~ ZHPDiag v2015.8.7.112 By Nicolas Coolman (2015/08/7)
~ Run by dell (Administrator)  (2015/08/07 18:47:05)
~ Site: http://www.nicolascoolman.fr
~ Facebook: https://www.facebook.com/nicolascoolman1
~ State version:  Version OK
~ Mode: Scan
~ Report: C:\Users\dell\Desktop\ZHPDiag.txt
~ Report: C:\Users\dell\AppData\Roaming\ZHP\ZHPDiag.txt
~ UAC: Deactivate
~ System startup: Normal (Normal boot)
Windows 7 Ultimate, 64-bit Service Pack 1 (Build 7601)

---\\ Internet Browsers (3) - 0s
GCIE: Google Chrome v44.0.2403.130
MFIE: Mozilla Firefox 39.0 (x86 en-US) v39.0
MSIE: Internet Explorer v11.0.9600.17914

---\\ Windows Product Information (4) - 0s
~ Windows Server License Manager Script : OK
~ Licence Script File Génération : OK
Windows Automatic Updates : OK (Auto)
Windows Activation Technologies : OK

---\\ System protection software (1) - 1s
Kaspersky Internet Security v15.0.0.463

---\\ System protection software (Superfluous) (1) - 1s
Kaspersky Security Scan v12.0.1.881

---\\ Surveillance software (2) - 1s
Adobe Flash Player 18 NPAPI
Adobe Reader XI

---\\ Information on the system (6) - 0s
~ Operating System: Intel64 Family 6 Model 58 Stepping 9, GenuineIntel
~ Operating System:  64-bit 
~ Boot mode: Normal (Normal boot)
Total RAM: 4078.124 MB (29% free)
~ System Restore: Activé (Enable)
~ System drive C: has 31 GB free of 149 GB

---\\ Connection to the system mode (3) - 0s
~ Computer Name: DELL-PC
~ User Name: dell
~ Logged in as Administrator

---\\ Enumeration of the disk units (4) - 0s
~ Drive C: has 31 GB free of 149 GB  (System)
~ Drive D: has 149 GB free of 149 GB
~ Drive E: has 174 GB free of 176 GB
~ Drive H: has 0 GB free of 0 GB

---\\ State of the Windows Security Center (11) - 0s
[HKLM\SOFTWARE\Microsoft\Security Center\Svc] AntiSpywareOverride: OK
[HKLM\SOFTWARE\Microsoft\Security Center\Svc] AntiVirusOverride: OK
[HKLM\SOFTWARE\Microsoft\Security Center\Svc] FirewallOverride: OK
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer] NoActiveDesktopChanges: Modified
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system] EnableLUA: Modified
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\NOHIDDEN] CheckedValue: Modified
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL] CheckedValue: OK
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Associations] Application: OK
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] Shell: OK
[HKLM\SYSTEM\CurrentControlSet\Services\COMSysApp] Type: OK
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install] LastSuccessTime : OK

---\\ Search Generic System Files (24) - 1s
[MD5.332FEAB1435662FC6C672E25BEB37BE3] - (.Microsoft Corporation - Windows Explorer.) () -- C:\Windows\Explorer.exe [2871808]
[MD5.DD81D91FF3B0763C392422865C9AC12E] - (.Microsoft Corporation - Windows host process (Rundll32).) () -- C:\Windows\System32\rundll32.exe [45568]
[MD5.94355C28C1970635A31B3FE52EB7CEBA] - (.Microsoft Corporation - Windows Start-Up Application.) () -- C:\Windows\System32\Wininit.exe [129024]
[MD5.E066FDC3A2074D926903B8C31EF3B347] - (.Microsoft Corporation - Internet Extensions for Win32.) () -- C:\Windows\System32\wininet.dll [2427392]
[MD5.8CEBD9D0A0A879CDE9F36F4383B7CAEA] - (.Microsoft Corporation - Windows Logon Application.) () -- C:\Windows\System32\Winlogon.exe [455168]
[MD5.067FA52BFB59A56110A12312EF9AF243] - (.Microsoft Corporation - Software Licensing Library.) () -- C:\Windows\System32\sppcomapi.dll [232448]
[MD5.0D57D091E06BB1E58E72E5D08479FDDF] - (.Microsoft Corporation - DLL client de l’API uilisateur de Windows m.) () -- C:\Windows\System32\fr-FR\user32.dll.mui [20480]
[MD5.FA886682CFC5D36718D3E436AACF10B9] - (.Microsoft Corporation - Ancillary Function Driver for WinSock.) () -- C:\Windows\System32\drivers\AFD.sys [497152]
[MD5.02062C0B390B7729EDC9E69C680A6F3C] - (.Microsoft Corporation - ATAPI IDE Miniport Driver.) () -- C:\Windows\System32\drivers\atapi.sys [24128]
[MD5.B8BD2BB284668C84865658C77574381A] - (.Microsoft Corporation - CD-ROM File System Driver.) () -- C:\Windows\System32\drivers\Cdfs.sys [92160]
[MD5.F036CE71586E93D94DAB220D7BDF4416] - (.Microsoft Corporation - SCSI CD-ROM Driver.) () -- C:\Windows\System32\drivers\Cdrom.sys [147456]
[MD5.9BB2EF44EAA163B29C4A4587887A0FE4] - (.Microsoft Corporation - DFS Namespace Client Driver.) () -- C:\Windows\System32\drivers\DfsC.sys [102400]
[MD5.97BFED39B6B79EB12CDDBFEED51F56BB] - (.Microsoft Corporation - High Definition Audio Bus Driver.) () -- C:\Windows\System32\drivers\HDAudBus.sys [122368]
[MD5.FA55C73D4AFFA7EE23AC4BE53B4592D3] - (.Microsoft Corporation - i8042 Port Driver.) () -- C:\Windows\System32\drivers\i8042prt.sys [105472]
[MD5.AF9B39A7E7B6CAA203B3862582E9F2D0] - (.Microsoft Corporation - IP Network Address Translator.) () -- C:\Windows\System32\drivers\IpNat.sys [116224]
[MD5.1877EB1495CFBDAB27D6A32F6DDF3818] - (.Microsoft Corporation - Windows NT SMB Minirdr.) () -- C:\Windows\System32\drivers\MRxSmb.sys [159232]
[MD5.09594D1089C523423B32A4229263F068] - (.Microsoft Corporation - MBT Transport driver.) () -- C:\Windows\System32\drivers\netBT.sys [261632]
[MD5.1A29A59A4C5BA6F8C85062A613B7E2B2] - (.Microsoft Corporation - NT File System Driver.) () -- C:\Windows\System32\drivers\ntfs.sys [1684928]
[MD5.0086431C29C35BE1DBC43F52CC273887] - (.Microsoft Corporation - Parallel Port Driver.) () -- C:\Windows\System32\drivers\Parport.sys [97280]
[MD5.471815800AE33E6F1C32FB1B97C490CA] - (.Microsoft Corporation - RAS L2TP mini-port/call-manager driver.) () -- C:\Windows\System32\drivers\Rasl2tp.sys [129536]
[MD5.1B6163C503398B23FF8B939C67747683] - (.Microsoft Corporation - Microsoft RDP Device redirector.) () -- C:\Windows\System32\drivers\rdpdr.sys [165888]
[MD5.548260A7B8654E024DC30BF8A7C5BAA4] - (.Microsoft Corporation - SMB Transport driver.) () -- C:\Windows\System32\drivers\smb.sys [93184]
[MD5.70988118145F5F10EF24720B97F35F65] - (.Microsoft Corporation - TDI Translation Driver.) () -- C:\Windows\System32\drivers\tdx.sys [119296]
[MD5.0D08D2F3B3FF84E433346669B5E0F639] - (.Microsoft Corporation - Volume Shadow Copy Driver.) () -- C:\Windows\System32\drivers\volsnap.sys [295808]

