DownloadCenter]
[HKCU\Software\DownloadManager]
[HKCU\Software\Filseclab]
[HKCU\Software\GNU]
[HKCU\Software\Gabest]
[HKCU\Software\Google]
[HKCU\Software\Intel]
[HKCU\Software\LAV]
[HKCU\Software\Local AppWizard-Generated Applications]
[HKCU\Software\Macromedia]
[HKCU\Software\Michael Herf]
[HKCU\Software\MozillaPlugins]
[HKCU\Software\Mozilla]
[HKCU\Software\Netscape]
[HKCU\Software\ODBC]
[HKCU\Software\Paltalk]
[HKCU\Software\Policies]
[HKCU\Software\Realtek]
[HKCU\Software\Splashtop Inc.]
[HKCU\Software\WinRAR SFX]
[HKCU\Software\WinRAR]
[HKCU\Software\Winamp]
[HKCU\Software\yahoo]
[HKLM\Software\ACE Compression Software]
[HKLM\Software\AVAST Software]
[HKLM\Software\Adobe]
[HKLM\Software\Avira]
[HKLM\Software\BrowserChoice]
[HKLM\Software\C07ft5Y]
[HKLM\Software\CDDB]
[HKLM\Software\Classes]
[HKLM\Software\Clients]
[HKLM\Software\CoreCodec]
[HKLM\Software\Creative Tech]
[HKLM\Software\Filseclab]
[HKLM\Software\GNU]
[HKLM\Software\Gemplus]
[HKLM\Software\Google]
[HKLM\Software\HaaliMkx]
[HKLM\Software\Hi]
[HKLM\Software\Intel]
[HKLM\Software\KLCodecPack]
[HKLM\Software\LAV]
[HKLM\Software\Macromedia]
[HKLM\Software\MozillaPlugins]
[HKLM\Software\Mozilla]
[HKLM\Software\Nullsoft]
[HKLM\Software\ODBC]
[HKLM\Software\Policies]
[HKLM\Software\Program Groups]
[HKLM\Software\Realtek]
[HKLM\Software\RegisteredApplications]
[HKLM\Software\Schlumberger]
[HKLM\Software\Splashtop Inc.]
[HKLM\Software\WinRAR]
[HKLM\Software\Windows 3.1 Migration Status]
[HKLM\Software\WiseCleaner]
[HKLM\Software\X-AVCSD]
[HKLM\Software\mozilla.org]
[HKLM\Software\yahoo]
~ Key Software: 133 Scanned in 00mn AMs



---\\ Contents of the Common Files folders (O43)
O43 - CFD: 6/22/2015 - 7:51:07 PM - [] ----D C:\Program Files\Adobe
O43 - CFD: 6/22/2015 - 3:00:34 PM - [] ----D C:\Program Files\AVAST Software
O43 - CFD: 6/22/2015 - 3:34:01 PM - [] ----D C:\Program Files\Avira
O43 - CFD: 6/22/2015 - 12:04:09 PM - [] ----D C:\Program Files\Common Files
O43 - CFD: 6/22/2015 - 7:21:47 PM - [0] ----D C:\Program Files\ComPlus Applications
O43 - CFD: 6/22/2015 - 8:22:31 PM - [] ----D C:\Program Files\Filseclab
O43 - CFD: 6/22/2015 - 7:44:48 PM - [] ----D C:\Program Files\GIGABYTE
O43 - CFD: 6/22/2015 - 4:40:02 PM - [] ----D C:\Program Files\Google
O43 - CFD: 6/22/2015 - 8:18:30 PM - [] ----D C:\Program Files\GUM24.tmp
O43 - CFD: 6/22/2015 - 7:49:09 PM - [] ----D C:\Program Files\Hi
O43 - CFD: 6/22/2015 - 7:44:47 PM - [] --H-D C:\Program Files\InstallShield Installation Information
O43 - CFD: 6/22/2015 - 7:43:21 PM - [] ----D C:\Program Files\Intel
O43 - CFD: 6/22/2015 - 4:09:23 PM - [] ----D C:\Program Files\Internet Download Manager
O43 - CFD: 6/22/2015 - 7:36:04 PM - [] ----D C:\Program Files\Internet Explorer
O43 - CFD: 6/22/2015 - 8:05:08 PM - [] ----D C:\Program Files\K-Lite Codec Pack
O43 - CFD: 6/22/2015 - 7:25:38 PM - [] ----D C:\Program Files\microsoft frontpage
O43 - CFD: 6/22/2015 - 12:04:15 PM - [] ----D C:\Program Files\Microsoft Office
O43 - CFD: 6/22/2015 - 12:02:37 PM - [] ----D C:\Program Files\Microsoft.NET
O43 - CFD: 6/22/2015 - 7:23:10 PM - [] ----D C:\Program Files\Movie Maker
O43 - CFD: 6/22/2015 - 11:46:29 AM - [] ----D C:\Program Files\Mozilla Firefox
O43 - CFD: 6/22/2015 - 7:37:10 PM - [] ----D C:\Program Files\MSBuild
O43 - CFD: 6/22/2015 - 7:21:26 PM - [] ----D C:\Program Files\MSN Gaming Zone
O43 - CFD: 6/22/2015 - 7:23:30 PM - [] ----D C:\Program Files\NetMeeting
O43 - CFD: 6/22/2015 - 7:24:10 PM - [] ----D C:\Program Files\Online Services
O43 - CFD: 6/22/2015 - 7:23:26 PM - [] ----D C:\Program Files\Outlook Express  =>.Microsoft Corporation
O43 - CFD: 6/22/2015 - 3:10:53 PM - [] ----D C:\Program Files\Paltalk Messenger
O43 - CFD: 6/22/2015 - 7:40:41 PM - [] ----D C:\Program Files\Realtek
O43 - CFD: 6/22/2015 - 7:37:06 PM - [] ----D C:\Program Files\Reference Assemblies
O43 - CFD: 6/22/2015 - 7:39:12 PM - [] ----D C:\Program Files\Splashtop
O43 - CFD: 6/22/2015 - 7:32:33 PM - [0] --H-D C:\Program Files\Uninstall Information
O43 - CFD: 6/22/2015 - 7:52:29 PM - [] ----D C:\Program Files\Winamp
O43 - CFD: 6/22/2015 - 7:52:17 PM - [] ----D C:\Program Files\Winamp Detect
O43 - CFD: 6/22/2015 - 7:25:22 PM - [] ----D C:\Program Files\Windows Media Player  =>.Microsoft Corporation
O43 - CFD: 6/22/2015 - 7:21:16 PM - [] ----D C:\Program Files\Windows NT
O43 - CFD: 6/22/2015 - 7:24:14 PM - [0] --H-D C:\Program Files\WindowsUpdate
O43 - CFD: 6/22/2015 - 7:50:30 PM - [] ----D C:\Program Files\WinRAR
O43 - CFD: 6/22/2015 - 11:41:01 AM - [] ----D C:\Program Files\Wise
O43 - CFD: 6/22/2015 - 7:25:38 PM - [] ----D C:\Program Files\xerox
O43 - CFD: 6/22/2015 - 3:13:36 PM - [] ----D C:\Program Files\Yahoo!
O43 - CFD: 6/23/2015 - 5:21:29 AM - [] ----D C:\Program Files\ZHPDiag  =>.Nicolas Coolman
O43 - CFD: 6/22/2015 - 7:51:12 PM - [] ----D C:\Program Files\Common Files\Adobe
O43 - CFD: 6/22/2015 - 12:04:09 PM - [] ----D C:\Program Files\Common Files\DESIGNER
O43 - CFD: 6/22/2015 - 7:40:20 PM - [] ----D C:\Program Files\Common Files\InstallShield
O43 - CFD: 6/22/2015 - 12:07:47 PM - [] ----D C:\Program Files\Common Files\Microsoft Shared
O43 - CFD: 6/22/2015 - 7:23:24 PM - [] ----D C:\Program Files\Common Files\MSSoap
O43 - CFD: 6/22/2015 - 12:15:15 PM - [] ----D C:\Program Files\Common Files\ODBC
O43 - CFD: 6/22/2015 - 7:23:29 PM - [] ----D C:\Program Files\Common Files\Services
O43 - CFD: 6/22/2015 - 12:15:10 PM - [] ----D C:\Program Files\Common Files\SpeechEngines
O43 - CFD: 6/22/2015 - 12:02:48 PM - [] ----D C:\Program Files\Common Files\System
O43 - CFD: 6/22/2015 - 7:50:47 PM - [] ----D C:\Documents and Settings\All Users\Application Data\Adobe
O43 - CFD: 6/22/2015 - 8:02:11 PM - [] ----D C:\Documents and Settings\All Users\Application Data\AVAST Software
O43 - CFD: 6/22/2015 - 3:34:01 PM - [] ----D C:\Documents and Settings\All Users\Application Data\Avira
O43 - CFD: 6/22/2015 - 7:49:23 PM - [] ----D C:\Documents and Settings\All Users\Application Data\Hi
O43 - CFD: 6/22/2015 - 4:07:19 PM - [0] ----D C:\Documents and Settings\All Users\Application Data\IDM
O43 - CFD: 6/22/2015 - 12:02:37 PM - [] -S--D C:\Documents and Settings\All Users\Application Data\Microsoft
O43 - CFD: 6/22/2015 - 1:57:46 PM - [] ----D C:\Documents and Settings\All Users\Application Data\Oberon Games
O43 - CFD: 6/22/2015 - 11:36:29 AM - [] ----D C:\Documents and Settings\All Users\Application Data\Splashtop
O43 - CFD: 6/22/2015 - 3:13:53 PM - [] ----D C:\Documents and Settings\All Users\Application Data\Yahoo!
O43 - CFD: 6/22/2015 - 7:38:42 PM - [] --H-D C:\Documents and Settings\All Users\Application Data\{8533ADFA-85F0-4dc1-946A-2A0BA58E78E3}
O43 - CFD: 6/22/2015 - 7:22:18 PM - [] R---D C:\Documents and Settings\All Users\Start Menu\Programs\Accessories
O43 - CFD: 6/22/2015 - 7:25:28 PM - [] R---D C:\Documents and Settings\All Users\Start Menu\Programs\Administrative Tools
O43 - CFD: 6/22/2015 - 3:34:39 PM - [] ----D C:\Documents and Settings\All Users\Start Menu\Programs\Avira
O43 - CFD: 6/22/2015 - 7:21:57 PM - [] R---D C:\Documents and Settings\All Users\Start Menu\Programs\Games
O43 - CFD: 6/22/2015 - 4:40:57 PM - [] ----D C:\Documents and Settings\All Users\Start Menu\Programs\Google Chrome
O43 - CFD: 6/22/2015 - 7:49:22 PM - [] ----D C:\Documents and Settings\All Users\Start Menu\Programs\HiPlayer
O43 - CFD: 6/22/2015 - 4:07:15 PM - [] ----D C:\Documents and Settings\All Users\Start Menu\Programs\Internet Download Manager
O43 - CFD: 6/22/2015 - 8:05:00 PM - [] ----D C:\Documents and Settings\All Users\Start Menu\Programs\K-Lite Codec Pack
O43 - CFD: 6/22/2015 - 12:07:52 PM - [] ----D C:\Documents and Settings\All Users\Start Menu\Programs\Microsoft Office
O43 - CFD: 6/22/2015 - 12:14:32 PM - [] R---D C:\Documents and Settings\All Users\Start Menu\Programs\Startup
O43 - CFD: 6/22/2015 - 8:23:13 PM - [] ----D C:\Documents and Settings\All Users\Start Menu\Programs\Twister Antivirus
O43 - CFD: 6/22/2015 - 7:52:24 PM - [] ----D C:\Documents and Settings\All Users\Start Menu\Programs\Winamp
O43 - CFD: 6/22/2015 - 7:50:01 PM - [] ----D C:\Documents and Settings\All Users\Start Menu\Programs\WinRAR
O43 - CFD: 6/22/2015 - 11:41:51 AM - [] ----D C:\Documents and Settings\All Users\Start Menu\Programs\Wise Care 365
O43 - CFD: 6/22/2015 - 3:13:43 PM - [] ----D C:\Documents and Settings\All Users\Start Menu\Programs\Yahoo! Messenger
O43 - CFD: 6/23/2015 - 5:21:29 AM - [] ----D C:\Documents and Settings\All Users\Start Menu\Programs\ZHP  =>.Nicolas Coolman
O43 - CFD: 6/22/2015 - 1:11:29 PM - [] ----D C:\Documents and Settings\d\Application Data\Adobe
O43 - CFD: 6/22/2015 - 4:02:43 PM - [] ----D C:\Documents and Settings\d\Application Data\Avira
O43 - CFD: 6/22/2015 - 7:52:48 PM - [] ----D C:\Documents and Settings\d\Application Data\Baidu
O43 - CFD: 6/23/2015 - 5:17:51 AM - [] ----D C:\Documents and Settings\d\Application Data\DMCache
O43 - CFD: 6/22/2015 - 7:52:48 PM - [] ----D C:\Documents and Settings\d\Application Data\Hi
O43 - CFD: 6/22/2015 - 7:32:35 PM - [] ----D C:\Documents and Settings\d\Application Data\Identities
O43 - CFD: 6/23/2015 - 5:13:52 AM - [] ----D C:\Documents and Settings\d\Application Data\IDM
O43 - CFD: 6/22/2015 - 3:16:55 PM - [] ----D C:\Documents and Settings\d\Application Data\Macromedia
O43 - CFD: 6/22/2015 - 3:37:58 PM - [] -S--D C:\Documents and Settings\d\Application Data\Microsoft
O43 - CFD: 6/22/2015 - 12:10:05 PM - [] ----D C:\Documents and Settings\d\Application Data\Mozilla
O43 - CFD: 6/22/2015 - 1:57:46 PM - [] ----D C:\Documents and Settings\d\Application Data\Oberon Games
O43 - CFD: 6/22/2015 - 3:10:54 PM - [] ----D C:\Documents and Settings\d\Application Data\Paltalk
O43 - CFD: 6/22/2015 - 7:38:41 PM - [] ----D C:\Documents and Settings\d\Application Data\Splashtop
O43 - CFD: 6/22/2015 - 7:52:58 PM - [] ----D C:\Documents and Settings\d\Application Data\Winamp
O43 - CFD: 6/22/2015 - 11:48:04 AM - [] ----D C:\Documents and Settings\d\Application Data\WinRAR
O43 - CFD: 6/23/2015 - 4:51:56 AM - [] ----D C:\Documents and Settings\d\Application Data\Wise Care 365
O43 - CFD: 6/23/2015 - 5:29:44 AM - [] ----D C:\Documents and Settings\d\Application Data\ZHP  =>.Nicolas Coolman
O43 - CFD: 6/22/2015 - 1:11:29 PM - [] ----D C:\Documents and Settings\d\Local Settings\Application Data\Adobe
O43 - CFD: 6/22/2015 - 4:41:32 PM - [] ----D C:\Documents and Settings\d\Local Settings\Application Data\Google
O43 - CFD: 6/22/2015 - 12:15:52 PM - [] -S--D C:\Documents and Settings\d\Local Settings\Application Data\Microsoft
O43 - CFD: 6/22/2015 - 12:09:51 PM - [] ----D C:\Documents and Settings\d\Local Settings\Application Data\Mozilla
O43 - CFD: 6/22/2015 - 7:25:28 PM - [] R---D C:\WINDOWS\system32\Config\systemprofile\Start Menu\Programs\Accessories
O43 - CFD: 6/22/2015 - 12:14:32 PM - [] R---D C:\WINDOWS\system32\Config\systemprofile\Start Menu\Programs\Startup
O43 - CFD: 6/22/2015 - 7:32:44 PM - [] R---D C:\Documents and Settings\d\Start Menu\Programs\Accessories
O43 - CFD: 6/22/2015 - 3:08:49 PM - [] ----D C:\Documents and Settings\d\Start Menu\Programs\Flux
O43 - CFD: 6/22/2015 - 7:49:24 PM - [] ----D C:\Documents and Settings\d\Start Menu\Programs\Hao123
O43 - CFD: 6/22/2015 - 4:07:15 PM - [] ----D C:\Documents and Settings\d\Start Menu\Programs\Internet Download Manager
O43 - CFD: 6/22/2015 - 3:10:56 PM - [] ----D C:\Documents and Settings\d\Start Menu\Programs\Paltalk Messenger
O43 - CFD: 6/22/2015 - 3:10:56 PM - [] R---D C:\Documents and Settings\d\Start Menu\Programs\Startup
O43 - CFD: 6/22/2015 - 7:52:17 PM - [] ----D C:\Documents and Settings\d\Start Menu\Programs\Winamp Detector Plug-in
O43 - CFD: 6/22/2015 - 7:50:01 PM - [] ----D C:\Documents and Settings\d\Start Menu\Programs\WinRAR
~ Program Folder: 106 Scanned in 00mn AMs



