~ ZHPDiag v2015.7.18.93 By Nicolas Coolman (2015/07/18) ~ Run by samy (Administrator) (2015/07/18 17:15:31) ~ Site: http://www.nicolascoolman.fr ~ Facebook: https://www.facebook.com/nicolascoolman1 ~ State version: Version OK ~ Mode: Scan ~ Report: C:\Users\samy\Desktop\ZHPDiag.txt ~ Report: C:\Users\samy\AppData\Roaming\ZHP\ZHPDiag.txt ~ UAC: Activate ~ System startup: Normal (Normal boot) ~ Windows 8.1, 32-bit (Build 9600) ---\\ Internet Browsers (2) - 0s GCIE: Google Chrome v43.0.2357.134 MSIE: Internet Explorer v11.0.10162.0 ---\\ Windows Product Information (3) - 13s ~ Windows Server License Manager Script : OK ~ Licence Script File Génération : OK Windows Activation Technologies : OK ---\\ System protection software (2) - 0s Malwarebytes Anti-Malware version 2.1.8.1057 SMADAV version 10.1.1 v10.1.1 ---\\ Surveillance software (1) - 0s Adobe Reader XI ---\\ Information on the system (6) - 0s ~ Operating System: x86 Family 15 Model 4 Stepping 3, GenuineIntel ~ Operating System: 32-bit ~ Boot mode: Normal (Normal boot) Total RAM: 2088.5 MB (15% free) ~ System Restore: Activé (Enable) ~ System drive C: has 14 GB free of 50 GB ---\\ Connection to the system mode (3) - 0s ~ Computer Name: HAMHARIYGOOD ~ User Name: samy ~ Logged in as Administrator ---\\ Enumeration of the disk units (4) - 5s ~ Drive C: has 14 GB free of 50 GB (System) ~ Drive E: has 45 GB free of 90 GB ~ Drive F: has 11 GB free of 96 GB ~ Drive G: has 0 GB free of 0 GB ---\\ Search Generic System Files (22) - 2s [MD5.C17698AC70C3BF10B13102AFF44BBBA7] - (.Microsoft Corporation - Windows Explorer.) () -- C:\WINDOWS\Explorer.exe [4043800] [MD5.71C501A0AB1B76BB0DC19D611AF0C47D] - (.Microsoft Corporation - Windows host process (Rundll32).) () -- C:\WINDOWS\System32\rundll32.exe [53760] [MD5.A8D7B907236309FBF2C0371065D98BF0] - (.Microsoft Corporation - Windows Start-Up Application.) () -- C:\WINDOWS\System32\Wininit.exe [191272] [MD5.93021542DAD22EC64CD104A0B935DA78] - (.Microsoft Corporation - Internet Extensions for Win32.) () -- C:\WINDOWS\System32\wininet.dll [2201600] [MD5.5F256EB3DFCEDF9B5128F360C8B93363] - (.Microsoft Corporation - Windows Logon Application.) () -- C:\WINDOWS\System32\Winlogon.exe [492032] [MD5.0D3ADE16F53EDCB8DCE2876C80A5A99B] - (.Microsoft Corporation - Software Licensing Library.) () -- C:\WINDOWS\System32\sppcomapi.dll [418304] [MD5.E14559C9D5FEC7C5F0CB47F7E3A92497] - (.Microsoft Corporation - Ancillary Function Driver for WinSock.) () -- C:\WINDOWS\System32\drivers\AFD.sys [478696] [MD5.1BF33ECC95D6C972D2799C2FE05E5244] - (.Microsoft Corporation - ATAPI IDE Miniport Driver.) () -- C:\WINDOWS\System32\drivers\atapi.sys [23528] [MD5.0DDF6AB0EF4B0E495D331895ABACBF84] - (.Microsoft Corporation - CD-ROM File System Driver.) () -- C:\WINDOWS\System32\drivers\Cdfs.sys [74752] [MD5.E133EA7F4813380C2D336E6ACA283A9F] - (.Microsoft Corporation - SCSI CD-ROM Driver.) () -- C:\WINDOWS\System32\drivers\Cdrom.sys [130560] [MD5.A0B8F3D65119E21D4664CD3DB40D75FB] - (.Microsoft Corporation - DFS Namespace Client Driver.) () -- C:\WINDOWS\System32\drivers\DfsC.sys [104960] [MD5.E7D9F01A078ED8834ABCAA73E39C4B1A] - (.Microsoft Corporation - High Definition Audio Bus Driver.) () -- C:\WINDOWS\System32\drivers\HDAudBus.sys [72704] [MD5.504DD70B1507D8D6FB645F9D831A36A1] - (.Microsoft Corporation - i8042 Port Driver.) () -- C:\WINDOWS\System32\drivers\i8042prt.sys [91136] [MD5.3B6D822F5228970E2C875D6AC69E3FBC] - (.Microsoft Corporation - IP Network Address Translator.) () -- C:\WINDOWS\System32\drivers\IpNat.sys [124416] [MD5.C044E63CD3B22EEF7F315C6A632CE84B] - (.Microsoft Corporation - Windows NT SMB Minirdr.) () -- C:\WINDOWS\System32\drivers\MRxSmb.sys [342528] [MD5.F9B44D742B44C481829E4A1223262279] - (.Microsoft Corporation - MBT Transport driver.) () -- C:\WINDOWS\System32\drivers\netBT.sys [211968] [MD5.F6B0444E87EC8F7388319D818FDFAFA6] - (.Microsoft Corporation - NT File System Driver.) () -- C:\WINDOWS\System32\drivers\ntfs.sys [1802216] [MD5.F9D5EE0F5514B86ABA9F206B5D77D168] - (.Microsoft Corporation - Parallel Port Driver.) () -- C:\WINDOWS\System32\drivers\Parport.sys [81408] [MD5.C67711CDA3746794443DC6230B72DA9A] - (.Microsoft Corporation - RAS L2TP mini-port/call-manager driver.) () -- C:\WINDOWS\System32\drivers\Rasl2tp.sys [81408] [MD5.8DB27F73A186F76F8604292079BA7BE1] - (.Microsoft Corporation - Microsoft RDP Device redirector.) () -- C:\WINDOWS\System32\drivers\rdpdr.sys [132608] [MD5.E02F511D18C0FC2F70BB8DF29BBC9737] - (.Microsoft Corporation - TDI Translation Driver.) () -- C:\WINDOWS\System32\drivers\tdx.sys [94184] [MD5.9EAC4218D13B5CA0EC5A9984AC54C5EB] - (.Microsoft Corporation - Volume Shadow Copy Driver.) () -- C:\WINDOWS\System32\drivers\volsnap.sys [342504] ---\\ Process running (24) - 7s [MD5.97715B4295C74B4D55B3445EEB9BD1F1] - (.BlueStack Systems, Inc. - BlueStacks Updater Service.) -- C:\Program Files\BlueStacks\HD-UpdaterService.exe [822904] [PID.768] [MD5.95B960980034877821E7FB5BFE25136E] - (.BlueStack Systems, Inc. - BlueStacks Log Rotator Service.) -- C:\Program Files\BlueStacks\HD-LogRotatorService.exe [413304] [PID.824] [MD5.FB51E8E39E3FDB6757874653B743BE72] - (.ESET - ESET Service.) -- C:\Program Files\ESET\ESET Smart Security\ekrn.exe [1349576] [PID.2128] [MD5.6106526CA0AB6DFE788BDB29C98B5004] - (.Copyright (C) 2012-2013 - .) -- C:\Windows\runSW.exe [44104] [PID.2412] [MD5.439BD966130226F464DC15F55ABD266E] - (.TechSmith Corporation - TechSmith Uploader Service.) -- C:\Program Files\Common Files\TechSmith Shared\Uploader\UploaderService.exe [3408384] [PID.2520] [MD5.EC5D6E0B2AF375CF5BFA947F34A5F441] - (.VMware, Inc. - VMware VMnet DHCP service.) -- C:\Windows\System32\vmnetdhcp.exe [334384] [PID.2544] [MD5.346AF8B2BE7E2E349B0FCA70C55CAC03] - (.VMware, Inc. - VMware USB Arbitration Service.) -- C:\Program Files\Common Files\VMware\USB\vmware-usbarbitrator.exe [563760] [PID.2552] [MD5.E51474E134E5915ACBCD2CB26FAE5473] - (.VMware, Inc. - VMware Authorization Service.) -- E:\hamza\vmware-authd.exe [113200] [PID.2624] [MD5.665BB54CBA86378D99328EFF57F0406C] - (.VMware, Inc. - VMware NAT Service.) -- C:\Windows\System32\vmnat.exe [395824] [PID.2788] [MD5.755B9539021C26749F3234DF8B8A4788] - (.Copyright (C) 2012~2013 - .) -- C:\Program Files\Edimax\Edimax AC1200 Wireless LAN Driver\WPSService20.exe [96768] [PID.2844] [MD5.349173F7D5763B2AD3F749C94187A418] - (.Smadsoft - Smadav USB Antivirus & Additional Protectio.) -- C:\Program Files\SMADAV\SM?RTP.exe [1630208] [PID.5016] [MD5.89DEEECC036CF21CB954E2148ECA801D] - (.Realtek Semiconductor - Realtek HD Audio Manager.) -- C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [12336856] [PID.4504] [MD5.B4809A4050B208CEF4FA50F626C7DCFA] - (.VMware, Inc. - VMware Host Network Access Status Tray Appl.) -- E:\hamza\hqtray.exe [64048] [PID.5528] [MD5.EF3E22DB024654232D9232CD16D37615] - (.BlueStack Systems, Inc. - BlueStacks Agent.) -- C:\Program Files\BlueStacks\HD-Agent.exe [888440] [PID.4568] [MD5.107AFCBC31E25314E56B69EEC25885BD] - (.ESET - ESET Main GUI.) -- C:\Program Files\ESET\ESET Smart Security\egui.exe [5088456] [PID.7880] [MD5.3AE97CB476F6DF4DFA0B4378E9DD9A81] - (.Tonec Inc. - Internet Download Manager (IDM).) -- C:\Program Files\Internet Download Manager\IDMan.exe [3898960] [PID.8100] [MD5.1F9D6BB3D93BD59285BED8BE26757C7C] - (. - Viber.) -- C:\Users\samy\AppData\Local\Viber\Viber.exe [80035536] [PID.5128] [MD5.4D3FA23829B4AE3A0563113716259AC9] - (.TechSmith Corporation - Snagit.) -- C:\Program Files\TechSmith\Snagit 12\Snagit32.exe [7434560] [PID.3068] [MD5.84289E333459DD1C5E9F2DC204FB1608] - (.TechSmith Corporation - Snagit RPC Helper.) -- C:\Program Files\TechSmith\Snagit 12\SnagPriv.exe [151872] [PID.3028] [MD5.E9C6EF9437ECB30911488F9313AD821A] - (.Tonec Inc. - Internet Download Manager agent for click m.) -- C:\Program Files\Internet Download Manager\IEMonitor.exe [269848] [PID.1032] [MD5.4AAA6D76DA9A243A4A6FC499EEC1C4A4] - (.Realtek - Switch USB2.0/USB3.0 for WinXP SP2+ ~ Win8.) -- C:\Windows\SwUSB.exe [445512] [PID.7312] [MD5.0A1810F3CF866F67856C8A4E98194493] - (.TechSmith Corporation - TechSmith HTML Help Helper.) -- C:\Program Files\TechSmith\Snagit 12\TscHelp.exe [46080] [PID.7676] [MD5.749A4EA9D92161BDA3CD59BBF6706949] - (.TechSmith Corporation - Snagit Editor.) -- C:\Program Files\TechSmith\Snagit 12\snagiteditor.exe [8604992] [PID.4948] [MD5.59499B4B9127191704FAAF58E220F85D] - (.Internet Download Manager, Tonec Inc. - Broker for reading of IDM settings.) -- C:\Program Files\Internet Download Manager\idmBroker.exe [69144] [PID.3760] ---\\ Google Chrome, Start,Search,Extensions (G0,G1,G2) (20) - 1s G0 - GCSP: Secure Preferences [User Data\Default][HomePage] http://www.google.com/ G0 - GCSP: Secure Preferences [User Data\Default][HomePage] http://www.trovigo.com/ =>PUP.Optional.Trovigo G0 - GCSP: Secure Preferences [User Data\Default][HomePage] http://www.arabyonline.com/ =>Trojan.Vonteera G0 - GCSP: Secure Preferences [User Data\Default][HomePage] http://arabia.msn.com/ G0 - GCSP: Secure Preferences [User Data\Default][HomePage] http://www.istartsurf.com/ =>PUP.Optional.IsStart G2 - GCE: Preference [User Data\Default] [aapocclcgogkmnckokdopfmhonfmgoek] Google Chrome manifest =>.Google Inc. G2 - GCE: Preference [User Data\Default] [aohghmighlieiainnegkcijnfilokake] Google Chrome manifest =>.Google Inc. G2 - GCE: Preference [User Data\Default] [apdfllckaahabafndbhieahigkjlhalf] Google Chrome manifest =>.Google Inc. G2 - GCE: Preference [User Data\Default] [bgbojmobaekecckmomemopckmeipecij] __MSG_extension_name__ G2 - GCE: Preference [User