---\\ Process running (18) - 2s
[MD5.058734C95991F6BEBF3D3075B8776234] - (.Kaspersky Lab ZAO - Kaspersky Anti-Virus.) -- C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe [233552] [PID.1808]
[MD5.B9963C336A2BF054520DC09CE7C81476] - (.Firebird Project - Firebird SQL Server.) -- C:\Program Files (x86)\Firebird\Firebird_2_1\bin\fbguard.exe [81920] [PID.2032]
[MD5.B3CEC022BFA008ADFF49CAB16D296B49] - (.Foxit Software Inc. - Foxit Cloud Safe Update Service.) -- C:\Program Files (x86)\Foxit Software\Foxit Reader\Foxit Cloud\FCUpdateService.exe [244392] [PID.1692]
[MD5.D24F934503A4E18C7AD5A72FE7AE947B] - (.SoftEther VPN Project at University of Tsukuba, Japan - SoftEther VPN.) -- C:\Program Files\SoftEther VPN Client\vpnclient_x64.exe [4409400] [PID.2136]
[MD5.41C191EBAD7F1B09FC12DE73CFF45D45] - (.Realtek Semiconductor Corp. - HD Audio Control Panel.) -- C:\Program Files\Realtek\Audio\HDA\RtDCpl64.exe [2908888] [PID.2148]
[MD5.2BFDFE9D19AE4A0CDD07291545D0C2A7] - (...) -- C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe [39568] [PID.2172]
[MD5.75BDD11C3EA1CF584C8B9A5BF7C7190C] - (.Tonec Inc. - Internet Download Manager (IDM).) -- C:\Program Files (x86)\Internet Download Manager\IDMan.exe [3898960] [PID.2380]
[MD5.2DF2235DB8AF585BA5F2E11911BF08D2] - (...) -- C:\Program Files (x86)\Real\UpdateService\RealPlayerUpdateSvc.exe [23552] [PID.2388]
[MD5.0FAD4CC5E7BB28A3931E578059B9587E] - (.TechSmith Corporation - SnagIt 9.) -- C:\Program Files (x86)\TechSmith\SnagIt 9\SnagIt32.exe [6822728] [PID.2424]
[MD5.0CF16DF07E1B492721269589AA440C2A] - (.Sabre Inc. - Open Auxiliary Device Platform.) -- E:\Sabre\Apps\OADP\OADP.exe [512000] [PID.2712]
[MD5.AD5A56AEBFDA0855B8ED6C0614E3415A] - (.Sabre Inc. - Open Auxiliary Device Platform.) -- E:\Sabre\Apps\OADP\OadpUtil.exe [528448] [PID.2808]
[MD5.DA55DFCB2B78A0D4375A0FC5ABE13381] - (.TechSmith Corporation - TechSmith HTML Help Helper.) -- C:\Program Files (x86)\TechSmith\SnagIt 9\TscHelp.exe [54600] [PID.3060]
[MD5.51A8295B8F0E6F4E42EF2D84C7D97E76] - (.TechSmith Corporation - SnagIt RPC Helper.) -- C:\Program Files (x86)\TechSmith\SnagIt 9\SnagPriv.exe [75080] [PID.2524]
[MD5.BD95E822E7A958BBCA842D078426A151] - (.Tonec Inc. - Internet Download Manager agent for click m.) -- C:\Program Files (x86)\Internet Download Manager\IEMonitor.exe [269848] [PID.3232]
[MD5.D24F934503A4E18C7AD5A72FE7AE947B] - (.SoftEther VPN Project at University of Tsukuba, Japan - SoftEther VPN.) -- C:\Program Files\SoftEther VPN Client\vpnclient_x64.exe [4409400] [PID.3364]
[MD5.4334FA63180F295BC3B2FE55987015B0] - (.TechSmith Corporation - SnagIt Editor 9.) -- C:\Program Files (x86)\TechSmith\SnagIt 9\snagiteditor.exe [7333192] [PID.4024]
[MD5.DB8EE43C90536A07D4BA481079AE214C] - (.Firebird Project - Firebird SQL Server.) -- C:\Program Files (x86)\Firebird\Firebird_2_1\bin\fbserver.exe [2736128] [PID.5392]
[MD5.A446F3898F1CE9989ACB3F6E758E179B] - (.Kaspersky Lab ZAO - Kaspersky Anti-Virus.) -- C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avpui.exe [192160] [PID.6136]

---\\ Google Chrome, Start,Search,Extensions (G0,G1,G2) (5) - 0s
G2 - GCE: Preference [User Data\Default] [apdfllckaahabafndbhieahigkjlhalf] Google Chrome manifest  =>.Google Inc.
G2 - GCE: Preference [User Data\Default] [blpcfgokakmgnkcojhhkbfbldkacnbeo] Google Chrome manifest  =>.Google Inc.
G2 - GCE: Preference [User Data\Default] [coobgpohoikkiipiblmjeljniedjpjpf] Google Chrome manifest  =>.Google Inc.
G2 - GCE: Preference [User Data\Default] [nmmhkkegccagdldgiimedpiccmgmieda] Google Chrome manifest  =>.Google Inc.
G2 - GCE: Preference [User Data\Default] [pjkljhegncpnkpknbcohdijeoejaedia] Google Chrome manifest  =>.Google Inc.