---\\ Last modified or created files under Windows and System32 (O44)
O44 - LFC:[MD5.010E3B4FDE328D64A2781E7FE3D204B2] - 6/22/2015 - 10:33:01 AM ---A- . (...) -- C:\WINDOWS\system32\wpa.dbl   [2206]
O44 - LFC:[MD5.15A9294B81D0FF0E4AC75276C13FD04B] - 6/22/2015 - 11:14:32 AM ---A- . (.Microsoft Corporation - Microsoft® Document Imaging.) -- C:\WINDOWS\system32\mdimon.dll   [24816]
O44 - LFC:[MD5.3FE791B7714A592B17C4DD8C24B382AF] - 6/22/2015 - 11:14:42 AM ---A- . (.Microsoft Corporation - Property Pages for Storage Devices.) -- C:\WINDOWS\system32\storprop.dll   [74752]
O44 - LFC:[MD5.A956751EF995DF776F19831123868A83] - 6/22/2015 - 11:14:43 AM ---A- . (.Microsoft Corporation - Battery Class Installer.) -- C:\WINDOWS\system32\batt.dll   [8704]
O44 - LFC:[MD5.C93C9FF7B04D772627A3646D89F7BF89] - 6/22/2015 - 11:14:43 AM ---A- . (.Microsoft Corporation - Infra-Red Bus Enumerator.) -- C:\WINDOWS\system32\Drivers\irenum.sys   [11264]
O44 - LFC:[MD5.E8F945B7F0A938FEDB44AE9996898F6C] - 6/22/2015 - 11:14:43 AM ---A- . (.Microsoft Corporation - Notepad.) -- C:\WINDOWS\NOTEPAD.EXE   [69120]
O44 - LFC:[MD5.30475F091008E24550523515A023270D] - 6/22/2015 - 11:14:44 AM ---A- . (...) -- C:\WINDOWS\system32\AUTOEXEC.NT   [1688]
O44 - LFC:[MD5.F4DFD83153E8C9088AE2DB704107060D] - 6/22/2015 - 11:14:44 AM ---A- . (.Microsoft Corporation - Task Manager.) -- C:\WINDOWS\TASKMAN.EXE   [15360]
O44 - LFC:[MD5.5726CB81771655731D011ABD878CB65D] - 6/22/2015 - 11:14:47 AM ---A- . (.Equinox Systems Inc. - Equinox Multiport Serial Coinstaller.) -- C:\WINDOWS\system32\EqnClass.Dll   [103424]
O44 - LFC:[MD5.060110976C713D49CEFEE9A7291CE9D7] - 6/22/2015 - 11:14:48 AM ---A- . (.Digi International - DGSETUP DLL.) -- C:\WINDOWS\system32\dgsetup.dll   [85020]
O44 - LFC:[MD5.1E8F9818D695F8759B125EE146BEB935] - 6/22/2015 - 11:14:48 AM ---A- . (.Digi International, Inc. - Digi RealPort® Driver Upgrade.) -- C:\WINDOWS\system32\dgrpsetu.dll   [176157]
O44 - LFC:[MD5.FACEF4325FE4795647149DEC6FF728C7] - 6/22/2015 - 11:14:48 AM ---A- . (.Microsoft Corporation - Infrared Class Coinstaller.) -- C:\WINDOWS\system32\irclass.dll   [13312]
O44 - LFC:[MD5.1C3C9B5B42A50D2D86CAF2EC05D34B3C] - 6/22/2015 - 11:14:48 AM ---A- . (.Perle Systems Ltd. - Specialix MPS NT Upgrade CoInstaller.) -- C:\WINDOWS\system32\spxcoins.dll   [24661]
O44 - LFC:[MD5.6CB26848BCDAA361B6EE21264FB362C3] - 6/22/2015 - 11:14:50 AM ---A- . (...) -- C:\WINDOWS\system32\c_20127.nls   [66082]
O44 - LFC:[MD5.6F8A509550FE8C92D07EE0143BF29BA1] - 6/22/2015 - 11:14:55 AM ---A- . (...) -- C:\WINDOWS\system32\c_10010.nls   [66082]
O44 - LFC:[MD5.D2CA471D36A69D17F82D5C1B64FAEE39] - 6/22/2015 - 11:14:55 AM ---A- . (...) -- C:\WINDOWS\system32\c_10029.nls   [66082]
O44 - LFC:[MD5.9CA501D2A8E6909C5B2E8C9274682BF1] - 6/22/2015 - 11:14:55 AM ---A- . (...) -- C:\WINDOWS\system32\c_10082.nls   [66082]
O44 - LFC:[MD5.21E928C8E6ED8EEAB0D1AAEE82ACDD76] - 6/22/2015 - 11:14:55 AM ---A- . (...) -- C:\WINDOWS\system32\c_852.nls   [66594]
O44 - LFC:[MD5.615DDBB5CBBAE8301C1E7FA95F1E66A3] - 6/22/2015 - 11:14:56 AM R--A- . (.Microsoft Corporation - Albania Keyboard Layout.) -- C:\WINDOWS\system32\KBDAL.DLL   [6656]
O44 - LFC:[MD5.5B46568257EE49714564511D58E0DE53] - 6/22/2015 - 11:14:56 AM R--A- . (.Microsoft Corporation - Croatian/Slovenian Keyboard Layout.) -- C:\WINDOWS\system32\kbdcr.dll   [6656]
O44 - LFC:[MD5.36E68E02AF2206FC4A8C73CAEABE1FB0] - 6/22/2015 - 11:14:56 AM R--A- . (.Microsoft Corporation - Czech Keyboard Layout.) -- C:\WINDOWS\system32\kbdcz.dll   [7168]
O44 - LFC:[MD5.AFA30A44ED11A5F9A059A2767AB6A81A] - 6/22/2015 - 11:14:56 AM R--A- . (.Microsoft Corporation - Czech_101 Keyboard Layout.) -- C:\WINDOWS\system32\kbdcz1.dll   [6656]
O44 - LFC:[MD5.90535C13EB54E1F2C95478F1B99DCCEB] - 6/22/2015 - 11:14:56 AM R--A- . (.Microsoft Corporation - Czech_Programmer's Keyboard Layout.) -- C:\WINDOWS\system32\kbdcz2.dll   [6656]
O44 - LFC:[MD5.F3D1EEC756847C70E65335E8CA1AE64B] - 6/22/2015 - 11:14:56 AM R--A- . (.Microsoft Corporation - Hungarian 101-key Keyboard Layout.) -- C:\WINDOWS\system32\kbdhu1.dll   [5632]
O44 - LFC:[MD5.CF92D95B5CB6649CB9D7E8D7616487A7] - 6/22/2015 - 11:14:56 AM R--A- . (.Microsoft Corporation - Hungarian Keyboard Layout.) -- C:\WINDOWS\system32\kbdhu.dll   [6656]
O44 - LFC:[MD5.D199B05901C2407FC0F87444A24A4F3C] - 6/22/2015 - 11:14:56 AM R--A- . (.Microsoft Corporation - Polish Keyboard Layout.) -- C:\WINDOWS\system32\kbdpl.dll   [6656]
O44 - LFC:[MD5.897663C8606357A8E86E57CDEA8EE219] - 6/22/2015 - 11:14:56 AM R--A- . (.Microsoft Corporation - Polish Programmer's Keyboard Layout.) -- C:\WINDOWS\system32\kbdpl1.dll   [5632]
O44 - LFC:[MD5.C2E62748C875A310A6D5B10498238A68] - 6/22/2015 - 11:14:56 AM R--A- . (.Microsoft Corporation - Romanian Keyboard Layout.) -- C:\WINDOWS\system32\kbdro.dll   [5632]
O44 - LFC:[MD5.552221E92D6BF55F8358B927F00696C3] - 6/22/2015 - 11:14:56 AM R--A- . (.Microsoft Corporation - Serbian_Latin Keyboard Layout.) -- C:\WINDOWS\system32\kbdycl.dll   [6656]
O44 - LFC:[MD5.DCCE231E5BDF1401AC0F770EE16902AA] - 6/22/2015 - 11:14:56 AM R--A- . (.Microsoft Corporation - Slovak Keyboard Layout.) -- C:\WINDOWS\system32\kbdsl.dll   [6656]
O44 - LFC:[MD5.93033C3EA80FB24B198B24DDECA07D4A] - 6/22/2015 - 11:14:56 AM R--A- . (.Microsoft Corporation - Slovak(QWERTY) Keyboard Layout.) -- C:\WINDOWS\system32\kbdsl1.dll   [6656]
O44 - LFC:[MD5.5D038EEABA8EA438F6B5ABD5E91BC851] - 6/22/2015 - 11:14:58 AM ---A- . (...) -- C:\WINDOWS\system32\C_28594.NLS   [66082]
O44 - LFC:[MD5.3E969213F35127D83DAB48FF1283E8E4] - 6/22/2015 - 11:14:58 AM ---A- . (...) -- C:\WINDOWS\system32\c_855.nls   [66594]
O44 - LFC:[MD5.5CD475CA7B87844DE1E0483B536F9AAE] - 6/22/2015 - 11:14:58 AM ---A- . (...) -- C:\WINDOWS\system32\c_866.nls   [66594]
O44 - LFC:[MD5.BBB6C3346064C6AECEE6AD9F144B1AEA] - 6/22/2015 - 11:14:58 AM R--A- . (.Microsoft Corporation - Estonia Keyboard Layout.) -- C:\WINDOWS\system32\kbdest.dll   [6144]
O44 - LFC:[MD5.C047165ED75FF85DB5A89EFEE3DA1133] - 6/22/2015 - 11:14:58 AM R--A- . (.Microsoft Corporation - Latvia Keyboard Layout.) -- C:\WINDOWS\system32\kbdlv.dll   [6144]
O44 - LFC:[MD5.27D72BCF2B495FCDA073DBA5F189D7A1] - 6/22/2015 - 11:14:58 AM R--A- . (.Microsoft Corporation - Latvia-QWERTY Keyboard Layout.) -- C:\WINDOWS\system32\kbdlv1.dll   [6144]
O44 - LFC:[MD5.F5B3B152A1D2752BC88928EB1E031B7E] - 6/22/2015 - 11:14:58 AM R--A- . (.Microsoft Corporation - Lithuania Keyboard Layout.) -- C:\WINDOWS\system32\kbdlt.dll   [5632]
O44 - LFC:[MD5.AF05A41DBD1B0424B5CB47092152C7F6] - 6/22/2015 - 11:14:58 AM R--A- . (.Microsoft Corporation - Lithuanian Keyboard Layout.) -- C:\WINDOWS\system32\kbdlt1.dll   [5632]
O44 - LFC:[MD5.B537ACFAB9E70F0EF48DB696A08ADC81] - 6/22/2015 - 11:15:00 AM ---A- . (...) -- C:\WINDOWS\system32\C_28597.NLS   [66082]
O44 - LFC:[MD5.0A206B5CACD3CA70D2044DA691304765] - 6/22/2015 - 11:15:00 AM ---A- . (...) -- C:\WINDOWS\system32\c_10006.nls   [66082]
O44 - LFC:[MD5.BAC7072B365F9648CA318154BA7E03EC] - 6/22/2015 - 11:15:00 AM ---A- . (...) -- C:\WINDOWS\system32\c_737.nls   [66594]
O44 - LFC:[MD5.780C444EB16B65E6DE96F794A732DA12] - 6/22/2015 - 11:15:00 AM ---A- . (...) -- C:\WINDOWS\system32\c_869.nls   [66594]
O44 - LFC:[MD5.8BE0D77A873730B4EB1DAB7C6622CD46] - 6/22/2015 - 11:15:00 AM ---A- . (...) -- C:\WINDOWS\system32\c_875.nls   [66082]
O44 - LFC:[MD5.1E81E1F3D5ACB3371CF73C1DE8F800BF] - 6/22/2015 - 11:15:00 AM R--A- . (.Microsoft Corporation - Greek IBM 220 Keyboard Layout.) -- C:\WINDOWS\system32\kbdhe220.dll   [5632]
O44 - LFC:[MD5.D26533FDF72381947F823882BBA4A196] - 6/22/2015 - 11:15:00 AM R--A- . (.Microsoft Corporation - Greek IBM 220 Latin Keyboard Layout.) -- C:\WINDOWS\system32\kbdhela2.dll   [6144]
O44 - LFC:[MD5.AC81A176BA35D1D7A5CD53137F3160FE] - 6/22/2015 - 11:15:00 AM R--A- . (.Microsoft Corporation - Greek IBM 319 Keyboard Layout.) -- C:\WINDOWS\system32\kbdhe319.dll   [5632]
O44 - LFC:[MD5.F2312B8A76FD584ACD1D956688BEB6F8] - 6/22/2015 - 11:15:00 AM R--A- . (.Microsoft Corporation - Greek IBM 319 Latin Keyboard Layout.) -- C:\WINDOWS\system32\kbdhela3.dll   [6656]
O44 - LFC:[MD5.83C99B438B3D6DBE7B838DA783E173AC] - 6/22/2015 - 11:15:00 AM R--A- . (.Microsoft Corporation - Greek Keyboard Layout.) -- C:\WINDOWS\system32\kbdhe.dll   [5632]
O44 - LFC:[MD5.A93447C87DDB6B1945F1F5F87EAB68DC] - 6/22/2015 - 11:15:00 AM R--A- . (.Microsoft Corporation - Greek_Latin Keyboard Layout.) -- C:\WINDOWS\system32\kbdgkl.dll   [6144]
O44 - LFC:[MD5.90CC52E8B52F0EC3A41D14FFBE789324] - 6/22/2015 - 11:15:00 AM R--A- . (.Microsoft Corporation - Greek_Polytonic Keyboard Layout.) -- C:\WINDOWS\system32\kbdhept.dll   [8192]
O44 - LFC:[MD5.E22D1B9AC7854C0A654E4C4232074E49] - 6/22/2015 - 11:15:02 AM ---A- . (...) -- C:\WINDOWS\system32\C_28595.NLS   [66082]
O44 - LFC:[MD5.AF4A866226BD04ACF06135088D75BB63] - 6/22/2015 - 11:15:02 AM ---A- . (...) -- C:\WINDOWS\system32\c_10007.nls   [66082]
O44 - LFC:[MD5.314E85390BEBDAE5D1E11DB2D8CBC6E9] - 6/22/2015 - 11:15:02 AM ---A- . (...) -- C:\WINDOWS\system32\c_10017.nls   [66082]
O44 - LFC:[MD5.A1FA7A83F9D98D84419A8E64286284F4] - 6/22/2015 - 11:15:02 AM R--A- . (.Microsoft Corporation - Belarusian Keyboard Layout.) -- C:\WINDOWS\system32\kbdblr.dll   [5632]
O44 - LFC:[MD5.1DF6E4758611E1328567BFE4D1B28E27] - 6/22/2015 - 11:15:02 AM R--A- . (.Microsoft Corporation - Bulgarian Keyboard Layout.) -- C:\WINDOWS\system32\kbdbu.dll   [5632]
O44 - LFC:[MD5.95D9106D39AB410A7F7EE513F181F84C] - 6/22/2015 - 11:15:02 AM R--A- . (.Microsoft Corporation - Kazak_Cyrillic Keyboard Layout.) -- C:\WINDOWS\system32\kbdkaz.dll   [5632]
O44 - LFC:[MD5.B6E962B7AC1CB4A78876953D369BE6DD] - 6/22/2015 - 11:15:02 AM R--A- . (.Microsoft Corporation - Russia(Typewriter) Keyboard Layout.) -- C:\WINDOWS\system32\kbdru1.dll   [5632]
O44 - LFC:[MD5.C6F23BC1411E91C179B0635893BB40A1] - 6/22/2015 - 11:15:02 AM R--A- . (.Microsoft Corporation - Russian Keyboard Layout.) -- C:\WINDOWS\system32\kbdru.dll   [5632]
O44 - LFC:[MD5.E5D4673C83271FEEE1ED73E1E281A42B] - 6/22/2015 - 11:15:02 AM R--A- . (.Microsoft Corporation - Serbian_Cyrillic Keyboard Layout.) -- C:\WINDOWS\system32\kbdycc.dll   [5632]
O44 - LFC:[MD5.3DDE3DC57C54452A313DC20F3019F8E3] - 6/22/2015 - 11:15:02 AM R--A- . (.Microsoft Corporation - Ukrainian Keyboard Layout.) -- C:\WINDOWS\system32\kbdur.dll   [5632]
O44 - LFC:[MD5.0304318F189E3CC4A99FCCCB0A68147F] - 6/22/2015 - 11:15:03 AM R--A- . (.Microsoft Corporation - Azerbaijan_Cyrillic Keyboard Layout.) -- C:\WINDOWS\system32\kbdaze.dll   [5632]
O44 - LFC:[MD5.FA30D45301EE66C33C0BF0F053DD9268] - 6/22/2015 - 11:15:03 AM R--A- . (.Microsoft Corporation - Kyrgyz Keyboard Layout.) -- C:\WINDOWS\system32\kbdkyr.dll   [5632]
O44 - LFC:[MD5.29F119AD63CE42E616E35792DB01A4E0] - 6/22/2015 - 11:15:03 AM R--A- . (.Microsoft Corporation - Mongolian Keyboard Layout.) -- C:\WINDOWS\system32\kbdmon.dll   [5632]
O44 - LFC:[MD5.F2D1EEF5ADCD5995C015AB3CB15C9415] - 6/22/2015 - 11:15:03 AM R--A- . (.Microsoft Corporation - Tatar_Cyrillic Keyboard Layout.) -- C:\WINDOWS\system32\kbdtat.dll   [5632]
O44 - LFC:[MD5.4F9CFFBF05831BB81833FC64A5329C36] - 6/22/2015 - 11:15:03 AM R--A- . (.Microsoft Corporation - Uzbek_Cyrillic Keyboard Layout.) -- C:\WINDOWS\system32\kbduzb.dll   [5632]
O44 - LFC:[MD5.EC940475561F651E8CCA80C9144191D0] - 6/22/2015 - 11:15:05 AM ---A- . (...) -- C:\WINDOWS\ODBC.INI   [376]
O44 - LFC:[MD5.EFFDFF60A38CF648811BBCDD722ECF5E] - 6/22/2015 - 11:15:05 AM ---A- . (...) -- C:\WINDOWS\system32\c_10081.nls   [66082]
O44 - LFC:[MD5.C37A21EE1ADFDC13FC707D97073148ED] - 6/22/2015 - 11:15:05 AM ---A- . (...) -- C:\WINDOWS\system32\c_28599.nls   [66082]
O44 - LFC:[MD5.A8764750B22B528D85A691A52CB21856] - 6/22/2015 - 11:15:05 AM ---A- . (...) -- C:\WINDOWS\system32\c_857.nls   [66594]
O44 - LFC:[MD5.188E56B70419D8353B8D4F3E381D9E52] - 6/22/2015 - 11:15:05 AM R--A- . (.Microsoft Corporation - Turkish F Keyboard Layout.) -- C:\WINDOWS\system32\kbdtuf.dll   [6144]
O44 - LFC:[MD5.5D569F2951F878EF01D7723DC08682E9] - 6/22/2015 - 11:15:05 AM R--A- . (.Microsoft Corporation - Turkish Q Keyboard Layout.) -- C:\WINDOWS\system32\kbdtuq.dll   [6144]
O44 - LFC:[MD5.712A218557F99D136735E0545E5AE223] - 6/22/2015 - 11:15:06 AM R--A- . (.Microsoft Corporation - Azeri-Latin Keyboard Layout.) -- C:\WINDOWS\system32\kbdazel.dll   [5632]
O44 - LFC:[MD5.35448F3A71EBBECF8E997FAD3A99327D] - 6/22/2015 - 11:15:08 AM ---A- . (...) -- C:\WINDOWS\system32\c_28603.nls   [66082]
O44 - LFC:[MD5.A5348CDD3A205288EAE3E318676EB7D6] - 6/22/2015 - 11:15:22 AM ---A- . (...) -- C:\WINDOWS\system32\pid.PNF   [4444]
O44 - LFC:[MD5.C2D7189CDD37453234A9BBCB58E50883] - 6/22/2015 - 11:17:09 AM ---A- . (.Microsoft Corporation - USB UI Dll.) -- C:\WINDOWS\system32\usbui.dll   [74240]
O44 - LFC:[MD5.F828DD7E1419B6653894A8F97A0094C5] - 6/22/2015 - 11:17:50 AM ---A- . (.Microsoft Corporation - Redbook Audio Filter Driver.) -- C:\WINDOWS\system32\Drivers\redbook.sys   [57600]
O44 - LFC:[MD5.D9F724AA26C010A217C97606B160ED68] - 6/22/2015 - 11:18:34 AM ---A- . (.Microsoft Corporation - AudStub Driver.) -- C:\WINDOWS\system32\Drivers\audstub.sys   [3072]
O44 - LFC:[MD5.D41D8CD98F00B204E9800998ECF8427E] - 6/22/2015 - 11:19:53 AM ---A- . (...) -- C:\WINDOWS\system32\h323log.txt   [0]
O44 - LFC:[MD5.82919BDF326810F03A4DA58E4F76107A] - 6/22/2015 - 12:55:28 PM ---A- . (...) -- C:\WINDOWS\vsfilter.INI   [138]
O44 - LFC:[MD5.F3C139AD492C4F73353057442E6995CE] - 6/22/2015 - 2:20:16 PM ---A- . (...) -- C:\WINDOWS\system32\c_10021.nls   [66082]
O44 - LFC:[MD5.E7B5FBCE2684A6AF661AEDEB2D6C741C] - 6/22/2015 - 2:20:16 PM ---A- . (.Microsoft Corporation - Thai Wordbreaker.) -- C:\WINDOWS\system32\ftlx041e.dll   [6144]
O44 - LFC:[MD5.797C5AF6A1558AF3EDF134B2591D8CE2] - 6/22/2015 - 2:20:17 PM R--A- . (.Microsoft Corporation - Thai Kedmanee (non-ShiftLock) Keyboard Layo.) -- C:\WINDOWS\system32\kbdth2.dll   [6144]
O44 - LFC:[MD5.0E3F96C13EE88880860E5F542A54EE6B] - 6/22/2015 - 2:20:17 PM R--A- . (.Microsoft Corporation - Thai Kedmanee Keyboard Layout.) -- C:\WINDOWS\system32\kbdth0.dll   [5632]
O44 - LFC:[MD5.6C7CFEEA3BCE3D6CC7548580FE4DEF1C] - 6/22/2015 - 2:20:17 PM R--A- . (.Microsoft Corporation - Thai Pattachote Keyboard Layout.) -- C:\WINDOWS\system32\kbdth1.dll   [5632]
O44 - LFC:[MD5.ECFC16BFAB5537D9542AB9365796F25B] - 6/22/2015 - 2:20:18 PM R--A- . (.Microsoft Corporation - Thai Pattachote (non-ShiftLock) Keyboard La.) -- C:\WINDOWS\system32\kbdth3.dll   [6144]
O44 - LFC:[MD5.A99203A3397A9DB352C5D8DFBDA230A8] - 6/22/2015 - 2:20:33 PM ---A- . (...) -- C:\WINDOWS\system32\c_862.nls   [66594]
O44 - LFC:[MD5.72233F1A1D788A84D4687A258CC97CBF] - 6/22/2015 - 2:20:34 PM ---A- . (...) -- C:\WINDOWS\system32\c_10005.nls   [66082]
O44 - LFC:[MD5.CD5DDA84167F24446183126083EE6C19] - 6/22/2015 - 2:20:34 PM R--A- . (.Microsoft Corporation - KBDHEB Keyboard Layout.) -- C:\WINDOWS\system32\kbdheb.dll   [5632]
O44 - LFC:[MD5.77F127766D758EB2C6451E221A0C7F7D] - 6/22/2015 - 2:20:41 PM ---A- . (...) -- C:\WINDOWS\system32\c_708.nls   [66082]
O44 - LFC:[MD5.C050215D8D21DF5658E94187973FB89C] - 6/22/2015 - 2:20:41 PM ---A- . (...) -- C:\WINDOWS\system32\c_720.nls   [66594]
O44 - LFC:[MD5.1DBBCC1B712C2674BDF29A05A5DD366E] - 6/22/2015 - 2:20:42 PM ---A- . (...) -- C:\WINDOWS\system32\c_10004.nls   [66082]
O44 - LFC:[MD5.C58563DF50115E935BC811FFBCE1FC89] - 6/22/2015 - 2:20:42 PM ---A- . (...) -- C:\WINDOWS\system32\c_864.nls   [66594]
O44 - LFC:[MD5.4D4C7CED88E5621F21A4911A44CADACC] - 6/22/2015 - 2:20:43 PM ---A- . (...) -- C:\WINDOWS\system32\C_28596.NLS   [66082]
O44 - LFC:[MD5.B6B5F451810EA14F9447BB5BB96B22F0] - 6/22/2015 - 2:20:43 PM R--A- . (.Microsoft Corporation - Arabic_English_101 Keyboard Layout.) -- C:\WINDOWS\system32\kbda1.dll   [5632]
O44 - LFC:[MD5.DF209C6F4CB8C10FA5DAB828A4164045] - 6/22/2015 - 2:20:44 PM R--A- . (.Microsoft Corporation - Arabic_2 Keyboard Layout.) -- C:\WINDOWS\system32\kbda2.dll   [5632]
O44 - LFC:[MD5.465E698788EC46B5E59A755CB0DE850A] - 6/22/2015 - 2:20:45 PM ---A- . (.Microsoft Corporation - US IBM Arabic 238_L Keyboard Layout.) -- C:\WINDOWS\system32\kbdusa.dll   [5632]
O44 - LFC:[MD5.D43F274BDC082FD86EFB72719DD8ECDB] - 6/22/2015 - 2:20:45 PM R--A- . (.Microsoft Corporation - Arabic_French_102 Keyboard Layout.) -- C:\WINDOWS\system32\kbda3.dll   [5632]
O44 - LFC:[MD5.B04DB738D62A7469C634FF9CD73402BF] - 6/22/2015 - 2:20:46 PM R--A- . (.Microsoft Corporation - Farsi Keyboard Layout.) -- C:\WINDOWS\system32\kbdfa.dll   [5632]
O44 - LFC:[MD5.CCB32FB83707777CF590170EC69F0643] - 6/22/2015 - 2:20:46 PM R--A- . (.Microsoft Corporation - Urdu Keyboard Layout.) -- C:\WINDOWS\system32\kbdurdu.dll   [5632]
O44 - LFC:[MD5.93D31B209FEFDC09431E8EFB708E7028] - 6/22/2015 - 2:20:47 PM R--A- . (.Microsoft Corporation - Divehi Phonetic Keyboard Layout.) -- C:\WINDOWS\system32\kbddiv1.dll   [5632]
O44 - LFC:[MD5.80E27279675CF29517DD0B6CFBE05504] - 6/22/2015 - 2:20:48 PM R--A- . (.Microsoft Corporation - Divehi Typewriter Keyboard Layout.) -- C:\WINDOWS\system32\kbddiv2.dll   [5632]
O44 - LFC:[MD5.02DC4BC9DB5980B5E7E911681E67ACF3] - 6/22/2015 - 2:20:48 PM R--A- . (.Microsoft Corporation - Syriac Standard Keyboard Layout.) -- C:\WINDOWS\system32\kbdsyr1.dll   [5632]
O44 - LFC:[MD5.315CFD150C86E55FD62475C91BE0BA8E] - 6/22/2015 - 2:20:49 PM R--A- . (.Microsoft Corporation - Syriac Phoenetic Keyboard Layout.) -- C:\WINDOWS\system32\kbdsyr2.dll   [5632]
O44 - LFC:[MD5.89FD6D6E233393794FB75CF79DDC1E06] - 6/22/2015 - 2:20:54 PM R--A- . (.Microsoft Corporation - Vietnamese Keyboard Layout.) -- C:\WINDOWS\system32\kbdvntc.dll   [5632]
O44 - LFC:[MD5.E36A034E3E54682477808BA92FECB075] - 6/22/2015 - 2:20:58 PM ---A- . (.Microsoft Corporation - ISCII Code Page Translation DLL.) -- C:\WINDOWS\system32\c_iscii.dll   [10752]
O44 - LFC:[MD5.835B4EF731C6FD35720C380B6A5B6F22] - 6/22/2015 - 2:20:58 PM R--A- . (.Microsoft Corporation - Devanagari Keyboard Layout.) -- C:\WINDOWS\system32\kbdindev.dll   [5632]
O44 - LFC:[MD5.F74D447B49E790BC96C6420EFBC49C4A] - 6/22/2015 - 2:20:59 PM R--A- . (.Microsoft Corporation - Marathi Keyboard Layout.) -- C:\WINDOWS\system32\kbdinmar.dll   [5632]
O44 - LFC:[MD5.5490159446E337B474BEA2C7E20F3E00] - 6/22/2015 - 2:20:59 PM R--A- . (.Microsoft Corporation - Tamil Keyboard Layout.) -- C:\WINDOWS\system32\kbdintam.dll   [5632]
O44 - LFC:[MD5.1FADCB5933564255A49614520B44B98E] - 6/22/2015 - 2:21:00 PM R--A- . (.Microsoft Corporation - Hindi Keyboard Layout.) -- C:\WINDOWS\system32\kbdinhin.dll   [5632]
O44 - LFC:[MD5.7FE7B02305737B8367ECF5F3A462991E] - 6/22/2015 - 2:21:01 PM R--A- . (.Microsoft Corporation - Gujarati Keyboard Layout.) -- C:\WINDOWS\system32\kbdinguj.dll   [5632]
O44 - LFC:[MD5.970A761FF57216E83AB852050CE4F6BF] - 6/22/2015 - 2:21:01 PM R--A- . (.Microsoft Corporation - Punjabi/Gurmukhi Keyboard Layout.) -- C:\WINDOWS\system32\kbdinpun.dll   [6144]
O44 - LFC:[MD5.D52F3380C21BA600BCFE9F45BCA6E887] - 6/22/2015 - 2:21:02 PM R--A- . (.Microsoft Corporation - Kannada Keyboard Layout.) -- C:\WINDOWS\system32\kbdinkan.dll   [5632]
O44 - LFC:[MD5.6C8CDF20DA9962616506E99BC293E153] - 6/22/2015 - 2:21:02 PM R--A- . (.Microsoft Corporation - Telugu Keyboard Layout.) -- C:\WINDOWS\system32\kbdintel.dll   [5632]
O44 - LFC:[MD5.E98DC261A6D62610293FF0CBDA8CAF65] - 6/22/2015 - 2:21:05 PM R--A- . (.Microsoft Corporation - Georgian Keyboard Layout.) -- C:\WINDOWS\system32\kbdgeo.dll   [5120]
O44 - LFC:[MD5.9970B6B4D37DA8D541537AA51068462D] - 6/22/2015 - 2:21:06 PM ---A- . (.Microsoft Corporation - Thai Word Breaker.) -- C:\WINDOWS\system32\Thawbrkr.dll   [185344]
O44 - LFC:[MD5.0EC03162E932B49E635A79445CCE1E4C] - 6/22/2015 - 2:21:06 PM R--A- . (.Microsoft Corporation - Eastern Armenian Keyboard Layout.) -- C:\WINDOWS\system32\kbdarme.dll   [5120]
O44 - LFC:[MD5.1004B259E77BEF2033CAF435760D95A6] - 6/22/2015 - 2:21:06 PM R--A- . (.Microsoft Corporation - Western Armenian Keyboard Layout.) -- C:\WINDOWS\system32\kbdarmw.dll   [5120]
O44 - LFC:[MD5.DB56DF4FA249A50B9C6ED97846C05237] - 6/22/2015 - 2:21:14 PM ---A- . (...) -- C:\WINDOWS\regopt.log   [750]
O44 - LFC:[MD5.5B44C214F9CD9F590BE9125347610380] - 6/22/2015 - 2:34:06 PM ---A- . (.Avira GmbH - Avira AntiVir File Filter Driver.) -- C:\WINDOWS\system32\Drivers\avgntdd.sys   [45416]
O44 - LFC:[MD5.87451AA7CC6B6A590EBCEA05E755075A] - 6/22/2015 - 2:34:07 PM ---A- . (.Avira GmbH - Avira AntiVir File Filter Driver Manager.) -- C:\WINDOWS\system32\Drivers\avgntmgr.sys   [22360]  =>PUP.DriverManager
O44 - LFC:[MD5.A88D29D928AD2B830E87B53E3F9BC182] - 6/22/2015 - 2:34:07 PM ---A- . (.Avira GmbH - Avira Minifilter Driver.) -- C:\WINDOWS\system32\Drivers\avgntflt.sys   [60936]
O44 - LFC:[MD5.1289E9A5D9118A25A13C0009519088E3] - 6/22/2015 - 2:34:08 PM ---A- . (.Avira GmbH - Avira Driver for Security Enhancement.) -- C:\WINDOWS\system32\Drivers\avipbb.sys   [124784]
O44 - LFC:[MD5.A36EE93698802CD899F98BFD553D8185] - 6/22/2015 - 2:34:21 PM ---A- . (.Avira GmbH - AVIRA SnapShot Driver.) -- C:\WINDOWS\system32\Drivers\ssmdrv.sys   [28520]
O44 - LFC:[MD5.D41D8CD98F00B204E9800998ECF8427E] - 6/22/2015 - 2:55:44 PM ---A- . (...) -- C:\openports.txt   [0]
O44 - LFC:[MD5.F4D021E764F6FA554606F4A735A3151B] - 6/22/2015 - 2:59:57 PM ---A- . (...) -- C:\WINDOWS\system.ini   [227]
O44 - LFC:[MD5.4D1E56E34C0D19EC9CBD2A471E3548C4] - 6/22/2015 - 2:59:57 PM ---A- . (...) -- C:\WINDOWS\win.ini   [573]
O44 - LFC:[MD5.FA579938B0733B87066546AFE951082C] - 6/22/2015 - 2:59:57 PM -SH-- . (...) -- C:\boot.ini   [211]
O44 - LFC:[MD5.47EA20320E3D6FDC7B7BB22B2B881CA6] - 6/22/2015 - 6:20:36 PM ---A- . (.Microsoft Corporation - Microsoft RDP Device redirector.) -- C:\WINDOWS\system32\Drivers\rdpdr.sys   [195712]
O44 - LFC:[MD5.88155247177638048422893737429D9E] - 6/22/2015 - 6:20:36 PM ---A- . (.Microsoft Corporation - Terminal Server Driver.) -- C:\WINDOWS\system32\Drivers\termdd.sys   [40840]
O44 - LFC:[MD5.56C0F2EF981F235AB011FBFE26D92088] - 6/22/2015 - 6:20:39 PM ---A- . (.Microsoft Corporation - WMI Snapin Helpers.) -- C:\WINDOWS\system32\mmfutil.dll   [17408]
O44 - LFC:[MD5.1C2C0143333F9651F088E29344D3BD0F] - 6/22/2015 - 6:20:39 PM ---A- . (.Microsoft Corporation - WMI Snapins.) -- C:\WINDOWS\system32\cmprops.dll   [185344]
O44 - LFC:[MD5.8E7C1B8BBA4070615D6E2F704F272255] - 6/22/2015 - 6:20:39 PM ---A- . (.Microsoft Corporation - WMI Snapins.) -- C:\WINDOWS\system32\servdeps.dll   [56320]
O44 - LFC:[MD5.6895427873D6C37A6D6DA7C3DB37DA14] - 6/22/2015 - 6:20:39 PM ---A- . (.Microsoft Corporation - Windows Product Activation Configuration WM.) -- C:\WINDOWS\system32\licwmi.dll   [58880]
O44 - LFC:[MD5.F137A0CA70003DB20448D540651FA003] - 6/22/2015 - 6:20:46 PM ---A- . (.Microsoft Corporation - No Comment.) -- C:\WINDOWS\system32\clbcatq.dll   [498688]
O44 - LFC:[MD5.85A335171B8D56B09276D1C6DF2A63B2] - 6/22/2015 - 6:20:46 PM ---A- . (.Microsoft Corporation - No Comment.) -- C:\WINDOWS\system32\comsnap.dll   [167424]
O44 - LFC:[MD5.ED0C0DF222209E43AD9AFBF3FE87DDE0] - 6/22/2015 - 6:20:46 PM ---A- . (.Microsoft Corporation - No Comment.) -- C:\WINDOWS\system32\comsvcs.dll   [1267200]
O44 - LFC:[MD5.E0950A5B73350A26AB063EF6772FDCA4] - 6/22/2015 - 6:20:46 PM ---A- . (.Microsoft Corporation - No Comment.) -- C:\WINDOWS\system32\comuid.dll   [539648]
O44 - LFC:[MD5.28CDB50D882D3BAD993D25BE596307EA] - 6/22/2015 - 6:20:47 PM ---A- . (.Microsoft Corporation - No Comment.) -- C:\WINDOWS\system32\catsrv.dll   [226304]
O44 - LFC:[MD5.846300110A32ACDEE7CB60E54C7F693A] - 6/22/2015 - 6:20:47 PM ---A- . (.Microsoft Corporation - No Comment.) -- C:\WINDOWS\system32\catsrvut.dll   [625664]
O44 - LFC:[MD5.5F5E83E18E9344BCD680704101CEA78A] - 6/22/2015 - 6:20:48 PM ---A- . (.Microsoft Corporation - No Comment.) -- C:\WINDOWS\system32\catsrvps.dll   [85504]
O44 - LFC:[MD5.33B37BB0C69F2DBD19277220435590BE] - 6/22/2015 - 6:20:48 PM ---A- . (.Microsoft Corporation - No Comment.) -- C:\WINDOWS\system32\clbcatex.dll   [110592]
O44 - LFC:[MD5.690D97864735E8ECD87F55777E266690] - 6/22/2015 - 6:20:48 PM ---A- . (.Microsoft Corporation - No Comment.) -- C:\WINDOWS\system32\colbact.dll   [60416]
O44 - LFC:[MD5.035FECD913735E843E95510D7CC89A4E] - 6/22/2015 - 6:20:48 PM ---A- . (.Microsoft Corporation - No Comment.) -- C:\WINDOWS\system32\comaddin.dll   [28160]
O44 - LFC:[MD5.E7427B6BD2F2B32403C23A4FE15DF3B3] - 6/22/2015 - 6:20:48 PM ---A- . (.Microsoft Corporation - No Comment.) -- C:\WINDOWS\system32\comrepl.dll   [97792]
O44 - LFC:[MD5.7827FB784D9B3029F3DAF73D3331A9CC] - 6/22/2015 - 6:20:48 PM ---A- . (.Microsoft Corporation - No Comment.) -- C:\WINDOWS\system32\mtxdm.dll   [30720]
O44 - LFC:[MD5.BC958016A1F7A23A1A9282C82D73D074] - 6/22/2015 - 6:20:48 PM ---A- . (.Microsoft Corporation - No Comment.) -- C:\WINDOWS\system32\mtxex.dll   [4096]
O44 - LFC:[MD5.9089B700986B7A441F79FE68F96E5149] - 6/22/2015 - 6:20:48 PM ---A- . (.Microsoft Corporation - No Comment.) -- C:\WINDOWS\system32\stclient.dll   [59392]
O44 - LFC:[MD5.238BDCE83AF21A6C2C0FCF216D3260E3] - 6/22/2015 - 6:20:49 PM ---A- . (.Microsoft Corporation - No Comment.) -- C:\WINDOWS\system32\dcomcnfg.exe   [6144]
O44 - LFC:[MD5.2A516AC024EA9E34AE0F0297293EABAB] - 6/22/2015 - 6:20:49 PM ---A- . (.Microsoft Corporation - No Comment.) -- C:\WINDOWS\system32\mtxlegih.dll   [34304]
O44 - LFC:[MD5.BCAB0BC4EDD47B54252D82D10A6EF5F5] - 6/22/2015 - 6:20:50 PM ---A- . (.Microsoft Corporation - MS DTC OLE Transactions interface proxy DLL.) -- C:\WINDOWS\system32\msdtcprx.dll   [428032]
O44 - LFC:[MD5.A137F1470499A205ABBB9AAFB3B6F2B1] - 6/22/2015 - 6:20:50 PM ---A- . (.Microsoft Corporation - MS DTC console program.) -- C:\WINDOWS\system32\msdtc.exe   [6144]
O44 - LFC:[MD5.AE3470D2BF8F16FD93FA54167B87172D] - 6/22/2015 - 6:20:50 PM ---A- . (.Microsoft Corporation - MS DTC helper APIs DLL.) -- C:\WINDOWS\system32\xolehlp.dll   [11776]
O44 - LFC:[MD5.110C8A0FF284DA86E637FEC98F14D6BC] - 6/22/2015 - 6:20:50 PM ---A- . (.Microsoft Corporation - MS DTC log manager DLL.) -- C:\WINDOWS\system32\msdtclog.dll   [58880]
O44 - LFC:[MD5.7C4F9779614844B1263246B81BA6685D] - 6/22/2015 - 6:20:50 PM ---A- . (.Microsoft Corporation - MS DTC transaction manager DLL.) -- C:\WINDOWS\system32\msdtctm.dll   [956928]
O44 - LFC:[MD5.AA4A015E2ACAE6127FDF833F301C1FE4] - 6/22/2015 - 6:20:51 PM ---A- . (.Microsoft Corporation - Configuration Backend Interface.) -- C:\WINDOWS\system32\cfgbkend.dll   [38912]
O44 - LFC:[MD5.DF6551E4C4C46655A0C76194F1FCEA5D] - 6/22/2015 - 6:20:51 PM ---A- . (.Microsoft Corporation - DLL Interface to TermDD Device Driver.) -- C:\WINDOWS\system32\icaapi.dll   [11264]
O44 - LFC:[MD5.8F3FFBB7890106572AC04EB9AD37417A] - 6/22/2015 - 6:20:51 PM ---A- . (.Microsoft Corporation - MS DTC administrative component DLL.) -- C:\WINDOWS\system32\msdtcuiu.dll   [161792]
O44 - LFC:[MD5.6B8A8B42D34A1D7279C2A948D5740B1D] - 6/22/2015 - 6:20:51 PM ---A- . (.Microsoft Corporation - Microsoft database support DLL for Oracle.) -- C:\WINDOWS\system32\mtxoci.dll   [91648]
O44 - LFC:[MD5.5AD00EED5722CAABDDAAC1CB92F68E57] - 6/22/2015 - 6:20:51 PM ---A- . (.Microsoft Corporation - Query Process Utility.) -- C:\WINDOWS\system32\qprocess.exe   [19968]
O44 - LFC:[MD5.DCCF6ED915BC05C244801B550AD12B17] - 6/22/2015 - 6:20:51 PM ---A- . (.Microsoft Corporation - RDP Clip Monitor.) -- C:\WINDOWS\system32\rdpclip.exe   [62976]
O44 - LFC:[MD5.C7C84DF7233F4834CD190F3DCCAF50CA] - 6/22/2015 - 6:20:51 PM ---A- . (.Microsoft Corporation - RDP Extension DLL.) -- C:\WINDOWS\system32\rdpwsx.dll   [87176]
O44 - LFC:[MD5.31DD1EF4149B0F22AFB12A2DD360B34D] - 6/22/2015 - 6:20:51 PM ---A- . (.Microsoft Corporation - Terminal Server MultiMedia Driver.) -- C:\WINDOWS\system32\rdpsnd.dll   [19968]
O44 - LFC:[MD5.C29AB058E20C56E8D1ECB44FEDEBC69F] - 6/22/2015 - 6:20:52 PM ---A- . (.Microsoft Corporation - Microsoft Remote Desktop TSRDP Session Add-.) -- C:\WINDOWS\system32\rdsaddin.exe   [13824]
O44 - LFC:[MD5.3C37BF86641BDA977C3BF8A840F3B7FA] - 6/22/2015 - 6:20:52 PM ---A- . (.Microsoft Corporation - Microsoft® Remote Desktop Help Session Mana.) -- C:\WINDOWS\system32\sessmgr.exe   [141312]
O44 - LFC:[MD5.B84AA6E863DE4A3BD9A0A39AEC207ECC] - 6/22/2015 - 6:20:52 PM ---A- . (.Microsoft Corporation - RDSHost Client Module.) -- C:\WINDOWS\system32\rdchost.dll   [147968]
O44 - LFC:[MD5.57E036885A222D1A8EF237C7399BE98B] - 6/22/2015 - 6:20:52 PM ---A- . (.Microsoft Corporation - RDSHost Server Module.) -- C:\WINDOWS\system32\rdshost.exe   [67072]
O44 - LFC:[MD5.A2DC7DE0307D6DE1DF0E23B70B6CFDC7] - 6/22/2015 - 6:20:52 PM ---A- . (.Microsoft Corporation - Remote Desktop Connection.) -- C:\WINDOWS\system32\mstsc.exe   [1034752]
O44 - LFC:[MD5.B30637E52CB169F89335119978BDBD3E] - 6/22/2015 - 6:20:52 PM ---A- . (.Microsoft Corporation - Remote Sessions CPL Extension.) -- C:\WINDOWS\system32\remotepg.dll   [60416]
O44 - LFC:[MD5.5128852A18AE46C387F87BF27DA4C9DD] - 6/22/2015 - 6:20:52 PM ---A- . (.Microsoft Corporation - Terminal Server Service.) -- C:\WINDOWS\system32\termsrv.dll   [296960]
O44 - LFC:[MD5.7398E4BF1FA653FFE86BACD18906E32B] - 6/22/2015 - 6:20:53 PM ---A- . (.Microsoft Corporation - Remote Desktop Services ActiveX Client.) -- C:\WINDOWS\system32\mstscax.dll   [2705408]
O44 - LFC:[MD5.3EC3BC6E8A4ACB2B87270212D75C1C5F] - 6/22/2015 - 6:20:54 PM ---A- . (.Microsoft Corporation - Anywhere access client.) -- C:\WINDOWS\system32\aaclient.dll   [131584]
O44 - LFC:[MD5.0779CEBD858DABA8DB5FBF3D64EE9B4C] - 6/22/2015 - 6:20:54 PM ---A- . (.Microsoft Corporation - RD Gateway QEC.) -- C:\WINDOWS\system32\tsgqec.dll   [36864]
O44 - LFC:[MD5.2D293B720C206473A05950CE007DB12A] - 6/22/2015 - 6:20:54 PM ---A- . (.Microsoft Corporation - RDP Terminal Stack Driver (US/Canada Only,.) -- C:\WINDOWS\system32\Drivers\rdpwd.sys   [139784]
O44 - LFC:[MD5.28D9646A6B8DE72980B683AF06D9D981] - 6/22/2015 - 6:20:54 PM ---A- . (.Microsoft Corporation - RPC/HTTP Downlevel Side-by-side Runtime.) -- C:\WINDOWS\system32\rhttpaa.dll   [290304]
O44 - LFC:[MD5.A125CBFE55C05735417786DD15A5BE76] - 6/22/2015 - 6:20:54 PM ---A- . (.Microsoft Corporation - Terminal Server Configuration WMI provider.) -- C:\WINDOWS\system32\tscfgwmi.dll   [93696]
O44 - LFC:[MD5.6471A66807F5E104E4885F5B67349397] - 6/22/2015 - 6:20:55 PM ---A- . (.Microsoft Corporation - Named Pipe Transport Driver.) -- C:\WINDOWS\system32\Drivers\tdpipe.sys   [12040]
O44 - LFC:[MD5.8D1492DBE9A856EE306EDC5A103E0BF2] - 6/22/2015 - 6:20:55 PM ---A- . (.Microsoft Corporation - Spider.) -- C:\WINDOWS\system32\spider.exe   [538624]
O44 - LFC:[MD5.C0578456F29E5F26285F81B7B71FE57D] - 6/22/2015 - 6:20:55 PM ---A- . (.Microsoft Corporation - TCP Transport Driver.) -- C:\WINDOWS\system32\Drivers\tdtcp.sys   [22024]
O44 - LFC:[MD5.66711BAF72A538CFA790E6180549F567] - 6/22/2015 - 6:20:56 PM ---A- . (.Microsoft Corporation - Paint.) -- C:\WINDOWS\system32\mspaint.exe   [343040]
O44 - LFC:[MD5.7A526169AC958E6602023A39734C8684] - 6/22/2015 - 6:20:56 PM ---A- . (.Microsoft Corporation - Windows NT ClipBook Viewer.) -- C:\WINDOWS\system32\clipbrd.exe   [102912]
O44 - LFC:[MD5.277BDF16A94BE0D063988D692541650B] - 6/22/2015 - 6:20:57 PM ---A- . (.Hilgraeve, Inc. - HyperTerminal Applet Library.) -- C:\WINDOWS\system32\hypertrm.dll   [347136]
O44 - LFC:[MD5.841FB340ABC439B4557FBDD32B7BA11D] - 6/22/2015 - 6:20:57 PM ---A- . (.Microsoft Corporation - Control Panel DLL.) -- C:\WINDOWS\system32\access.cpl   [68608]
O44 - LFC:[MD5.954BD0D7C3CB90D23C136FEC90999377] - 6/22/2015 - 6:20:57 PM ---A- . (.Microsoft Corporation - Media Player.) -- C:\WINDOWS\system32\mplay32.exe   [123392]
O44 - LFC:[MD5.D4B13D675DEC600C5A0ED2BB0EB301E6] - 6/22/2015 - 6:20:57 PM ---A- . (.Microsoft Corporation - Microsoft Accessibility Wizard.) -- C:\WINDOWS\system32\accwiz.exe   [184320]
O44 - LFC:[MD5.B22332758A8293C14DB318748A928CC4] - 6/22/2015 - 6:20:57 PM ---A- . (.Microsoft Corporation - Sound Recorder accessory.) -- C:\WINDOWS\system32\sndrec32.exe   [131584]
O44 - LFC:[MD5.2CE7B1EEB99C14032C0E2201B004F80E] - 6/22/2015 - 6:20:58 PM ---A- . (...) -- C:\WINDOWS\system32\wmimgmt.msc   [63488]
O44 - LFC:[MD5.CDD932EDCB756FB5F7CE5E2F090BA838] - 6/22/2015 - 6:21:04 PM ---A- . (...) -- C:\WINDOWS\system32\msdtcprf.h   [768]
O44 - LFC:[MD5.28E3647CBB608139AFB076103208552B] - 6/22/2015 - 6:21:04 PM ---A- . (...) -- C:\WINDOWS\system32\msdtcprf.ini   [1931]
O44 - LFC:[MD5.0D72D44A333628B15288C69738583A2E] - 6/22/2015 - 6:21:04 PM ---A- . (.Microsoft Corporation - Modem Connection Driver.) -- C:\WINDOWS\system32\cdmodem.dll   [15872]
O44 - LFC:[MD5.4A547D74B435E78418BE06406250C1D3] - 6/22/2015 - 6:21:05 PM ---A- . (...) -- C:\WINDOWS\system32\tslabels.h   [3286]
O44 - LFC:[MD5.DE60FA13A37BEA1EE44228DCB60F44BF] - 6/22/2015 - 6:21:05 PM ---A- . (.Microsoft Corporation - Message Utility.) -- C:\WINDOWS\system32\msg.exe   [20992]
O44 - LFC:[MD5.1317CB79629C34B5FF8260C297B09A1C] - 6/22/2015 - 6:21:05 PM ---A- . (.Microsoft Corporation - Query Session Utility.) -- C:\WINDOWS\system32\qwinsta.exe   [22016]
O44 - LFC:[MD5.1556473E920CA676702516DA38DCAC86] - 6/22/2015 - 6:21:05 PM ---A- . (.Microsoft Corporation - Query Terminal Server Utility.) -- C:\WINDOWS\system32\qappsrv.exe   [16896]
O44 - LFC:[MD5.4114B8D04AEE5FF6700A5CE1130D64FA] - 6/22/2015 - 6:21:05 PM ---A- . (.Microsoft Corporation - Registry Initializer.) -- C:\WINDOWS\system32\regini.exe   [33792]
O44 - LFC:[MD5.4ED862390A8986E2423122FC6A326EC4] - 6/22/2015 - 6:21:05 PM ---A- . (.Microsoft Corporation - Reset Session Utility.) -- C:\WINDOWS\system32\rwinsta.exe   [15872]
O44 - LFC:[MD5.900D05DAB18DA23083358D0839DC1134] - 6/22/2015 - 6:21:05 PM ---A- . (.Microsoft Corporation - Session Connection Utility.) -- C:\WINDOWS\system32\tscon.exe   [14848]
O44 - LFC:[MD5.DC8AAE44CDB63F178BC7B993B43C3318] - 6/22/2015 - 6:21:05 PM ---A- . (.Microsoft Corporation - Session Disconnection Utility.) -- C:\WINDOWS\system32\tsdiscon.exe   [14848]
O44 - LFC:[MD5.1497D0AB91183A5B51EF37CCFC88C6C5] - 6/22/2015 - 6:21:05 PM ---A- . (.Microsoft Corporation - Session Logoff Utility.) -- C:\WINDOWS\system32\logoff.exe   [15360]
O44 - LFC:[MD5.A72C27CE68318023981A4E034F85131C] - 6/22/2015 - 6:21:05 PM ---A- . (.Microsoft Corporation - Session Remote Control Utility.) -- C:\WINDOWS\system32\shadow.exe   [14848]
O44 - LFC:[MD5.092D468C0BDF67EC129C28692276AC88] - 6/22/2015 - 6:21:05 PM ---A- . (.Microsoft Corporation - Terminal Server Connection Configuration Ex.) -- C:\WINDOWS\system32\rdpcfgex.dll   [4096]
O44 - LFC:[MD5.03C361FAB5AD67924C5150A384C62BE6] - 6/22/2015 - 6:21:06 PM ---A- . (...) -- C:\WINDOWS\system32\tslabels.ini   [13223]
O44 - LFC:[MD5.F463BC45CD34ADE54F801746B6D322B1] - 6/22/2015 - 6:21:06 PM ---A- . (...) -- C:\WINDOWS\system32\usrlogon.cmd   [1161]
O44 - LFC:[MD5.4D9B5E540158BF8E9B1BCAC1AEDD8C60] - 6/22/2015 - 6:21:06 PM ---A- . (.Microsoft Corporation - Entertainment Pack FreeCell Game.) -- C:\WINDOWS\system32\freecell.exe   [55296]
O44 - LFC:[MD5.9C45D38B74634C9DED60BEC640C5C3CA] - 6/22/2015 - 6:21:06 PM ---A- . (.Microsoft Corporation - Entertainment Pack Minesweeper Game.) -- C:\WINDOWS\system32\winmine.exe   [119808]
O44 - LFC:[MD5.725902D25A3B8F234F729CA057052C41] - 6/22/2015 - 6:21:06 PM ---A- . (.Microsoft Corporation - System Shutdown Utility.) -- C:\WINDOWS\system32\tsshutdn.exe   [16896]
O44 - LFC:[MD5.F5FE756927FEF0F4A069DE0A832B5F0F] - 6/22/2015 - 6:21:06 PM ---A- . (.Microsoft Corporation - Terminal Services End Process Utility.) -- C:\WINDOWS\system32\tskill.exe   [16384]
O44 - LFC:[MD5.88F105251EE261ACF11AD88E7567258C] - 6/22/2015 - 6:21:06 PM ---A- . (.Microsoft Corporation - Terminal Services Reset Utility.) -- C:\WINDOWS\system32\reset.exe   [9728]
O44 - LFC:[MD5.BE1B85306352E0AC901EC08506792B6B] - 6/22/2015 - 6:21:06 PM ---A- . (.Microsoft Corporation - The Microsoft Hearts Network.) -- C:\WINDOWS\system32\mshearts.exe   [126976]
O44 - LFC:[MD5.405E1EF8E3C88E9BCD2853382BB12430] - 6/22/2015 - 6:21:07 PM ---A- . (...) -- C:\WINDOWS\system32\bopomofo.uce   [22984]
O44 - LFC:[MD5.AC9FA2BA34225342A8897930503AE12F] - 6/22/2015 - 6:21:07 PM ---A- . (.Microsoft Corporation - Character Map.) -- C:\WINDOWS\system32\charmap.exe   [80384]
O44 - LFC:[MD5.373E7A863A1A345C60EDB9E20EC32311] - 6/22/2015 - 6:21:07 PM ---A- . (.Microsoft Corporation - Solitaire Game Applet.) -- C:\WINDOWS\system32\sol.exe   [56832]
O44 - LFC:[MD5.829E4805B0E12B383EE09ABDC9E2DC3C] - 6/22/2015 - 6:21:07 PM ---A- . (.Microsoft Corporation - Windows Calculator application file.) -- C:\WINDOWS\system32\calc.exe   [114688]
O44 - LFC:[MD5.4FDED87068052EEB9B72A97FDBC141DB] - 6/22/2015 - 6:21:08 PM ---A- . (...) -- C:\WINDOWS\system32\gb2312.uce   [24006]
O44 - LFC:[MD5.038F6AD6CEE43585D814CDBC7CDFD3EC] - 6/22/2015 - 6:21:08 PM ---A- . (...) -- C:\WINDOWS\system32\ideograf.uce   [60458]
O44 - LFC:[MD5.7C0C25F4BA1084C4ABBEEA2C74194C5F] - 6/22/2015 - 6:21:08 PM ---A- . (...) -- C:\WINDOWS\system32\kanji_1.uce   [6948]
O44 - LFC:[MD5.529BBD63519BBD654EF328454019693F] - 6/22/2015 - 6:21:08 PM ---A- . (...) -- C:\WINDOWS\system32\kanji_2.uce   [8484]
O44 - LFC:[MD5.7A7A04370A6030B9B0E8178DAD4A6E41] - 6/22/2015 - 6:21:08 PM ---A- . (...) -- C:\WINDOWS\system32\korean.uce   [12876]
O44 - LFC:[MD5.8CA32E9D986FA76F60EFBCFCD9D80A58] - 6/22/2015 - 6:21:08 PM ---A- . (...) -- C:\WINDOWS\system32\shiftjis.uce   [16740]
O44 - LFC:[MD5.30F5568679A54042F99CA9EC1102EBCD] - 6/22/2015 - 6:21:08 PM ---A- . (...) -- C:\WINDOWS\system32\subrange.uce   [93702]
O44 - LFC:[MD5.60B9959D333C3D11255D8695D2685430] - 6/22/2015 - 6:21:08 PM ---A- . (.Microsoft Corporation - Unicode name Dll for UCE.) -- C:\WINDOWS\system32\getuname.dll   [605696]
O44 - LFC:[MD5.DAC71A10A6A71CB6E3F427AE3283734B] - 6/22/2015 - 6:21:09 PM ---A- . (...) -- C:\WINDOWS\Blue Lace 16.bmp   [1272]
O44 - LFC:[MD5.73D70ED3EC3BBFD8FD35DF431C38F374] - 6/22/2015 - 6:21:09 PM ---A- . (...) -- C:\WINDOWS\Coffee Bean.bmp   [17062]
O44 - LFC:[MD5.3A8B85AB7B415BF3F8AFE285DFE0CE29] - 6/22/2015 - 6:21:09 PM ---A- . (...) -- C:\WINDOWS\FeatherTexture.bmp   [16730]
O44 - LFC:[MD5.203EF178BF8B0A8EC34E27E4DEDB6349] - 6/22/2015 - 6:21:09 PM ---A- . (...) -- C:\WINDOWS\Gone Fishing.bmp   [17336]
O44 - LFC:[MD5.1AC5E83598D4F2143B59A2D893C3279A] - 6/22/2015 - 6:21:09 PM ---A- . (...) -- C:\WINDOWS\Greenstone.bmp   [26582]
O44 - LFC:[MD5.280920B6773C74C3649A934257112BE1] - 6/22/2015 - 6:21:09 PM ---A- . (...) -- C:\WINDOWS\Prairie Wind.bmp   [65954]
O44 - LFC:[MD5.927A66BD587E31CB12D3AB25381658DC] - 6/22/2015 - 6:21:09 PM ---A- . (...) -- C:\WINDOWS\Rhododendron.bmp   [17362]
O44 - LFC:[MD5.5B4AC407E566076BB726BA91E067D313] - 6/22/2015 - 6:21:09 PM ---A- . (...) -- C:\WINDOWS\River Sumida.bmp   [26680]
O44 - LFC:[MD5.39F43DBCE366B2561DF073B4C0839299] - 6/22/2015 - 6:21:09 PM ---A- . (...) -- C:\WINDOWS\Soap Bubbles.bmp   [65978]
O44 - LFC:[MD5.EB3BFC14E41FBAA41B4FD4489AA82D39] - 6/22/2015 - 6:21:10 PM ---A- . (...) -- C:\WINDOWS\Santa Fe Stucco.bmp   [65832]
O44 - LFC:[MD5.5290EA6951F4724259F423B12C8E1393] - 6/22/2015 - 6:21:10 PM ---A- . (...) -- C:\WINDOWS\Zapotec.bmp   [9522]
O44 - LFC:[MD5.399495998BCEEA80F23E57CCAB074508] - 6/22/2015 - 6:21:15 PM ---A- . (.Microsoft Corporation - Metering Controls.) -- C:\WINDOWS\system32\avmeter.dll   [16384]
O44 - LFC:[MD5.B82C4535E430DDC631FEC10D63390ECA] - 6/22/2015 - 6:21:15 PM ---A- . (.Microsoft Corporation - TAPI 3.0 Dialer and IP Multicast Conference.) -- C:\WINDOWS\system32\avtapi.dll   [227840]
O44 - LFC:[MD5.FEFC52216D2787EA1DE42BABA01AF9BF] - 6/22/2015 - 6:21:15 PM ---A- . (.Microsoft Corporation - Windows for Workgroups Chat (NT).) -- C:\WINDOWS\system32\winchat.exe   [35328]
O44 - LFC:[MD5.F759A6E14403BC3D7A55CCAD1B8F7B4A] - 6/22/2015 - 6:21:16 PM ---A- . (.Hilgraeve, Inc. - HyperTerminal Applet Library.) -- C:\WINDOWS\system32\hticons.dll   [44544]
O44 - LFC:[MD5.7DF33946B5911E75320CCA9AC1A3492B] - 6/22/2015 - 6:21:16 PM ---A- . (.Microsoft Corporation - Volume Control.) -- C:\WINDOWS\system32\sndvol32.exe   [138752]
O44 - LFC:[MD5.F415ACC27107AA6DADABE339949EE670] - 6/22/2015 - 6:21:16 PM ---A- . (.Microsoft Corporation - Wave Manipulation Component.) -- C:\WINDOWS\system32\avwav.dll   [73216]
O44 - LFC:[MD5.BB75ED2CEA65D2DE97E88FDE1B1A0BF8] - 6/22/2015 - 6:21:26 PM ---A- . (.Microsoft Corporation - Windows Write.) -- C:\WINDOWS\system32\write.exe   [5632]
O44 - LFC:[MD5.487403459F0B2F1A3ADEEF02496BD80E] - 6/22/2015 - 6:21:45 PM ---A- . (...) -- C:\WINDOWS\vb.ini   [36]
O44 - LFC:[MD5.6C2F0BA210C2B53EF07653ABAC6C2490] - 6/22/2015 - 6:21:45 PM ---A- . (...) -- C:\WINDOWS\vbaddin.ini   [37]
O44 - LFC:[MD5.FB7D44C564ED3A2E6EF4E2083BE211EE] - 6/22/2015 - 6:21:55 PM ---A- . (...) -- C:\WINDOWS\system32\emptyregdb.dat   [21640]
O44 - LFC:[MD5.009F0BE67B62150904D266A1D5BDC95B] - 6/22/2015 - 6:22:30 PM ---A- . (.Microsoft Corporation - Internet Connection Wizard Autodialer.) -- C:\WINDOWS\system32\icwdial.dll   [73728]
O44 - LFC:[MD5.474EABDCA846408BB854EE6542888D29] - 6/22/2015 - 6:22:30 PM ---A- . (.Microsoft Corporation - Internet Connection Wizard Library.) -- C:\WINDOWS\system32\inetcfg.dll   [274432]
O44 - LFC:[MD5.922ED2C991F4D05107467C854D38BB71] - 6/22/2015 - 6:22:30 PM ---A- . (.Microsoft Corporation - Internet Connection Wizard.) -- C:\WINDOWS\system32\icwphbk.dll   [65536]
O44 - LFC:[MD5.E135606BD22651CB8A8136B4141A56B5] - 6/22/2015 - 6:22:30 PM ---A- . (.Microsoft Corporation - Internet Signup.) -- C:\WINDOWS\system32\isign32.dll   [81920]