Data\Default] [bibbkdilejnhmpilleppebbkmcnknfli] Image Dictionary G2 - GCE: Preference [User Data\Default] [blpcfgokakmgnkcojhhkbfbldkacnbeo] Google Chrome manifest =>.Google Inc. G2 - GCE: Preference [User Data\Default] [chphlpgkkbolifaimnlloiipkdnihall] OneTab G2 - GCE: Preference [User Data\Default] [coobgpohoikkiipiblmjeljniedjpjpf] Google Chrome manifest =>.Google Inc. G2 - GCE: Preference [User Data\Default] [felcaaldnbdncclmgdcncolpebgiejap] Google Chrome manifest =>.Google Inc. G2 - GCE: Preference [User Data\Default] [gighmmpiobklfepjocnamgkkbiglidom] AdBlock G2 - GCE: Preference [User Data\Default] [klbibkeccnjlkjkiokjodocebajanakg] The Great Suspender G2 - GCE: Preference [User Data\Default] [ngpampappnmepgilojfohadhhmbhlaek] IDM Integration Module G2 - GCE: Preference [User Data\Default] [nmgcfemagnogdodbambjhdcmfcpicngl] Norton Safe G2 - GCE: Preference [User Data\Default] [nmmhkkegccagdldgiimedpiccmgmieda] Google Chrome manifest =>.Google Inc. G2 - GCE: Preference [User Data\Default] [pjkljhegncpnkpknbcohdijeoejaedia] Google Chrome manifest =>.Google Inc. ---\\ Internet Explorer Extensions, Start, Search (R4,R3,R0,R1) (9) - 0s R0 - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com/ R0 - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/ R1 - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/ R1 - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/ R1 - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/ R1 - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:noadd-ons R1 - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:securityrisk R1 - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/ R3 - URLSearchHook: (no name) - {CFBFAE00-17A6-11D0-99CB-00C04FD64497} Orphean =>.Microsoft Internet Explorer ---\\ Internet Explorer, Proxy Management (R5) (4) - 0s R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,MigrateProxy = 1 R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,EnableHttp1_1 = 1 R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyHttp1.1 = 1 R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigProxy = wininet.dll ---\\ Line Analysis F0, F1, F2, F3 - IniFiles, Auto loading programs (3) - 1s F2 - REG:system.ini: UserInit=C:\Windows\system32\userinit.exe (.Microsoft Corporation.) F2 - REG:system.ini: Shell=C:\WINDOWS\explorer.exe (.Microsoft Corporation.) F2 - REG:system.ini: VMApplet=C:\WINDOWS\system32\SystemPropertiesPerformance.exe (.Microsoft Corporation.) ---\\ Hosts file redirection (O1) (1) - 0s ~ Le fichier hôte est sain (The hosts file is clean) (21) ---\\ Browser Helper Object (BHO) (O2) (1) - 0s O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} . (.Internet Download Manager, Tonec Inc. - IDM Browser Helper Object.) -- C:\Program Files\Internet Download Manager\IDMIECC.dll ---\\ Auto loading programs from Registry and folders (O4) (18) - 1s O4 - HKLM\..\Run: [RTHDVCPL] . (.Realtek Semiconductor - Realtek HD Audio Manager.) -- C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe O4 - HKLM\..\Run: [VMware hqtray] . (.VMware, Inc. - VMware Host Network Access Status Tray Appl.) -- E:\hamza\hqtray.exe O4 - HKLM\..\Run: [BlueStacks Agent] . (.BlueStack Systems, Inc. - BlueStacks Agent.) -- C:\Program Files\BlueStacks\HD-Agent.exe O4 - HKLM\..\Run: [egui] . (.ESET - ESET Main GUI.) -- C:\Program Files\ESET\ESET Smart Security\egui.exe O4 - HKCU\..\Run: [Skype] . (.Skype Technologies S.A. - Skype.) -- C:\Program Files\Skype\Phone\Skype.exe O4 - HKCU\..\Run: [BingSvc] . (.© 2015 Microsoft Corporation - Microsoft Bing Service.) -- C:\Users\samy\AppData\Local\Microsoft\BingSvc\BingSvc.exe O4 - HKCU\..\Run: [IDMan] . (.Tonec Inc. - Internet Download Manager (IDM).) -- C:\Program Files\Internet Download Manager\IDMan.exe O4 - HKCU\..\Run: [OneDrive] . (.Microsoft Corporation - Microsoft OneDrive.) -- C:\Users\samy\AppData\Local\Microsoft\OneDrive\OneDrive.exe O4 - HKCU\..\Run: [GoogleChromeAutoLaunch_1B84C0C1EC1010B72EBDFEC4964B253E] . (.Google Inc. - Google Chrome.) -- C:\Program Files\Google\Chrome\Application\chrome.exe O4 - HKCU\..\Run: [Viber] . (. - Viber.) -- C:\Users\samy\AppData\Local\Viber\Viber.exe O4 - HKUS\S-1-5-19\..\Run: [OneDriveSetup] . (.Microsoft Corporation - Microsoft OneDrive Setup.) -- C:\Windows\System32\OneDriveSetup.exe O4 - HKUS\S-1-5-20\..\Run: [OneDriveSetup] . (.Microsoft Corporation - Microsoft OneDrive Setup.) -- C:\Windows\System32\OneDriveSetup.exe O4 - HKUS\S-1-5-21-2935308778-1239240103-3368453402-1001\..\Run: [Skype] . (.Skype Technologies S.A. - Skype.) -- C:\Program Files\Skype\Phone\Skype.exe O4 - HKUS\S-1-5-21-2935308778-1239240103-3368453402-1001\..\Run: [BingSvc] . (.© 2015 Microsoft Corporation - Microsoft Bing Service.) -- C:\Users\samy\AppData\Local\Microsoft\BingSvc\BingSvc.exe O4 - HKUS\S-1-5-21-2935308778-1239240103-3368453402-1001\..\Run: [IDMan] . (.Tonec Inc. - Internet Download Manager (IDM).) -- C:\Program Files\Internet Download Manager\IDMan.exe O4 - HKUS\S-1-5-21-2935308778-1239240103-3368453402-1001\..\Run: [OneDrive] . (.Microsoft Corporation - Microsoft OneDrive.) -- C:\Users\samy\AppData\Local\Microsoft\OneDrive\OneDrive.exe O4 - HKUS\S-1-5-21-2935308778-1239240103-3368453402-1001\..\Run: [GoogleChromeAutoLaunch_1B84C0C1EC1010B72EBDFEC4964B253E] . (.Google Inc. - Google Chrome.) -- C:\Program Files\Google\Chrome\Application\chrome.exe O4 - HKUS\S-1-5-21-2935308778-1239240103-3368453402-1001\..\Run: [Viber] . (. - Viber.) -- C:\Users\samy\AppData\Local\Viber\Viber.exe ---\\ Global shortcuts Startup (O4G) (5) - 5s O4 - GS\Quicklaunch [__vmware_user__]: QQPlayer.lnk . (.Tencent Technology Company limited - QQ Player.) C:\Program Files\Tencent\QQPlayer\QQPlayer.exe =>PUP.Optional.TencentAddressBar O4 - GS\Quicklaunch [Administrator]: QQPlayer.lnk . (.Tencent Technology Company limited - QQ Player.) C:\Program Files\Tencent\QQPlayer\QQPlayer.exe =>PUP.Optional.TencentAddressBar O4 - GS\Quicklaunch [DefaultAccount]: QQPlayer.lnk . (.Tencent Technology Company limited - QQ Player.) C:\Program Files\Tencent\QQPlayer\QQPlayer.exe =>PUP.Optional.TencentAddressBar O4 - GS\Quicklaunch [Guest]: QQPlayer.lnk . (.Tencent Technology Company limited - QQ Player.) C:\Program Files\Tencent\QQPlayer\QQPlayer.exe =>PUP.Optional.TencentAddressBar O4 - GS\Quicklaunch [samy]: QQPlayer.lnk . (.Tencent Technology Company limited - QQ Player.) C:\Program Files\Tencent\QQPlayer\QQPlayer.exe =>PUP.Optional.TencentAddressBar ---\\ Lop.com/Domain Hijackers (O17) (2) - 0s O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1 O17 - HKLM\System\CS1\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1 ---\\ Non Microsoft non disabled Windows XP/NT/2000 Services (O23) (15) - 3s O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) . (.Adobe Systems Incorporated - Adobe Acrobat Update Service.) - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe O23 - Service: BlueStacks Log Rotator Service (BstHdLogRotatorSvc) . (.BlueStack Systems, Inc. - BlueStacks Log Rotator Service.) - C:\Program Files\BlueStacks\HD-LogRotatorService.exe O23 - Service: BlueStacks Updater Service (BstHdUpdaterSvc) . (.BlueStack Systems, Inc. - BlueStacks Updater Service.) - C:\Program Files\BlueStacks\HD-UpdaterService.exe O23 - Service: ESET Service (ekrn) . (.ESET - ESET Service.) - C:\Program Files\ESET\ESET Smart Security\ekrn.exe O23 - Service: ÎÏãÉ Google Update (gupdate) (gupdate) . (.Google Inc. - Google Installer.) - C:\Program Files\Google\Update\GoogleUpdate.exe O23 - Service: MBAMScheduler (MBAMScheduler) . (.Malwarebytes Corporation - Malwarebytes Anti-Malware.) - C:\Program Files\Malwarebytes Anti-Malware\mbamscheduler.exe O23 - Service: MBAMService (MBAMService) . (.Malwarebytes Corporation - Malwarebytes Anti-Malware.) - C:\Program Files\Malwarebytes Anti-Malware\mbamservice.exe O23 - Service: RunSwUSB (RunSwUSB) . (.Copyright (C) 2012-2013 - .) - C:\Windows\runSW.exe O23 - Service: Skype Updater (SkypeUpdate) . (.Skype Technologies - Skype Updater Service.) - C:\Program Files\Skype\Updater\Updater.exe O23 - Service: TechSmith Uploader Service (TechSmith Uploader Service) . (.TechSmith Corporation - TechSmith Uploader Service.) - C:\Program Files\Common Files\TechSmith Shared\Uploader\UploaderService.exe O23 - Service: VMware Authorization Service (VMAuthdService) . (.VMware, Inc. - VMware Authorization Service.) - E:\hamza\vmware-authd.exe O23 - Service: VMware DHCP Service (VMnetDHCP) . (.VMware, Inc. - VMware VMnet DHCP service.) - C:\Windows\System32\vmnetdhcp.exe O23 - Service: VMware USB Arbitration Service (VMUSBArbService) . (.VMware, Inc. - VMware USB Arbitration Service.) - C:\Program Files\Common Files\VMware\USB\vmware-usbarbitrator.exe O23 - Service: VMware NAT Service (VMware NAT Service) . (.VMware, Inc. - VMware NAT Service.) - C:\Windows\System32\vmnat.exe O23 - Service: WPS2.0 HW PBC Service (WPSService20) . (.Copyright (C) 2012~2013 - .) - C:\Program Files\Edimax\Edimax AC1200 Wireless LAN Driver\WPSService20.exe ---\\ Task Planned Automatically (O39) (27) - 6s [MD5.E3FB05F33E1404AD606B1E1FE7C323C3] [APT] [Adobe Acrobat Update Task] (.Adobe Systems Incorporated.) -- C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [998104] [MD5.DD3A4BEBE7EA3E75F71F3D9E9E2AA016] [APT] [AutoKMS] (.CODYQX4.) -- C:\Windows\AutoKMS\AutoKMS.exe [3798528] =>HackTool.AutoKMS [MD5.00000000000000000000000000000000] [APT] [Driver Booster SkipUAC (samy)] (.CODYQX4.) -- C:\Program Files\IObit\Driver Booster\DriverBooster.exe (.not file.) [0] =>HackTool.AutoKMS [MD5.00000000000000000000000000000000] [APT] [Driver Booster