---\\ Mozilla Firefox,Plugins,Start,Search,Extensions (P2,M0,M1,M2,M3) (19) - 2s
M0 - MFSP: prefs.js [dell - xwibiqxs.default] http://www.arabyonline.com/?scr=90Qw8888   =>Trojan.Vonteera
P2 - EXT FILE: (...) -- C:\Users\dell\AppData\Roaming\Mozilla\Firefox\Profiles\xwibiqxs.default\searchplugins\VenteeRo.xml
P2 - EXT: (...) -- C:\Program Files (x86)\Mozilla Firefox\browser\searchplugins\amazondotcom.xml
P2 - EXT: (...) -- C:\Program Files (x86)\Mozilla Firefox\browser\searchplugins\bing.xml
P2 - EXT: (...) -- C:\Program Files (x86)\Mozilla Firefox\browser\searchplugins\ddg.xml
P2 - EXT: (...) -- C:\Program Files (x86)\Mozilla Firefox\browser\searchplugins\eBay.xml
P2 - EXT: (...) -- C:\Program Files (x86)\Mozilla Firefox\browser\searchplugins\google.xml
P2 - EXT: (...) -- C:\Program Files (x86)\Mozilla Firefox\browser\searchplugins\twitter.xml
P2 - EXT: (...) -- C:\Program Files (x86)\Mozilla Firefox\browser\searchplugins\wikipedia.xml
P2 - EXT: (...) -- C:\Program Files (x86)\Mozilla Firefox\browser\searchplugins\yahoo.xml  =>PUP.Optional.BDYahoo
P2 - EXT: (.Mozilla - Default.) -- C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
P2 - FPN: [HKLM] [@adobe.com/FlashPlayer] - (.Adobe Systems Incorporated.) -- C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_18_0_0_209.dll
P2 - FPN: [HKLM] [@foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf] - (.Foxit Corporation.) -- C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll
P2 - FPN: [HKLM] [@foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.fdf] - (.Foxit Corporation.) -- C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll
P2 - FPN: [HKLM] [@kaspersky.com/content_blocker] - (.kaspersky.com.) -- C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\content_blocker@kaspersky.com
P2 - FPN: [HKLM] [@kaspersky.com/online_banking] - (.kaspersky.com.) -- C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\online_banking@kaspersky.com
P2 - FPN: [HKLM] [@kaspersky.com/virtual_keyboard] - (.kaspersky.com.) -- C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\virtual_keyboard@kaspersky.com
P2 - FPN: [HKLM] [@messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.6] - (.Yahoo.) -- C:\Program Files (x86)\Yahoo!\Shared\npYState.dll
P2 - FPN: [HKLM] [@real.com/nprpplugin;version=17.0.9.17] - (.RealPlayer Cloud.) -- C:\Program Files (x86)\Real\RealPlayer\Netscape6\nprpplugin.dll

---\\ Internet Explorer Extensions, Start, Search (R4,R3,R0,R1) (11) - 0s
R0 - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/
R1 - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/
R1 - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:noadd-ons
R1 - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:securityrisk
R1 - HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/
R1 - HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Main,Extensions Off Page = about:noadd-ons
R1 - HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Main,Security Risk Page = about:securityrisk
R3 - URLSearchHook: (no name) - {CFBFAE00-17A6-11D0-99CB-00C04FD64497} Orphean  =>.Microsoft Internet Explorer

---\\ Internet Explorer, Proxy Management (R5) (4) - 0s
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = socks=127.0.0.1:9150   =>Hijacker.Proxy
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,MigrateProxy = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,EnableHttp1_1 = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigProxy = wininet.dll

---\\ Line Analysis F0, F1, F2, F3 - IniFiles, Auto loading programs (3) - 0s
F2 - REG:system.ini: UserInit=userinit.exe (.Microsoft Corporation.)
F2 - REG:system.ini: Shell=C:\Windows\explorer.exe (.Microsoft Corporation.)
F2 - REG:system.ini: VMApplet=C:\Windows\SysWOW64\SystemPropertiesPerformance.exe (.Microsoft Corporation.)

---\\ Hosts file redirection (O1) (1) - 0s
~ Le fichier hôte est sain (The hosts file is clean) (79)

---\\ Browser Helper Object (BHO) (O2) (9) - 0s
O2 - BHO: IDM Helper [64Bits] - {0055C089-8582-441B-A0BF-17B458C2A3A8} . (.Internet Download Manager, Tonec Inc. - IDM Browser Helper Object.) -- C:\Program Files (x86)\Internet Download Manager\IDMIECC64.dll
O2 - BHO: SnagIt Toolbar Loader [64Bits] - {00C6482D-C502-44C8-8409-FCE54AD9C208} . (.TechSmith Corporation - SnagIt Browser Helper Object for Internet E.) -- C:\Program Files (x86)\TechSmith\SnagIt 9\DLLx64\SnagItBHO64.dll
O2 - BHO: RealNetworks Download and Record Plugin for Internet Explorer [64Bits] - {3049C3E9-B461-4BC5-8870-4C09146192CA} . (.RealDownloader - RealPlayer Video Downloader.) -- C:\Program Files (x86)\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin64.dll
O2 - BHO: ContentBlockerBrowserHelperObject [64Bits] - {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} . (.Kaspersky Lab ZAO - Content Blocker Plugin.) -- C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\x64\IEExt\ContentBlocker\ie_content_blocker_plugin.dll
O2 - BHO: (no name) [64Bits] - {72853161-30C5-4D22-B7F9-0BBC1D38A37E}  (Orphean)
O2 - BHO: VirtualKeyboardBrowserHelperObject [64Bits] - {73455575-E40C-433C-9784-C78DC7761455} . (.Kaspersky Lab ZAO - Virtual Keyboard Plugin.) -- C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\x64\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll
O2 - BHO: Safe Money Plugin [64Bits] - {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} . (.Kaspersky Lab ZAO - Safe Money Plugin.) -- C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\x64\IEExt\OnlineBanking\online_banking_bho.dll
O2 - BHO: (no name) [64Bits] - {DBC80044-A445-435b-BC74-9C25C1C588A9}  (Orphean)
O2 - BHO: link filter bho [64Bits] - {E33CF602-D945-461A-83F0-819F76A199F8} . (.Kaspersky Lab ZAO - URL Advisor Plugin.) -- C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\x64\IEExt\UrlAdvisor\klwtbbho.dll

---\\ Internet Explorer Toolbars (O3) (1) - 0s
O3 - Toolbar: (no name) - [HKLM]{8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3}  (Orphean)