O44 - LFC:[MD5.0A9A7365A1CA4319AA7C1D6CD8E4EAFA] - 6/22/2015 - 6:22:31 PM ---A- . (.Microsoft Corporation - Task Scheduler Engine.) -- C:\WINDOWS\system32\schedsvc.dll   [192512]
O44 - LFC:[MD5.D5788A5243D1DD160E0F97AA4808B2BE] - 6/22/2015 - 6:22:31 PM ---A- . (.Microsoft Corporation - Task Scheduler Setup.) -- C:\WINDOWS\system32\mstinit.exe   [12288]
O44 - LFC:[MD5.4044E880593FE1AC9942190FCE414BE7] - 6/22/2015 - 6:22:31 PM ---A- . (.Microsoft Corporation - Task Scheduler interface DLL.) -- C:\WINDOWS\system32\mstask.dll   [274944]
O44 - LFC:[MD5.A6F6923B46802785B9A47A03AE3CD8BF] - 6/22/2015 - 6:22:34 PM ---A- . (.Microsoft Corporation - Microsoft Internet Messaging API Resources.) -- C:\WINDOWS\system32\inetres.dll   [48128]
O44 - LFC:[MD5.3B438284E0F22B154E9ECC27FE0EC3AE] - 6/22/2015 - 6:22:34 PM ---A- . (.Microsoft Corporation - Microsoft Internet Messaging API.) -- C:\WINDOWS\system32\inetcomm.dll   [692736]
O44 - LFC:[MD5.871888B4AA0CA343E73C81E94AD4ED93] - 6/22/2015 - 6:22:35 PM ---A- . (.Microsoft Corporation - Microsoft Internet Account Manager.) -- C:\WINDOWS\system32\msoeacct.dll   [252928]
O44 - LFC:[MD5.0485AB01B862FB91C21D39BD60BDF2AC] - 6/22/2015 - 6:22:35 PM ---A- . (.Microsoft Corporation - Microsoft Outlook Express RT Lib.) -- C:\WINDOWS\system32\msoert2.dll   [105984]
O44 - LFC:[MD5.0C56AFBBDFA19694CA03F159A5724EA6] - 6/22/2015 - 6:22:39 PM ---A- . (.Intel Corporation - ISR Debug 32-bit Engine.) -- C:\WINDOWS\system32\isrdbg32.dll   [32768]
O44 - LFC:[MD5.621822F2F2BDE521D3FC687B62659B76] - 6/22/2015 - 6:22:39 PM ---A- . (.Microsoft Corporation - Application Sharing Display Driver.) -- C:\WINDOWS\system32\mnmdd.dll   [34560]
O44 - LFC:[MD5.BBF115327F043F0BD46C58393261E6DD] - 6/22/2015 - 6:22:39 PM ---A- . (.Microsoft Corporation - Conferencing Utility Dll.) -- C:\WINDOWS\system32\msconf.dll   [69632]
O44 - LFC:[MD5.C6FD300A6100AC89BC4CB944C19FA2A9] - 6/22/2015 - 6:22:39 PM ---A- . (.Microsoft Corporation - Microsoft H.261 ICM Driver.) -- C:\WINDOWS\system32\msh261.drv   [188416]
O44 - LFC:[MD5.14E333392A7C41AF18F21849AEE1741E] - 6/22/2015 - 6:22:39 PM ---A- . (.Microsoft Corporation - NMMKCERT Library.) -- C:\WINDOWS\system32\nmmkcert.dll   [28672]
O44 - LFC:[MD5.D18F1F0C101D06A1C1ADF26EED16FCDD] - 6/22/2015 - 6:22:39 PM ---A- . (.Microsoft Corporation - NetMeeting Remote Desktop Sharing.) -- C:\WINDOWS\system32\mnmsrvc.exe   [32768]
O44 - LFC:[MD5.A1E481512C1602C36D3384FEB7DDEC12] - 6/22/2015 - 6:22:39 PM ---A- . (.Microsoft Corporation - User Location Services Component Module.) -- C:\WINDOWS\system32\ils.dll   [81920]
O44 - LFC:[MD5.77A54BDFBAD4604E6131AE68E3CF76D6] - 6/22/2015 - 6:22:40 PM ---A- . (.Microsoft Corporation - SR CLIENT DLL.) -- C:\WINDOWS\system32\srclient.dll   [67584]
O44 - LFC:[MD5.76BB022C2FB6902FD5BDD4F78FC13A5D] - 6/22/2015 - 6:22:40 PM ---A- . (.Microsoft Corporation - System Restore Filesystem Filter Driver.) -- C:\WINDOWS\system32\Drivers\sr.sys   [73472]
O44 - LFC:[MD5.92E2A2574186BCBB7027A6048E1B8B1B] - 6/22/2015 - 6:22:40 PM ---A- . (.Microsoft Corporation - System Restore Restore Operation Library.) -- C:\WINDOWS\system32\srrstr.dll   [239104]
O44 - LFC:[MD5.3805DF0AC4296A34BA4BF93B346CC378] - 6/22/2015 - 6:22:40 PM ---A- . (.Microsoft Corporation - System Restore Service.) -- C:\WINDOWS\system32\srsvc.dll   [171008]
O44 - LFC:[MD5.5D43C9A33F18C707BA169AFDA88BDF30] - 6/22/2015 - 6:22:41 PM ---A- . (.Microsoft Corporation - Filter Library.) -- C:\WINDOWS\system32\fltlib.dll   [16896]
O44 - LFC:[MD5.1DE61BAEDE3FD349B7AE86F428C25482] - 6/22/2015 - 6:22:41 PM ---A- . (.Microsoft Corporation - Filter Manager Control Program.) -- C:\WINDOWS\system32\fltMc.exe   [23040]
O44 - LFC:[MD5.B2CF4B0786F8212CB92ED2B50C6DB6B0] - 6/22/2015 - 6:22:41 PM ---A- . (.Microsoft Corporation - Microsoft Filesystem Filter Manager.) -- C:\WINDOWS\system32\Drivers\fltMgr.sys   [129792]
O44 - LFC:[MD5.482A0A0E3AE3F6A2564F8BE32767DCDB] - 6/22/2015 - 6:22:46 PM ---A- . (.Microsoft Corporation - Microsoft Help Center Desktop Manager.) -- C:\WINDOWS\system32\safrdm.dll   [29696]
O44 - LFC:[MD5.62A9B35C335A85311DC1280568CE9D89] - 6/22/2015 - 6:22:46 PM ---A- . (.Microsoft Corporation - Microsoft Help Center Session Resolver.) -- C:\WINDOWS\system32\safrslv.dll   [45568]
O44 - LFC:[MD5.CC8E648AE54B18037F7D0A91D196FE91] - 6/22/2015 - 6:22:46 PM ---A- . (.Microsoft Corporation - Microsoft PCHealth Remote Assistance File O.) -- C:\WINDOWS\system32\safrcdlg.dll   [43520]
O44 - LFC:[MD5.59AD4CEDBFCD1EEFCAC19E25BA15E2F3] - 6/22/2015 - 6:22:46 PM ---A- . (.Microsoft Corporation - Microsoft Remote Assistance.) -- C:\WINDOWS\system32\racpldlg.dll   [43520]
O44 - LFC:[MD5.574738F61FCA2935F5265DC4E5691314] - 6/22/2015 - 6:23:10 PM ---A- . (.Microsoft Corporation - Background Intelligent Transfer Service.) -- C:\WINDOWS\system32\qmgr.dll   [409088]
O44 - LFC:[MD5.EDEB10BFC84EA8A541D85DA650360FCD] - 6/22/2015 - 6:23:11 PM ---A- . (.Microsoft Corporation - Automatic Updates Control Panel.) -- C:\WINDOWS\system32\wuaucpl.cpl   [217592]
O44 - LFC:[MD5.08763C1AE79D88D122207D0471E834DB] - 6/22/2015 - 6:23:11 PM ---A- . (.Microsoft Corporation - Background Intelligent Transfer Service 2.0.) -- C:\WINDOWS\system32\bitsprx3.dll   [7168]
O44 - LFC:[MD5.97AE3A4180CAB360F44F7F03E5E0F409] - 6/22/2015 - 6:23:11 PM ---A- . (.Microsoft Corporation - Background Intelligent Transfer Service 2.5.) -- C:\WINDOWS\system32\bitsprx4.dll   [7168]
O44 - LFC:[MD5.9B2E14F4D66A59306584566A705F8CDD] - 6/22/2015 - 6:23:11 PM ---A- . (.Microsoft Corporation - Background Intelligent Transfer Service Pro.) -- C:\WINDOWS\system32\bitsprx2.dll   [8192]
O44 - LFC:[MD5.F1DAC7969C1337AF790BD1D981AA780C] - 6/22/2015 - 6:23:11 PM ---A- . (.Microsoft Corporation - Background Intelligent Transfer Service Pro.) -- C:\WINDOWS\system32\qmgrprxy.dll   [18944]
O44 - LFC:[MD5.09201D6BAEF7984633270D347B5C215E] - 6/22/2015 - 6:23:11 PM ---A- . (.Microsoft Corporation - Windows Update AutoUpdate Client.) -- C:\WINDOWS\system32\wuauclt1.exe   [172504]
O44 - LFC:[MD5.90F7DB00AA2BACC3C83FD3D620016A62] - 6/22/2015 - 6:23:11 PM ---A- . (.Microsoft Corporation - Windows Update Client API.) -- C:\WINDOWS\system32\wuapi.dll   [575480]
O44 - LFC:[MD5.C75A5DF207B2254AE069C6409E997910] - 6/22/2015 - 6:23:11 PM ---A- . (.Microsoft Corporation - Windows Update client proxy stub.) -- C:\WINDOWS\system32\wups.dll   [35320]
O44 - LFC:[MD5.E3EC2E7355C9EA123C59B498BBC3DBB9] - 6/22/2015 - 6:23:11 PM ---A- . (.Microsoft Corporation - Windows Update.) -- C:\WINDOWS\system32\wuauclt.exe   [53240]
O44 - LFC:[MD5.5F9C8619DC432D96AF967EE10970B3AE] - 6/22/2015 - 6:23:12 PM ---A- . (.Microsoft Corporation - Windows Update Agent.) -- C:\WINDOWS\system32\wuaueng.dll   [1931256]
O44 - LFC:[MD5.F0EA9AE7565345467B3E45AC1A4B5A1E] - 6/22/2015 - 6:23:12 PM ---A- . (.Microsoft Corporation - Windows Update AutoUpdate Engine.) -- C:\WINDOWS\system32\wuaueng1.dll   [194520]
O44 - LFC:[MD5.DCB24800BF4616DC2DF5D38ED3EF4C27] - 6/22/2015 - 6:23:12 PM ---A- . (.Microsoft Corporation - Windows Update AutoUpdate Service.) -- C:\WINDOWS\system32\wuauserv.dll   [22520]
O44 - LFC:[MD5.5B1BC51B6F37F8F97B68A57DBDB7BABD] - 6/22/2015 - 6:23:12 PM ---A- . (.Microsoft Corporation - Windows Update Client UI Plugin.) -- C:\WINDOWS\system32\wucltui.dll   [327672]
O44 - LFC:[MD5.196486C07C75E6E5D0B53007E53E6D35] - 6/22/2015 - 6:23:12 PM ---A- . (.Microsoft Corporation - Windows Update Web Control.) -- C:\WINDOWS\system32\wuweb.dll   [209400]
O44 - LFC:[MD5.BE085C746EA903B38204053FF709C634] - 6/22/2015 - 6:23:25 PM ---A- . (.Microsoft Corporation - Internet Connection Wizard.) -- C:\WINDOWS\system32\icfgnt5.dll   [16384]
O44 - LFC:[MD5.441086F355F0DEA94621984C9A3BE765] - 6/22/2015 - 6:23:29 PM ---A- . (.Microsoft Corporation - Microsoft Internet Account Manager Resource.) -- C:\WINDOWS\system32\acctres.dll   [64512]
O44 - LFC:[MD5.B87F759738C52E8D6FBCDAAA84C6486F] - 6/22/2015 - 6:23:30 PM ---A- . (.Microsoft Corporation - Microsoft G.723.1 CODEC for MSACM.) -- C:\WINDOWS\system32\msg723.acm   [118784]
O44 - LFC:[MD5.3C891D38FF07120FD926F51A37568646] - 6/22/2015 - 6:23:30 PM ---A- . (.Microsoft Corporation - NetMeeting Event Logging DLL.) -- C:\WINDOWS\system32\nmevtmsg.dll   [12288]
O44 - LFC:[MD5.81051BCC2CF1BEDF378224B0A93E2877] - 6/22/2015 - 6:23:38 PM ---A- . (...) -- C:\WINDOWS\desktop.ini   [2]
O44 - LFC:[MD5.81051BCC2CF1BEDF378224B0A93E2877] - 6/22/2015 - 6:23:38 PM ---A- . (...) -- C:\WINDOWS\system32\desktop.ini   [2]
O44 - LFC:[MD5.2F3CDC1D898FD25B2547F5BFEB01FD0D] - 6/22/2015 - 6:23:38 PM -SH-- . (...) -- C:\WINDOWS\winnt.bmp   [48680]
O44 - LFC:[MD5.2F3CDC1D898FD25B2547F5BFEB01FD0D] - 6/22/2015 - 6:23:38 PM -SH-- . (...) -- C:\WINDOWS\winnt256.bmp   [48680]
O44 - LFC:[MD5.1204FA2AB2A5F321125F777E8D061B22] - 6/22/2015 - 6:23:41 PM ---A- . (.Microsoft Corporation - Async Trace DLL.) -- C:\WINDOWS\system32\atrace.dll   [11264]
O44 - LFC:[MD5.5A5CFF37F1BD0F86B9BDAAD7A9445882] - 6/22/2015 - 6:24:19 PM R-HA- . (...) -- C:\WINDOWS\WindowsShell.Manifest   [749]
O44 - LFC:[MD5.5A5CFF37F1BD0F86B9BDAAD7A9445882] - 6/22/2015 - 6:24:19 PM R-HA- . (...) -- C:\WINDOWS\system32\cdplayer.exe.manifest   [749]
O44 - LFC:[MD5.5A5CFF37F1BD0F86B9BDAAD7A9445882] - 6/22/2015 - 6:24:19 PM R-HA- . (...) -- C:\WINDOWS\system32\ncpa.cpl.manifest   [749]
O44 - LFC:[MD5.5A5CFF37F1BD0F86B9BDAAD7A9445882] - 6/22/2015 - 6:24:19 PM R-HA- . (...) -- C:\WINDOWS\system32\nwc.cpl.manifest   [749]
O44 - LFC:[MD5.5A5CFF37F1BD0F86B9BDAAD7A9445882] - 6/22/2015 - 6:24:19 PM R-HA- . (...) -- C:\WINDOWS\system32\sapi.cpl.manifest   [749]
O44 - LFC:[MD5.5A5CFF37F1BD0F86B9BDAAD7A9445882] - 6/22/2015 - 6:24:19 PM R-HA- . (...) -- C:\WINDOWS\system32\wuaucpl.cpl.manifest   [749]
O44 - LFC:[MD5.5D76C3FB736514E1D7C88791E7322784] - 6/22/2015 - 6:24:22 PM R-HA- . (...) -- C:\WINDOWS\system32\WindowsLogon.manifest   [488]
O44 - LFC:[MD5.5D76C3FB736514E1D7C88791E7322784] - 6/22/2015 - 6:24:22 PM R-HA- . (...) -- C:\WINDOWS\system32\logonui.exe.manifest   [488]
O44 - LFC:[MD5.E81BBE78A8EF85ACD490B3E64EF63A7C] - 6/22/2015 - 6:25:09 PM ---A- . (.Microsoft Corporation - Extended MAPI 1.0 for Windows NT.) -- C:\WINDOWS\system32\mapi32.dll   [112128]
O44 - LFC:[MD5.53D7F47255085310F50604FDE3076F97] - 6/22/2015 - 6:25:10 PM ---A- . (...) -- C:\WINDOWS\ODBCINST.INI   [4161]
O44 - LFC:[MD5.6D6F4B1886E91EB37ABCCAD19C561EE0] - 6/22/2015 - 6:25:18 PM ---A- . (...) -- C:\WINDOWS\system32\amcompat.tlb   [16832]
O44 - LFC:[MD5.A32B14BE5EDAE794FCE1A9E970827509] - 6/22/2015 - 6:25:18 PM ---A- . (...) -- C:\WINDOWS\system32\nscompat.tlb   [23392]
O44 - LFC:[MD5.DC17DD0189B0C36D863B4DD0A036C10F] - 6/22/2015 - 6:25:19 PM ---A- . (...) -- C:\WINDOWS\WMSysPr9.prx   [316640]
O44 - LFC:[MD5.D41D8CD98F00B204E9800998ECF8427E] - 6/22/2015 - 6:25:23 PM ---A- . (...) -- C:\AUTOEXEC.BAT   [0]
O44 - LFC:[MD5.D41D8CD98F00B204E9800998ECF8427E] - 6/22/2015 - 6:25:23 PM ---A- . (...) -- C:\CONFIG.SYS   [0]
O44 - LFC:[MD5.D41D8CD98F00B204E9800998ECF8427E] - 6/22/2015 - 6:25:23 PM ---A- . (...) -- C:\WINDOWS\control.ini   [0]
O44 - LFC:[MD5.D41D8CD98F00B204E9800998ECF8427E] - 6/22/2015 - 6:25:23 PM RSHA- . (...) -- C:\IO.SYS   [0]
O44 - LFC:[MD5.D41D8CD98F00B204E9800998ECF8427E] - 6/22/2015 - 6:25:23 PM RSHA- . (...) -- C:\MSDOS.SYS   [0]
O44 - LFC:[MD5.089806807CBF8497AD4DCD28160FCF97] - 6/22/2015 - 6:27:45 PM ---A- . (...) -- C:\WINDOWS\system32\$winnt$.inf   [745]
O44 - LFC:[MD5.25F5C4E9157B84103AB26982EED805C9] - 6/22/2015 - 6:28:48 PM ---A- . (...) -- C:\WINDOWS\REGLOCS.OLD   [8192]
O44 - LFC:[MD5.EAB287E3724CED398BEB059018012C5E] - 6/22/2015 - 6:33:47 PM ---A- . (...) -- C:\WINDOWS\GSetup.ini   [10]
O44 - LFC:[MD5.46E77AB5E91094D6C1EE518CA4626972] - 6/22/2015 - 6:33:47 PM R--A- . (.No owner - GSetup MFC Application.) -- C:\WINDOWS\GSetup.exe   [207400]
O44 - LFC:[MD5.89B23B4BE691942072E0E3F7EDEB33B6] - 6/22/2015 - 6:36:40 PM ----- . (.Microsoft Corporation - Native Code Xps Services Library.) -- C:\WINDOWS\system32\xpssvcs.dll   [1676288]
O44 - LFC:[MD5.81C4B0077427391D582FBB1B6B9578CB] - 6/22/2015 - 6:36:40 PM ----- . (.Microsoft Corporation - Package Document Shell Extension Handler.) -- C:\WINDOWS\system32\xpsshhdr.dll   [575488]
O44 - LFC:[MD5.180E1D44727EB72CB11EC5953C5E4C52] - 6/22/2015 - 6:36:40 PM ----- . (.Microsoft Corporation - Print Ticket Services Module.) -- C:\WINDOWS\system32\prntvpt.dll   [117760]
O44 - LFC:[MD5.5329079D8726DE34A58C2EF0BD2AC8B9] - 6/22/2015 - 6:36:43 PM ---A- . (.Microsoft Corporation - Update RunOnce Service.) -- C:\WINDOWS\system32\spupdsvc.exe   [26488]
O44 - LFC:[MD5.96C9A439DCDA7643DCB20D88F6DB66F3] - 6/22/2015 - 6:36:45 PM ----- . (.Microsoft Corporation - Service Pack Messages.) -- C:\WINDOWS\system32\spmsg.dll   [17272]
O44 - LFC:[MD5.055849B604CE156BF13ACAF68C246224] - 6/22/2015 - 6:39:36 PM R--A- . (.Windows XP Bundled build C-Centric Single U - CSVer.) -- C:\WINDOWS\system32\CSVer.dll   [53248]
O44 - LFC:[MD5.0BF254F2A678F70237012A084B783CB7] - 6/22/2015 - 6:40:27 PM R---- . (.Realtek Semiconductor Corp. - RtlExUpd DLL for setup utility function.) -- C:\WINDOWS\RtlExUpd.dll   [1284712]
O44 - LFC:[MD5.1AD94F3D0A3ADD031919D119AE7543D2] - 6/22/2015 - 6:40:42 PM ---A- . (.Realtek Semiconductor Corp. - Realtek HD Audio Control Panel.) -- C:\WINDOWS\system32\ALSNDMGR.CPL   [285288]
O44 - LFC:[MD5.267FC636801EDC5AB28E14036349E3BE] - 6/22/2015 - 6:40:43 PM ---A- . (.Creative - Creative WDM 3D Audio Driver.) -- C:\WINDOWS\system32\Drivers\Ambfilt.sys   [1691480]
O44 - LFC:[MD5.39C913873B3AB8593116BD4A7B9BB82B] - 6/22/2015 - 6:40:53 PM ---A- . (.RealTek Semicoductor Corp. - RealTek AlcWzrd Application.) -- C:\WINDOWS\ALCWZRD.EXE   [2815592]
O44 - LFC:[MD5.EEB2E393B7EB8EBC1E9E56ED005806EC] - 6/22/2015 - 6:40:57 PM ---A- . (.Realtek Semiconductor Corp. - Realtek Azalia Audio - Event Monitor.) -- C:\WINDOWS\ALCMTR.EXE   [64104]
O44 - LFC:[MD5.3616DDC4353F49360DD2EFED8FE4A6C4] - 6/22/2015 - 6:41:20 PM ---A- . (.Realtek Semiconductor Corp. - Realtek Audio Microphone Calibration.) -- C:\WINDOWS\MicCal.exe   [2180712]
O44 - LFC:[MD5.C7D9F9717916B34C1B00DD4834AF485C] - 6/22/2015 - 6:41:22 PM ---A- . (.Creative Technology Ltd. - Creative WDM Audio Driver (32-bit).) -- C:\WINDOWS\system32\Drivers\Monfilt.sys   [1395800]
O44 - LFC:[MD5.4CB7C0105E9BF50EF2C2F220FBEDBF49] - 6/22/2015 - 6:41:27 PM ---A- . (.Realtek Semiconductor Corp. - Realtek HD Audio Control Panel.) -- C:\WINDOWS\RTHDCPL.EXE   [20053608]
O44 - LFC:[MD5.992B653A9B3405BA903CEE7B3D4709B0] - 6/22/2015 - 6:42:25 PM ---A- . (.Realtek Semiconductor Corp. - Realtek Audio Control Panel.) -- C:\WINDOWS\RTLCPL.EXE   [9721960]
O44 - LFC:[MD5.329A432A62EEE6307D32DF1BAC4E1B93] - 6/22/2015 - 6:42:44 PM ---A- . (.Realtek Semiconductor Corp. - Realtek HD Audio Control Panel.) -- C:\WINDOWS\system32\RTSndMgr.CPL   [891496]
O44 - LFC:[MD5.129BBDFFE4D3AE373DFA1779E6ED8989] - 6/22/2015 - 6:42:46 PM ---A- . (.Realtek Semiconductor - Realtek Audio Service.) -- C:\WINDOWS\RtkAudioService.exe   [129640]
O44 - LFC:[MD5.6781BB98748C5D4F66B3CD2D5D04DDD3] - 6/22/2015 - 6:42:47 PM ---A- . (.Realtek Semiconductor Corp. - Realtek HD Audio Coinstaller.) -- C:\WINDOWS\system32\RtkCoInstXP.dll   [59496]
O44 - LFC:[MD5.8F45830F12A210FC581AE2BBC7E03925] - 6/22/2015 - 6:42:48 PM ---A- . (.Realtek Semiconductor Corp. - Realtek(r) High Definition Audio Function D.) -- C:\WINDOWS\system32\Drivers\RtkHDAud.sys   [6353000]
O44 - LFC:[MD5.0DCFBDBA37A962EFF1F4990D80036AAA] - 6/22/2015 - 6:42:58 PM ---A- . (.Realtek Semiconductor Corp. - Driver Update and remove for Windows x64 or.) -- C:\WINDOWS\RtlUpd.exe   [1489512]
O44 - LFC:[MD5.048EFA87303BC48BB38DFAFEA9DF87F8] - 6/22/2015 - 6:43:03 PM ---A- . (.Realtek Semiconductor Corp. - Realtek Voice  Manager.) -- C:\WINDOWS\SkyTel.exe   [1833576]
O44 - LFC:[MD5.798C0C1FF4E0FCE646CA82AE0379CCB0] - 6/22/2015 - 6:43:05 PM ---A- . (.Realtek Semiconductor Corp. - Realtek Sound Manager.) -- C:\WINDOWS\SOUNDMAN.EXE   [84584]
O44 - LFC:[MD5.D94DA294C79A1F6CB4D9BC5DABF6C2A4] - 6/22/2015 - 6:43:05 PM ---A- . (.Realtek Semiconductor Crop. - Noise Canceling Program.) -- C:\WINDOWS\vncutil.exe   [359016]
O44 - LFC:[MD5.93DF26C93F4D7504771B839D8A502843] - 6/22/2015 - 6:43:14 PM R--A- . (...) -- C:\WINDOWS\system32\igcompkrng500.bin   [439336]
O44 - LFC:[MD5.B7CE3863C74EB5DA2F2158432616C9C1] - 6/22/2015 - 6:43:14 PM R--A- . (...) -- C:\WINDOWS\system32\igkrng500.bin   [982224]
O44 - LFC:[MD5.F8697BCCCEA973DCAEEDE7FD2A3A17C7] - 6/22/2015 - 6:43:14 PM R--A- . (...) -- C:\WINDOWS\system32\igxpxa32.cpa   [1674683]
O44 - LFC:[MD5.9A4D45EE7D8D9BA81366C2A243A7E27B] - 6/22/2015 - 6:43:14 PM R--A- . (...) -- C:\WINDOWS\system32\igxpxa32.vp   [1023]
O44 - LFC:[MD5.983A1A854E4F19D934390DAD2E256D30] - 6/22/2015 - 6:43:14 PM R--A- . (...) -- C:\WINDOWS\system32\igxpxk32.vp   [58558]
O44 - LFC:[MD5.E8CC824020E67414CEC938513272F894] - 6/22/2015 - 6:43:14 PM R--A- . (...) -- C:\WINDOWS\system32\igxpxs32.vp   [33280]
O44 - LFC:[MD5.B059A48DF3E3FD8EE51E06C83B2687C0] - 6/22/2015 - 6:43:14 PM R--A- . (.Intel Corporation - Component GHAL Driver.) -- C:\WINDOWS\system32\igxpdv32.dll   [3226048]
O44 - LFC:[MD5.F1D94B8A7DCB226ACDD7640CA2CF5F5D] - 6/22/2015 - 6:43:14 PM R--A- . (.Intel Corporation - DirectDraw(R) Driver for Intel(R) Graphics.) -- C:\WINDOWS\system32\igxpdx32.dll   [3767808]
O44 - LFC:[MD5.023DAAAFFC9870AADD6382539AA38F76] - 6/22/2015 - 6:43:14 PM R--A- . (.Intel Corporation - GfxUI.) -- C:\WINDOWS\system32\GfxUI.exe   [3118104]
O44 - LFC:[MD5.479B74464BC0C4003A392661D6C3E241] - 6/22/2015 - 6:43:14 PM R--A- . (.Intel Corporation - Intel Graphics 2D Driver.) -- C:\WINDOWS\system32\igxpgd32.dll   [183808]
O44 - LFC:[MD5.A7B7B61825879F272B30E89E390234A3] - 6/22/2015 - 6:43:14 PM R--A- . (.Intel Corporation - Intel Graphics 2D Rotation Driver.) -- C:\WINDOWS\system32\igxprd32.dll   [57344]
O44 - LFC:[MD5.0A50599E2AFECC2142329BDD7A137463] - 6/22/2015 - 6:43:14 PM R--A- . (.Intel Corporation - Intel Graphics Miniport Driver.) -- C:\WINDOWS\system32\Drivers\igxpmp32.sys   [1917344]
O44 - LFC:[MD5.518B651EFC4568B8154655921F2F62F4] - 6/22/2015 - 6:43:14 PM R--A- . (.Intel Corporation - No Comment.) -- C:\WINDOWS\system32\gfxSrvc.dll   [120832]
O44 - LFC:[MD5.439FB74DDA66C421A147FD437809AEE8] - 6/22/2015 - 6:43:14 PM R--A- . (.Intel Corporation - hccutils Module.) -- C:\WINDOWS\system32\hccutils.dll   [94720]
O44 - LFC:[MD5.BD06FDEAC870D09856B965A88655D747] - 6/22/2015 - 6:43:14 PM R--A- . (.Intel Corporation - hkcmd Module.) -- C:\WINDOWS\system32\hkcmd.exe   [174104]
O44 - LFC:[MD5.EB7376A9F65736B659AAAF21F964BA89] - 6/22/2015 - 6:43:14 PM R--A- . (.Intel Corporation - igfxTray Module.) -- C:\WINDOWS\system32\igfxtray.exe   [141848]
O44 - LFC:[MD5.6F50B638B73C6158A715B6F1DE4BA6F7] - 6/22/2015 - 6:43:14 PM R--A- . (.Intel Corporation - igfxcpl Module.) -- C:\WINDOWS\system32\igfxcpl.cpl   [119808]
O44 - LFC:[MD5.7C78761F437973750C72DF26779A507E] - 6/22/2015 - 6:43:14 PM R--A- . (.Intel Corporation - igfxdev Module.) -- C:\WINDOWS\system32\igfxdev.dll   [213504]
O44 - LFC:[MD5.C885B80105E68A2CFD89019B584F016F] - 6/22/2015 - 6:43:14 PM R--A- . (.Intel Corporation - igfxdo Module.) -- C:\WINDOWS\system32\igfxdo.dll   [130048]
O44 - LFC:[MD5.B84855D91BF8E82B6A853B1495C96C3D] - 6/22/2015 - 6:43:14 PM R--A- . (.Intel Corporation - igfxpph Module.) -- C:\WINDOWS\system32\igfxpph.dll   [199680]
O44 - LFC:[MD5.60BBCF7E2423079AE449A8EC5872E7E1] - 6/22/2015 - 6:43:14 PM R--A- . (.Intel Corporation - igfxress Module.) -- C:\WINDOWS\system32\igfxress.dll   [9030656]
O44 - LFC:[MD5.528F422D2E141F21B456E2C19265164E] - 6/22/2015 - 6:43:14 PM R--A- . (.Intel Corporation - igfxsrvc Module.) -- C:\WINDOWS\system32\igfxsrvc.dll   [56832]
O44 - LFC:[MD5.02FA2499A54B83581F72073853352B38] - 6/22/2015 - 6:43:14 PM R--A- . (.Intel Corporation - igfxsrvc Module.) -- C:\WINDOWS\system32\igfxsrvc.exe   [265752]
O44 - LFC:[MD5.756E7DACD8B6EDD26B8C62C2907CD845] - 6/22/2015 - 6:43:14 PM R--A- . (.Intel Corporation - persistence Module.) -- C:\WINDOWS\system32\igfxpers.exe   [144920]
O44 - LFC:[MD5.FFB49EE58EF3E271AA25F847D3299047] - 6/22/2015 - 6:43:15 PM R--A- . (...) -- C:\WINDOWS\system32\GfxUI.exe.config   [151]
O44 - LFC:[MD5.DF458591A7CDF9BE72D85F726ACD8A1F] - 6/22/2015 - 6:43:15 PM R--A- . (...) -- C:\WINDOWS\system32\Gfxres.ar-SA.resources   [138355]
O44 - LFC:[MD5.15DB3F171F60556312611A11C65A0E3A] - 6/22/2015 - 6:43:15 PM R--A- . (...) -- C:\WINDOWS\system32\Gfxres.cs-CZ.resources   [117179]
O44 - LFC:[MD5.3C5333479F789D7674D0AEAB479710A6] - 6/22/2015 - 6:43:15 PM R--A- . (...) -- C:\WINDOWS\system32\Gfxres.da-DK.resources   [112667]
O44 - LFC:[MD5.31C514B2A60538FF1D10174161600C5E] - 6/22/2015 - 6:43:15 PM R--A- . (...) -- C:\WINDOWS\system32\Gfxres.de-DE.resources   [121140]
O44 - LFC:[MD5.800D832071ED8BAB83BD3CC9721941F9] - 6/22/2015 - 6:43:15 PM R--A- . (...) -- C:\WINDOWS\system32\Gfxres.el-GR.resources   [176824]
O44 - LFC:[MD5.50961D38C00943C26F318ECE90987D88] - 6/22/2015 - 6:43:15 PM R--A- . (...) -- C:\WINDOWS\system32\Gfxres.en-US.resources   [108636]
O44 - LFC:[MD5.83868404E44265F2665F678E2DBA5BC0] - 6/22/2015 - 6:43:15 PM R--A- . (...) -- C:\WINDOWS\system32\Gfxres.es-ES.resources   [121375]
O44 - LFC:[MD5.6D890CFE858C70E339F5C16F3B1F3076] - 6/22/2015 - 6:43:15 PM R--A- . (...) -- C:\WINDOWS\system32\Gfxres.fi-FI.resources   [117094]
O44 - LFC:[MD5.15A04D3D23964D9A4BF930C16B9F65F5] - 6/22/2015 - 6:43:15 PM R--A- . (...) -- C:\WINDOWS\system32\Gfxres.fr-FR.resources   [119204]
O44 - LFC:[MD5.AE5AF8F3A173AD32D845CD3029011E63] - 6/22/2015 - 6:43:15 PM R--A- . (...) -- C:\WINDOWS\system32\IGFXDEVLib.dll   [4096]
O44 - LFC:[MD5.294E373168B19BDCEED7B21B98C8F565] - 6/22/2015 - 6:43:15 PM R--A- . (.Intel Corporation - igfxres Module.) -- C:\WINDOWS\system32\igfxrara.lrc   [282624]
O44 - LFC:[MD5.D68B5D863D69C7E7EC4C90CD96F8C59C] - 6/22/2015 - 6:43:15 PM R--A- . (.Intel Corporation - igfxres Module.) -- C:\WINDOWS\system32\igfxrchs.lrc   [279552]
O44 - LFC:[MD5.4E9B5EC2E08EE5FC62A32095CD1687BE] - 6/22/2015 - 6:43:15 PM R--A- . (.Intel Corporation - igfxres Module.) -- C:\WINDOWS\system32\igfxrcht.lrc   [279552]
O44 - LFC:[MD5.07695A736881F8218FD219981714E13E] - 6/22/2015 - 6:43:15 PM R--A- . (.Intel Corporation - igfxres Module.) -- C:\WINDOWS\system32\igfxrcsy.lrc   [283648]
O44 - LFC:[MD5.A40BC6A4DE9AF5B71A9DC4BD83EAF016] - 6/22/2015 - 6:43:15 PM R--A- . (.Intel Corporation - igfxres Module.) -- C:\WINDOWS\system32\igfxrdan.lrc   [283136]
O44 - LFC:[MD5.37A17AF1FBD3A1C9FA39DF2EFE6AC8C9] - 6/22/2015 - 6:43:15 PM R--A- . (.Intel Corporation - igfxres Module.) -- C:\WINDOWS\system32\igfxrdeu.lrc   [284160]
O44 - LFC:[MD5.EBE738E124DC9742B4539A3CE8EC0C86] - 6/22/2015 - 6:43:15 PM R--A- . (.Intel Corporation - igfxres Module.) -- C:\WINDOWS\system32\igfxrell.lrc   [284672]
O44 - LFC:[MD5.1168C9855A401994843CA23F3F15845B] - 6/22/2015 - 6:43:15 PM R--A- . (.Intel Corporation - igfxres Module.) -- C:\WINDOWS\system32\igfxrenu.lrc   [283136]
O44 - LFC:[MD5.3C24B0E10D76FBD3B9CEF4A1C5D08D9D] - 6/22/2015 - 6:43:15 PM R--A- . (.Intel Corporation - igfxres Module.) -- C:\WINDOWS\system32\igfxresn.lrc   [284672]
O44 - LFC:[MD5.D78D10D20BE4E1BABFDC13C7751A0A52] - 6/22/2015 - 6:43:15 PM R--A- . (.Intel Corporation - igfxres Module.) -- C:\WINDOWS\system32\igfxrfin.lrc   [283648]
O44 - LFC:[MD5.40DFCA390328D606C11411AE479565AD] - 6/22/2015 - 6:43:15 PM R--A- . (.Intel Corporation - igfxres Module.) -- C:\WINDOWS\system32\igfxrfra.lrc   [284672]
O44 - LFC:[MD5.5FAEA0F4B53325AC648BE06BE3FEB5BE] - 6/22/2015 - 6:43:15 PM R--A- . (.Intel Corporation - igfxres Module.) -- C:\WINDOWS\system32\igfxrheb.lrc   [282624]
O44 - LFC:[MD5.BA39C06210809E2D8F4D3A2BAAB06C35] - 6/22/2015 - 6:43:15 PM R--A- . (.Intel Corporation - igfxres Module.) -- C:\WINDOWS\system32\igfxrhun.lrc   [283648]
O44 - LFC:[MD5.A1190BFFFBDFA081D364B61672039182] - 6/22/2015 - 6:43:15 PM R--A- . (.Intel Corporation - igfxres Module.) -- C:\WINDOWS\system32\igfxrita.lrc   [284160]
O44 - LFC:[MD5.F331DED3B6DC0A14A10308AF6308CBD7] - 6/22/2015 - 6:43:15 PM R--A- . (.Intel Corporation - igfxres Module.) -- C:\WINDOWS\system32\igfxrjpn.lrc   [280576]
O44 - LFC:[MD5.D40346048CFBF1362CCABE4736E12E27] - 6/22/2015 - 6:43:15 PM R--A- . (.Intel Corporation - igfxres Module.) -- C:\WINDOWS\system32\igfxrkor.lrc   [280576]
O44 - LFC:[MD5.F5BA94BC9973EEE96C077114BFC7BD7F] - 6/22/2015 - 6:43:15 PM R--A- . (.Intel Corporation - igfxres Module.) -- C:\WINDOWS\system32\igfxrnld.lrc   [283648]
O44 - LFC:[MD5.15C12A7CFBEB7553D461ADEF87817FDC] - 6/22/2015 - 6:43:15 PM R--A- . (.Intel Corporation - igfxres Module.) -- C:\WINDOWS\system32\igfxrnor.lrc   [283648]
O44 - LFC:[MD5.2AF503A3EFB9324E7799CB1CC80C23B7] - 6/22/2015 - 6:43:15 PM R--A- . (.Intel Corporation - igfxres Module.) -- C:\WINDOWS\system32\igfxrplk.lrc   [284160]
O44 - LFC:[MD5.1D96E4A000C4D69AF8CE5EF136B466FA] - 6/22/2015 - 6:43:15 PM R--A- . (.Intel Corporation - igfxres Module.) -- C:\WINDOWS\system32\igfxrptb.lrc   [283648]
O44 - LFC:[MD5.7E0088D69276898E4F5DA2201CC323B0] - 6/22/2015 - 6:43:15 PM R--A- . (.Intel Corporation - igfxres Module.) -- C:\WINDOWS\system32\igfxrptg.lrc   [284160]
O44 - LFC:[MD5.90A72F522CAA4DD1C1CE8FF46E5AB14F] - 6/22/2015 - 6:43:15 PM R--A- . (.Intel Corporation - igfxres Module.) -- C:\WINDOWS\system32\igfxrrus.lrc   [284160]
O44 - LFC:[MD5.EC00C1A14250882BCAA4E784259D0490] - 6/22/2015 - 6:43:15 PM R--A- . (.Intel Corporation - igfxres Module.) -- C:\WINDOWS\system32\igfxrsky.lrc   [284160]
O44 - LFC:[MD5.9C1B47790F110F4BA316BFD868556776] - 6/22/2015 - 6:43:15 PM R--A- . (.Intel Corporation - igfxres Module.) -- C:\WINDOWS\system32\igfxrslv.lrc   [283648]
O44 - LFC:[MD5.7B7177D490211A64CBE748DF1C149D58] - 6/22/2015 - 6:43:15 PM R--A- . (.Intel Corporation - igfxres Module.) -- C:\WINDOWS\system32\igfxrsve.lrc   [283648]
O44 - LFC:[MD5.D450CF7D20DB4749D2A8C1F7B04DA075] - 6/22/2015 - 6:43:15 PM R--A- . (.Intel Corporation - igfxres Module.) -- C:\WINDOWS\system32\igfxrtha.lrc   [283136]
O44 - LFC:[MD5.8385B3CDB5796B01801804B5B3547BF4] - 6/22/2015 - 6:43:15 PM R--A- . (.Intel Corporation - igfxres Module.) -- C:\WINDOWS\system32\igfxrtrk.lrc   [283648]
O44 - LFC:[MD5.6CB08593487F5701D2D2254E693EAFCE] - 6/22/2015 - 6:43:16 PM ---A- . (.Microsoft Corporation - Microsoft Kernel DRM Descrambler Filter.) -- C:\WINDOWS\system32\Drivers\drmk.sys   [60160]
O44 - LFC:[MD5.AED18317AC7A6415739EAB370B0182D7] - 6/22/2015 - 6:43:16 PM R--A- . (...) -- C:\WINDOWS\system32\Gfxres.he-IL.resources   [132174]
O44 - LFC:[MD5.D7F71FD90C19811EB6CE6F20BAC02714] - 6/22/2015 - 6:43:16 PM R--A- . (...) -- C:\WINDOWS\system32\Gfxres.hu-HU.resources   [117981]
O44 - LFC:[MD5.D021EBF8B89CB40E3DBC78FE317FA187] - 6/22/2015 - 6:43:16 PM R--A- . (...) -- C:\WINDOWS\system32\Gfxres.it-IT.resources   [123983]
O44 - LFC:[MD5.3EEC2B24C6DBB703C2CD1291B23DA56E] - 6/22/2015 - 6:43:16 PM R--A- . (...) -- C:\WINDOWS\system32\Gfxres.ja-JP.resources   [134852]
O44 - LFC:[MD5.8B25E299A8A6C7A53863BF9A8616FD8A] - 6/22/2015 - 6:43:16 PM R--A- . (...) -- C:\WINDOWS\system32\Gfxres.ko-KR.resources   [121696]
O44 - LFC:[MD5.7745AC55F01A5540B5242E964A353BCE] - 6/22/2015 - 6:43:16 PM R--A- . (...) -- C:\WINDOWS\system32\Gfxres.nb-NO.resources   [113272]
O44 - LFC:[MD5.80F8E5E0DC5F1B8AA63721CB9327B1F5] - 6/22/2015 - 6:43:16 PM R--A- . (...) -- C:\WINDOWS\system32\Gfxres.nl-NL.resources   [118003]
O44 - LFC:[MD5.02BFBA030CCDB1807B7A4571835E8D0F] - 6/22/2015 - 6:43:16 PM R--A- . (...) -- C:\WINDOWS\system32\Gfxres.pl-PL.resources   [116862]
O44 - LFC:[MD5.A4BF9256FEE75B06C8645A5C39BF7625] - 6/22/2015 - 6:43:16 PM R--A- . (...) -- C:\WINDOWS\system32\Gfxres.pt-BR.resources   [118800]
O44 - LFC:[MD5.9EF9456992C6F0F7894898A12EE201EC] - 6/22/2015 - 6:43:16 PM R--A- . (...) -- C:\WINDOWS\system32\Gfxres.pt-PT.resources   [117466]
O44 - LFC:[MD5.995024357CCCE89D5A59ED87281B0A18] - 6/22/2015 - 6:43:16 PM R--A- . (...) -- C:\WINDOWS\system32\Gfxres.ru-RU.resources   [163864]
O44 - LFC:[MD5.684D2D04901E9B2268E176778DAF22BC] - 6/22/2015 - 6:43:16 PM R--A- . (...) -- C:\WINDOWS\system32\Gfxres.sk-SK.resources   [116472]
O44 - LFC:[MD5.11D0F87BA3FBE2C10D919152DB559FDB] - 6/22/2015 - 6:43:16 PM R--A- . (...) -- C:\WINDOWS\system32\Gfxres.sl-SI.resources   [112763]
O44 - LFC:[MD5.D0CB8CD5C7A630A586EB8FB6320E546C] - 6/22/2015 - 6:43:16 PM R--A- . (...) -- C:\WINDOWS\system32\Gfxres.sv-SE.resources   [117770]
O44 - LFC:[MD5.E9E02E3AEA6CDA7BA2FC09A0A41047B3] - 6/22/2015 - 6:43:16 PM R--A- . (...) -- C:\WINDOWS\system32\Gfxres.th-TH.resources   [188114]
O44 - LFC:[MD5.78B88D1E9546846B0D9D4151910B86B3] - 6/22/2015 - 6:43:16 PM R--A- . (...) -- C:\WINDOWS\system32\Gfxres.tr-TR.resources   [119560]
O44 - LFC:[MD5.C64F56E3474775545541B961024179F8] - 6/22/2015 - 6:43:16 PM R--A- . (...) -- C:\WINDOWS\system32\Gfxres.zh-CN.resources   [101329]
O44 - LFC:[MD5.B2918F4685A44D3CE5FE656274CC5E67] - 6/22/2015 - 6:43:16 PM R--A- . (...) -- C:\WINDOWS\system32\Gfxres.zh-TW.resources   [102448]
O44 - LFC:[MD5.6B2EEF2346E68B1FCB7F98F777BCB838] - 6/22/2015 - 6:43:16 PM R--A- . (.Intel Corporation - OpenGL(R) Device Driver for Intel(R) Graphi.) -- C:\WINDOWS\system32\ig4dev32.dll   [4018688]
O44 - LFC:[MD5.A72BE0086CCF38FE35B76107AC0B58EE] - 6/22/2015 - 6:43:16 PM R--A- . (.Intel Corporation - OpenGL(R) Driver for Intel(R) Graphics Acce.) -- C:\WINDOWS\system32\ig4icd32.dll   [6057984]
O44 - LFC:[MD5.6730A1E1FFB59F1CBD86405E4A114450] - 6/22/2015 - 6:43:16 PM R--A- . (.Intel Corporation - igfxext Module.) -- C:\WINDOWS\system32\igfxexps.dll   [23552]
O44 - LFC:[MD5.AD0C05D6C0FEBC888D017B58E961D5E2] - 6/22/2015 - 6:43:16 PM R--A- . (.Intel Corporation - igfxext Module.) -- C:\WINDOWS\system32\igfxext.exe   [177688]
O44 - LFC:[MD5.AEF54BF915BF5C2ED1B856EF94E89721] - 6/22/2015 - 6:43:17 PM ---A- . (.Microsoft Corporation - Port Class (Class Driver for Port/Miniport.) -- C:\WINDOWS\system32\Drivers\portcls.sys   [146048]
O44 - LFC:[MD5.9B9F1C38D559047B8AC0DBA2D5FEBDE9] - 6/22/2015 - 6:43:17 PM ---A- . (.Microsoft Corporation - User CSA Library.) -- C:\WINDOWS\system32\ksuser.dll   [4096]
O44 - LFC:[MD5.F1941197A42F9F373CC70042FC82C950] - 6/22/2015 - 6:43:17 PM ---A- . (.Microsoft Corporation - WDM Streaming ActiveMovie Proxy.) -- C:\WINDOWS\system32\ksproxy.ax   [129536]
O44 - LFC:[MD5.BDFC5E1B8D8DC6A14A27BE92D71DC62C] - 6/22/2015 - 6:43:17 PM R--A- . (.Intel Corporation - Intel(R) Graphics Media Accelerator Driver.) -- C:\WINDOWS\system32\igfxCoIn_v5259.dll   [81920]
O44 - LFC:[MD5.1BD976DD77B31FE0F25708AD5C1351AE] - 6/22/2015 - 6:43:25 PM R--A- . (.Microsoft Corporation - Driver Install Frameworks for API library m.) -- C:\WINDOWS\system32\difxapi.dll   [319456]
O44 - LFC:[MD5.8935BAB897EE5370F0536E94EC3626E5] - 6/22/2015 - 6:44:03 PM ---A- . (...) -- C:\RHDSetup.log   [2057]
O44 - LFC:[MD5.95EF7247C50C7241FDAE39A9B3AFF4AE] - 6/22/2015 - 6:44:48 PM ---A- . (...) -- C:\WINDOWS\system32\AppleChargerSrv.exe   [31272]
O44 - LFC:[MD5.E592751036C1D0A74EC3E57302A03745] - 6/22/2015 - 6:44:48 PM ---A- . (...) -- C:\WINDOWS\system32\Drivers\AppleCharger.sys   [18544]
O44 - LFC:[MD5.325BB26842FC7CCC1FCCE2C457317F3E] - 6/22/2015 - 6:45:53 PM ---A- . (.Microsoft Corporation - MS Proxy Clock.) -- C:\WINDOWS\system32\Drivers\MSPCLOCK.sys   [5376]
O44 - LFC:[MD5.BAD59648BA099DA4A17680B39730CB3D] - 6/22/2015 - 6:45:54 PM ---A- . (.Microsoft Corporation - MS Proxy Quality Manager.) -- C:\WINDOWS\system32\Drivers\MSPQM.sys   [4992]
O44 - LFC:[MD5.D1575E71568F4D9E14CA56B7B0453BF1] - 6/22/2015 - 6:45:55 PM ---A- . (.Microsoft Corporation - MS KS Server.) -- C:\WINDOWS\system32\Drivers\MSKSSRV.sys   [7552]
O44 - LFC:[MD5.0A2E5A1963708AEE3BEE39D17726D736] - 6/22/2015 - 6:45:55 PM R--A- . (.Atheros Communications, Inc. - Atheros AR813x/AR815x PCI-E Ethernet Contro.) -- C:\WINDOWS\system32\Drivers\l1c51x86.sys   [65136]
O44 - LFC:[MD5.8B83F3ED0F1688B4958F77CD6D2BF290] - 6/22/2015 - 6:45:57 PM ---A- . (.Microsoft Corporation - System Audio WDM Filter.) -- C:\WINDOWS\system32\Drivers\sysaudio.sys   [60800]
O44 - LFC:[MD5.8F5FCFF8E8848AFAC920905FBD9D33C8] - 6/22/2015 - 6:45:59 PM ---A- . (.Microsoft Corporation - Microsoft Kernel DRM Audio Descrambler Filt.) -- C:\WINDOWS\system32\Drivers\drmkaud.sys   [2944]
O44 - LFC:[MD5.692BCF44383D056AED41B045A323D378] - 6/22/2015 - 6:46:01 PM ---A- . (.Microsoft Corporation - Kernel Mode Audio Mixer.) -- C:\WINDOWS\system32\Drivers\kmixer.sys   [172416]
O44 - LFC:[MD5.8BED39E3C35D6A489438B8141717A557] - 6/22/2015 - 6:46:02 PM ---A- . (.Microsoft Corporation - Microsoft Acoustic Echo Canceller.) -- C:\WINDOWS\system32\Drivers\aec.sys   [142592]
O44 - LFC:[MD5.8CE882BCC6CF8A62F2B2323D95CB3D01] - 6/22/2015 - 6:46:03 PM ---A- . (.Microsoft Corporation - Microsoft GS Wavetable Synthesizer.) -- C:\WINDOWS\system32\Drivers\swmidi.sys   [56576]
O44 - LFC:[MD5.8A208DFCF89792A484E76C40E5F50B45] - 6/22/2015 - 6:46:04 PM ---A- . (.Microsoft Corporation - Microsoft Kernel DLS Synthesizer.) -- C:\WINDOWS\system32\Drivers\DMusic.sys   [52864]
O44 - LFC:[MD5.6768ACF64B18196494413695F0C3A00F] - 6/22/2015 - 6:46:05 PM ---A- . (.Microsoft Corporation - MMSYSTEM Wave/Midi API mapper.) -- C:\WINDOWS\system32\Drivers\wdmaud.sys   [83072]
O44 - LFC:[MD5.AB8B92451ECB048A4D1DE7C3FFCB4A9F] - 6/22/2015 - 6:46:06 PM ---A- . (.Microsoft Corporation - Microsoft Kernel Audio Splitter.) -- C:\WINDOWS\system32\Drivers\splitter.sys   [6272]
O44 - LFC:[MD5.2F79811BD7D21C15C8B2718557BA1BD3] - 6/22/2015 - 6:46:10 PM ---A- . (...) -- C:\csb.log   [180]
O44 - LFC:[MD5.F6E6D42B4F480B3CEE7937CD21C61A64] - 6/22/2015 - 6:51:00 PM ---A- . (.Adobe Systems Incorporated - Adobe Flash Player Control Panel Applet.) -- C:\WINDOWS\system32\FlashPlayerCPLApp.cpl   [403616]
O44 - LFC:[MD5.C3E76B0C05EBF7261ABFB08D9E75822E] - 6/22/2015 - 6:52:06 PM ----- . (.Sonic Solutions - CDR4 CD and DVD Place Holder Driver (see Px.) -- C:\WINDOWS\system32\Drivers\cdr4_xp.sys   [9072]
O44 - LFC:[MD5.17590DFE29E02842A6E3A463E443D1B9] - 6/22/2015 - 6:52:06 PM ----- . (.Sonic Solutions - CDRAL Place Holder Driver (see PxHelp).) -- C:\WINDOWS\system32\Drivers\cdralw2k.sys   [9200]
O44 - LFC:[MD5.08D51E037F487F9CA9FD0B0388F4C15A] - 6/22/2015 - 6:52:06 PM ----- . (.Sonic Solutions - PX Install Application.) -- C:\WINDOWS\system32\pxcpya64.exe   [68080]
O44 - LFC:[MD5.50A76D2D5E4BE94556326C4BF748C758] - 6/22/2015 - 6:52:06 PM ----- . (.Sonic Solutions - PX Install Application.) -- C:\WINDOWS\system32\pxcpyi64.exe   [123888]
O44 - LFC:[MD5.D2728A10CCD2A675638B016D47B1C254] - 6/22/2015 - 6:52:06 PM ----- . (.Sonic Solutions - PX Install Application.) -- C:\WINDOWS\system32\pxhpinst.exe   [72176]
O44 - LFC:[MD5.6D3630B7F27B3643FDE05D1088F84F2F] - 6/22/2015 - 6:52:06 PM ----- . (.Sonic Solutions - PX Install Application.) -- C:\WINDOWS\system32\pxinsa64.exe   [68592]
O44 - LFC:[MD5.94F95BE2A44C8291132D314582F141F8] - 6/22/2015 - 6:52:06 PM ----- . (.Sonic Solutions - PX Install Application.) -- C:\WINDOWS\system32\pxinsi64.exe   [126448]
O44 - LFC:[MD5.8F6F3AA814143099B431744B16845664] - 6/22/2015 - 6:52:06 PM ----- . (.Sonic Solutions - Px Unit Table.) -- C:\WINDOWS\system32\pxdrv.dll   [571888]
O44 - LFC:[MD5.DBB66B386C194A58E29E49D7EBBEBE65] - 6/22/2015 - 6:52:06 PM ----- . (.Sonic Solutions - Px.) -- C:\WINDOWS\system32\px.dll   [698864]
O44 - LFC:[MD5.E66569100ADA3821D49BE51109FA111C] - 6/22/2015 - 6:52:06 PM ----- . (.Sonic Solutions - PxAFS Dynamic Link Library.) -- C:\WINDOWS\system32\pxafs.dll   [133616]
O44 - LFC:[MD5.746833260D2123EBB46FF44AFCB8103C] - 6/22/2015 - 6:52:06 PM ----- . (.Sonic Solutions - PxMas.) -- C:\WINDOWS\system32\pxmas.dll   [219632]
O44 - LFC:[MD5.E5AE8BD7D28EB4BF87F9C56DAA6D3E3A] - 6/22/2015 - 6:52:06 PM ----- . (.Sonic Solutions - PxSfs.) -- C:\WINDOWS\system32\pxsfs.dll   [2095600]
O44 - LFC:[MD5.CBAA54AE75A0B8430E6BB65C72C7683D] - 6/22/2015 - 6:52:06 PM ----- . (.Sonic Solutions - PxWMA.dll.) -- C:\WINDOWS\system32\pxwma.dll   [59888]
O44 - LFC:[MD5.24FA4BCCC5AC82F5471ABD0E3C9CB878] - 6/22/2015 - 6:52:06 PM ----- . (.Sonic Solutions - PxWave.) -- C:\WINDOWS\system32\pxwave.dll   [440816]
O44 - LFC:[MD5.BA8559B1DE9E06E1EBC5B41138839FFF] - 6/22/2015 - 6:52:06 PM ----- . (.Sonic Solutions - VxBlock.) -- C:\WINDOWS\system32\vxblock.dll   [100848]
O44 - LFC:[MD5.E42E3433DBB4CFFE8FDD91EAB29AEA8E] - 6/22/2015 - 6:52:07 PM ----- . (.Sonic Solutions - Px Engine Device Driver for Windows 2000/XP.) -- C:\WINDOWS\system32\Drivers\PxHelp20.sys   [45648]
O44 - LFC:[MD5.415A5E79C601465D992466E70F54A07C] - 6/22/2015 - 6:53:21 PM ---A- . (...) -- C:\WINDOWS\system32\d3d9caps.dat   [664]
O44 - LFC:[MD5.6D0634CEBBFF7F428DD816706F5AA1FB] - 6/22/2015 - 6:55:50 PM ---A- . (...) -- C:\WINDOWS\system32\BuzzingBee.wav   [146650]
O44 - LFC:[MD5.E2FA75ADE398C9A44815B11CC141105C] - 6/22/2015 - 6:55:50 PM ---A- . (...) -- C:\WINDOWS\system32\LoopyMusic.wav   [940794]
O44 - LFC:[MD5.7B948E3657BEA62E437BC46CA6EF6012] - 6/22/2015 - 7:02:39 PM ---A- . (.ALWIL Software - avast! Filtering NDIS driver.) -- C:\WINDOWS\system32\Drivers\aswNdis.sys   [12112]
O44 - LFC:[MD5.E9C8673674ECF840EE59ED805DBE9966] - 6/22/2015 - 7:02:40 PM ---A- . (.AVAST Software - avast! Screen Saver stub.) -- C:\WINDOWS\avastSS.scr   [41664]
O44 - LFC:[MD5.CFE4114B963AB0AB22F6EBEF89564194] - 6/22/2015 - 7:03:06 PM ---A- . (.AVAST Software - avast! start-up scanner.) -- C:\WINDOWS\system32\aswBoot.exe   [229648]
O44 - LFC:[MD5.01C47C2ECED034EF6F8C1552A97CFF00] - 6/22/2015 - 7:03:07 PM ---A- . (...) -- C:\WINDOWS\system32\CONFIG.NT   [2577]
O44 - LFC:[MD5.B680134BA1813B78B47FDD1DFF223CA5] - 6/22/2015 - 7:03:07 PM ---A- . (...) -- C:\WINDOWS\system32\Drivers\aswRvrt.sys   [49376]
O44 - LFC:[MD5.16B8E3CD50A460EC32CA680C8210A0A9] - 6/22/2015 - 7:03:07 PM ---A- . (...) -- C:\WINDOWS\system32\Drivers\aswVmm.sys   [174664]
O44 - LFC:[MD5.1F7094D4268D46F718C51286DC189791] - 6/22/2015 - 7:03:07 PM ---A- . (.AVAST Software - avast! File System Minifilter for Windows 2.) -- C:\WINDOWS\system32\Drivers\aswMonFlt.sys   [66336]
O44 - LFC:[MD5.3FCA5C1A8F33CF9857220CC3A3076A3E] - 6/22/2015 - 7:03:08 PM ---A- . (.AVAST Software - avast! Keyboard Filter Driver.) -- C:\WINDOWS\system32\Drivers\aswKbd.sys   [21576]
O44 - LFC:[MD5.1F71F170D90E42EFDE9633D81D5E12DC] - 6/22/2015 - 7:03:08 PM ---A- . (.AVAST Software - avast! TDI Filter Driver.) -- C:\WINDOWS\system32\Drivers\aswTdi.sys   [56080]
O44 - LFC:[MD5.6CAB0A5991C5C0FC63F5E66593E71D7E] - 6/22/2015 - 7:03:08 PM ---A- . (.AVAST Software - avast! Virtualization Driver.) -- C:\WINDOWS\system32\Drivers\aswSnx.sys   [765736]
O44 - LFC:[MD5.EA235FC109D9B9FA7A602BA30888B2B9] - 6/22/2015 - 7:03:09 PM ---A- . (.AVAST Software - avast! Filtering TDI driver.) -- C:\WINDOWS\system32\Drivers\aswFW.sys   [104752]
O44 - LFC:[MD5.7B43265F92257A21CBFD88E7A651044C] - 6/22/2015 - 7:03:09 PM ---A- . (.AVAST Software - avast! TDI Redirect Driver.) -- C:\WINDOWS\system32\Drivers\aswRdr.sys   [49760]
O44 - LFC:[MD5.47DA17FD9C2F8B1B62A06DFB7AFDC8CA] - 6/22/2015 - 7:03:10 PM ---A- . (.AVAST Software - avast! Filtering NDIS driver.) -- C:\WINDOWS\system32\Drivers\aswNdis2.sys   [204784]
O44 - LFC:[MD5.DED4C49C39D6CEFC00FDA0C4D7D59407] - 6/22/2015 - 7:04:50 PM ---A- . (...) -- C:\WINDOWS\system32\ff_vfw.dll.manifest   [714]
O44 - LFC:[MD5.34FF78B64E8DD8386F35F6F2A830DED3] - 6/22/2015 - 7:04:50 PM ---A- . (.No owner - ffdshow VFW.) -- C:\WINDOWS\system32\ff_vfw.dll   [79360]
O44 - LFC:[MD5.C26B7B8CA40C627B9DE399F9F8FACC69] - 6/22/2015 - 7:04:51 PM ---A- . (...) -- C:\WINDOWS\system32\xvidcore.dll   [650752]
O44 - LFC:[MD5.56552C7C36B6237704CE3BA9DF49FECF] - 6/22/2015 - 7:04:51 PM ---A- . (...) -- C:\WINDOWS\system32\xvidvfw.dll   [243200]
O44 - LFC:[MD5.006C6378513685ACDFFA84A5ECB86F76] - 6/22/2015 - 7:04:51 PM ---A- . (.fccHandler - AC-3 ACM Codec.) -- C:\WINDOWS\system32\ac3acm.acm   [151552]
O44 - LFC:[MD5.5B7F4F0976BE76D8F0A8BFA8714BD1C8] - 6/22/2015 - 7:04:52 PM ---A- . (...) -- C:\WINDOWS\system32\lame_acm.xml   [414]
O44 - LFC:[MD5.22722B4E887BB95AB071542DE5A42C80] - 6/22/2015 - 7:04:52 PM ---A- . (.http://www.mp3dev.org/ - Lame MP3 codec engine.) -- C:\WINDOWS\system32\lameACM.acm   [839680]
O44 - LFC:[MD5.1AD3D52C38B68D658D5B808A00CDB880] - 6/22/2015 - 7:04:57 PM ---A- . (...) -- C:\WINDOWS\system32\unrar.dll   [175616]
O44 - LFC:[MD5.AE4F3B20D47EAAFE6D5FA41F80D707C6] - 6/23/2015 - 12:23:44 AM ---A- . (...) -- C:\WINDOWS\system32\FNTCACHE.DAT   [286112]
O44 - LFC:[MD5.6DC37325950311976002F9F9B20FFBFB] - 6/23/2015 - 12:25:15 AM ---A- . (...) -- C:\WINDOWS\setupapi.log   [46977]
O44 - LFC:[MD5.0F7A9E47F8F6625EEC0685E9208B8401] - 6/23/2015 - 12:57:54 AM ---A- . (...) -- C:\WINDOWS\SchedLgU.Txt   [11532]
O44 - LFC:[MD5.6A2CB42966136854F4464516FBB4AE72] - 6/23/2015 - 3:51:16 AM -S-A- . (...) -- C:\WINDOWS\bootstat.dat   [2048]
O44 - LFC:[MD5.6458632D47BE18536698FFC807244414] - 6/23/2015 - 3:55:56 AM ---A- . (...) -- C:\WINDOWS\system32\PerfStringBackup.INI   [508956]
O44 - LFC:[MD5.D06B19DBF5477A6923492DB6DCF0466B] - 6/23/2015 - 3:55:56 AM ---A- . (...) -- C:\WINDOWS\system32\perfc009.dat   [67516]
O44 - LFC:[MD5.F4DEFA72E126C641F3E66E9103B245C3] - 6/23/2015 - 3:55:56 AM ---A- . (...) -- C:\WINDOWS\system32\perfh009.dat   [432686]
O44 - LFC:[MD5.FF1200178BADF456FA6A818D6065052E] - 6/23/2015 - 4:12:58 AM ---A- . (...) -- C:\WINDOWS\WindowsUpdate.log   [28332]
~ Files: 496 Scanned in 21mn AMs