Update] (.CODYQX4.) -- C:\Users\samy\Desktop\s8fmi.IObit.Driver.Booster.Pro.2.4.0.19..Portable.Multilingual_2\s8fmi.IObit.Driver.Booster.Pro.2.4.0.19..Portable.Multilingual\App\Driver Booster\AutoUpdate.exe (.not file.) [0] =>HackTool.AutoKMS [MD5.00000000000000000000000000000000] [APT] [DriverNavigator Scheduled Scan] (.CODYQX4.) -- C:\Program Files\Easeware\DriverNavigator\DriverNavigator.exe (.not file.) [0] =>HackTool.AutoKMS [MD5.00000000000000000000000000000000] [APT] [DriverToolkit Autorun] (.CODYQX4.) -- C:\Program Files\DriverToolkit\DriverToolkit.exe (.not file.) [0] =>HackTool.AutoKMS [MD5.E1B44A75947137F4143308D566889837] [APT] [GoogleUpdateTaskMachineCore] (.Google Inc..) -- C:\Program Files\Google\Update\GoogleUpdate.exe [107848] [MD5.E1B44A75947137F4143308D566889837] [APT] [GoogleUpdateTaskMachineUA] (.Google Inc..) -- C:\Program Files\Google\Update\GoogleUpdate.exe [107848] [MD5.00000000000000000000000000000000] [APT] [smadav] (.Authors.) -- C:\Program Files\Smadav\SM?RTP.exe [1630208] [MD5.E0DEBE808C0FC71F6CAAB979547F84CD] [APT] [TechSmith Updater] (.TechSmith Corporation.) -- C:\Program Files\Common Files\TechSmith Shared\Updater\TSCUpdClt.exe [56704] [MD5.00000000000000000000000000000000] [APT] [Windows 10 Manager - Privacy Protector] (.TechSmith Corporation.) -- C:\Program Files\Yamicsoft\Windows 10 Manager\PrivacyProtector.exe (.not file.) [0] O39 - APT: Automatic Planified Task - (...) -- C:\WINDOWS\Tasks\CreateExplorerShellUnelevatedTask.job [214] O39 - APT: DriverNavigator Scheduled Scan - (.CODYQX4.) -- C:\WINDOWS\Tasks\DriverNavigator Scheduled Scan.job [460] =>HackTool.AutoKMS O39 - APT: DriverToolkit Autorun - (.CODYQX4.) -- C:\WINDOWS\Tasks\DriverToolkit Autorun.job [370] =>HackTool.AutoKMS O39 - APT: GoogleUpdateTaskMachineCore - (.Google Inc..) -- C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job [916] O39 - APT: GoogleUpdateTaskMachineUA - (.Google Inc..) -- C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job [920] O39 - APT: Windows 10 Manager - Privacy Protector - (.TechSmith Corporation.) -- C:\WINDOWS\Tasks\Windows 10 Manager - Privacy Protector.job [322] O39 - APT: Adobe Acrobat Update Task - (.Adobe Systems Incorporated.) -- C:\WINDOWS\System32\Tasks\Adobe Acrobat Update Task [3960] O39 - APT: AutoKMS - (.CODYQX4.) -- C:\WINDOWS\System32\Tasks\AutoKMS [3808] =>HackTool.AutoKMS O39 - APT: Driver Booster SkipUAC (samy) - (.CODYQX4.) -- C:\WINDOWS\System32\Tasks\Driver Booster SkipUAC (samy) [3062] =>HackTool.AutoKMS O39 - APT: DriverNavigator Scheduled Scan - (.CODYQX4.) -- C:\WINDOWS\System32\Tasks\DriverNavigator Scheduled Scan [3956] =>HackTool.AutoKMS O39 - APT: DriverToolkit Autorun - (.CODYQX4.) -- C:\WINDOWS\System32\Tasks\DriverToolkit Autorun [2824] =>HackTool.AutoKMS O39 - APT: GoogleUpdateTaskMachineCore - (.Google Inc..) -- C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineCore [3746] O39 - APT: GoogleUpdateTaskMachineUA - (.Google Inc..) -- C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineUA [3978] O39 - APT: smadav - (.Authors.) -- C:\WINDOWS\System32\Tasks\smadav [3262] O39 - APT: TechSmith Updater - (.TechSmith Corporation.) -- C:\WINDOWS\System32\Tasks\TechSmith Updater [3898] O39 - APT: Windows 10 Manager - Privacy Protector - (.TechSmith Corporation.) -- C:\WINDOWS\System32\Tasks\Windows 10 Manager - Privacy Protector [2712] ---\\ Software installed (O42) (32) - 16s O42 - Logiciel: BlueStacks App Player - (.BlueStack Systems, Inc..) [HKLM] -- BlueStacks App Player O42 - Logiciel: FileViewPro - (.Solvusoft Corporation.) [HKLM] -- FileViewPro_is1 O42 - Logiciel: Google Chrome - (.Google Incý.ý.) [HKLM] -- Google Chrome O42 - Logiciel: Hard Disk Low Level Format Tool 4.25 - (.HDDGURU.) [HKLM] -- Hard Disk Low Level Format Tool_is1 O42 - Logiciel: HD Tune Pro 5.50 - (.EFD Software.) [HKLM] -- HD Tune Pro_is1 O42 - Logiciel: Internet Download Manager - (.Tonec Inc..) [HKLM] -- Internet Download Manager O42 - Logiciel: Malwarebytes Anti-Malware version 2.1.8.1057 - (.Malwarebytes Corporation.) [HKLM] -- Malwarebytes Anti-Malware_is1 O42 - Logiciel: SoftOrbits Flash Drive Recovery 2.3 - (.SoftOrbits.) [HKLM] -- SoftOrbits Flash Drive Recovery_is1 O42 - Logiciel: UltraISO Premium V9.62 - (...) [HKLM] -- UltraISO_is1 O42 - Logiciel: VMware Player - (.VMware, Inc.) [HKLM] -- VMware_Player O42 - Logiciel: WinRAR 5.21 (32-bit) - (.win.rar GmbH.) [HKLM] -- WinRAR archiver O42 - Logiciel: HDD Regenerator - (.Abstradrome.) [HKLM] -- {2445981B-A23B-4A0E-AD15-3D391BDAEC3E} O42 - Logiciel: Skype™ 7.6 - (.Skype Technologies S.A..) [HKLM] -- {24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7} O42 - Logiciel: BlueStacks Notification Center - (.BlueStack Systems, Inc..) [HKLM] -- {3792811C-832F-4392-B44A-24092901EDDC} O42 - Logiciel: Snagit 12 - (.TechSmith Corporation.) [HKLM] -- {50f2d2b0-9e6e-466f-b418-b3526b61aa3f} O42 - Logiciel: Snagit 12 - (.TechSmith Corporation.) [HKLM] -- {588591F5-74D7-4646-87C5-6A07E526F303} O42 - Logiciel: Google Update Helper - (.Google Inc..) [HKLM] -- {60EC980A-BDA2-4CB6-A427-B07A5498B4CA} O42 - Logiciel: Revo Uninstaller Pro 3.0.2 - (.VS Revo Group, Ltd..) [HKLM] -- {67579783-0FB7-4F7B-B881-E5BE47C9DBE0}_is1 O42 - Logiciel: Skype Click to Call - (.Microsoft Corporation.) [HKLM] -- {6D1221A9-17BF-4EC0-81F2-27D30EC30701} O42 - Logiciel: SMADAV version 10.1.1 - (.SmadSoft.) [HKLM] -- {8B9FA5FF-3E61-4658-B0DA-E6DDB46D6BAD}_is1 O42 - Logiciel: Eassos PartitionGuru Free 3.7.0 - (.Eassos Co., Ltd..) [HKLM] -- {971F12D0-D834-4BAC-BD22-8769EBA08106}_is1 O42 - Logiciel: VMware Player - (.VMware, Inc..) [HKLM] -- {A53A11EA-0095-493F-86FA-A15E8A86A405} O42 - Logiciel: Adobe Refresh Manager - (.Adobe Systems Incorporated.) [HKLM] -- {AC76BA86-0804-1033-1959-001824147215} O42 - Logiciel: Adobe Reader XI (11.0.12) - (.Adobe Systems Incorporated.) [HKLM] -- {AC76BA86-7AD7-1033-7B44-AB0000000001} O42 - Logiciel: @BIOS - (.GIGABYTE.) [HKLM] -- {B2DC3F08-2EB2-49A5-AA24-15DFC8B1CB83} O42 - Logiciel: Edimax AC1200 Wireless LAN Driver - (.Edimax Technology Co..) [HKLM] -- {B63CCD1C-A133-4DF8-8306-DA0387231152} O42 - Logiciel: ESET Smart Security - (.ESET, spol s r. o..) [HKLM] -- {D66C9F03-5F7C-4A4F-A4D0-7D04FCD426AE} O42 - Logiciel: Oracle VM VirtualBox 4.3.12_ZZZZ - (.Oracle Corporation.) [HKLM] -- {D90E08B8-E7BB-4D29-8249-8670D4CC24BD} O42 - Logiciel: Realtek High Definition Audio Driver - (.Realtek Semiconductor Corp..) [HKLM] -- {F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC} O42 - Logiciel: tools-windows - (.VMware, Inc..) [HKLM] -- {FFD9383C-01D5-4897-A954-43AF599AED30} O42 - Logiciel: QQ??3.7 - (.????(??)????.) [HKCU] -- QQPlayer O42 - Logiciel: Viber - (.Viber Media Inc.) [HKCU] -- Viber ---\\ HKCU & HKLM Software Keys (90) - 17s HKLM\SOFTWARE\Adobe HKLM\SOFTWARE\Belarc HKLM\SOFTWARE\BlueStacks HKLM\SOFTWARE\CA561A HKLM\SOFTWARE\Chicony HKLM\SOFTWARE\CyberLink HKLM\SOFTWARE\Dolby HKLM\SOFTWARE\EasyBoot Systems HKLM\SOFTWARE\Edimax Technology Co. HKLM\SOFTWARE\ESET HKLM\SOFTWARE\GIGABYTE HKLM\SOFTWARE\Google HKLM\SOFTWARE\HaaliMkx HKLM\SOFTWARE\IM Providers HKLM\SOFTWARE\Intel HKLM\SOFTWARE\Internet Download Manager HKLM\SOFTWARE\IObit HKLM\SOFTWARE\Knowles HKLM\SOFTWARE\Licenses HKLM\SOFTWARE\Macromedia HKLM\SOFTWARE\MozillaPlugins HKLM\SOFTWARE\Nahimic HKLM\SOFTWARE\Nuance HKLM\SOFTWARE\ODBC HKLM\SOFTWARE\OEM HKLM\SOFTWARE\Oracle HKLM\SOFTWARE\Partner HKLM\SOFTWARE\Realtek HKLM\SOFTWARE\RegisteredApplications HKLM\SOFTWARE\RtWLan HKLM\SOFTWARE\Skype HKLM\SOFTWARE\SRS Labs HKLM\SOFTWARE\SUPERAntiSpyware.com HKLM\SOFTWARE\SwUSB HKLM\SOFTWARE\TechSmith HKLM\SOFTWARE\Tencent =>PUP.Optional.TencentAddressBar HKLM\SOFTWARE\ThinPrint HKLM\SOFTWARE\Ubisoft HKLM\SOFTWARE\VMware, Inc. HKLM\SOFTWARE\Volatile HKLM\SOFTWARE\Waves Audio HKLM\SOFTWARE\Windows HKLM\SOFTWARE\WinRAR HKCU\SOFTWARE\8GadgetPack HKCU\SOFTWARE\Adobe HKCU\SOFTWARE\Anvisoft HKCU\SOFTWARE\AppDataLow HKCU\SOFTWARE\Clipboarder HKCU\SOFTWARE\CompSoft HKCU\SOFTWARE\CoreAAC HKCU\SOFTWARE\CyberLink HKCU\SOFTWARE\DownloadManager HKCU\SOFTWARE\DriverToolkit HKCU\SOFTWARE\DSP-worx HKCU\SOFTWARE\EasyBoot Systems HKCU\SOFTWARE\EFD Software HKCU\SOFTWARE\ESET HKCU\SOFTWARE\Gabest HKCU\SOFTWARE\Google HKCU\SOFTWARE\HashTab HKCU\SOFTWARE\IM Providers HKCU\SOFTWARE\Intel HKCU\SOFTWARE\LockHunter HKCU\SOFTWARE\Macromedia HKCU\SOFTWARE\Mine HKCU\SOFTWARE\Mirage HKCU\SOFTWARE\Mozilla HKCU\SOFTWARE\MozillaPlugins HKCU\SOFTWARE\Netscape HKCU\SOFTWARE\QtProject HKCU\SOFTWARE\Realtek HKCU\SOFTWARE\RegisteredApplications HKCU\SOFTWARE\Skype HKCU\SOFTWARE\SMAD?V HKCU\SOFTWARE\softorbits HKCU\SOFTWARE\SUPERAntiSpyware.com HKCU\SOFTWARE\TechSmith HKCU\SOFTWARE\TempCleaner HKCU\SOFTWARE\Tencent =>PUP.Optional.TencentAddressBar HKCU\SOFTWARE\Ubisoft HKCU\SOFTWARE\Viber HKCU\SOFTWARE\VMware, Inc. HKCU\SOFTWARE\VS Revo Group HKCU\SOFTWARE\WinRAR HKCU\SOFTWARE\WinRAR SFX HKCU\SOFTWARE\Yamicsoft HKCU\SOFTWARE\ZebHelpProcess Helper HKCU\SOFTWARE\ZRT Labs HKCU\SOFTWARE\AppDataLow\Software HKCU\SOFTWARE\AppDataLow\Software\ThinPrint ---\\ Contents of the Common Files folders (O43) (208) - 17s O43 - CFD: 2015/06/16 16:24:31 - [] D -- C:\Program Files\Adobe O43 - CFD: 2015/07/11 14:48:30 - [] D -- C:\Program Files\BlueStacks O43 - CFD: 2015/07/17 17:26:47 - [] D -- C:\Program Files\CalendarTool O43 - CFD: 2015/07/17 19:38:50 - [0] D -- C:\Program Files\CinemaP-1.9cV17.07 =>PUP.Optional.CrossRider O43 - CFD: 2015/07/13 21:42:17 - [] D -- C:\Program Files\Common Files O43 - CFD: 2015/07/17 19:38:50 - [] D -- C:\Program Files\DownChecker O43 - CFD: 2015/07/12 14:21:19 - [] D -- C:\Program