---\\ Auto loading programs from Registry and folders (O4) (20) - 1s
O4 - HKLM\..\Run: [SoftEther VPN Client UI Helper] . (.SoftEther VPN Project at University of Tsukuba, Japan - SoftEther VPN.) -- C:\Program Files\SoftEther VPN Client\vpnclient_x64.exe
O4 - HKLM\..\Run: [RtHDVCpl] . (.Realtek Semiconductor Corp. - HD Audio Control Panel.) -- C:\Program Files\Realtek\Audio\HDA\RtDCpl64.exe
O4 - HKCU\..\Run: [KSS] . (.Kaspersky Lab ZAO - Kaspersky Security Scan.) -- C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan 2.0\kss.exe
O4 - HKCU\..\Run: [uTorrent] . (.BitTorrent Inc. - µTorrent.) -- C:\Users\dell\AppData\Roaming\uTorrent\uTorrent.exe
O4 - HKCU\..\Run: [GoogleChromeAutoLaunch_9FD5ED0742D873E78F8A54709BF48770] . (.Google Inc. - Google Chrome.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
O4 - HKCU\..\Run: [IDMan] . (.Tonec Inc. - Internet Download Manager (IDM).) -- C:\Program Files (x86)\Internet Download Manager\IDMan.exe
O4 - HKLM\..\Wow6432Node\Run: [Adobe ARM] . (.Adobe Systems Incorporated - Adobe Reader and Acrobat Manager.) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
O4 - HKLM\..\Wow6432Node\Run: [TkBellExe] . (.RealNetworks, Inc. - RealNetworks Scheduler.) -- C:\Program Files (x86)\Real\RealPlayer\Update\realsched.exe
O4 - HKLM\..\Wow6432Node\Run: [Sabre OADP Util] . (.Sabre Inc. - Open Auxiliary Device Platform.) -- E:\Sabre\Apps\OADP\OadpUtil.exe
O4 - HKLM\..\Wow6432Node\Run: [GrooveMonitor] . (.Microsoft Corporation - GrooveMonitor Utility.) -- C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe
O4 - HKUS\.DEFAULT\..\RunOnce: [SPReview] . (.Microsoft Corporation - SP Reviewer.) -- C:\Windows\System32\SPReview\SPReview.exe
O4 - HKUS\S-1-5-18\..\RunOnce: [SPReview] . (.Microsoft Corporation - SP Reviewer.) -- C:\Windows\System32\SPReview\SPReview.exe
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe
O4 - HKUS\S-1-5-21-506657601-157788839-3318356469-1000\..\Run: [KSS] . (.Kaspersky Lab ZAO - Kaspersky Security Scan.) -- C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan 2.0\kss.exe
O4 - HKUS\S-1-5-21-506657601-157788839-3318356469-1000\..\Run: [uTorrent] . (.BitTorrent Inc. - µTorrent.) -- C:\Users\dell\AppData\Roaming\uTorrent\uTorrent.exe
O4 - HKUS\S-1-5-21-506657601-157788839-3318356469-1000\..\Run: [GoogleChromeAutoLaunch_9FD5ED0742D873E78F8A54709BF48770] . (.Google Inc. - Google Chrome.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
O4 - HKUS\S-1-5-21-506657601-157788839-3318356469-1000\..\Run: [IDMan] . (.Tonec Inc. - Internet Download Manager (IDM).) -- C:\Program Files (x86)\Internet Download Manager\IDMan.exe

---\\ Lop.com/Domain Hijackers (O17) (9) - 0s
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpDomain = afaqe2e.com
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1 192.168.1.1
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: DhcpDomain = afaqe2e.com
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1 192.168.1.1
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: DhcpDomain = afaqe2e.com

---\\ Non Microsoft non disabled Windows XP/NT/2000 Services (O23) (14) - 0s
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) . (.Adobe Systems Incorporated - Adobe Acrobat Update Service.) - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: خدمة Kaspersky Anti-Virus 15.0.0 (AVP15.0.0) . (.Kaspersky Lab ZAO - Kaspersky Anti-Virus.) - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe
O23 - Service: Firebird Guardian - DefaultInstance (FirebirdGuardianDefaultInstance) . (.Firebird Project - Firebird SQL Server.) - C:\Program Files (x86)\Firebird\Firebird_2_1\bin\fbguard.exe
O23 - Service: Foxit Cloud Safe Update Service (FoxitCloudUpdateService) . (.Foxit Software Inc. - Foxit Cloud Safe Update Service.) - C:\Program Files (x86)\Foxit Software\Foxit Reader\Foxit Cloud\FCUpdateService.exe
O23 - Service: خدمة Google Update (gupdate) (gupdate) . (.Google Inc. - Google Installer.) - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Intel(R) HD Graphics Control Panel Service (igfxCUIService1.0.0.0) . (.Intel Corporation - igfxCUIService Module.) - C:\Windows\system32\igfxCUIService.exe
O23 - Service: Kaspersky Security Scan Service (KSS) . (.Kaspersky Lab ZAO - Kaspersky Security Scan.) - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan 2.0\kss.exe
O23 - Service: RealNetworks Downloader Resolver Service (RealNetworks Downloader Resolver Service) . (...) - C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe
O23 - Service: RealPlayer Cloud Service (RealPlayer Cloud Service) . (.RealNetworks, Inc. - RealPlayer Cloud Service.) - C:\Program Files (x86)\Real\RealPlayer\RPDS\Bin\rpdsvc.exe
O23 - Service: RealPlayer Update Service (RealPlayerUpdateSvc) . (...) - C:\Program Files (x86)\Real\UpdateService\RealPlayerUpdateSvc.exe
O23 - Service: Sabre Print Service (SabrePrint) . (.Sabre Inc. - Open Auxiliary Device Platform.) - E:\Sabre\Apps\OADP\OADP.exe
O23 - Service: SoftEther VPN Client (SEVPNCLIENT) . (.SoftEther VPN Project at University of Tsukuba, Japan - SoftEther VPN.) - C:\Program Files\SoftEther VPN Client\vpnclient_x64.exe
O23 - Service: Skype Updater (SkypeUpdate) . (.Skype Technologies - Skype Updater Service.) - C:\Program Files (x86)\Skype\Updater\Updater.exe
O23 - Service: TeamViewer 9 (TeamViewer9) . (.TeamViewer GmbH - TeamViewer 9.) - C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe

---\\ Task Planned Automatically (O39) (18) - 3s
[MD5.9B3355B29942AF67F014EA90CE1EA960] [APT] [Adobe Flash Player Updater] (.Adobe Systems Incorporated.) -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe   [268976]
[MD5.506708142BC63DABA64F2D3AD1DCD5BF] [APT] [GoogleUpdateTaskMachineCore] (.Google Inc..) -- C:\Program Files (x86)\Google\Update\GoogleUpdate.exe   [116648]
[MD5.506708142BC63DABA64F2D3AD1DCD5BF] [APT] [GoogleUpdateTaskMachineUA] (.Google Inc..) -- C:\Program Files (x86)\Google\Update\GoogleUpdate.exe   [116648]
[MD5.00000000000000000000000000000000] [APT] [keepup] (...) -- C:\Users\dell\AppData\Roaming\miaul\RJFC.exe (.not file.)   [0]
[MD5.2A5C656B0A364580E578B26EAE2EE889] [APT] [klcp_update] (...) -- C:\Program Files (x86)\K-Lite Codec Pack\Tools\CodecTweakTool.exe   [1173504]
[MD5.4DFA7C80C31DFDA973E7122E15CA2F90] [APT] [Start PC Reviver for dell-PC@dell(logon)] (.ReviverSoft.) -- C:\Program Files\ReviverSoft\PC Reviver\PC Reviver.exe   [5116168]
O39 - APT: Adobe Flash Player Updater - (.Adobe Systems Incorporated.) -- C:\Windows\Tasks\Adobe Flash Player Updater.job   [830]  =>.Adobe Systems Incorporated
O39 - APT: GoogleUpdateTaskMachineCore - (.Google Inc..) -- C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job   [838]  =>.Google Inc.
O39 - APT: GoogleUpdateTaskMachineUA - (.Google Inc..) -- C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job   [842]  =>.Google Inc.
O39 - APT: Start PC Reviver for dell-PC@dell(logon) - (.ReviverSoft.) -- C:\Windows\Tasks\Start PC Reviver for dell-PC@dell(logon).job   [304]
O39 - APT: Adobe Flash Player Updater - (.Adobe Systems Incorporated.) -- C:\Windows\System32\Tasks\Adobe Flash Player Updater   [3768]  =>.Adobe Systems Incorporated
O39 - APT: GoogleUpdateTaskMachineCore - (.Google Inc..) -- C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore   [3586]  =>.Google Inc.
O39 - APT: GoogleUpdateTaskMachineUA - (.Google Inc..) -- C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA   [3838]  =>.Google Inc.
O39 - APT: keepup - (...) -- C:\Windows\System32\Tasks\keepup   [3740]
O39 - APT: klcp_update - (...) -- C:\Windows\System32\Tasks\klcp_update   [3672]
O39 - APT: Start PC Reviver for dell-PC@dell(logon) - (.ReviverSoft.) -- C:\Windows\System32\Tasks\Start PC Reviver for dell-PC@dell(logon)   [2592]
O39 - APT: Orphean - (...) -- C:\Windows\System32\Tasks\{B606AC67-EA74-4A57-878B-0ABEE5CBE35D}   [3170]
O39 - APT: Orphean - (...) -- C:\Windows\System32\Tasks\{E5277723-3D55-4B25-B2AF-2A979AE35403}   [3180]

---\\ Software installed (O42) (53) - 4s
O42 - Logiciel: PC Reviver - (.ReviverSoft LLC.) [HKLM][64Bits] -- PC Reviver
O42 - Logiciel: Intel(R) Network Connections Drivers - (.Intel.) [HKLM][64Bits] -- PROSet
O42 - Logiciel: SoftEther VPN Client - (.SoftEther VPN Project.) [HKLM][64Bits] -- softether_sevpnclient
O42 - Logiciel: WinRAR 4.20 (64-bit) - (.win.rar GmbH.) [HKLM][64Bits] -- WinRAR archiver
O42 - Logiciel: Microsoft Silverlight - (.Microsoft Corporation.) [HKLM][64Bits] -- {89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}
O42 - Logiciel: SAMSUNG USB Driver for Mobile Phones - (.SAMSUNG Electronics Co., Ltd..) [HKLM][64Bits] -- {D0795B21-0CDA-4a92-AB9E-6E92D8111E44}
O42 - Logiciel: Adobe Flash Player 18 ActiveX - (.Adobe Systems Incorporated.) [HKLM][64Bits] -- Adobe Flash Player ActiveX
O42 - Logiciel: Adobe Flash Player 18 NPAPI - (.Adobe Systems Incorporated.) [HKLM][64Bits] -- Adobe Flash Player NPAPI
O42 - Logiciel: Firebird 2.1.3.18185 (Win32) - (.Firebird Project.) [HKLM][64Bits] -- FBDBServer_2_1_is1
O42 - Logiciel: FormatFactory 2.96 - (.Free Time.) [HKLM][64Bits] -- FormatFactory
O42 - Logiciel: Foxit Reader - (.Foxit Corporation.) [HKLM][64Bits] -- Foxit Reader_is1
O42 - Logiciel: Freemake Video Downloader - (.Ellora Assets Corporation.) [HKLM][64Bits] -- Freemake Video Downloader_is1
O42 - Logiciel: Google Chrome - (.Google Inc‎.‎.) [HKLM][64Bits] -- Google Chrome
O42 - Logiciel: GoToAssist Corporate - (.Citrix Online, a division of Citrix Systems, Inc..) [HKLM][64Bits] -- GoToAssist
O42 - Logiciel: Samsung Kies3 - (.Samsung Electronics Co., Ltd..) [HKLM][64Bits] -- InstallShield_{88547073-C566-4895-9005-EBE98EA3F7C7}