---\\ Latest files created in Windows Prefetcher (O45)
O45 - LFCP:[MD5.8C128E331EEB88520F5AC108D1A800EC] - 6/22/2015 - 6:39:18 PM ---A- - C:\WINDOWS\Prefetch\STCHELPER.EXE-00C2703C.pf  =>Toolbar.Splashtop
~ Prefetcher: 1 Scanned in 00mn AMs



---\\ Export authorized application key (O47)
O47 - AAKE:Key Export SP - "%windir%\Network Diagnostic\xpnetdiag.exe" [Enabled] .(.Microsoft Corporation.) -- C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O47 - AAKE:Key Export SP - "%windir%\system32\sessmgr.exe" [Enabled] .(.Microsoft Corporation.) -- C:\WINDOWS\system32\sessmgr.exe
O47 - AAKE:Key Export SP - "C:\Program Files\Hi\HiPlayer\1.14.0.138\HiP2PService.exe" [Enabled] .(...) -- C:\Program Files\Hi\HiPlayer\1.14.0.138\HiP2PService.exe
O47 - AAKE:Key Export SP - "C:\Program Files\Hi\HiPlayer\1.14.0.138\StatReport.exe" [Enabled] .(..) -- C:\Program Files\Hi\HiPlayer\1.14.0.138\StatReport.exe
O47 - AAKE:Key Export SP - "C:\Program Files\Hi\HiPlayer\1.14.0.138\HiPlayer.exe" [Enabled] .(.HiPlayer Inc..) -- C:\Program Files\Hi\HiPlayer\1.14.0.138\HiPlayer.exe
O47 - AAKE:Key Export SP - "C:\Program Files\Winamp\winamp.exe" [Enabled] .(.Nullsoft, Inc..) -- C:\Program Files\Winamp\winamp.exe
O47 - AAKE:Key Export SP - "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" [Enabled] .(.Yahoo! Inc..) -- C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
O47 - AAKE:Key Export SP - "C:\Documents and Settings\All Users\Application Data\Hi\HiPlayer\bdupdate.exe" [Enabled] .(...) -- C:\Documents and Settings\All Users\Application Data\Hi\HiPlayer\bdupdate.exe
O47 - AAKE:Key Export SP - "C:\Program Files\Google\Chrome\Application\chrome.exe" [Enabled] .(.Google Inc..) -- C:\Program Files\Google\Chrome\Application\chrome.exe
O47 - AAKE:Key Export DP - "%windir%\Network Diagnostic\xpnetdiag.exe" [Enabled] .(.Microsoft Corporation.) -- C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O47 - AAKE:Key Export DP - "%windir%\system32\sessmgr.exe" [Enabled] .(.Microsoft Corporation.) -- C:\WINDOWS\system32\sessmgr.exe
O47 - AAKE:Key Export DP - "C:\Program Files\Winamp\winamp.exe" [Enabled] .(.Nullsoft, Inc..) -- C:\Program Files\Winamp\winamp.exe
~ Keys Export: 12 Scanned in 00mn AMs