Files\Droid4Xext O43 - CFD: 2015/06/17 12:16:52 - [] D -- C:\Program Files\Edimax O43 - CFD: 2015/06/18 18:03:34 - [] D -- C:\Program Files\ESET O43 - CFD: 2015/07/18 17:02:46 - [] D -- C:\Program Files\FileViewPro O43 - CFD: 2015/07/14 03:49:38 - [0] D -- C:\Program Files\Flobo Hard Disk Repair O43 - CFD: 2015/07/16 09:51:17 - [] D -- C:\Program Files\Genymobile O43 - CFD: 2015/06/19 20:23:25 - [] D -- C:\Program Files\GIGABYTE O43 - CFD: 2015/07/05 02:59:37 - [] D -- C:\Program Files\Google O43 - CFD: 2015/06/21 08:00:47 - [] D -- C:\Program Files\HD Tune Pro O43 - CFD: 2015/06/26 20:33:46 - [] D -- C:\Program Files\HDD Regenerator O43 - CFD: 2015/06/20 18:16:02 - [] D -- C:\Program Files\HDDGURU LLF Tool O43 - CFD: 2015/06/19 20:23:24 - [] HD -- C:\Program Files\InstallShield Installation Information O43 - CFD: 2015/06/17 00:24:04 - [] D -- C:\Program Files\Internet Download Manager O43 - CFD: 2015/07/14 16:47:43 - [] D -- C:\Program Files\Internet Explorer O43 - CFD: 2015/07/05 12:23:42 - [] D -- C:\Program Files\LockHunter O43 - CFD: 2015/07/10 04:07:31 - [] D -- C:\Program Files\Malwarebytes Anti-Malware O43 - CFD: 2015/06/30 09:15:29 - [] D -- C:\Program Files\Microsoft.NET O43 - CFD: 2015/07/17 19:38:47 - [] D -- C:\Program Files\MixVideoPlayer =>PUP.Optional.MixVideoPlayer O43 - CFD: 2015/07/14 07:23:20 - [] D -- C:\Program Files\MSBuild O43 - CFD: 2015/07/05 12:23:22 - [] D -- C:\Program Files\OCCTPT O43 - CFD: 2015/07/17 19:38:47 - [] D -- C:\Program Files\OLBPre =>PUP.Optional.MyPCBackup O43 - CFD: 2015/07/17 17:29:38 - [] D -- C:\Program Files\Opera O43 - CFD: 2015/06/26 12:40:48 - [] D -- C:\Program Files\Oracle O43 - CFD: 2015/07/17 19:38:47 - [] D -- C:\Program Files\OSForensics O43 - CFD: 2015/07/08 14:55:21 - [] D -- C:\Program Files\PartitionGuru Free O43 - CFD: 2015/07/13 21:35:07 - [] D -- C:\Program Files\Realtek O43 - CFD: 2015/07/14 07:23:20 - [] D -- C:\Program Files\Reference Assemblies O43 - CFD: 2015/07/04 03:23:19 - [] D -- C:\Program Files\Seagate O43 - CFD: 2015/07/11 13:12:30 - [] RD -- C:\Program Files\Skype O43 - CFD: 2015/07/12 14:05:14 - [] D -- C:\Program Files\SMADAV O43 - CFD: 2015/06/19 14:13:20 - [] D -- C:\Program Files\SoftOrbits Flash Drive Recovery O43 - CFD: 2015/06/17 00:08:40 - [] D -- C:\Program Files\TechSmith O43 - CFD: 2015/07/17 19:38:52 - [] D -- C:\Program Files\Tencent =>PUP.Optional.TencentAddressBar O43 - CFD: 2015/07/17 19:38:54 - [] D -- C:\Program Files\Ubisoft O43 - CFD: 2015/06/26 03:45:52 - [] D -- C:\Program Files\UltraISO O43 - CFD: 2015/07/11 14:11:44 - [] D -- C:\Program Files\Unlocker O43 - CFD: 2015/07/10 13:49:36 - [] D -- C:\Program Files\Unlocker Tool O43 - CFD: 2015/07/18 04:49:58 - [] D -- C:\Program Files\VS Revo Group O43 - CFD: 2015/07/17 19:39:06 - [] D -- C:\Program Files\Windows Defender O43 - CFD: 2015/06/30 11:10:54 - [] D -- C:\Program Files\Windows Journal O43 - CFD: 2015/06/30 11:03:11 - [] D -- C:\Program Files\Windows Mail O43 - CFD: 2015/06/30 11:03:11 - [] D -- C:\Program Files\Windows Media Player O43 - CFD: 2015/06/30 09:15:30 - [] D -- C:\Program Files\Windows Multimedia Platform O43 - CFD: 2015/06/30 09:15:29 - [] D -- C:\Program Files\Windows NT O43 - CFD: 2015/06/30 11:03:11 - [] D -- C:\Program Files\Windows Photo Viewer O43 - CFD: 2015/06/30 09:15:30 - [] D -- C:\Program Files\Windows Portable Devices O43 - CFD: 2015/07/18 16:59:22 - [] HD -- C:\Program Files\WindowsApps O43 - CFD: 2015/06/30 09:15:29 - [] SD -- C:\Program Files\WindowsPowerShell O43 - CFD: 2015/06/16 15:03:57 - [] D -- C:\Program Files\WinRAR O43 - CFD: 2015/07/17 19:32:03 - [] D -- C:\Program Files\Yamicsoft O43 - CFD: 2015/06/30 09:15:30 - [] RD -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility O43 - CFD: 2015/06/30 11:10:58 - [] RD -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories O43 - CFD: 2015/07/13 21:42:21 - [] RD -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools O43 - CFD: 2015/07/13 21:46:12 - [] D -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\BlueStacks O43 - CFD: 2015/07/13 21:46:12 - [] D -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Edimax Wireless LAN O43 - CFD: 2015/07/13 21:42:21 - [] D -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ESET O43 - CFD: 2015/07/18 17:02:38 - [] D -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FileViewPro O43 - CFD: 2015/07/17 17:17:38 - [0] D -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games O43 - CFD: 2015/07/13 21:42:21 - [] D -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GIGABYTE O43 - CFD: 2015/07/17 19:38:55 - [] D -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome O43 - CFD: 2015/07/13 21:46:12 - [] D -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HD Tune Pro O43 - CFD: 2015/07/13 21:46:12 - [] D -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HDD Low Level Format Tool O43 - CFD: 2015/07/13 21:46:12 - [] D -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HDD Regenerator O43 - CFD: 2015/07/13 21:46:12 - [] D -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Internet Download Manager O43 - CFD: 2015/06/30 09:15:30 - [] D -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance O43 - CFD: 2015/07/13 21:46:12 - [] D -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware O43 - CFD: 2015/07/13 21:46:12 - [] D -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PartitionGuru Free O43 - CFD: 2015/07/18 04:50:06 - [] D -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Revo Uninstaller Pro O43 - CFD: 2015/07/13 21:46:12 - [] D -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype O43 - CFD: 2015/07/13 21:46:12 - [] D -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SMADAV Antivirus O43 - CFD: 2015/07/13 21:46:12 - [] D -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SoftOrbits Flash Drive Recovery O43 - CFD: 2015/07/13 21:46:12 - [] RD -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp O43 - CFD: 2015/06/30 09:15:30 - [] RD -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools O43 - CFD: 2015/07/13 21:46:13 - [] D -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TechSmith O43 - CFD: 2015/07/13 21:46:13 - [] D -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\UltraISO O43 - CFD: 2015/07/13 21:46:13 - [] D -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VMware O43 - CFD: 2015/07/13 21:46:13 - [] D -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR O43 - CFD: 2015/06/29 03:00:47 - [] D -- C:\ProgramData\Adobe O43 - CFD: 2015/06/30 10:11:10 - [0] SHD -- C:\ProgramData\Application Data O43 - CFD: 2015/07/11 14:41:13 - [] D -- C:\ProgramData\BlueStacks O43 - CFD: 2015/07/11 14:37:54 - [] D -- C:\ProgramData\BlueStacksSetup O43 - CFD: 2015/06/30 09:15:29 - [0] D -- C:\ProgramData\Comms O43 - CFD: 2015/06/30 10:11:10 - [0] SHD -- C:\ProgramData\Desktop O43 - CFD: 2015/07/17 21:49:49 - [] D -- C:\ProgramData\DhmReu O43 - CFD: 2015/06/30 10:11:10 - [0] SHD -- C:\ProgramData\Documents O43 - CFD: 2015/07/10 02:25:31 - [] D -- C:\ProgramData\ESET O43 - CFD: 2015/07/17 05:17:00 - [0] D -- C:\ProgramData\firebird O43 - CFD: 2015/06/17 00:24:01 - [0] D -- C:\ProgramData\IDM O43 - CFD: 2015/06/16 15:07:26 - [] D -- C:\ProgramData\IObit O43 - CFD: 2015/07/05 12:23:40 - [] D -- C:\ProgramData\LHService O43 - CFD: 2015/07/02 14:55:04 - [] D -- C:\ProgramData\Malwarebytes O43 - CFD: 2015/07/13 21:54:44 - [] SD -- C:\ProgramData\Microsoft O43 - CFD: 2015/06/26 19:04:12 - [] D -- C:\ProgramData\Microsoft OneDrive O43 - CFD: 2015/06/26 19:21:47 - [] D -- C:\ProgramData\Microsoft Toolkit O43 - CFD: 2015/06/17 00:08:21 - [] D -- C:\ProgramData\Package Cache O43 - CFD: 2015/07/17 05:02:32 - [] D -- C:\ProgramData\PassMark O43 - CFD: 2015/07/13 14:22:22 - [] D -- C:\ProgramData\ProductData O43 - CFD: 2015/06/30 11:10:54 - [] D -- C:\ProgramData\regid.1991-06.com.microsoft O43 - CFD: 2015/07/13 21:46:13 - [] D -- C:\ProgramData\regid.1995-08.com.techsmith O43 - CFD: 2015/07/11 13:12:41 - [] D -- C:\ProgramData\Skype O43 - CFD: 2015/06/30 09:15:29 - [0] D -- C:\ProgramData\SoftwareDistribution O43 - CFD: 2015/06/30 10:11:10 - [0] SHD -- C:\ProgramData\Start Menu O43 - CFD: 2015/06/24 12:54:52 - [] D -- C:\ProgramData\SUPERAntiSpyware.com O43 - CFD: 2015/06/17 00:09:46 - [] D -- C:\ProgramData\TechSmith O43 - CFD: 2015/06/27 00:52:24 - [0] AD -- C:\ProgramData\TEMP O43 - CFD: 2015/06/30 10:11:10 - [0] SHD -- C:\ProgramData\Templates O43 - CFD: 2015/07/18 05:04:10 - [] D -- C:\ProgramData\Tencent =>PUP.Optional.TencentAddressBar O43 - CFD: 2015/07/12 14:03:42 - [] D -- C:\ProgramData\Thunder Network O43 - CFD: 2015/07/17 19:38:45 - [] D -- C:\ProgramData\ToolsUpdatePlatform O43 - CFD: 2015/06/26 18:59:28 - [] D -- C:\ProgramData\Users O43 - CFD: 2015/06/30 10:12:25 - [] D -- C:\ProgramData\USOPrivate O43 - CFD: 2015/06/30 10:12:24 - [] D -- C:\ProgramData\USOShared O43 - CFD: 2015/07/18 14:37:59 - [] D -- C:\ProgramData\VMware O43 - CFD: 2015/07/18 04:50:03 - [] D -- C:\ProgramData\VS Revo Group O43 - CFD: 2015/06/29 03:00:55 - [] D -- C:\Program Files\Common Files\Adobe O43 - CFD: 2015/06/26 03:45:52 - [] D -- C:\Program Files\Common Files\EZB Systems O43 - CFD: 2015/06/19 20:22:29 - [] D -- C:\Program Files\Common Files\InstallShield O43 - CFD: 2015/07/13 21:42:17 - [] D -- C:\Program Files\Common Files\microsoft shared O43 - CFD: 2015/06/30 09:15:30 - [] D -- C:\Program Files\Common Files\Services O43 - CFD: 2015/06/16 17:29:30 - [] D -- C:\Program Files\Common Files\Skype O43 - CFD: 2015/06/30 11:03:11 - [] D -- C:\Program Files\Common Files\System O43 - CFD: 2015/06/17 