O42 - Logiciel: Kaspersky Internet Security - (.Kaspersky Lab.) [HKLM][64Bits] -- InstallWIX_{653C1B5A-3287-47B1-8613-0745D4E771C4}
O42 - Logiciel: Kaspersky Security Scan - (.Kaspersky Lab.) [HKLM][64Bits] -- InstallWIX_{D1282694-0693-41A8-ABC1-6D1FFC1F65C4}
O42 - Logiciel: Internet Download Manager - (.Tonec Inc..) [HKLM][64Bits] -- Internet Download Manager
O42 - Logiciel: JLC's Internet TV - (...) [HKLM][64Bits] -- JLC's Internet TV
O42 - Logiciel: K-Lite Codec Pack 10.8.0 Full - (...) [HKLM][64Bits] -- KLiteCodecPack_is1
O42 - Logiciel: Mozilla Firefox 39.0 (x86 en-US) - (.Mozilla.) [HKLM][64Bits] -- Mozilla Firefox 39.0 (x86 en-US)
O42 - Logiciel: Mozilla Maintenance Service - (.Mozilla.) [HKLM][64Bits] -- MozillaMaintenanceService
O42 - Logiciel: RealPlayer Cloud - (.RealNetworks.) [HKLM][64Bits] -- RealPlayer 17.0
O42 - Logiciel: TeamViewer 9 - (.TeamViewer.) [HKLM][64Bits] -- TeamViewer 9
O42 - Logiciel: VideoLAN VLC media player 0.8.6c - (.VideoLAN Team.) [HKLM][64Bits] -- VLC media player
O42 - Logiciel: Sabre OADP (SPM) Installer v9.0.0 - (.Sabre-Holdings Inc..) [HKLM][64Bits] -- {117F3374-8E69-11DD-8848-67BF55D89593}
O42 - Logiciel: RealDownloader - (.RealNetworks, Inc..) [HKLM][64Bits] -- {2259DBC1-EFFB-42B5-BA35-DFC0AAB2B3FB}
O42 - Logiciel: Skype™ 7.0 - (.Skype Technologies S.A..) [HKLM][64Bits] -- {24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}
O42 - Logiciel: Java(TM) 6 Update 16 - (.Sun Microsystems, Inc..) [HKLM][64Bits] -- {26A24AE4-039D-4CA4-87B4-2F83216016FF}
O42 - Logiciel: RealUpgrade 1.1 - (.RealNetworks, Inc..) [HKLM][64Bits] -- {28C2DED6-325B-4CC7-983A-1777C8F7FBAB}
O42 - Logiciel: Brother MFL-Pro Suite MFC-7360 - (.Brother Industries, Ltd..) [HKLM][64Bits] -- {3ACCCFB3-7B17-4E9F-ACB0-46868FCD4487}
O42 - Logiciel: Foxit Cloud - (.Foxit Software Inc..) [HKLM][64Bits] -- {41914D8B-9D6E-4764-A1F9-BC43FB6782C1}_is1
O42 - Logiciel: SnagIt 9 - (.TechSmith Corporation.) [HKLM][64Bits] -- {59991D18-A988-45AB-B1BF-5ADE6E64CD3F}
O42 - Logiciel: Google Update Helper - (.Google Inc..) [HKLM][64Bits] -- {60EC980A-BDA2-4CB6-A427-B07A5498B4CA}
O42 - Logiciel: Kaspersky Internet Security - (.Kaspersky Lab.) [HKLM][64Bits] -- {653C1B5A-3287-47B1-8613-0745D4E771C4}
O42 - Logiciel: Skype Click to Call - (.Microsoft Corporation.) [HKLM][64Bits] -- {6D1221A9-17BF-4EC0-81F2-27D30EC30701}
O42 - Logiciel: Google Earth - (.Google.) [HKLM][64Bits] -- {817750FA-EC6A-485D-9901-0683AE6FFDF1}
O42 - Logiciel: MSXML 4.0 SP2 (KB954430) - (.Microsoft Corporation.) [HKLM][64Bits] -- {86493ADD-824D-4B8E-BD72-8C5DCDC52A71}
O42 - Logiciel: Samsung Kies3 - (.Samsung Electronics Co., Ltd..) [HKLM][64Bits] -- {88547073-C566-4895-9005-EBE98EA3F7C7}
O42 - Logiciel: MSI to redistribute MS VS2005 CRT libraries - (.The Firebird Project.) [HKLM][64Bits] -- {A8D93648-9F7F-407D-915C-62044644C3DA}
O42 - Logiciel: Google Update Helper - (.Google Inc..) [HKLM][64Bits] -- {A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}
O42 - Logiciel: Adobe Reader XI (11.0.09) - (.Adobe Systems Incorporated.) [HKLM][64Bits] -- {AC76BA86-7AD7-1033-7B44-AB0000000001}
O42 - Logiciel: Kaspersky Security Scan - (.Kaspersky Lab.) [HKLM][64Bits] -- {D1282694-0693-41A8-ABC1-6D1FFC1F65C4}
O42 - Logiciel: Easy Street Draw 3 - (...) [HKLM][64Bits] -- {D8E80883-C928-4571-B6C8-467FE58EE80B}
O42 - Logiciel: UpdateService - (.RealNetworks, Inc..) [HKLM][64Bits] -- {E3AE96D6-E196-45B4-AF62-2B41998B9E37}
O42 - Logiciel: VRS Client - (.Videcom International Ltd.) [HKLM][64Bits] -- {ED44D035-D2F9-44F7-BFC1-7EC09AB6AC51}
O42 - Logiciel: Adobe Photoshop CS - (.Adobe Systems, Inc..) [HKLM][64Bits] -- {EFB21DE7-8C19-4A88-BB28-A766E16493BC}
O42 - Logiciel: Intel(R) Processor Graphics - (.Intel Corporation.) [HKLM][64Bits] -- {F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}
O42 - Logiciel: Realtek High Definition Audio Driver - (.Realtek Semiconductor Corp..) [HKLM][64Bits] -- {F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}
O42 - Logiciel: MSXML 4.0 SP2 (KB973688) - (.Microsoft Corporation.) [HKLM][64Bits] -- {F662A8E6-F4DC-41A2-901E-8C11F044BDEC}
O42 - Logiciel: Foxit Reader Packages - (...) [HKCU][64Bits] -- Foxit Reader Packages
O42 - Logiciel: Sabre VPN - (.Sabre Inc..) [HKCU][64Bits] -- Sabre VPN
O42 - Logiciel: µTorrent - (.BitTorrent Inc..) [HKCU][64Bits] -- uTorrent