---\\ Local Security Authority-LSA Deny (O48)
O48 - LSA:Local Security Authority Authentication Packages . (.Microsoft Corporation - Microsoft Authentication Package v1.0.) -- C:\WINDOWS\system32\msv1_0.dll
O48 - LSA:Local Security Authority Notification Packages . (.Microsoft Corporation - Windows Security Configuration Editor Client Engine.) -- C:\WINDOWS\system32\scecli.dll
O48 - LSA:Local Security Authority Security Packages . (.Microsoft Corporation - Kerberos Security Package.) -- C:\WINDOWS\system32\kerberos.dll
O48 - LSA:Local Security Authority Security Packages . (.Microsoft Corporation - Microsoft Authentication Package v1.0.) -- C:\WINDOWS\system32\msv1_0.dll
O48 - LSA:Local Security Authority Security Packages . (.Microsoft Corporation - TLS / SSL Security Provider.) -- C:\WINDOWS\system32\schannel.dll
O48 - LSA:Local Security Authority Security Packages . (.Microsoft Corporation - Microsoft Digest Access.) -- C:\WINDOWS\system32\wdigest.dll
O48 - LSA:Local Security Authority Security Packages . (.Microsoft Corporation - Web Service Security Package.) -- C:\WINDOWS\system32\tspkg.dll
~ LSA: 7 Scanned in 00mn AMs