00:08:51 - [] D -- C:\Program Files\Common Files\TechSmith Shared O43 - CFD: 2015/07/02 01:32:55 - [] D -- C:\Program Files\Common Files\VMware O43 - CFD: 2015/06/17 10:48:21 - [] D -- C:\Users\samy\AppData\Roaming\Adobe O43 - CFD: 2015/07/17 19:38:31 - [] D -- C:\Users\samy\AppData\Roaming\CalendarTool O43 - CFD: 2015/07/18 14:48:37 - [] D -- C:\Users\samy\AppData\Roaming\DMCache O43 - CFD: 2015/06/17 12:06:57 - [] D -- C:\Users\samy\AppData\Roaming\Easeware O43 - CFD: 2015/06/18 18:15:59 - [] D -- C:\Users\samy\AppData\Roaming\ESET O43 - CFD: 2015/07/12 14:03:58 - [] D -- C:\Users\samy\AppData\Roaming\HaiYuInst O43 - CFD: 2015/06/21 08:03:35 - [] D -- C:\Users\samy\AppData\Roaming\HD Tune Pro O43 - CFD: 2015/06/17 07:41:43 - [] D -- C:\Users\samy\AppData\Roaming\Identities O43 - CFD: 2015/07/14 01:05:08 - [] D -- C:\Users\samy\AppData\Roaming\IDM O43 - CFD: 2015/07/13 15:25:32 - [] D -- C:\Users\samy\AppData\Roaming\IObit O43 - CFD: 2015/07/17 17:44:47 - [] D -- C:\Users\samy\AppData\Roaming\istartsurf =>PUP.Optional.IsStart O43 - CFD: 2015/06/27 14:21:38 - [] D -- C:\Users\samy\AppData\Roaming\LockHunter O43 - CFD: 2015/06/16 15:07:44 - [] D -- C:\Users\samy\AppData\Roaming\Macromedia O43 - CFD: 2015/07/18 12:19:20 - [] SD -- C:\Users\samy\AppData\Roaming\Microsoft O43 - CFD: 2015/07/17 17:29:29 - [0] D -- C:\Users\samy\AppData\Roaming\Opera Software O43 - CFD: 2015/07/11 14:12:32 - [] D -- C:\Users\samy\AppData\Roaming\Process Hacker 2 O43 - CFD: 2015/07/18 17:12:30 - [] D -- C:\Users\samy\AppData\Roaming\Skype O43 - CFD: 2015/07/12 01:36:47 - [] D -- C:\Users\samy\AppData\Roaming\Smadav O43 - CFD: 2015/07/17 19:38:30 - [] D -- C:\Users\samy\AppData\Roaming\Software Tool O43 - CFD: 2015/06/24 12:54:52 - [] D -- C:\Users\samy\AppData\Roaming\SUPERAntiSpyware.com O43 - CFD: 2015/07/18 05:04:10 - [] D -- C:\Users\samy\AppData\Roaming\Tencent =>PUP.Optional.TencentAddressBar O43 - CFD: 2015/07/14 16:24:12 - [] D -- C:\Users\samy\AppData\Roaming\USBSafelyRemove O43 - CFD: 2015/07/18 16:46:44 - [] D -- C:\Users\samy\AppData\Roaming\ViberPC O43 - CFD: 2015/07/02 03:32:53 - [] D -- C:\Users\samy\AppData\Roaming\VMware O43 - CFD: 2015/06/16 23:50:06 - [] D -- C:\Users\samy\AppData\Roaming\WinRAR O43 - CFD: 2015/07/14 03:19:49 - [] D -- C:\Users\samy\AppData\Roaming\Yamicsoft O43 - CFD: 2015/07/18 17:16:10 - [] D -- C:\Users\samy\AppData\Roaming\ZHP O43 - CFD: 2015/07/18 16:46:41 - [] D -- C:\Users\samy\AppData\Local\ActiveSync O43 - CFD: 2015/06/17 10:48:21 - [] D -- C:\Users\samy\AppData\Local\Adobe O43 - CFD: 2015/07/13 21:39:56 - [0] SHD -- C:\Users\samy\AppData\Local\Application Data O43 - CFD: 2015/07/11 14:34:48 - [] D -- C:\Users\samy\AppData\Local\Bluestacks O43 - CFD: 2015/06/29 14:06:08 - [] D -- C:\Users\samy\AppData\Local\Clipboarder O43 - CFD: 2015/06/26 19:01:27 - [] D -- C:\Users\samy\AppData\Local\Comms O43 - CFD: 2015/06/19 03:00:45 - [] D -- C:\Users\samy\AppData\Local\CrashDumps O43 - CFD: 2015/06/26 01:12:47 - [] D -- C:\Users\samy\AppData\Local\Diagnostics O43 - CFD: 2015/06/21 12:26:11 - [] D -- C:\Users\samy\AppData\Local\Downloaded Installations O43 - CFD: 2015/07/13 14:50:44 - [] D -- C:\Users\samy\AppData\Local\Droid4X O43 - CFD: 2015/06/18 01:28:42 - [] D -- C:\Users\samy\AppData\Local\ElevatedDiagnostics O43 - CFD: 2015/06/17 10:16:14 - [0] SHD -- C:\Users\samy\AppData\Local\EmieSiteList O43 - CFD: 2015/06/17 10:16:14 - [0] SHD -- C:\Users\samy\AppData\Local\EmieUserList O43 - CFD: 2015/06/18 18:15:59 - [] D -- C:\Users\samy\AppData\Local\ESET O43 - CFD: 2015/06/26 18:59:02 - [0] D -- C:\Users\samy\AppData\Local\GameDVR O43 - CFD: 2015/07/16 09:53:15 - [] D -- C:\Users\samy\AppData\Local\Genymobile O43 - CFD: 2015/07/05 03:00:04 - [] D -- C:\Users\samy\AppData\Local\Google O43 - CFD: 2015/06/19 12:42:02 - [] D -- C:\Users\samy\AppData\Local\GWX O43 - CFD: 2015/07/13 21:39:56 - [0] SHD -- C:\Users\samy\AppData\Local\History O43 - CFD: 2015/07/14 15:30:42 - [] D -- C:\Users\samy\AppData\Local\Microsoft O43 - CFD: 2015/07/14 00:57:01 - [] D -- C:\Users\samy\AppData\Local\MicrosoftEdge O43 - CFD: 2015/06/26 19:08:06 - [0] D -- C:\Users\samy\AppData\Local\NetworkTiles O43 - CFD: 2015/06/22 01:56:28 - [] D -- C:\Users\samy\AppData\Local\OCCT_-_Ocbase_-_Adrien_Me O43 - CFD: 2015/07/17 17:29:29 - [0] D -- C:\Users\samy\AppData\Local\Opera Software O43 - CFD: 2015/07/14 01:15:49 - [] D -- C:\Users\samy\AppData\Local\Packages O43 - CFD: 2015/06/16 14:54:42 - [0] D -- C:\Users\samy\AppData\Local\PackageStaging O43 - CFD: 2015/06/26 19:17:51 - [0] D -- C:\Users\samy\AppData\Local\PeerDistRepub O43 - CFD: 2015/06/16 15:06:37 - [] D -- C:\Users\samy\AppData\Local\Programs O43 - CFD: 2015/06/28 13:36:48 - [] D -- C:\Users\samy\AppData\Local\Publishers O43 - CFD: 2015/06/29 14:18:35 - [] D -- C:\Users\samy\AppData\Local\Sidebar7 O43 - CFD: 2015/06/16 17:29:49 - [] D -- C:\Users\samy\AppData\Local\Skype O43 - CFD: 2015/06/30 14:22:06 - [] D -- C:\Users\samy\AppData\Local\Spartan O43 - CFD: 2015/06/17 00:09:54 - [] D -- C:\Users\samy\AppData\Local\TechSmith O43 - CFD: 2015/07/18 17:16:31 - [] D -- C:\Users\samy\AppData\Local\Temp O43 - CFD: 2015/07/13 21:39:56 - [0] SHD -- C:\Users\samy\AppData\Local\Temporary Internet Files O43 - CFD: 2015/06/26 18:56:36 - [] D -- C:\Users\samy\AppData\Local\TileDataLayer O43 - CFD: 2015/07/17 17:17:46 - [0] D -- C:\Users\samy\AppData\Local\Ubisoft Game Launcher O43 - CFD: 2015/07/07 16:19:07 - [] D -- C:\Users\samy\AppData\Local\Viber O43 - CFD: 2015/07/11 10:50:56 - [] D -- C:\Users\samy\AppData\Local\VirtualStore O43 - CFD: 2015/06/28 15:19:23 - [] D -- C:\Users\samy\AppData\Local\VMware O43 - CFD: 2015/07/18 04:50:19 - [] D -- C:\Users\samy\AppData\Local\VS Revo Group O43 - CFD: 2015/07/13 21:41:09 - [] RD -- C:\Users\samy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility O43 - CFD: 2015/07/17 19:39:05 - [] RD -- C:\Users\samy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories O43 - CFD: 2015/07/14 00:46:16 - [] RD -- C:\Users\samy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools O43 - CFD: 2015/07/13 21:46:10 - [] D -- C:\Users\samy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Download Manager O43 - CFD: 2015/07/13 21:41:10 - [] D -- C:\Users\samy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance O43 - CFD: 2015/07/14 00:46:16 - [] RD -- C:\Users\samy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup O43 - CFD: 2015/07/13 21:41:10 - [] RD -- C:\Users\samy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools O43 - CFD: 2015/07/13 21:41:10 - [] D -- C:\Users\samy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Tencent =>PUP.Optional.TencentAddressBar O43 - CFD: 2015/07/13 21:46:10 - [] D -- C:\Users\samy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Unlocker Tool O43 - CFD: 2015/06/30 09:15:37 - [] RSD -- C:\Users\samy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell O43 - CFD: 2015/07/13 21:46:11 - [] D -- C:\Users\samy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR ---\\ Latest files created in Windows Prefetcher (O45) (4) - 24s O45 - LFCP:[MD5.BCACC904F4D15B1B7C200140C5EC76B0] 2015/07/17 18:43:28 A -- C:\WINDOWS\Prefetch\MIXVIDEOPLAYERSETUP.EXE-AC20AE3B.pf =>PUP.Optional.MixVideoPlayer O45 - LFCP:[MD5.2BBD1EA3C0902C300D8F1045EC9CB30C] 2015/07/17 18:49:15 A -- C:\WINDOWS\Prefetch\OLBPRE.EXE-5CC5F889.pf =>PUP.Optional.MyPCBackup O45 - LFCP:[MD5.C3597963A9885E2018D0EA1528261E18] 2015/07/17 18:43:15 A -- C:\WINDOWS\Prefetch\SPEEDUPMYPC.EXE-65B6E02C.pf =>PUP.Optional.SpeedUpMyPC O45 - LFCP:[MD5.48E5BA9FFDBAFCC89B26E9EC142D836C] 2015/07/17 18:43:24 A -- C:\WINDOWS\Prefetch\SPEEDUPMYPC.TMP-74DD751A.pf =>PUP.Optional.SpeedUpMyPC ---\\ System Drivers List (SDL) (O58) (80) - 19s O58 - SDL:2015/06/30 09:11:17 A . (.LSI - LSI 3ware SCSI Storport Driver.) -- C:\WINDOWS\System32\drivers\3ware.sys [85992] O58 - SDL:2015/07/03 15:59:30 A . (.Malwarebytes Corporation - Malwarebytes Anti-Malware.) -- C:\WINDOWS\System32\drivers\4C0D3ECE.sys [98520] O58 - SDL:2015/06/30 09:11:17 A . (.PMC-Sierra - PMC-Sierra Storport Driver For SPC8x6G SAS.) -- C:\WINDOWS\System32\drivers\adp80xx.sys [1038312] O58 - SDL:2015/06/30 09:11:17 A . (.Advanced Micro Devices - AHCI 1.3 Device Driver.) -- C:\WINDOWS\System32\drivers\amdsata.sys [75240] O58 - SDL:2015/06/30 09:11:17 A . (.AMD Technologies Inc. - AMD Technology AHCI Compatible Controller D.) -- C:\WINDOWS\System32\drivers\amdsbs.sys [215528] O58 - SDL:2015/06/30 09:11:17 A . (.Advanced Micro Devices - Storage Filter Driver.) -- C:\WINDOWS\System32\drivers\amdxata.sys [23016] O58 - SDL:2015/06/30 09:11:17 A . (.PMC-Sierra, Inc. - Adaptec SAS RAID WS03 Driver.) -- C:\WINDOWS\System32\drivers\arcsas.sys [116712] O58 - SDL:2015/06/30 09:11:17 A . (.Windows (R) Win 7 DDK provider - BCM Function 2 Device Driver.) -- C:\WINDOWS\System32\drivers\bcmfn2.sys [16088] O58 - SDL:2015/01/30 16:13:30 A . (.ESET - Amon monitor.) -- C:\WINDOWS\System32\drivers\eamonm.sys [193464] O58 - SDL:2015/01/30 16:13:30 A . (.ESET - Devmon monitor.) -- C:\WINDOWS\System32\drivers\edevmon.sys [190880] O58 - SDL:2015/03/19 12:51:22 A . (.ESET - ESET ELAM driver.) -- C:\WINDOWS\System32\drivers\eelam.sys [14496] O58 - SDL:2015/01/30 16:13:30 A . (.ESET - ESET Helper driver.) -- C:\WINDOWS\System32\drivers\ehdrv.sys [135808] O58 - SDL:2015/05/21 11:10:58 A . (.ESET - ESET OPP Keyboard Filter.) -- C:\WINDOWS\System32\drivers\ekbdflt.sys [110528] O58 - SDL:2015/01/30 16:13:30 A . (.ESET - ESET Personal Firewall driver.) -- C:\WINDOWS\System32\drivers\epfw.sys [176448] O58 - SDL:2015/01/30 