---\\ HKCU & HKLM Software Keys (119) - 4s
HKLM\SOFTWARE\Wow6432Node\Adobe
HKLM\SOFTWARE\Wow6432Node\Ahead
HKLM\SOFTWARE\Wow6432Node\Amadeus
HKLM\SOFTWARE\Wow6432Node\Ammyy
HKLM\SOFTWARE\Wow6432Node\baidu
HKLM\SOFTWARE\Wow6432Node\Baidu Security
HKLM\SOFTWARE\Wow6432Node\Brother
HKLM\SOFTWARE\Wow6432Node\Brother Industries, Ltd.
HKLM\SOFTWARE\Wow6432Node\CDDB
HKLM\SOFTWARE\Wow6432Node\Citrix
HKLM\SOFTWARE\Wow6432Node\Firebird Project
HKLM\SOFTWARE\Wow6432Node\Foxit Software
HKLM\SOFTWARE\Wow6432Node\Freemake
HKLM\SOFTWARE\Wow6432Node\GNU
HKLM\SOFTWARE\Wow6432Node\Google
HKLM\SOFTWARE\Wow6432Node\HaaliMkx
HKLM\SOFTWARE\Wow6432Node\Hewlett-Packard
HKLM\SOFTWARE\Wow6432Node\IM Providers
HKLM\SOFTWARE\Wow6432Node\InstallShield
HKLM\SOFTWARE\Wow6432Node\Intel
HKLM\SOFTWARE\Wow6432Node\Internet Download Manager
HKLM\SOFTWARE\Wow6432Node\JavaSoft
HKLM\SOFTWARE\Wow6432Node\JLC's Software
HKLM\SOFTWARE\Wow6432Node\KasperskyLab
HKLM\SOFTWARE\Wow6432Node\Khronos
HKLM\SOFTWARE\Wow6432Node\KLCodecPack
HKLM\SOFTWARE\Wow6432Node\LAV
HKLM\SOFTWARE\Wow6432Node\Macromedia
HKLM\SOFTWARE\Wow6432Node\Mozilla
HKLM\SOFTWARE\Wow6432Node\mozilla.org
HKLM\SOFTWARE\Wow6432Node\MozillaPlugins
HKLM\SOFTWARE\Wow6432Node\Nuance
HKLM\SOFTWARE\Wow6432Node\ODBC
HKLM\SOFTWARE\Wow6432Node\RealNetworks
HKLM\SOFTWARE\Wow6432Node\Samsung
HKLM\SOFTWARE\Wow6432Node\Skype
HKLM\SOFTWARE\Wow6432Node\SoftEther Project
HKLM\SOFTWARE\Wow6432Node\TeamViewer
HKLM\SOFTWARE\Wow6432Node\TechSmith
HKLM\SOFTWARE\Wow6432Node\The SABRE Group
HKLM\SOFTWARE\Wow6432Node\Torch  =>PUP.Optional.Torch
HKLM\SOFTWARE\Wow6432Node\Trancite Logic Systems
HKLM\SOFTWARE\Wow6432Node\TuneUp
HKLM\SOFTWARE\Wow6432Node\VideoLAN
HKLM\SOFTWARE\Wow6432Node\Volatile
HKLM\SOFTWARE\Wow6432Node\Xing Technology Corp.
HKLM\SOFTWARE\Wow6432Node\yahoo
HKLM\SOFTWARE\Wow6432Node\RegisteredApplications
HKCU\SOFTWARE\Adobe
HKCU\SOFTWARE\Ahead
HKCU\SOFTWARE\Amadeus
HKCU\SOFTWARE\Ammyy
HKCU\SOFTWARE\Anchorfree
HKCU\SOFTWARE\APN PIP  =>PUP.Optional.Conduit
HKCU\SOFTWARE\AppDataLow
HKCU\SOFTWARE\ARHome  =>Trojan.Vonteera
HKCU\SOFTWARE\Avast Software
HKCU\SOFTWARE\Baidu
HKCU\SOFTWARE\Baidu Security
HKCU\SOFTWARE\BitTorrent
HKCU\SOFTWARE\Brother
HKCU\SOFTWARE\Citrix
HKCU\SOFTWARE\cmcm
HKCU\SOFTWARE\DownloadManager
HKCU\SOFTWARE\drpsu
HKCU\SOFTWARE\FileHippo
HKCU\SOFTWARE\Foxit Software
HKCU\SOFTWARE\Freemake
HKCU\SOFTWARE\FreeTime
HKCU\SOFTWARE\Gabest
HKCU\SOFTWARE\GNU
HKCU\SOFTWARE\Google
HKCU\SOFTWARE\Haali
HKCU\SOFTWARE\HitLeap
HKCU\SOFTWARE\Icaros
HKCU\SOFTWARE\IM Providers
HKCU\SOFTWARE\InstallCore  =>PUP.Optional.InstallCore
HKCU\SOFTWARE\Intel
HKCU\SOFTWARE\JavaSoft
HKCU\SOFTWARE\KasperskyLab
HKCU\SOFTWARE\Local AppWizard-Generated Applications
HKCU\SOFTWARE\Macromedia
HKCU\SOFTWARE\madshi
HKCU\SOFTWARE\Medad Educational
HKCU\SOFTWARE\MediaInfo
HKCU\SOFTWARE\Mozilla
HKCU\SOFTWARE\MozillaPlugins
HKCU\SOFTWARE\MPC-HC
HKCU\SOFTWARE\Netscape
HKCU\SOFTWARE\NoVooIT  =>Trojan.Vonteera
HKCU\SOFTWARE\NoVooITSet  =>Trojan.Vonteera
HKCU\SOFTWARE\ODBC
HKCU\SOFTWARE\RealNetworks
HKCU\SOFTWARE\Realtek
HKCU\SOFTWARE\Samsung
HKCU\SOFTWARE\Skype
HKCU\SOFTWARE\SoftEther Project
HKCU\SOFTWARE\Tbccint  =>PUP.Optional.Conduit
HKCU\SOFTWARE\Tbccint_HKLM  =>PUP.Optional.Conduit
HKCU\SOFTWARE\TeamViewer
HKCU\SOFTWARE\TechSmith
HKCU\SOFTWARE\Torch  =>PUP.Optional.Torch
HKCU\SOFTWARE\Trolltech
HKCU\SOFTWARE\TuneUp
HKCU\SOFTWARE\Ultracopier
HKCU\SOFTWARE\University of Tsukuba
HKCU\SOFTWARE\VB and VBA Program Settings
HKCU\SOFTWARE\Vonteera Safe ads  =>Trojan.Vonteera
HKCU\SOFTWARE\wine
HKCU\SOFTWARE\WinRAR
HKCU\SOFTWARE\WinRAR SFX
HKCU\SOFTWARE\Wintertree
HKCU\SOFTWARE\yahoo
HKCU\SOFTWARE\yahooinstall
HKCU\SOFTWARE\ZebHelpProcess Helper
HKCU\SOFTWARE\AppDataLow\Software
HKCU\SOFTWARE\AppDataLow\Software\Smartbar  =>PUP.Optional.SmartBar
HKCU\SOFTWARE\AppDataLow\Software\Tbccint  =>PUP.Optional.Conduit
HKCU\SOFTWARE\AppDataLow\Software\TbccintSearchScopes  =>PUP.Optional.Conduit