---\\ Safe Boot Control (O49)
O49 - CSB:Control Safe Boot HKLM\...\CCS\Minimal\dmboot.sys . (.Microsoft Corp., Veritas Software - NT Disk Manager Startup Driver.) -- C:\WINDOWS\system32\Drivers\dmboot.sys
O49 - CSB:Control Safe Boot HKLM\...\CCS\Minimal\dmio.sys . (.Microsoft Corp., Veritas Software - NT Disk Manager I/O Driver.) -- C:\WINDOWS\system32\Drivers\dmio.sys
O49 - CSB:Control Safe Boot HKLM\...\CCS\Minimal\dmload.sys . (.Microsoft Corp., Veritas Software. - NT Disk Manager Startup Driver.) -- C:\WINDOWS\system32\Drivers\dmload.sys
O49 - CSB:Control Safe Boot HKLM\...\CCS\Minimal\sermouse.sys . (...) -- C:\WINDOWS\system32\Drivers\sermouse.sys (.not file.)
O49 - CSB:Control Safe Boot HKLM\...\CCS\Minimal\sr.sys . (.Microsoft Corporation - System Restore Filesystem Filter Driver.) -- C:\WINDOWS\system32\Drivers\sr.sys
O49 - CSB:Control Safe Boot HKLM\...\CCS\Minimal\vga.sys . (.Microsoft Corporation - VGA/Super VGA Video Driver.) -- C:\WINDOWS\system32\Drivers\vga.sys
O49 - CSB:Control Safe Boot HKLM\...\CCS\Minimal\vgasave.sys . (...) -- C:\WINDOWS\system32\Drivers\vgasave.sys (.not file.)
O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\dmboot.sys . (.Microsoft Corp., Veritas Software - NT Disk Manager Startup Driver.) -- C:\WINDOWS\system32\Drivers\dmboot.sys
O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\dmio.sys . (.Microsoft Corp., Veritas Software - NT Disk Manager I/O Driver.) -- C:\WINDOWS\system32\Drivers\dmio.sys
O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\dmload.sys . (.Microsoft Corp., Veritas Software. - NT Disk Manager Startup Driver.) -- C:\WINDOWS\system32\Drivers\dmload.sys
O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\ip6fw.sys . (.Microsoft Corporation - IPv6 Windows Firewall Driver.) -- C:\WINDOWS\system32\Drivers\ip6fw.sys
O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\ipnat.sys . (.Microsoft Corporation - IP Network Address Translator.) -- C:\WINDOWS\system32\Drivers\ipnat.sys
O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\rdpcdd.sys . (.Microsoft Corporation - RDP Miniport.) -- C:\WINDOWS\system32\Drivers\rdpcdd.sys
O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\rdpdd.sys . (...) -- C:\WINDOWS\system32\Drivers\rdpdd.sys (.not file.)
O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\rdpwd.sys . (.Microsoft Corporation - RDP Terminal Stack Driver (US/Canada Only, Not for Export).) -- C:\WINDOWS\system32\Drivers\rdpwd.sys
O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\sermouse.sys . (...) -- C:\WINDOWS\system32\Drivers\sermouse.sys (.not file.)
O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\sr.sys . (.Microsoft Corporation - System Restore Filesystem Filter Driver.) -- C:\WINDOWS\system32\Drivers\sr.sys
O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\tdpipe.sys . (.Microsoft Corporation - Named Pipe Transport Driver.) -- C:\WINDOWS\system32\Drivers\tdpipe.sys
O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\tdtcp.sys . (.Microsoft Corporation - TCP Transport Driver.) -- C:\WINDOWS\system32\Drivers\tdtcp.sys
O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\vga.sys . (.Microsoft Corporation - VGA/Super VGA Video Driver.) -- C:\WINDOWS\system32\Drivers\vga.sys
O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\vgasave.sys . (...) -- C:\WINDOWS\system32\Drivers\vgasave.sys (.not file.)
~ CSB: 21 Scanned in 00mn AMs