16:13:30 A . (.ESET - Epfw NDIS LightWeight Filter.) -- C:\WINDOWS\System32\drivers\EpfwLWF.sys [37928] O58 - SDL:2015/01/30 16:13:30 A . (.ESET - ESET Personal Firewall driver.) -- C:\WINDOWS\System32\drivers\epfwwfp.sys [51824] O58 - SDL:2002/06/03 10:18:32 A . (.Creative Technology Ltd. - ENSONIQ AudioPCI 97 WDM Audio Miniport.) -- C:\WINDOWS\System32\drivers\es1371mp.sys [40832] O58 - SDL:2009/10/22 03:47:52 A . (.VMware, Inc. - VMware USB monitor.) -- C:\WINDOWS\System32\drivers\hcmon.sys [32304] O58 - SDL:2015/06/30 09:11:17 A . (.Hewlett-Packard Company - Smart Array SAS/SATA Controller Media Drive.) -- C:\WINDOWS\System32\drivers\HpSAMD.sys [56808] O58 - SDL:2015/06/16 15:07:26 A . (.REALiX(tm) - HWiNFO x86 Kernel Driver.) -- C:\WINDOWS\System32\drivers\HWiNFO32.SYS [23840] O58 - SDL:2006/10/20 23:32:32 A . (.Chicony - Numpad.sys.) -- C:\WINDOWS\System32\drivers\i8042HDR.sys [13224] O58 - SDL:2015/06/30 09:11:17 A . (.Intel Corporation - Intel(R) Atom(TM) Processor GPIO Controller.) -- C:\WINDOWS\System32\drivers\iaiogpio.sys [22016] O58 - SDL:2015/06/30 09:11:17 A . (.Intel Corporation - Intel(R) Atom(TM) Processor I2C Controller.) -- C:\WINDOWS\System32\drivers\iaioi2c.sys [61936] O58 - SDL:2015/06/30 09:11:17 A . (.Intel Corporation - Intel(R) Rapid Storage Technology driver (i.) -- C:\WINDOWS\System32\drivers\iaStorAV.sys [524776] O58 - SDL:2015/06/30 09:11:17 A . (.Intel Corporation - Intel Matrix Storage Manager driver - ia32.) -- C:\WINDOWS\System32\drivers\iaStorV.sys [333800] O58 - SDL:2015/04/18 03:06:24 A . (.Tonec Inc. - Internet Download Manager WFP Driver.) -- C:\WINDOWS\System32\drivers\idmwfp.sys [122432] O58 - SDL:2015/06/26 19:09:46 A . (.Intel Corporation - Intel Graphics Kernel Mode Driver.) -- C:\WINDOWS\System32\drivers\igdkmd32.sys [4815872] O58 - SDL:2015/06/30 09:11:17 A . (.LSI Corporation - LSI Fusion-MPT SAS Driver (StorPort).) -- C:\WINDOWS\System32\drivers\lsi_sas.sys [94184] O58 - SDL:2015/06/30 09:11:17 A . (.LSI Corporation - LSI SAS Gen2 Driver (StorPort).) -- C:\WINDOWS\System32\drivers\lsi_sas2i.sys [89064] O58 - SDL:2015/06/30 09:11:17 A . (.Avago Technologies - Avago SAS Gen3 Driver (StorPort).) -- C:\WINDOWS\System32\drivers\lsi_sas3i.sys [83432] O58 - SDL:2015/06/30 09:11:17 A . (.LSI Corporation - LSI SSS PCIe/Flash Driver (StorPort).) -- C:\WINDOWS\System32\drivers\lsi_sss.sys [69608] O58 - SDL:2015/06/18 08:41:36 A . (.Malwarebytes Corporation - Malwarebytes Anti-Malware.) -- C:\WINDOWS\System32\drivers\mbam.sys [23256] O58 - SDL:2015/06/18 08:41:42 A . (.Malwarebytes Corporation - Malwarebytes Chameleon Protection Driver.) -- C:\WINDOWS\System32\drivers\mbamchameleon.sys [94936] O58 - SDL:2015/07/18 16:44:47 A . (.Malwarebytes Corporation - Malwarebytes Anti-Malware.) -- C:\WINDOWS\System32\drivers\MBAMSwissArmy.sys [98520] O58 - SDL:2015/06/30 09:11:18 A . (.Avago Technologies - MEGASAS RAID Controller Driver for Windows.) -- C:\WINDOWS\System32\drivers\megasas.sys [52200] O58 - SDL:2015/06/30 09:11:18 A . (.LSI Corporation, Inc. - LSI MegaRAID Software RAID Driver.) -- C:\WINDOWS\System32\drivers\megasr.sys [464872] O58 - SDL:2015/06/30 09:11:18 A . (.Marvell Semiconductor, Inc. - Marvell Flash Controller Driver.) -- C:\WINDOWS\System32\drivers\mvumis.sys [58344] O58 - SDL:2015/06/18 08:41:58 A . (.Malwarebytes Corporation - Malwarebytes Web Access Control.) -- C:\WINDOWS\System32\drivers\mwac.sys [51928] O58 - SDL:2015/06/30 09:11:18 A . (.NVIDIA Corporation - NVIDIA® nForce(TM) RAID Driver.) -- C:\WINDOWS\System32\drivers\nvraid.sys [119272] O58 - SDL:2015/06/30 09:11:18 A . (.NVIDIA Corporation - NVIDIA® nForce(TM) Sata Performance Driver.) -- C:\WINDOWS\System32\drivers\nvstor.sys [142312] O58 - SDL:2015/06/30 09:11:18 A . (.LSI Corporation - MEGASAS RAID Controller Driver for Windows.) -- C:\WINDOWS\System32\drivers\percsas2i.sys [51176] O58 - SDL:2015/06/30 09:11:18 A . (.Avago Technologies - MEGASAS RAID Controller Driver for Windows.) -- C:\WINDOWS\System32\drivers\percsas3i.sys [51688] O58 - SDL:2009/12/30 10:21:18 A . (.VS Revo Group - Revo Uninstaller Minifilter.) -- C:\WINDOWS\System32\drivers\revoflt.sys [27192] O58 - SDL:2015/06/30 09:11:18 A . (.Realtek - Realtek 8136/8168/8169 NDIS 6.40 32-bit Dri.) -- C:\WINDOWS\System32\drivers\rt640x86.sys [492032] O58 - SDL:2015/07/06 03:22:54 A . (.Realtek Semiconductor Corp. - Realtek(r) High Definition Audio Function D.) -- C:\WINDOWS\System32\drivers\RTKVHDA.sys [3522264] O58 - SDL:2015/06/30 09:11:18 A . (.Silicon Integrated Systems Corp. - SiS RAID Stor Miniport Driver.) -- C:\WINDOWS\System32\drivers\sisraid2.sys [41448] O58 - SDL:2015/06/30 09:11:18 A . (.Silicon Integrated Systems - SiS AHCI Stor-Miniport Driver.) -- C:\WINDOWS\System32\drivers\sisraid4.sys [79336] O58 - SDL:2009/10/12 14:33:00 A . (.StorageCraft Technology Corporation - StorageCraft Volume Snapshot Driver.) -- C:\WINDOWS\System32\drivers\stcp2v30.sys [64960] O58 - SDL:2015/06/30 09:11:18 A . (.Promise Technology, Inc. - Promise SuperTrak EX Series Driver for Wind.) -- C:\WINDOWS\System32\drivers\stexstor.sys [27112] O58 - SDL:2013/08/22 14:40:22 A . (.The OpenVPN Project - TAP-Windows Virtual Network Driver.) -- C:\WINDOWS\System32\drivers\tap0901.sys [35288] O58 - SDL:2015/06/30 09:11:23 A . (...) -- C:\WINDOWS\System32\drivers\Udecx.sys [31744] O58 - SDL:2014/05/16 15:25:48 A . (.Oracle Corporation - VirtualBox Support Driver.) -- C:\WINDOWS\System32\drivers\VBoxDrv.sys [204064] O58 - SDL:2015/05/13 17:29:54 A . (.Oracle Corporation - VirtualBox Host-Only Network Adapter Driver.) -- C:\WINDOWS\System32\drivers\VBoxNetAdp.sys [115672] O58 - SDL:2015/05/13 17:29:54 A . (.Oracle Corporation - VirtualBox Bridged Networking Driver.) -- C:\WINDOWS\System32\drivers\VBoxNetFlt.sys [127008] O58 - SDL:2015/05/13 17:29:54 A . (.Oracle Corporation - VirtualBox USB Monitor Driver.) -- C:\WINDOWS\System32\drivers\VBoxUSBMon.sys [104896] O58 - SDL:2009/10/22 04:45:00 A . (.VMware, Inc. - VMware kernel driver.) -- C:\WINDOWS\System32\drivers\vmci.sys [70704] O58 - SDL:2009/10/22 04:45:00 A . (.VMware, Inc. - VMware keyboard filter driver (32-bit).) -- C:\WINDOWS\System32\drivers\VMkbd.sys [23216] O58 - SDL:2009/10/22 00:13:32 A . (.VMware, Inc. - VMware virtual network driver (32-bit).) -- C:\WINDOWS\System32\drivers\vmnet.sys [18736] O58 - SDL:2009/10/22 00:13:32 A . (.VMware, Inc. - VMware virtual network adapter driver (32-b.) -- C:\WINDOWS\System32\drivers\vmnetadapter.sys [16560] O58 - SDL:2009/10/22 00:13:32 RA . (.VMware, Inc. - VMware bridge driver (32-bit).) -- C:\WINDOWS\System32\drivers\vmnetbridge.sys [36400] O58 - SDL:2009/10/22 04:44:58 A . (.VMware, Inc. - VMware network application interface driver.) -- C:\WINDOWS\System32\drivers\vmnetuserif.sys [26288] O58 - SDL:2009/10/22 04:44:06 A . (.VMware, Inc. - VMware parallel port driver.) -- C:\WINDOWS\System32\drivers\vmparport.sys [14896] O58 - SDL:2009/10/22 04:45:02 A . (.VMware, Inc. - VMware kernel driver.) -- C:\WINDOWS\System32\drivers\vmx86.sys [853936] O58 - SDL:2015/06/30 09:11:18 A . (.VIA Technologies Inc.,Ltd - VIA RAID DRIVER FOR X86-32.) -- C:\WINDOWS\System32\drivers\vsmraid.sys [149992] O58 - SDL:2015/06/30 09:11:18 A . (.VIA Corporation - VIA StorX RAID Controller Driver.) -- C:\WINDOWS\System32\drivers\VSTXRAID.SYS [276968] O58 - SDL:2015/07/14 07:23:08 A . (...) -- C:\WINDOWS\System32\ANSI.SYS [9029] O58 - SDL:2015/07/14 07:23:08 A . (...) -- C:\WINDOWS\System32\country.sys [27097] O58 - SDL:2015/07/14 07:23:08 A . (...) -- C:\WINDOWS\System32\HIMEM.SYS [4768] O58 - SDL:2015/07/14 07:23:08 A . (...) -- C:\WINDOWS\System32\KEY01.SYS [42809] O58 - SDL:2015/07/14 07:23:09 A . (...) -- C:\WINDOWS\System32\KEYBOARD.SYS [42537] O58 - SDL:2015/07/14 07:23:09 A . (...) -- C:\WINDOWS\System32\NTDOS.SYS [27866] O58 - SDL:2015/07/14 07:23:08 A . (...) -- C:\WINDOWS\System32\NTDOS404.SYS [29146] O58 - SDL:2015/07/14 07:23:08 A . (...) -- C:\WINDOWS\System32\NTDOS411.SYS [29370] O58 - SDL:2015/07/14 07:23:08 A . (...) -- C:\WINDOWS\System32\NTDOS412.SYS [29274] O58 - SDL:2015/07/14 07:23:08 A . (...) -- C:\WINDOWS\System32\NTDOS804.SYS [29146] O58 - SDL:2015/07/14 07:23:09 A . (...) -- C:\WINDOWS\System32\NTIO.SYS [33968] O58 - SDL:2015/07/14 07:23:08 A . (...) -- C:\WINDOWS\System32\NTIO404.SYS [34688] O58 - SDL:2015/07/14 07:23:08 A . (...) -- C:\WINDOWS\System32\NTIO411.SYS [35776] O58 - SDL:2015/07/14 07:23:08 A . (...) -- C:\WINDOWS\System32\NTIO412.SYS [35552] O58 - SDL:2015/07/14 07:23:08 A . (...) -- C:\WINDOWS\System32\NTIO804.SYS [34688] ---\\ Last modified or created user files (O61) (39) - 107s O61 - LFC: 2015/07/17 21:11:40 A . (.ESET, spol. s r.o..) -- C:\Users\samy\Downloads\Programs\ESETRepairNdis.exe [85024] O61 - LFC: 2015/07/17 21:32:25 A . (.ESET, spol. s r.o..) -- C:\Users\samy\Downloads\Programs\ESETRepairNdis_2.exe [85024] O61 - LFC: 2015/07/18 04:08:39 A . (.ESET.) -- C:\Users\samy\Downloads\Programs\eset_smart_security_live_installer.exe [1661128] O61 - LFC: 2015/07/18 17:00:31 A . (..) -- C:\Users\samy\Desktop\2015_FileViewPro_Setup.exe [2983168] O61 - LFC: 2015/07/12 01:36:45 A . (..) -- C:\Users\samy\AppData\Roaming\Smadav\Update-Smadav.exe [1015475] O61 - LFC: 2015/07/18 16:45:42 A . (.Tonec Inc..) -- C:\Users\samy\AppData\Roaming\IDM\idmmzcc5\components2\idmcchandler2.dll [332824] O61 - LFC: 2015/07/18 16:45:43 A . (.Tonec Inc..) -- C:\Users\samy\AppData\Roaming\IDM\idmmzcc5\components2\idmcchandler2_64.dll [460824] O61 - LFC: 2015/07/18 16:45:43 A . (.Tonec Inc..) -- C:\Users\samy\AppData\Roaming\IDM\idmmzcc5\components2\idmmzcc.dll [34216] O61 - LFC: 2015/07/18 16:45:43 A . (.Tonec Inc..) -- C:\Users\samy\AppData\Roaming\IDM\idmmzcc5\components2\idmmzcc64.dll [28512] O61 - LFC: 2015/07/18 16:45:42 A . (.Tonec Inc..) -- C:\Users\samy\AppData\Roaming\IDM\idmmzcc5\components12\idmmzcc.dll [26648] O61 - LFC: 2015/07/18 16:45:42 A . (.Tonec Inc..) -- C:\Users\samy\AppData\Roaming\IDM\idmmzcc5\components12\idmmzcc64.dll [31768] O61 - LFC: 2015/07/18 16:45:42 A . (.Tonec Inc..) -- C:\Users\samy\AppData\Roaming\IDM\idmmzcc5\components\idmmzcc.dll [34216] O61 - LFC: 2015/07/18 12:34:25 A . (.Reimage®.) -- C:\Users\samy\AppData\Roaming\IDM\DwnlData\samy\ReimageRepair_541\ReimageRepair.exe [772016] =>PUP.Optional.ReImageRepair O61 - LFC: 2015/07/12 01:59:22 A . (.MEGA Limited.) -- C:\Users\samy\AppData\Roaming\IDM\DwnlData\samy\MEGAsyncSetup_456\MEGAsyncSetup.exe [3079911] O61 - LFC: 2015/07/12 14:20:54 A . (.?????????????.) -- C:\Users\samy\AppData\Roaming\HaiYuInst\plugins\xldl.dll [297416] O61 - LFC: 2015/07/12 14:20:54 A . (.ShenZhen Xunlei Networking Technologies,LTD.) -- C:\Users\samy\AppData\Roaming\HaiYuInst\plugins\download\dl_peer_id.dll [92080] O61 - LFC: 2015/07/12 14:20:54 A . (.Thunder Networking Technologies,LTD.) -- C:\Users\samy\AppData\Roaming\HaiYuInst\plugins\download\download_engine.dll [3512776] O61 - LFC: 2015/07/12 14:20:54 A . (.?????????????.) -- C:\Users\samy\AppData\Roaming\HaiYuInst\plugins\download\MiniThunderPlatform.exe [272840] O61 - LFC: 2015/07/12 14:20:54 A . (.???? (C) 2011.) -- C:\Users\samy\AppData\Roaming\HaiYuInst\plugins\download\minizip.dll [19968] O61 - LFC: 2015/07/12 14:20:54 A . (.Copyright (C) 2009.) -- C:\Users\samy\AppData\Roaming\HaiYuInst\plugins\download\XLBugHandler.dll [100808] O61 - LFC: 2015/07/12 14:20:54 A . (.Copyright 2010.) -- C:\Users\samy\AppData\Roaming\HaiYuInst\plugins\download\XLBugReport.exe [248264] O61 - LFC: 2015/07/12 14:20:54 A . (.(C) 1995-2004 Jean-loup Gailly & Mark Adler.) -- C:\Users\samy\AppData\Roaming\HaiYuInst\plugins\download\zlib1.dll [59904] O61 - LFC: 2015/07/12 14:13:03 A . (..) -- C:\Users\samy\AppData\Roaming\HaiYuInst\DXInst\Setup.exe [241577560] O61 - LFC: 2015/07/18 17:17:30 A . (..) -- C:\Users\samy\AppData\Local\TechSmith\SnagIt\Tray.bin [628] O61 - LFC: 2015/07/14 00:47:54 A . (..) -- C:\Users\samy\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\TempState\TileCache_100_0_Data.bin [2109468] O61 - LFC: 2015/07/14 00:47:54 A . (..) -- C:\Users\samy\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\TempState\TileCache_100_0_Header.bin [9640] O61 - LFC: 2015/07/18 14:48:44 A . (..) -- C:\Users\samy\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\LocalState\speech_onecorereg.bin [8192] O61 - LFC: 2015/07/17 20:26:11 A . (..) -- C:\Users\samy\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\UrlBlock\urlblock_635727492210169964.bin [77641] O61 - LFC: 2015/07/13 20:53:38 A . (..) -- C:\Users\samy\AppData\Local\Microsoft\Windows\appsFolderLayout-menu.bin [818] O61 - LFC: 2015/07/13 20:53:38 A . (..) -- C:\Users\samy\AppData\Local\Microsoft\Windows\appsFolderLayout.bin [818] O61 - LFC: 2015/07/17 21:11:40 A . (..) -- C:\Users\samy\AppData\Local\Microsoft\Windows\INetCache\Low\IE\5L7L79JC\ESETRepairNdis[1].exe [735] O61 - LFC: 2015/07/14 00:49:57 A . (..) -- C:\Users\samy\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin [395737] O61 - LFC: 2015/07/16 10:09:47 A . (..) -- C:\Users\samy\AppData\Local\Microsoft\Internet Explorer\UrlBlock\urlblock_635726268619325651.bin [77629] O61 - LFC: 2015/07/17 17:08:47 A . (..) -- C:\Users\samy\AppData\Local\Microsoft\Internet Explorer\UrlBlock\urlblock_635727384435897334.bin [77293] O61 - LFC: 2015/07/18 16:47:45 A . (..) -- C:\Users\samy\AppData\Local\Microsoft\Internet Explorer\UrlBlock\urlblock_635728248441712474.bin [73209] O61 - LFC: 2015/07/18 16:55:35 A . (..) -- C:\Users\samy\AppData\Local\Microsoft\GameDVR\KnownGameList.bin [38396] O61 - LFC: 2015/07/18 16:45:45 A . (..) -- C:\Users\samy\AppData\Local\Google\Chrome\User Data\ev_hashes_whitelist.bin [1113849] O61 - LFC: 2015/07/13 10:14:22 A . (..) -- C:\Users\samy\AppData\Local\Google\Chrome\User Data\PepperFlash\18.0.0.209\pepflashplayer.dll [16307888] O61 - LFC: 2015/07/15 15:45:09 A . (..) -- C:\Users\samy\AppData\Local\Adobe\Acrobat\11.0\UserCache.bin [78720] ---\\ File Associations Shell Spawning (O67) (9) - 1s O67 - Shell Spawning: <.bat> [HKLM\..\open\Command] (...) -- "%1" %* O67 - Shell Spawning: <.cpl> [HKLM\..\cplopen\Command] (.Microsoft Corporation - Windows Control Panel.) -- C:\Windows\System32\control.exe O67 - Shell Spawning: <.cmd> [HKLM\..\open\Command] (...) -- "%1" %* O67 - Shell Spawning: <.com> [HKLM\..\open\Command] (...) -- "%1" %* O67 - Shell Spawning: <.exe> [HKLM\..\open\Command] (...) -- "%1" %* O67 - Shell Spawning: <.html> [HKLM\..\open\Command] (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe O67 - Shell Spawning: <.js> [HKLM\..\open\Command] (.Microsoft Corporation - Microsoft ® Windows Based Script Host.) -- C:\Windows\System32\wscript.exe O67 - Shell Spawning: <.reg> [HKLM\..\open\Command] (.Microsoft Corporation - Registry Editor.) -- C:\Windows\regedit.exe O67 - Shell Spawning: <.scr> [HKLM\..\open\Command] (...) -- "%1" /S ---\\ Start Menu Internet (SMI) (O68) (8) - 0s O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Google Inc. - Google Chrome.) -- C:\Program Files\Google\Chrome\Application\chrome.exe O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe O68 - StartMenuInternet: [HKLM\..\InstallInfo\ShowIconsCommand] (.Google Inc. - Google Chrome.) -- C:\Program Files\Google\Chrome\Application\chrome.exe O68 - StartMenuInternet: [HKLM\..\InstallInfo\ShowIconsCommand] (.Microsoft Corporation - IE Per-User Initialization Utility.) -- C:\Windows\System32\ie4uinit.exe O68 - StartMenuInternet: [HKLM\..\InstallInfo\ReinstallCommand] (.Google Inc. - Google Chrome.) -- C:\Program Files\Google\Chrome\Application\chrome.exe O68 - StartMenuInternet: [HKLM\..\InstallInfo\ReinstallCommand] (.Microsoft Corporation - IE Per-User Initialization Utility.) -- C:\Windows\System32\ie4uinit.exe O68 - StartMenuInternet: [HKLM\..\InstallInfo\HideIconsCommand] (.Google Inc. - Google Chrome.) -- C:\Program Files\Google\Chrome\Application\chrome.exe O68 - StartMenuInternet: [HKLM\..\InstallInfo\HideIconsCommand] (.Microsoft Corporation - IE Per-User Initialization Utility.) -- C:\Windows\System32\ie4uinit.exe ---\\ Search Browser Infection (SBI) (O69) (1) - 1s O69 - SBI: SearchScopes [HKCU] {0633EE93-D776-472f-A0FF-E1416B8B2E3A} [DefaultScope] - (Bing) - http://www.bing.com/ ---\\ Search Svchost Services (SSS) (O83) (42) - 3s O83 - Search Svchost Services: CertPropSvc (CertPropSvc) . (.Microsoft Corporation - Microsoft Smartcard Certificate Propagation.) -- C:\Windows\System32\certprop.dll [161792] O83 - Search Svchost Services: SCPolicySvc (SCPolicySvc) . (.Microsoft Corporation - Microsoft Smartcard Certificate Propagation.) -- C:\Windows\System32\certprop.dll [161792] O83 - Search Svchost Services: lanmanserver (lanmanserver) . (.Microsoft Corporation - Server Service DLL.) -- C:\Windows\System32\srvsvc.dll [218112] O83 - Search Svchost Services: gpsvc (gpsvc) . (.Microsoft Corporation - Group Policy Client.) -- C:\Windows\System32\gpsvc.dll [1195520] O83 - Search Svchost Services: IKEEXT (IKEEXT) . (.Microsoft Corporation - IKE extension.) -- C:\Windows\System32\IKEEXT.DLL [737792] O83 - Search Svchost Services: iphlpsvc (iphlpsvc) . (.Microsoft Corporation - Service that offers IPv6 connectivity over.) -- C:\Windows\System32\iphlpsvc.dll [838144] O83 - Search Svchost Services: seclogon (seclogon) . (.Microsoft Corporation - Secondary Logon Service DLL.) -- C:\Windows\System32\seclogon.dll [25088] O83 - Search Svchost Services: AppInfo (AppInfo) . (.Microsoft Corporation - Application Information Service.) -- C:\Windows\System32\appinfo.dll [75264] O83 - Search Svchost Services: msiscsi (msiscsi) . (.Microsoft Corporation - iSCSI Discovery service.) -- C:\Windows\System32\iscsiexe.dll [116224] O83 - Search Svchost Services: EapHost (EapHost) . (.Microsoft Corporation - Microsoft EAPHost service.) -- C:\Windows\System32\eapsvc.dll [87040] O83 - Search Svchost Services: schedule (schedule) . (.Microsoft Corporation - Task Scheduler Service.) -- C:\Windows\System32\schedsvc.dll [822784] O83 - Search Svchost Services: winmgmt (winmgmt) . (.Microsoft Corporation - WMI.) -- C:\Windows\System32\wbem\WMIsvc.dll [183808] O83 - Search Svchost Services: browser (browser) . (.Microsoft Corporation - Computer Browser Service DLL.) -- C:\Windows\System32\browser.dll [105984] O83 - Search Svchost Services: ProfSvc (ProfSvc) . (.Microsoft Corporation - ProfSvc.) -- C:\Windows\System32\profsvc.dll [244224] O83 - Search Svchost Services: SessionEnv (SessionEnv) . (.Microsoft Corporation - Remote Desktop Configuration service.) -- C:\Windows\System32\SessEnv.dll [312320] O83 - Search Svchost Services: wercplsupport (wercplsupport) . (.Microsoft Corporation - Problem Reports and Solutions.) -- C:\Windows\System32\wercplsupport.dll [68096] O83 - Search Svchost Services: Themes (Themes) . (.Microsoft Corporation - Windows Shell Theme Service Dll.) -- C:\Windows\System32\themeservice.dll [44032] O83 - Search Svchost Services: UserManager (UserManager) . (.Microsoft Corporation - UserMgr.) -- C:\Windows\System32\usermgr.dll [541184] O83 - Search Svchost Services: wlidsvc (wlidsvc) . (.Microsoft Corporation - Microsoft® Account Service.) -- C:\Windows\System32\wlidsvc.dll [1565184] O83 - Search Svchost Services: XblGameSave (XblGameSave) . (.Microsoft Corporation - Xbox Live Game Save Service.) -- C:\Windows\System32\XblGameSave.dll [733696] O83 - Search Svchost Services: XblAuthManager (XblAuthManager) . (.Microsoft Corporation - Xbox Live Auth Manager.) -- C:\Windows\System32\XblAuthManager.dll [519680] O83 - Search Svchost Services: DmEnrollmentSvc (DmEnrollmentSvc) . (.Microsoft Corporation - Windows Managent Service DLL.) -- C:\Windows\System32\Windows.Internal.Management.dll [193024] O83 - Search Svchost Services: BDESVC (BDESVC) . (.Microsoft Corporation - BDE Service.) -- C:\Windows\System32\bdesvc.dll [307200] O83 - Search Svchost Services: RetailDemo (RetailDemo) . (.Microsoft Corporation - RDXService.) -- C:\Windows\System32\RDXService.dll [696320] O83 - Search Svchost Services: NetSetupSvc (NetSetupSvc) . (.Microsoft Corporation - Network Setup Service.) -- C:\Windows\System32\NetSetupSvc.dll [128000] O83 - Search Svchost Services: dmwappushservice (dmwappushservice) . (.Microsoft Corporation - dmwappushsvc.) -- C:\Windows\System32\dmwappushsvc.dll [53760] O83 - Search Svchost Services: DcpSvc (DcpSvc) . (.Microsoft Corporation - dcpsvc Task.) -- C:\Windows\System32\dcpsvc.dll [152064] O83 - Search Svchost Services: XboxNetApiSvc (XboxNetApiSvc) . (.Microsoft Corporation - Xbox Live Networking Service.) -- C:\Windows\System32\XboxNetApiSvc.dll [802304] O83 - Search Svchost Services: DsmSvc (DsmSvc) . (.Microsoft Corporation - Device Setup Manager.) -- C:\Windows\System32\DeviceSetupManager.dll [183808] O83 - Search Svchost Services: NcaSvc (NcaSvc) . (.Microsoft Corporation - Microsoft Network Connectivity Assistant Se.) -- C:\Windows\System32\NcaSvc.dll [143360] O83 - Search Svchost Services: UsoSvc (UsoSvc) . (.Microsoft Corporation - Update Session Orchestrator Core.) -- C:\Windows\System32\usocore.dll [234496] O83 - Search Svchost Services: Rasauto (Rasauto) . (.Microsoft Corporation - Remote Access AutoDial Manager.) -- C:\Windows\System32\rasauto.dll [93184] O83 - Search Svchost Services: Rasman (Rasman) . (.Microsoft Corporation - Remote Access Connection Manager.) -- C:\Windows\System32\rasmans.dll [587264] O83 - Search Svchost Services: Remoteaccess (Remoteaccess) . (.Microsoft Corporation - Dynamic Interface Manager.) -- C:\Windows\System32\mprdim.dll [410112] O83 - Search Svchost Services: SENS (SENS) . (.Microsoft Corporation - System Event Notification Service (SENS).) -- C:\Windows\System32\Sens.dll [57856] O83 - Search Svchost Services: Sharedaccess (Sharedaccess) . (.Microsoft Corporation - Microsoft NAT Helper Components.) -- C:\Windows\System32\ipnathlp.dll [392704] O83 - Search Svchost Services: Tapisrv (Tapisrv) . (.Microsoft Corporation - Microsoft® Windows(TM) Telephony Server.) -- C:\Windows\System32\tapisrv.dll [254976] O83 - Search Svchost Services: wuauserv (wuauserv) . (.Microsoft Corporation - Windows Update Agent.) -- C:\Windows\System32\wuaueng.dll [1734656] O83 - Search Svchost Services: BITS (BITS) . (.Microsoft Corporation - Background Intelligent Transfer Service.) -- C:\Windows\System32\qmgr.dll [956416] O83 - Search Svchost Services: ShellHWDetection (ShellHWDetection) . (.Microsoft Corporation - Windows Shell Services Dll.) -- C:\Windows\System32\shsvcs.dll [544768] O83 - Search Svchost Services: lfsvc (lfsvc) . (.Microsoft Corporation - Geolocation Service.) -- C:\Windows\System32\lfsvc.dll [22528] O83 - Search Svchost Services: AppMgmt (AppMgmt) . (.Microsoft Corporation - Software installation Service.) -- C:\Windows\System32\appmgmts.dll [165376] ---\\ Firewall Active Exception List (FirewallRules) (O87) (5) - 3s O87 - FAEL: "{1E08C7F0-78AB-427A-A7A3-CD16778C3F4E}" [In-None-P6-TRUE] .(...) -- C:\Program Files\Oracle\VirtualBox\vboxheadless.exe O87 - FAEL: "{455ABF61-2AD4-4E95-9A73-3F071BBAC403}" [In-None-P17-TRUE] .(.VMware, Inc. - VMware Authorization Service.) -- E:\hamza\vmware-authd.exe O87 - FAEL: "{DF6712BB-BB9E-495A-8032-3F77AC2B10BB}" [In-None-P6-TRUE] .(.VMware, Inc. - VMware Authorization Service.) -- E:\hamza\vmware-authd.exe O87 - FAEL: "{9F194D34-88CD-481E-8B8C-39FCDC834F94}" [In-None-P17-TRUE] .(.VMware, Inc. - VMware Authorization Service.) -- E:\hamza\vmware-authd.exe O87 - FAEL: "{D29FCF33-DA3F-4C5C-B8BB-9CB96034772A}" [In-None-P6-TRUE] .(.VMware, Inc. - VMware Authorization Service.) -- E:\hamza\vmware-authd.exe ---\\ General States of Services not Microsoft (EGS) (SR=Running, SS=Stopped) (18) - 40s SR - Auto [2015/07/07 20:12:28] [ 82128] Adobe Acrobat Update Service (AdobeARMservice) . (.Adobe Systems Incorporated.) - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe SS - Demand [2015/06/16 22:33:14] [ 433784] BlueStacks Android Service (BstHdAndroidSvc) . (.BlueStack Systems, Inc..) - C:\Program Files\BlueStacks\HD-Service.exe SR - Auto [2015/06/16 22:33:36] [ 413304] BlueStacks Log Rotator Service (BstHdLogRotatorSvc) . (.BlueStack Systems, Inc..) - C:\Program Files\BlueStacks\HD-LogRotatorService.exe SR - Auto [2015/06/16 22:34:50] [ 822904] BlueStacks Updater Service (BstHdUpdaterSvc) . (.BlueStack Systems, Inc..) - C:\Program Files\BlueStacks\HD-UpdaterService.exe SR - Auto [2015/01/28 14:08:58] [ 1349576] ESET Service (ekrn) . (.ESET.) - C:\Program Files\ESET\ESET Smart Security\ekrn.exe SS - Auto [2015/07/05 02:59:22] [ 107848] ÎÏãÉ Google Update (gupdate) (gupdate) . (.Google Inc..) - C:\Program Files\Google\Update\GoogleUpdate.exe SS - Demand [2015/07/05 02:59:22] [ 107848] ÎÏãÉ Google Update (gupdatem) (gupdatem) . (.Google Inc..) - C:\Program Files\Google\Update\GoogleUpdate.exe SR - Auto [2015/06/18 08:39:46] [ 1871160] MBAMScheduler (MBAMScheduler) . (.Malwarebytes Corporation.) - C:\Program Files\Malwarebytes Anti-Malware\mbamscheduler.exe SR - Auto [2015/06/18 08:39:50] [ 1133880] MBAMService (MBAMService) . (.Malwarebytes Corporation.) - C:\Program Files\Malwarebytes Anti-Malware\mbamservice.exe SR - Auto [2014/01/16 16:19:36] [ 44104] RunSwUSB (RunSwUSB) . (.Copyright (C) 2012-2013.) - C:\Windows\runSW.exe SS - Auto [2015/06/03 16:42:38] [ 327296] Skype Updater (SkypeUpdate) . (.Skype Technologies.) - C:\Program Files\Skype\Updater\Updater.exe SR - Auto [2015/01/26 08:48:10] [ 3408384] TechSmith Uploader Service (TechSmith Uploader Service) . (.TechSmith Corporation.) - C:\Program Files\Common Files\TechSmith Shared\Uploader\UploaderService.exe SS - Demand [2009/10/12 14:32:24] [ 191024] VMware Agent Service (ufad-ws60) . (.VMware, Inc..) - E:\hamza\vmware-ufad.exe SR - Auto [2009/10/22 04:44:18] [ 113200] VMware Authorization Service (VMAuthdService) . (.VMware, Inc..) - E:\hamza\vmware-authd.exe SR - Auto [2009/10/22 04:44:08] [ 334384] VMware DHCP Service (VMnetDHCP) . (.VMware, Inc..) - C:\Windows\System32\vmnetdhcp.exe SR - Auto [2009/10/22 03:47:54] [ 563760] VMware USB Arbitration Service (VMUSBArbService) . (.VMware, Inc..) - C:\Program Files\Common Files\VMware\USB\vmware-usbarbitrator.exe SR - Auto [2009/10/22 04:44:24] [ 395824] VMware NAT Service (VMware NAT Service) . (.VMware, Inc..) - C:\Windows\System32\vmnat.exe SR - Auto [2013/05/07 15:06:18] [ 96768] WPS2.0 HW PBC Service (WPSService20) . (.Copyright (C) 2012~2013.) - C:\Program Files\Edimax\Edimax AC1200 Wireless LAN Driver\WPSService20.exe ---\\ Additional Scan (O88) (22) - 0s C:\Windows\AutoKMS\AutoKMS.exe =>HackTool.AutoKMS C:\WINDOWS\Tasks\DriverNavigator Scheduled Scan.job =>HackTool.AutoKMS C:\WINDOWS\Tasks\DriverToolkit Autorun.job =>HackTool.AutoKMS C:\WINDOWS\System32\Tasks\AutoKMS =>HackTool.AutoKMS C:\WINDOWS\System32\Tasks\Driver Booster SkipUAC (samy) =>HackTool.AutoKMS C:\WINDOWS\System32\Tasks\DriverNavigator Scheduled Scan =>HackTool.AutoKMS C:\WINDOWS\System32\Tasks\DriverToolkit Autorun =>HackTool.AutoKMS HKLM\SOFTWARE\Tencent =>PUP.Optional.TencentAddressBar HKCU\SOFTWARE\Tencent =>PUP.Optional.TencentAddressBar C:\Program Files\CinemaP-1.9cV17.07 =>PUP.Optional.CrossRider C:\Program Files\MixVideoPlayer =>PUP.Optional.MixVideoPlayer C:\Program Files\OLBPre =>PUP.Optional.MyPCBackup C:\Program Files\Tencent =>PUP.Optional.TencentAddressBar C:\ProgramData\Tencent =>PUP.Optional.TencentAddressBar C:\Users\samy\AppData\Roaming\istartsurf =>PUP.Optional.IsStart C:\Users\samy\AppData\Roaming\Tencent =>PUP.Optional.TencentAddressBar C:\Users\samy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Tencent =>PUP.Optional.TencentAddressBar C:\WINDOWS\Prefetch\MIXVIDEOPLAYERSETUP.EXE-AC20AE3B.pf =>PUP.Optional.MixVideoPlayer C:\WINDOWS\Prefetch\OLBPRE.EXE-5CC5F889.pf =>PUP.Optional.MyPCBackup C:\WINDOWS\Prefetch\SPEEDUPMYPC.EXE-65B6E02C.pf =>PUP.Optional.SpeedUpMyPC C:\WINDOWS\Prefetch\SPEEDUPMYPC.TMP-74DD751A.pf =>PUP.Optional.SpeedUpMyPC C:\Users\samy\AppData\Roaming\IDM\DwnlData\samy\ReimageRepair_541\ReimageRepair.exe =>PUP.Optional.ReImageRepair ---\\ Summary of the elements found on your workstation (10) - 0s http://www.nicolascoolman.fr/hijacker-trovigo/ =>PUP.Optional.Trovigo http://www.nicolascoolman.fr/trojan-vonteera/ =>Trojan.Vonteera http://www.nicolascoolman.fr/pup-isstart/ =>PUP.Optional.IsStart http://www.nicolascoolman.fr/adware-tencentaddressbar/ =>PUP.Optional.TencentAddressBar http://www.nicolascoolman.fr/trojan-autokms/ =>HackTool.AutoKMS http://www.nicolascoolman.fr/pup-crossrider/ =>PUP.Optional.CrossRider http://www.nicolascoolman.fr/blog =>PUP.Optional.MixVideoPlayer http://www.nicolascoolman.fr/pup-mypcbackup/ =>PUP.Optional.MyPCBackup http://www.nicolascoolman.fr/blog =>PUP.Optional.SpeedUpMyPC http://www.nicolascoolman.fr/rogue-reimagerepair/ =>PUP.Optional.ReImageRepair ~ End of the scan, 33115 items in 280 seconds (774)(0)()