---\\ Trojan Driver Search Data (HKLM)(TDSD) (O52)
O52 - TDSD: \Drivers32\"msacm.trspch"="tssoft32.acm" . (.DSP GROUP, INC. - DSP Group TrueSpeech(TM) Audio Codec for MSACM V3.50.) -- C:\WINDOWS\system32\tssoft32.acm
O52 - TDSD: \Drivers32\"vidc.cvid"="iccvid.dll" . (.Radius Inc. - Cinepak® Codec.) -- C:\WINDOWS\system32\iccvid.dll
O52 - TDSD: \Drivers32\"vidc.iv31"="ir32_32.dll" . (...) -- C:\WINDOWS\system32\ir32_32.dll
O52 - TDSD: \Drivers32\"vidc.iv32"="ir32_32.dll" . (...) -- C:\WINDOWS\system32\ir32_32.dll
O52 - TDSD: \Drivers32\"vidc.iv41"="ir41_32.ax" . (.Intel Corporation - Intel Indeo® Video 4.5.) -- C:\WINDOWS\system32\ir41_32.ax
O52 - TDSD: \Drivers32\"msacm.sl_anet"="sl_anet.acm" . (.Sipro Lab Telecom Inc. - Audio codec for MS ACM.) -- C:\WINDOWS\system32\sl_anet.acm
O52 - TDSD: \Drivers32\"msacm.iac2"="C:\WINDOWS\system32\iac25_32.ax" . (.Intel Corporation - Indeo® audio software.) -- C:\WINDOWS\system32\iac25_32.ax
O52 - TDSD: \Drivers32\"vidc.iv50"="ir50_32.dll" . (.Intel Corporation - Intel Indeo® video 5.10.) -- C:\WINDOWS\system32\ir50_32.dll
O52 - TDSD: \Drivers32\"msacm.l3acm"="C:\WINDOWS\system32\l3codeca.acm" . (.Fraunhofer Institut Integrierte Schaltungen - MPEG Layer-3 Audio Codec for MSACM.) -- C:\WINDOWS\system32\l3codeca.acm
O52 - TDSD: \Drivers32\"VIDC.XVID"="xvidvfw.dll" . (...) -- C:\WINDOWS\system32\xvidvfw.dll
O52 - TDSD: \Drivers32\"VIDC.YV12"="xvidvfw.dll" . (...) -- C:\WINDOWS\system32\xvidvfw.dll
O52 - TDSD: \Drivers32\"msacm.ac3acm"="ac3acm.acm" . (.fccHandler - AC-3 ACM Codec.) -- C:\WINDOWS\system32\ac3acm.acm
O52 - TDSD: \Drivers32\"msacm.lameacm"="lameACM.acm" . (.http://www.mp3dev.org/ - Lame MP3 codec engine.) -- C:\WINDOWS\system32\lameACM.acm
O52 - TDSD: \Drivers32\"VIDC.FFDS"="ff_vfw.dll" . (.No owner - ffdshow VFW.) -- C:\WINDOWS\system32\ff_vfw.dll
O52 - TDSD: \drivers.desc\"sl_anet.acm"="Sipro Lab Telecom Audio Codec" . (.Sipro Lab Telecom Inc. - Audio codec for MS ACM.) -- C:\WINDOWS\system32\sl_anet.acm
O52 - TDSD: \drivers.desc\"C:\WINDOWS\system32\iac25_32.ax"="Indeo® audio software" . (.Intel Corporation - Indeo® audio software.) -- C:\WINDOWS\system32\iac25_32.ax
O52 - TDSD: \drivers.desc\"C:\WINDOWS\system32\l3codeca.acm"="Fraunhofer IIS MPEG Layer-3 Codec" . (.Fraunhofer Institut Integrierte Schaltungen - MPEG Layer-3 Audio Codec for MSACM.) -- C:\WINDOWS\system32\l3codeca.acm
O52 - TDSD: \drivers.desc\"ac3acm.acm"="AC-3 ACM Codec" . (.fccHandler - AC-3 ACM Codec.) -- C:\WINDOWS\system32\ac3acm.acm
O52 - TDSD: \drivers.desc\"ff_vfw.dll"="ffdshow video encoder" . (.No owner - ffdshow VFW.) -- C:\WINDOWS\system32\ff_vfw.dll
~ TDSD: 19 Scanned in 00mn AMs



---\\ Microsoft Control Security Providers (MCSP) (O54)
O54 - MCSP:[HKLM\...\CurrentControlSet\Control] - (SecurityProviders) - (.Microsoft Corporation - DPA Client for 32 bit platforms.) -- C:\WINDOWS\system32\msapsspc.dll
O54 - MCSP:[HKLM\...\CurrentControlSet\Control] - (SecurityProviders) - (.Microsoft Corporation - TLS / SSL Security Provider.) -- C:\WINDOWS\system32\schannel.dll
O54 - MCSP:[HKLM\...\CurrentControlSet\Control] - (SecurityProviders) - (.Microsoft Corporation - TS Single Sign On Security Package.) -- C:\WINDOWS\system32\credssp.dll
O54 - MCSP:[HKLM\...\CurrentControlSet\Control] - (SecurityProviders) - (.Microsoft Corporation - Digest SSPI Authentication Package.) -- C:\WINDOWS\system32\digest.dll
O54 - MCSP:[HKLM\...\ControlSet001\Control] - (SecurityProviders) - (.Microsoft Corporation - DPA Client for 32 bit platforms.) -- C:\WINDOWS\system32\msapsspc.dll
O54 - MCSP:[HKLM\...\ControlSet001\Control] - (SecurityProviders) - (.Microsoft Corporation - TLS / SSL Security Provider.) -- C:\WINDOWS\system32\schannel.dll
O54 - MCSP:[HKLM\...\ControlSet001\Control] - (SecurityProviders) - (.Microsoft Corporation - TS Single Sign On Security Package.) -- C:\WINDOWS\system32\credssp.dll
O54 - MCSP:[HKLM\...\ControlSet001\Control] - (SecurityProviders) - (.Microsoft Corporation - Digest SSPI Authentication Package.) -- C:\WINDOWS\system32\digest.dll
~ MSCP: 8 Scanned in 00mn AMs



---\\ Microsoft Windows Policies System (MWPS) (O55)
O55 - MWPS:[HKLM\...\Policies\System] - "dontdisplaylastusername"=0
O55 - MWPS:[HKLM\...\Policies\System] - "legalnoticecaption"=0
O55 - MWPS:[HKLM\...\Policies\System] - "legalnoticetext"=0
O55 - MWPS:[HKLM\...\Policies\System] - "shutdownwithoutlogon"=1
O55 - MWPS:[HKLM\...\Policies\System] - "undockwithoutlogon"=1
~ MWPS: 5 Scanned in 00mn AMs



---\\ Microsoft Windows Policies Explorer (MWPE) (O56)
O56 - MWPE:[HKCU\...\policies\Explorer] - "NoDriveTypeAutoRun"=221
O56 - MWPE:[HKCU\...\policies\Explorer] - "NoLowDiskSpaceChecks"=1
O56 - MWPE:[HKLM\...\policies\Explorer] - "HonorAutoRunSetting"=1
~ MWPE Keys: 3 Scanned in 00mn AMs



---\\ System Drivers List (SDL) (O58)
O58 - SDL:11/17/2009 - 3:16:00 PM ---A- . (.Creative - Creative WDM 3D Audio Driver.) -- C:\WINDOWS\system32\Drivers\Ambfilt.sys   [1691480]
O58 - SDL:1/10/2011 - 5:16:16 PM ---A- . (...) -- C:\WINDOWS\system32\Drivers\AppleCharger.sys   [18544]
O58 - SDL:5/9/2013 - 12:59:08 AM ---A- . (.AVAST Software - avast! Filtering TDI driver.) -- C:\WINDOWS\system32\Drivers\aswFW.sys   [104752]
O58 - SDL:5/9/2013 - 12:59:09 AM ---A- . (.AVAST Software - avast! Keyboard Filter Driver.) -- C:\WINDOWS\system32\Drivers\aswKbd.sys   [21576]
O58 - SDL:5/9/2013 - 12:59:09 AM ---A- . (.AVAST Software - avast! File System Minifilter for Windows 2003/Vista.) -- C:\WINDOWS\system32\Drivers\aswMonFlt.sys   [66336]
O58 - SDL:3/13/2013 - 10:01:58 AM ---A- . (.ALWIL Software - avast! Filtering NDIS driver.) -- C:\WINDOWS\system32\Drivers\aswNdis.sys   [12112]
O58 - SDL:5/9/2013 - 12:59:09 AM ---A- . (.AVAST Software - avast! Filtering NDIS driver.) -- C:\WINDOWS\system32\Drivers\aswNdis2.sys   [204784]
O58 - SDL:5/9/2013 - 12:59:09 AM ---A- . (.AVAST Software - avast! TDI Redirect Driver.) -- C:\WINDOWS\system32\Drivers\aswRdr.sys   [49760]
O58 - SDL:5/9/2013 - 12:59:10 AM ---A- . (...) -- C:\WINDOWS\system32\Drivers\aswRvrt.sys   [49376]  =>.ALWIL Software
O58 - SDL:5/9/2013 - 12:59:10 AM ---A- . (.AVAST Software - avast! Virtualization Driver.) -- C:\WINDOWS\system32\Drivers\aswSnx.sys   [765736]
O58 - SDL:5/9/2013 - 12:59:10 AM ---A- . (.AVAST Software - avast! TDI Filter Driver.) -- C:\WINDOWS\system32\Drivers\aswTdi.sys   [56080]
O58 - SDL:5/9/2013 - 12:59:10 AM ---A- . (...) -- C:\WINDOWS\system32\Drivers\aswVmm.sys   [174664]  =>.ALWIL Software
O58 - SDL:5/11/2009 - 10:49:28 AM ---A- . (.Avira GmbH - Avira AntiVir File Filter Driver.) -- C:\WINDOWS\system32\Drivers\avgntdd.sys   [45416]
O58 - SDL:2/16/2010 - 12:24:01 PM ---A- . (.Avira GmbH - Avira Minifilter Driver.) -- C:\WINDOWS\system32\Drivers\avgntflt.sys   [60936]
O58 - SDL:5/11/2009 - 10:49:28 AM ---A- . (.Avira GmbH - Avira AntiVir File Filter Driver Manager.) -- C:\WINDOWS\system32\Drivers\avgntmgr.sys   [22360]  =>PUP.DriverManager
O58 - SDL:3/1/2010 - 8:05:24 AM ---A- . (.Avira GmbH - Avira Driver for Security Enhancement.) -- C:\WINDOWS\system32\Drivers\avipbb.sys   [124784]
O58 - SDL:3/4/2011 - 11:44:12 AM ----- . (.Sonic Solutions - CDR4 CD and DVD Place Holder Driver (see PxHelp).) -- C:\WINDOWS\system32\Drivers\cdr4_xp.sys   [9072]
O58 - SDL:3/4/2011 - 11:44:12 AM ----- . (.Sonic Solutions - CDRAL Place Holder Driver (see PxHelp).) -- C:\WINDOWS\system32\Drivers\cdralw2k.sys   [9200]
O58 - SDL:5/9/2012 - 5:07:03 AM ---A- . (.RAVISENT Technologies Inc. - CineMaster C 1.2 WDM Main Driver.) -- C:\WINDOWS\system32\Drivers\cinemst2.sys   [262528]
O58 - SDL:5/9/2012 - 5:07:03 AM ---A- . (.Compaq Computer Corporation - Compaq PA-1 Player Driver.) -- C:\WINDOWS\system32\Drivers\cpqdap01.sys   [11776]
O58 - SDL:4/14/2008 - 4:00:00 AM ---A- . (.Microsoft Corp., Veritas Software - NT Disk Manager Startup Driver.) -- C:\WINDOWS\system32\Drivers\dmboot.sys   [799744]
O58 - SDL:4/14/2008 - 4:00:00 AM ---A- . (.Microsoft Corp., Veritas Software - NT Disk Manager I/O Driver.) -- C:\WINDOWS\system32\Drivers\dmio.sys   [153344]
O58 - SDL:4/14/2008 - 4:00:00 AM ---A- . (.Microsoft Corp., Veritas Software. - NT Disk Manager Startup Driver.) -- C:\WINDOWS\system32\Drivers\dmload.sys   [5888]
O58 - SDL:4/14/2008 - 4:00:00 AM ---A- . (.Windows (R) Server 2003 DDK provider - High Definition Audio Bus Driver v1.0a.) -- C:\WINDOWS\system32\Drivers\hdaudbus.sys   [144384]
O58 - SDL:11/28/2014 - 4:37:06 PM ---A- . (.Tonec Inc. - Internet Download Manager TDI Driver.) -- C:\WINDOWS\system32\Drivers\idmtdi.sys   [123360]
O58 - SDL:4/20/2010 - 4:42:38 PM R--A- . (.Intel Corporation - Intel Graphics Miniport Driver.) -- C:\WINDOWS\system32\Drivers\igxpmp32.sys   [1917344]
O58 - SDL:3/21/2011 - 11:58:42 PM R--A- . (.Atheros Communications, Inc. - Atheros AR813x/AR815x PCI-E Ethernet Controller ndis miniport d.) -- C:\WINDOWS\system32\Drivers\l1c51x86.sys   [65136]
O58 - SDL:11/17/2009 - 3:17:00 PM ---A- . (.Creative Technology Ltd. - Creative WDM Audio Driver (32-bit).) -- C:\WINDOWS\system32\Drivers\Monfilt.sys   [1395800]
O58 - SDL:5/9/2012 - 5:12:42 AM ---A- . (.Marvell Semiconductor Inc. - Marvell Aux NV Bridge DLL.) -- C:\WINDOWS\system32\Drivers\mv61xxmm.sys   [13616]
O58 - SDL:5/9/2012 - 5:12:43 AM ---A- . (.Marvell Semiconductor Inc. - Marvell Aux NV Bridge DLL.) -- C:\WINDOWS\system32\Drivers\mv64xxmm.sys   [5632]
O58 - SDL:5/9/2012 - 5:12:43 AM ---A- . (.Marvell Semiconductor Inc. - Marvell Aux NV Bridge DLL.) -- C:\WINDOWS\system32\Drivers\mvxxmm.sys   [13616]
O58 - SDL:5/9/2012 - 5:07:03 AM ---A- . (.S3/Diamond Multimedia Systems - NikeDrv Usb Driver.) -- C:\WINDOWS\system32\Drivers\nikedrv.sys   [12032]
O58 - SDL:4/14/2008 - 4:00:00 AM ---A- . (.Parallel Technologies, Inc. - Parallel Technologies DirectParallel IO Library.) -- C:\WINDOWS\system32\Drivers\ptilink.sys   [17792]
O58 - SDL:3/4/2011 - 11:44:14 AM ----- . (.Sonic Solutions - Px Engine Device Driver for Windows 2000/XP.) -- C:\WINDOWS\system32\Drivers\PxHelp20.sys   [45648]
O58 - SDL:5/9/2012 - 5:07:03 AM ---A- . (.S3/Diamond Multimedia Systems - Rio8Drv.sys Usb Driver.) -- C:\WINDOWS\system32\Drivers\rio8drv.sys   [12032]
O58 - SDL:5/9/2012 - 5:07:03 AM ---A- . (.S3/Diamond Multimedia Systems - RioDrv Usb Driver.) -- C:\WINDOWS\system32\Drivers\riodrv.sys   [12032]
O58 - SDL:6/7/2011 - 4:57:28 AM ---A- . (.Realtek Semiconductor Corp. - Realtek(r) High Definition Audio Function Driver.) -- C:\WINDOWS\system32\Drivers\RtkHDAud.sys   [6353000]
O58 - SDL:4/14/2008 - 4:00:00 AM ---A- . (.Macrovision Corporation, Macrovision Europe - Macrovision SECURITY Driver.) -- C:\WINDOWS\system32\Drivers\secdrv.sys   [20480]
O58 - SDL:5/11/2009 - 8:12:49 AM ---A- . (.Avira GmbH - AVIRA SnapShot Driver.) -- C:\WINDOWS\system32\Drivers\ssmdrv.sys   [28520]
O58 - SDL:5/9/2012 - 5:07:03 AM ---A- . (.Toshiba Corporation - WDM Toshiba Tecra Video Capture Driver.) -- C:\WINDOWS\system32\Drivers\tsbvcap.sys   [21376]
O58 - SDL:5/9/2012 - 5:07:03 AM ---A- . (.RAVISENT Technologies Inc. - CineMaster C WDM DVD Minidriver.) -- C:\WINDOWS\system32\Drivers\vdmindvd.sys   [58112]
O58 - SDL:4/14/2008 - 4:00:00 AM ---A- . (...) -- C:\WINDOWS\system32\ansi.sys   [9029]
O58 - SDL:4/14/2008 - 4:00:00 AM ---A- . (...) -- C:\WINDOWS\system32\country.sys   [27097]
O58 - SDL:4/14/2008 - 4:00:00 AM ---A- . (...) -- C:\WINDOWS\system32\himem.sys   [4768]
O58 - SDL:4/14/2008 - 4:00:00 AM ---A- . (...) -- C:\WINDOWS\system32\key01.sys   [42809]
O58 - SDL:4/14/2008 - 4:00:00 AM ---A- . (...) -- C:\WINDOWS\system32\keyboard.sys   [42537]
O58 - SDL:4/14/2008 - 4:00:00 AM ---A- . (...) -- C:\WINDOWS\system32\ntdos.sys   [27866]
O58 - SDL:4/14/2008 - 4:00:00 AM ---A- . (...) -- C:\WINDOWS\system32\ntdos404.sys   [29146]
O58 - SDL:4/14/2008 - 4:00:00 AM ---A- . (...) -- C:\WINDOWS\system32\ntdos411.sys   [29370]
O58 - SDL:4/14/2008 - 4:00:00 AM ---A- . (...) -- C:\WINDOWS\system32\ntdos412.sys   [29274]
O58 - SDL:4/14/2008 - 4:00:00 AM ---A- . (...) -- C:\WINDOWS\system32\ntdos804.sys   [29146]
O58 - SDL:4/14/2008 - 4:00:00 AM ---A- . (...) -- C:\WINDOWS\system32\ntio.sys   [33840]
O58 - SDL:4/14/2008 - 4:00:00 AM ---A- . (...) -- C:\WINDOWS\system32\ntio404.sys   [34560]
O58 - SDL:4/14/2008 - 4:00:00 AM ---A- . (...) -- C:\WINDOWS\system32\ntio411.sys   [35648]
O58 - SDL:4/14/2008 - 4:00:00 AM ---A- . (...) -- C:\WINDOWS\system32\ntio412.sys   [35424]
O58 - SDL:4/14/2008 - 4:00:00 AM ---A- . (...) -- C:\WINDOWS\system32\ntio804.sys   [34560]
~ Drivers: 56 Scanned in 01mn AMs



---\\ Last modified or created user files (O61)
O61 - LFC: 6/19/2015 - 5:30:16 AM ---A- . (.Google Inc..) -- C:\Documents and Settings\d\Local Settings\Application Data\Google\Chrome\User Data\WidevineCDM\1.4.8.823\_platform_specific\win_x86\widevinecdmadapter.dll   [189256]
O61 - LFC: 6/22/2015 - 5:30:14 AM ---A- . (.Baidu.com.) -- C:\Documents and Settings\d\Application Data\Baidu\hao123\hao123.1.0.0.1089.exe   [549832]
O61 - LFC: 6/22/2015 - 5:30:15 AM ---A- . (...) -- C:\Documents and Settings\d\Local Settings\Application Data\Adobe\Acrobat\11.0\UserCache.bin   [64661]
O61 - LFC: 6/22/2015 - 5:30:16 AM ---A- . (...) -- C:\Documents and Settings\d\Local Settings\Apps\F.lux\uninstall.exe   [47265]
O61 - LFC: 6/22/2015 - 5:30:16 AM ---A- . (...) -- C:\Documents and Settings\d\Local Settings\Temp\Arabic.bin   [21543]
O61 - LFC: 6/22/2015 - 5:30:16 AM ---A- . (...) -- C:\Documents and Settings\d\Local Settings\Temp\Croatian.bin   [24855]
O61 - LFC: 6/22/2015 - 5:30:16 AM ---A- . (...) -- C:\Documents and Settings\d\Local Settings\Temp\Czech.bin   [24769]
O61 - LFC: 6/22/2015 - 5:30:16 AM ---A- . (...) -- C:\Documents and Settings\d\Local Settings\Temp\Danish.bin   [23225]
O61 - LFC: 6/22/2015 - 5:30:16 AM ---A- . (...) -- C:\Documents and Settings\d\Local Settings\Temp\Dutch.bin   [26202]
O61 - LFC: 6/22/2015 - 5:30:16 AM ---A- . (...) -- C:\Documents and Settings\d\Local Settings\Temp\English.bin   [22808]
O61 - LFC: 6/22/2015 - 5:30:16 AM ---A- . (...) -- C:\Documents and Settings\d\Local Settings\Temp\Finnish.bin   [23326]
O61 - LFC: 6/22/2015 - 5:30:16 AM ---A- . (...) -- C:\Documents and Settings\d\Local Settings\Temp\French.bin   [28183]
O61 - LFC: 6/22/2015 - 5:30:16 AM ---A- . (...) -- C:\Documents and Settings\d\Local Settings\Temp\German.bin   [26669]
O61 - LFC: 6/22/2015 - 5:30:16 AM ---A- . (...) -- C:\Documents and Settings\d\Local Settings\Temp\Greek.bin   [25631]
O61 - LFC: 6/22/2015 - 5:30:16 AM ---A- . (...) -- C:\Documents and Settings\d\Local Settings\Temp\Hebrew.bin   [19937]
O61 - LFC: 6/22/2015 - 5:30:16 AM ---A- . (...) -- C:\Documents and Settings\d\Local Settings\Temp\Hungarian.bin   [26549]
O61 - LFC: 6/22/2015 - 5:30:16 AM ---A- . (...) -- C:\Documents and Settings\d\Local Settings\Temp\Italian.bin   [28419]
O61 - LFC: 6/22/2015 - 5:30:16 AM ---A- . (...) -- C:\Documents and Settings\d\Local Settings\Temp\Japanese.bin   [25202]
O61 - LFC: 6/22/2015 - 5:30:16 AM ---A- . (...) -- C:\Documents and Settings\d\Local Settings\Temp\Korean.bin   [20917]
O61 - LFC: 6/22/2015 - 5:30:16 AM ---A- . (...) -- C:\Documents and Settings\d\Local Settings\Temp\Lithuanian.bin   [25980]
O61 - LFC: 6/22/2015 - 5:30:16 AM ---A- . (...) -- C:\Documents and Settings\d\Local Settings\Temp\Norwegian.bin   [22406]
O61 - LFC: 6/22/2015 - 5:30:16 AM ---A- . (...) -- C:\Documents and Settings\d\Local Settings\Temp\Polish.bin   [24949]
O61 - LFC: 6/22/2015 - 5:30:17 AM ---A- . (...) -- C:\Documents and Settings\d\Local Settings\Temp\Portuguese(Brazil).bin   [26023]
O61 - LFC: 6/22/2015 - 5:30:17 AM ---A- . (...) -- C:\Documents and Settings\d\Local Settings\Temp\Portuguese.bin   [26912]
O61 - LFC: 6/22/2015 - 5:30:17 AM ---A- . (...) -- C:\Documents and Settings\d\Local Settings\Temp\Russian.bin   [26582]
O61 - LFC: 6/22/2015 - 5:30:17 AM ---A- . (...) -- C:\Documents and Settings\d\Local Settings\Temp\SWEDISH.bin   [24503]
O61 - LFC: 6/22/2015 - 5:30:17 AM ---A- . (...) -- C:\Documents and Settings\d\Local Settings\Temp\SimChin.bin   [17030]
O61 - LFC: 6/22/2015 - 5:30:17 AM ---A- . (...) -- C:\Documents and Settings\d\Local Settings\Temp\Slovak.bin   [26159]
O61 - LFC: 6/22/2015 - 5:30:17 AM ---A- . (...) -- C:\Documents and Settings\d\Local Settings\Temp\Slovenian.bin   [24330]
O61 - LFC: 6/22/2015 - 5:30:17 AM ---A- . (...) -- C:\Documents and Settings\d\Local Settings\Temp\Spanish.bin   [28759]
O61 - LFC: 6/22/2015 - 5:30:17 AM ---A- . (...) -- C:\Documents and Settings\d\Local Settings\Temp\Thai.bin   [22395]
O61 - LFC: 6/22/2015 - 5:30:17 AM ---A- . (...) -- C:\Documents and Settings\d\Local Settings\Temp\TradChin.bin   [17584]
O61 - LFC: 6/22/2015 - 5:30:17 AM ---A- . (...) -- C:\Documents and Settings\d\Local Settings\Temp\Turkish.bin   [22830]
O61 - LFC: 6/22/2015 - 5:30:18 AM ---A- . (.Google Inc..) -- C:\Documents and Settings\d\My Documents\Downloads\ChromeSetup.exe   [931408]
O61 - LFC: 6/23/2015 - 5:30:14 AM ---A- . (.Nicolas Coolman.) -- C:\Documents and Settings\d\Desktop\ZHPDiag2.exe   [6883618]  =>.Nicolas Coolman
O61 - LFC: 6/23/2015 - 5:30:14 AM ---A- . (.Tonec Inc..) -- C:\Documents and Settings\d\Application Data\IDM\idmmzcc5\components11\idmmzcc.dll   [26136]
O61 - LFC: 6/23/2015 - 5:30:14 AM ---A- . (.Tonec Inc..) -- C:\Documents and Settings\d\Application Data\IDM\idmmzcc5\components11\idmmzcc64.dll   [31256]
O61 - LFC: 6/23/2015 - 5:30:14 AM ---A- . (.Tonec Inc..) -- C:\Documents and Settings\d\Application Data\IDM\idmmzcc5\components2\idmcchandler2.dll   [326168]
O61 - LFC: 6/23/2015 - 5:30:14 AM ---A- . (.Tonec Inc..) -- C:\Documents and Settings\d\Application Data\IDM\idmmzcc5\components2\idmcchandler2_64.dll   [452632]
O61 - LFC: 6/23/2015 - 5:30:14 AM ---A- . (.Tonec Inc..) -- C:\Documents and Settings\d\Application Data\IDM\idmmzcc5\components2\idmmzcc.dll   [34216]
O61 - LFC: 6/23/2015 - 5:30:14 AM ---A- . (.Tonec Inc..) -- C:\Documents and Settings\d\Application Data\IDM\idmmzcc5\components2\idmmzcc64.dll   [28512]
O61 - LFC: 6/23/2015 - 5:30:14 AM ---A- . (.Tonec Inc..) -- C:\Documents and Settings\d\Application Data\IDM\idmmzcc5\components\idmmzcc.dll   [34216]
O61 - LFC: 6/23/2015 - 5:30:15 AM ---A- . (...) -- C:\Documents and Settings\d\Local Settings\Application Data\Google\Chrome\User Data\ev_hashes_whitelist.bin   [1113849]
~ 1020 Fichiers temporaires (Temporary files)
~ 24 Fichiers cookies (Cookies files)
~ Files: 43 Scanned in 04mn AMs



---\\ List all tools cleaner (LATC) (O63)
O63 - Logiciel: ZHPDiag 2015 - (.Nicolas Coolman.) [HKLM] -- ZHPDiag_is1  =>.Nicolas Coolman
~ ADS:  Scanned in 00mn AMs



---\\ List all legacy services(LALS) (O64)
O64 - Services: CurCS - 2/24/2010 - C:\Program Files\Avira\AntiVir Desktop\sched.exe (AntiVirSchedulerService)  .(.Avira GmbH - Antivirus Scheduler.) - LEGACY_ANTIVIRSCHEDULERSERVICE
O64 - Services: CurCS - 3/16/2010 - C:\Program Files\Avira\AntiVir Desktop\avguard.exe (AntiVirService)  .(.Avira GmbH - Antivirus On-Access Service.) - LEGACY_ANTIVIRSERVICE
O64 - Services: CurCS - 1/10/2011 - C:\WINDOWS\system32\DRIVERS\AppleCharger.sys (AppleCharger) .(...) - LEGACY_APPLECHARGER
O64 - Services: CurCS - 5/9/2013 - C:\WINDOWS\system32\drivers\aswFW.sys (aswFW)  .(.AVAST Software - avast! Filtering TDI driver.) - LEGACY_ASWFW
O64 - Services: CurCS - 5/9/2013 - C:\WINDOWS\system32\drivers\aswMonFlt.sys (aswMonFlt)  .(.AVAST Software - avast! File System Minifilter for Windows 2.) - LEGACY_ASWMONFLT
O64 - Services: CurCS - 5/9/2013 - C:\WINDOWS\system32\drivers\aswNdis2.sys (aswNdis2)  .(.AVAST Software - avast! Filtering NDIS driver.) - LEGACY_ASWNDIS2
O64 - Services: CurCS - 5/9/2013 - C:\WINDOWS\system32\Drivers\AswRdr.sys (AswRdr)  .(.AVAST Software - avast! TDI Redirect Driver.) - LEGACY_ASWRDR
O64 - Services: CurCS - 5/9/2013 - C:\WINDOWS\system32\Drivers\aswRvrt.sys (aswRvrt) .(...) - LEGACY_ASWRVRT
O64 - Services: CurCS - 5/9/2013 - C:\WINDOWS\system32\Drivers\aswSnx.sys (aswSnx)  .(.AVAST Software - avast! Virtualization Driver.) - LEGACY_ASWSNX
O64 - Services: CurCS - 5/9/2013 - C:\WINDOWS\system32\Drivers\aswTdi.sys (aswTdi)  .(.AVAST Software - avast! TDI Filter Driver.) - LEGACY_ASWTDI
O64 - Services: CurCS - 5/9/2013 - C:\WINDOWS\system32\Drivers\aswVmm.sys (aswVmm) .(...) - LEGACY_ASWVMM
O64 - Services: CurCS - 5/11/2009 - C:\Program Files\Avira\AntiVir Desktop\avgio.sys (avgio)  .(.Avira GmbH - Avira AntiVir Support for Minifilter.) - LEGACY_AVGIO
O64 - Services: CurCS - 2/16/2010 - C:\WINDOWS\system32\DRIVERS\avgntflt.sys (avgntflt)  .(.Avira GmbH - Avira Minifilter Driver.) - LEGACY_AVGNTFLT
O64 - Services: CurCS - 3/1/2010 - C:\WINDOWS\system32\DRIVERS\avipbb.sys (avipbb)  .(.Avira GmbH - Avira Driver for Security Enhancement.) - LEGACY_AVIPBB
O64 - Services: CurCS - 4/14/2008 - C:\WINDOWS\system32\drivers\dmload.sys (dmload)  .(.Microsoft Corp., Veritas Software. - NT Disk Manager Startup Driver.) - LEGACY_DMLOAD
O64 - Services: CurCS - 9/4/2012 - C:\Program Files\FILSEC~1\Twister\x86\ffsmon.sys (ffsmon)  .(.Filseclab Corp. - Filseclab File-system Monitor.) - LEGACY_FFSMON
O64 - Services: CurCS - 4/11/2013 - C:\Program Files\FILSEC~1\Twister\fildds.sys (fildds)  .(.Filseclab Corporation - Filseclab Dynamic Defense System Drv.) - LEGACY_FILDDS
O64 - Services: CurCS - 4/11/2013 - C:\Program Files\FILSEC~1\Twister\filmfd.sys (filmfd)  .(.Filseclab Corporation - Filseclab Antivirus Drv.) - LEGACY_FILMFD
O64 - Services: CurCS - 9/28/2012 - C:\Program Files\FILSEC~1\Twister\filppd.sys (filppd)  .(.Filseclab Corporation - Filseclab Process Protection.) - LEGACY_FILPPD
O64 - Services: CurCS - 11/28/2014 - C:\WINDOWS\system32\DRIVERS\idmtdi.sys (IDMTDI)  .(.Tonec Inc. - Internet Download Manager TDI Driver.) - LEGACY_IDMTDI
O64 - Services: CurCS - 11/15/2010 - C:\Program Files\Splashtop\Splashtop Connect\BackService.exe (SCBackService)  .(.Splashtop Inc. - Splashtop Connect Back Service..) - LEGACY_SCBACKSERVICE
O64 - Services: CurCS - 5/11/2009 - C:\WINDOWS\system32\DRIVERS\ssmdrv.sys (ssmdrv)  .(.Avira GmbH - AVIRA SnapShot Driver.) - LEGACY_SSMDRV
O64 - Services: CurCS - 7/10/2013 - C:\Program Files\Filseclab\Twister\twssrv.exe (twssrv)  .(.Filseclab Corporation - Twister Server.) - LEGACY_TWSSRV
O64 - Services: CurCS - 11/29/2010 - C:\Program Files\Splashtop\Splashtop Connect Firefox Software Updater\WCUService.exe (WCUService_STC_FF)  .(.Splashtop Inc. - Splashtop Connect Firefox Software Updater.) - LEGACY_WCUSERVICE_STC_FF
O64 - Services: CurCS - 11/4/2010 - C:\Program Files\Splashtop\Splashtop Connect IE Software Updater\WCUService.exe (WCUService_STC_IE)  .(.Splashtop Inc. - Splashtop Connect IE Software Updater Servi.) - LEGACY_WCUSERVICE_STC_IE
~ Legacy: 131 Scanned in 01mn AMs



---\\ File Associations Shell Spawning (O67)
O67 - Shell Spawning: <.bat> <batfile>[HKLM\..\open\Command] (...) -- "%1" %*
O67 - Shell Spawning: <.cpl> <cplfile>[HKLM\..\cplopen\Command] (.Microsoft Corporation - Windows Shell Common Dll.) -- C:\WINDOWS\system32\shell32.dll
O67 - Shell Spawning: <.cmd> <cmdfile>[HKLM\..\open\Command] (...) -- "%1" %*
O67 - Shell Spawning: <.com> <comfile>[HKLM\..\open\Command] (...) -- "%1" %*
O67 - Shell Spawning: <.exe> <exefile>[HKLM\..\open\Command] (...) -- "%1" %*
O67 - Shell Spawning: <.html> <htmlfile>[HKLM\..\open\Command] (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\IEXPLORE.exe
O67 - Shell Spawning: <.js> <JSFile>[HKLM\..\open\Command] (.Microsoft Corporation - Microsoft (R) Windows Based Script Host.) -- C:\WINDOWS\system32\WScript.exe
O67 - Shell Spawning: <.reg> <regfile>[HKLM\..\open\Command] (.Microsoft Corporation - Registry Editor.) -- C:\WINDOWS\regedit.exe
O67 - Shell Spawning: <.scr> <scrfile>[HKLM\..\open\Command] (...) -- "%1" /S
O67 - Shell Spawning: <.html> <ChromeHTML>[HKCU\..\open\Command] (.Not Key.)
~ FASS Keys: 10 Scanned in 00mn AMs



---\\ Start Menu Internet (SMI) (O68)
O68 - StartMenuInternet: <chrome.exe> <>[HKLM\..\Shell\open\Command] (.Google Inc. - Google Chrome.) -- C:\Program Files\Google\Chrome\Application\chrome.exe
O68 - StartMenuInternet: <FIREFOX.EXE> <Mozilla Firefox>[HKLM\..\Shell\open\Command] (.Mozilla Corporation - Firefox.) -- C:\Program Files\Mozilla Firefox\firefox.exe
O68 - StartMenuInternet: <Google Chrome> <Google Chrome>[HKLM\..\Shell\open\Command] (.Google Inc. - Google Chrome.) -- C:\Program Files\Google\Chrome\Application\chrome.exe
O68 - StartMenuInternet: <IEXPLORE.EXE> <Internet Explorer>[HKLM\..\Shell\open\Command] (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
~ Keys:  Scanned in 00mn AMs



---\\ Search Browser Infection (SBI) (O69)
O69 - SBI: SearchScopes [HKCU] {0633EE93-D776-472f-A0FF-E1416B8B2E3A} [DefaultScope] - () - http://search.live.com
O69 - SBI: SearchScopes [HKCU] {5B67305A-6EBB-41b7-8CDA-A020A05ABB6C} - (Yahoo) - http://search.yahoo.com
O69 - SBI: SearchScopes [HKCU] {93657BB4-D2E1-4c58-803D-AAF6D9C155FE} - (Bing) - http://www.bing.com
O69 - SBI: SearchScopes [HKCU] {FF4BDCD7-505E-457d-ADAE-7C2DDF5203F1} - (Google) - http://www.google.com
~ Keys:  Scanned in 00mn AMs



---\\ Crack & Keygen Files (CKF) (O82)
E:\العاب تسليه\العاب الأسرار والبحث عن الخفايا\العاب بنات\Ranch Rush + Adnan_Boy 2008 + Precracked\Ranch Rush.exe  =>.Crack,Keygen
E:\العاب تسليه\العاب الأسرار والبحث عن الخفايا\العاب بنات\Ranch Rush + Adnan_Boy 2008 + Precracked\Torrent downloaded from Demonoid.com.txt  =>.Crack,Keygen
E:\العاب تسليه\العاب تسليه\العاب الأسرار والبحث عن الخفايا\العاب زوما\Zuma's Revenge\Keygen.exe  =>.Crack,Keygen
~ Files:  Scanned in 35mn AMs



---\\ Search Svchost Services (SSS) (O83)
O83 - Search Svchost Services: AppMgmt (AppMgmt) . (.Microsoft Corporation - Software installation Service.) -- C:\WINDOWS\system32\appmgmts.dll   [167936]
O83 - Search Svchost Services: AudioSrv (AudioSrv) . (.Microsoft Corporation - Windows Audio Service.) -- C:\WINDOWS\system32\audiosrv.dll   [42496]
O83 - Search Svchost Services: Browser (Browser) . (.Microsoft Corporation - Computer Browser Service DLL.) -- C:\WINDOWS\system32\browser.dll   [77824]
O83 - Search Svchost Services: CryptSvc (CryptSvc) . (.Microsoft Corporation - Cryptographic Services.) -- C:\WINDOWS\system32\cryptsvc.dll   [62464]
O83 - Search Svchost Services: DMServer (DMServer) . (.Microsoft Corp. - Logical Disk Manager service dll.) -- C:\WINDOWS\system32\dmserver.dll   [23552]
O83 - Search Svchost Services: DHCP (DHCP) . (.Microsoft Corporation - DHCP Client Service.) -- C:\WINDOWS\system32\dhcpcsvc.dll   [126976]
O83 - Search Svchost Services: ERSvc (ERSvc) . (.Microsoft Corporation - Windows Error Reporting Service.) -- C:\WINDOWS\system32\ersvc.dll   [23040]
O83 - Search Svchost Services: EventSystem (EventSystem) . (.Microsoft Corporation - No Comment.) -- C:\WINDOWS\system32\es.dll   [253952]
O83 - Search Svchost Services: FastUserSwitchingCompatibility (FastUserSwitchingCompatibility) . (.Microsoft Corporation - Windows Shell Services Dll.) -- C:\WINDOWS\system32\shsvcs.dll   [135168]
O83 - Search Svchost Services: HidServ (HidServ) . (...) -- C:\WINDOWS\system32\hidserv.dll   [0]
O83 - Search Svchost Services: LanmanServer (LanmanServer) . (.Microsoft Corporation - Server Service DLL.) -- C:\WINDOWS\system32\srvsvc.dll   [99840]
O83 - Search Svchost Services: LanmanWorkstation (LanmanWorkstation) . (.Microsoft Corporation - Workstation Service DLL.) -- C:\WINDOWS\system32\wkssvc.dll   [134144]
O83 - Search Svchost Services: Messenger (Messenger) . (.Microsoft Corporation - NT Messenger Service.) -- C:\WINDOWS\system32\msgsvc.dll   [33792]
O83 - Search Svchost Services: Netman (Netman) . (.Microsoft Corporation - Network Connections Manager.) -- C:\WINDOWS\system32\netman.dll   [198144]
O83 - Search Svchost Services: Nla (Nla) . (.Microsoft Corporation - Microsoft Windows Sockets 2.0 Service Provider.) -- C:\WINDOWS\system32\mswsock.dll   [245248]
O83 - Search Svchost Services: Ntmssvc (Ntmssvc) . (.Microsoft Corporation - Removable Storage Manager.) -- C:\WINDOWS\system32\ntmssvc.dll   [435200]
O83 - Search Svchost Services: Rasauto (Rasauto) . (.Microsoft Corporation - Remote Access AutoDial Manager.) -- C:\WINDOWS\system32\rasauto.dll   [88576]
O83 - Search Svchost Services: Rasman (Rasman) . (.Microsoft Corporation - Remote Access Connection Manager.) -- C:\WINDOWS\system32\rasmans.dll   [186368]
O83 - Search Svchost Services: Remoteaccess (Remoteaccess) . (.Microsoft Corporation - Dynamic Interface Manager.) -- C:\WINDOWS\system32\mprdim.dll   [53248]
O83 - Search Svchost Services: Schedule (Schedule) . (.Microsoft Corporation - Task Scheduler Engine.) -- C:\WINDOWS\system32\schedsvc.dll   [192512]
O83 - Search Svchost Services: Seclogon (Seclogon) . (.Microsoft Corporation - Secondary Logon Service DLL.) -- C:\WINDOWS\system32\seclogon.dll   [18944]
O83 - Search Svchost Services: SENS (SENS) . (.Microsoft Corporation - System Event Notification Service (SENS).) -- C:\WINDOWS\system32\sens.dll   [39424]
O83 - Search Svchost Services: Sharedaccess (Sharedaccess) . (.Microsoft Corporation - Microsoft NAT Helper Components.) -- C:\WINDOWS\system32\ipnathlp.dll   [330752]
O83 - Search Svchost Services: SRService (SRService) . (.Microsoft Corporation - System Restore Service.) -- C:\WINDOWS\system32\srsvc.dll   [171008]
O83 - Search Svchost Services: Tapisrv (Tapisrv) . (.Microsoft Corporation - Microsoft® Windows(TM) Telephony Server.) -- C:\WINDOWS\system32\tapisrv.dll   [249856]
O83 - Search Svchost Services: Themes (Themes) . (.Microsoft Corporation - Windows Shell Services Dll.) -- C:\WINDOWS\system32\shsvcs.dll   [135168]
O83 - Search Svchost Services: TrkWks (TrkWks) . (.Microsoft Corporation - Distributed Link Tracking Client.) -- C:\WINDOWS\system32\trkwks.dll   [90112]
O83 - Search Svchost Services: W32Time (W32Time) . (.Microsoft Corporation - Windows Time Service.) -- C:\WINDOWS\system32\w32time.dll   [175616]
O83 - Search Svchost Services: WZCSVC (WZCSVC) . (.Microsoft Corporation - Wireless Zero Configuration Service.) -- C:\WINDOWS\system32\wzcsvc.dll   [483328]
O83 - Search Svchost Services: Wmi (Wmi) . (.Microsoft Corporation - Advanced Windows 32 Base API.) -- C:\WINDOWS\system32\advapi32.dll   [617472]
O83 - Search Svchost Services: winmgmt (winmgmt) . (.Microsoft Corporation - WMI.) -- C:\WINDOWS\system32\wbem\WMIsvc.dll   [144896]
O83 - Search Svchost Services: wscsvc (wscsvc) . (.Microsoft Corporation - Windows Security Center Service.) -- C:\WINDOWS\system32\wscsvc.dll   [80896]
O83 - Search Svchost Services: xmlprov (xmlprov) . (.Microsoft Corporation - Network Provisioning Service.) -- C:\WINDOWS\system32\xmlprov.dll   [129024]
O83 - Search Svchost Services: napagent (napagent) . (.Microsoft Corporation - Quarantine Agent Service Run-Time.) -- C:\WINDOWS\system32\qagentrt.dll   [291328]
O83 - Search Svchost Services: hkmsvc (hkmsvc) . (.Microsoft Corporation - Key Management Service.) -- C:\WINDOWS\system32\kmsvc.dll   [61440]
O83 - Search Svchost Services: BITS (BITS) . (.Microsoft Corporation - Background Intelligent Transfer Service.) -- C:\WINDOWS\system32\qmgr.dll   [409088]
O83 - Search Svchost Services: wuauserv (wuauserv) . (.Microsoft Corporation - Windows Update AutoUpdate Service.) -- C:\WINDOWS\system32\wuauserv.dll   [22520]
O83 - Search Svchost Services: ShellHWDetection (ShellHWDetection) . (.Microsoft Corporation - Windows Shell Services Dll.) -- C:\WINDOWS\system32\shsvcs.dll   [135168]
O83 - Search Svchost Services: helpsvc (helpsvc) . (.Microsoft Corporation - Microsoft PCHealth Service Holder.) -- C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll   [38400]
O83 - Search Svchost Services: WmdmPmSN (WmdmPmSN) . (.Microsoft Corporation - Microsoft Media Device Service Provider.) -- C:\WINDOWS\system32\mspmsnsv.dll   [52224]
~ Services: 40 Scanned in 00mn AMs



---\\ Search Particular Root Folder (SPRF) (O84)
[MD5.1833923DA90E73C3A392F05069E3BA8B] [SPRF][6/23/2015] (.Nicolas Coolman - ZHPDiag Setup.) -- C:\Documents and Settings\d\Desktop\ZHPDiag2.exe   [6883618]
~ Files: 1 Scanned in 00mn AMs



---\\ MyComputer Name Space (MNS) (O92)
O92 - MNS: مجلدات ويب - {BDEADF00-C265-11D0-BCED-00A0C90AB50F}
~ MNS: 1 Scanned in 00mn AMs



---\\ Search CLSID Registry Key (O101)
[HKCR\CLSID\{30E7F2A0-EC4C-11ce-8865-00805F742EF6}] (SpeedDial)  =>PUP.SpeedDial
~ BCK: 3811 Scanned in 13mn AMs



---\\ General States of Services not Microsoft (EGS) (SR=Running, SS=Stopped)
SS - | Demand 4/6/2010 31272 |  (AppleChargerSrv) . (...) - C:\WINDOWS\system32\AppleChargerSrv.exe
SS - | Disabled 7/22/1658 0 |  (avast! Antivirus) . (...) - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
SS - | Auto 7/22/1658 0 |  (avast! Firewall) . (...) - C:\Program Files\AVAST Software\Avast\afwServ.exe
SS - | Demand 4/14/2008 224768 |  (dmadmin) . (.Microsoft Corp., Veritas Software.) - C:\WINDOWS\system32\dmadmin.exe
SS - | Auto 6/22/2015 144200 |  (gupdate) . (.Google Inc..) - C:\Program Files\Google\Update\GoogleUpdate.exe
SS - | Demand 6/22/2015 144200 |  (gupdatem) . (.Google Inc..) - C:\Program Files\Google\Update\GoogleUpdate.exe
SS - | Auto 4/25/2013 580232 |  (WiseBootAssistant) . (.WiseCleaner.com.) - C:\Program Files\Wise\Wise Care 365\BootTime.exe
SR - | Auto 2/24/2010 135336 |  (AntiVirSchedulerService) . (.Avira GmbH.) - C:\Program Files\Avira\AntiVir Desktop\sched.exe
SR - | Auto 3/16/2010 267432 |  (AntiVirService) . (.Avira GmbH.) - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
SR - | Auto 11/15/2010 477000 |  (SCBackService) . (.Splashtop Inc..) - C:\Program Files\Splashtop\Splashtop Connect\BackService.exe
SR - | Auto 7/10/2013 30536 |  (twssrv) . (.Filseclab Corporation.) - C:\Program Files\Filseclab\Twister\twssrv.exe
SR - | Auto 11/29/2010 493384 |  (WCUService_STC_FF) . (.Splashtop Inc..) - C:\Program Files\Splashtop\Splashtop Connect Firefox Software Updater\WCUService.exe
SR - | Auto 11/4/2010 493384 |  (WCUService_STC_IE) . (.Splashtop Inc..) - C:\Program Files\Splashtop\Splashtop Connect IE Software Updater\WCUService.exe
~ Services:  Scanned in 14mn AMs



---\\ Search Master Boot Record Infection (MBR)(O80)
Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net
Run by d at 6/23/2015 5:32:17 AM
device: opened successfully
user: MBR read successfully
Disk trace:
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys pciide.sys PCIIDEX.SYS 
1 ntkrnlpa!IofCallDriver[0x804EF1B0] >> \Device\Harddisk0\DR0[0x89D3AAB8]
3 CLASSPNP[0xBA0E8FD7] >> ntkrnlpa!IofCallDriver[0x804EF1B0] >> \Device\00000070[0x89DCA3B8]
5 ACPI[0xB9F7F620] >> ntkrnlpa!IofCallDriver[0x804EF1B0] >> \Device\Ide\IdeDeviceP0T0L0-3[0x89D3E940]
kernel: MBR read successfully
user & kernel MBR OK 
~ MBR: 13 Scanned in 02mn AMs



---\\ Search Master Boot Record Infection (MBRCheck)(O80)
Written by ad13, http://ad13.geekstog
Run by d at 6/23/2015 5:32:19 AM
********* Dump file Name *********
C:\PhysicalDisk0_MBR.bin
~ MBR:  Scanned in 04mn AMs



---\\ Scan Additionnel (O88)
Database Version : 13008 - (6/16/2015)
Clés trouvées (Keys found) : 6
Valeurs trouvées (Values found) : 1
Dossiers trouvés  (Folders found) : 0
Fichiers trouvés  (Files found) : 2

[HKCU\Software\APN PIP]   =>Toolbar.Ask
[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{0E5680D1-BF44-4929-94AF-FD30D784AD1D}]   =>Toolbar.Agent
[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{0E5680D1-BF44-4929-94AF-FD30D784AD1D}]   =>Toolbar.Agent
[HKLM\Software\Classes\CLSID\{0E5680D1-BF44-4929-94AF-FD30D784AD1D}]   =>Toolbar.Agent
[HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0E5680D1-BF44-4929-94AF-FD30D784AD1D}]   =>Toolbar.Agent
[HKLM\SYSTEM\CurrentControlSet\Services\SCBackService]   =>Toolbar.Agent
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]:ZyngaGamesAgent   =>Toolbar.Zynga^
C:\Program Files\Splashtop\Splashtop Connect\ZyngaGamesAgent.exe   =>Toolbar.Zynga^
[HKCR\CLSID\{30E7F2A0-EC4C-11ce-8865-00805F742EF6}] (SpeedDial)   =>PUP.SpeedDial^
~ Additionnel Scan: 142287 Items scanned in 30mn AMs



---\\ Additional information about modules
~ http://www.nicolascoolman.fr/g2-google-chrome-extensions/  =>.Google Chrome, Start,Search,Extensions (G0,G1,G2)
~ http://www.nicolascoolman.fr/r5-internet-explorer-proxy-management-iepm/  =>.Internet Explorer, Proxy Management (R5)
~ http://www.nicolascoolman.fr/o2-browser-helper-objects-de-navigateur/  =>.Browser Helper Objects (O2)
~ http://www.nicolascoolman.fr/o3-internet-explorer-toolbars/  =>.Internet Explorer toolbars (O3)
~ http://www.nicolascoolman.fr/o4-applications-demarrees-par-le-registre/  =>.Auto loading programs from Registry and folders (O4)
~ AMI: 5 Scanned in 00mn AMs



---\\ Summary of the detections found on your workstation
http://www.nicolascoolman.fr/blog/  =>Toolbar.Zynga
http://www.nicolascoolman.fr/hijacker-browsers  =>Hijacker.Browser
http://www.nicolascoolman.fr/blog/  =>PUP.DriverManager
http://www.nicolascoolman.fr/blog/  =>Toolbar.Splashtop
http://www.nicolascoolman.fr/32720552-pup-speeddial  =>PUP.SpeedDial
http://www.nicolascoolman.fr/toolbar-ask  =>Toolbar.Ask
http://www.nicolascoolman.fr/blog/  =>Toolbar.Agent
~ MSI: 7 link(s) detected in 00mn AMs



End of the scan (1590 lines in 25mn AMs)(3.4)