---\\ Contents of the Common Files folders (O43) (207) - 4s
O43 - CFD: 2014/09/22 17:23:10 - [] D -- C:\Program Files (x86)\Adobe
O43 - CFD: 2015/05/25 09:55:19 - [] D -- C:\Program Files (x86)\Ahead
O43 - CFD: 2014/10/04 08:04:02 - [] D -- C:\Program Files (x86)\Baidu-Security-2014-4.4.4.78690
O43 - CFD: 2014/09/15 09:37:39 - [] D -- C:\Program Files (x86)\Brother
O43 - CFD: 2014/09/15 09:37:44 - [] D -- C:\Program Files (x86)\Browny02
O43 - CFD: 2014/09/17 20:19:39 - [] D -- C:\Program Files (x86)\Citrix
O43 - CFD: 2015/06/10 12:54:49 - [] D -- C:\Program Files (x86)\cmcm
O43 - CFD: 2015/06/16 10:02:00 - [] D -- C:\Program Files (x86)\Common Files
O43 - CFD: 2014/09/15 09:37:43 - [] D -- C:\Program Files (x86)\ControlCenter4
O43 - CFD: 2015/03/25 23:24:20 - [] D -- C:\Program Files (x86)\Firebird
O43 - CFD: 2014/09/22 17:33:14 - [] D -- C:\Program Files (x86)\Foxit Software
O43 - CFD: 2014/09/15 07:36:58 - [] D -- C:\Program Files (x86)\Freemake
O43 - CFD: 2014/09/15 07:30:30 - [] D -- C:\Program Files (x86)\FreeTime
O43 - CFD: 2015/06/04 16:57:24 - [] D -- C:\Program Files (x86)\Google
O43 - CFD: 2015/01/21 10:13:31 - [] HD -- C:\Program Files (x86)\InstallShield Installation Information
O43 - CFD: 2014/09/15 06:36:12 - [] D -- C:\Program Files (x86)\Intel
O43 - CFD: 2015/04/08 13:37:29 - [] D -- C:\Program Files (x86)\Internet Download Manager
O43 - CFD: 2015/08/06 10:57:18 - [] D -- C:\Program Files (x86)\Internet Explorer
O43 - CFD: 2014/12/11 10:33:58 - [] D -- C:\Program Files (x86)\Java
O43 - CFD: 2014/12/15 18:13:42 - [] D -- C:\Program Files (x86)\JLC's Software
O43 - CFD: 2014/10/16 20:16:32 - [] D -- C:\Program Files (x86)\K-Lite Codec Pack
O43 - CFD: 2015/01/14 18:41:39 - [] D -- C:\Program Files (x86)\Kaspersky Lab
O43 - CFD: 2014/11/21 21:54:02 - [] D -- C:\Program Files (x86)\KONAMI
O43 - CFD: 2015/06/16 10:02:24 - [] D -- C:\Program Files (x86)\Microsoft Office
O43 - CFD: 2015/06/14 17:14:02 - [] D -- C:\Program Files (x86)\Microsoft Silverlight
O43 - CFD: 2014/09/15 07:07:23 - [] D -- C:\Program Files (x86)\Microsoft Visual Studio
O43 - CFD: 2014/09/15 07:06:22 - [] D -- C:\Program Files (x86)\Microsoft Visual Studio 8
O43 - CFD: 2015/06/15 23:10:29 - [] D -- C:\Program Files (x86)\Microsoft Works
O43 - CFD: 2014/10/15 20:10:32 - [] D -- C:\Program Files (x86)\Microsoft.NET
O43 - CFD: 2015/07/12 00:08:33 - [] D -- C:\Program Files (x86)\Mozilla Firefox
O43 - CFD: 2015/07/12 13:44:54 - [] D -- C:\Program Files (x86)\Mozilla Maintenance Service
O43 - CFD: 2014/09/15 07:07:26 - [] D -- C:\Program Files (x86)\MSBuild
O43 - CFD: 2014/10/16 12:00:36 - [0] D -- C:\Program Files (x86)\MSXML 4.0
O43 - CFD: 2014/12/10 16:45:33 - [] D -- C:\Program Files (x86)\Office
O43 - CFD: 2014/09/15 07:31:16 - [] D -- C:\Program Files (x86)\Real
O43 - CFD: 2014/09/15 07:31:10 - [] D -- C:\Program Files (x86)\RealNetworks
O43 - CFD: 2009/07/14 08:32:38 - [] D -- C:\Program Files (x86)\Reference Assemblies
O43 - CFD: 2014/11/15 12:21:50 - [] D -- C:\Program Files (x86)\Samsung
O43 - CFD: 2015/06/15 23:12:42 - [] RD -- C:\Program Files (x86)\Skype
O43 - CFD: 2014/10/04 07:55:14 - [0] D -- C:\Program Files (x86)\Tbccint  =>PUP.Optional.Conduit
O43 - CFD: 2014/09/16 02:59:45 - [] D -- C:\Program Files (x86)\TeamViewer
O43 - CFD: 2014/12/13 22:37:50 - [] D -- C:\Program Files (x86)\TechSmith
O43 - CFD: 2015/01/21 10:13:06 - [] D -- C:\Program Files (x86)\Trancite
O43 - CFD: 2009/07/14 07:57:06 - [0] HD -- C:\Program Files (x86)\Uninstall Information
O43 - CFD: 2014/09/15 07:30:17 - [] D -- C:\Program Files (x86)\VideoLAN
O43 - CFD: 2014/11/05 10:41:04 - [] D -- C:\Program Files (x86)\vrsclient
O43 - CFD: 2015/08/04 11:07:20 - [] D -- C:\Program Files (x86)\Windows Defender
O43 - CFD: 2015/08/04 11:07:21 - [] D -- C:\Program Files (x86)\Windows Mail
O43 - CFD: 2015/08/04 11:07:20 - [] D -- C:\Program Files (x86)\Windows Media Player
O43 - CFD: 2009/07/14 08:32:38 - [] D -- C:\Program Files (x86)\Windows NT
O43 - CFD: 2015/08/04 11:07:20 - [] D -- C:\Program Files (x86)\Windows Photo Viewer
O43 - CFD: 2015/08/04 11:07:21 - [] D -- C:\Program Files (x86)\Windows Sidebar
O43 - CFD: 2015/05/23 12:34:23 - [] D -- C:\Program Files (x86)\WinMX
O43 - CFD: 2015/08/06 11:01:55 - [] RD -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories
O43 - CFD: 2014/10/20 12:45:15 - [] RD -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools
O43 - CFD: 2014/09/15 09:38:54 - [] D -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Brother
O43 - CFD: 2015/01/21 10:13:33 - [] D -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Easy Street Draw 3
O43 - CFD: 2015/03/25 23:24:21 - [] D -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Firebird 2.1 (Win32)
O43 - CFD: 2014/09/22 17:33:22 - [] D -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Foxit Reader
O43 - CFD: 2014/09/15 07:36:58 - [] D -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Freemake
O43 - CFD: 2015/05/25 09:55:30 - [] RD -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
O43 - CFD: 2014/10/15 16:40:30 - [] D -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
O43 - CFD: 2014/11/27 20:27:58 - [] D -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Internet Download Manager
O43 - CFD: 2014/12/15 18:13:42 - [] D -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\JLC's Software
O43 - CFD: 2014/10/16 20:16:38 - [] D -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\K-Lite Codec Pack
O43 - CFD: 2015/01/14 18:42:22 - [] D -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Kaspersky Internet Security
O43 - CFD: 2009/07/14 07:57:09 - [] RD -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance
O43 - CFD: 2014/09/15 07:08:07 - [] D -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office
O43 - CFD: 2015/06/14 17:14:05 - [] D -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
O43 - CFD: 2015/05/25 09:54:58 - [] D -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Nero
O43 - CFD: 2014/09/15 07:31:11 - [] D -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RealNetworks
O43 - CFD: 2015/08/06 21:58:03 - [] D -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ReviverSoft
O43 - CFD: 2015/03/10 20:05:52 - [] D -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sabre
O43 - CFD: 2014/11/15 12:22:06 - [] D -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Samsung
O43 - CFD: 2015/06/15 23:12:43 - [] D -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
O43 - CFD: 2014/12/13 22:37:54 - [] D -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SnagIt 9
O43 - CFD: 2015/02/26 11:58:46 - [] D -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SoftEther VPN Client
O43 - CFD: 2015/02/26 11:58:46 - [] RD -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
O43 - CFD: 2009/07/14 10:45:14 - [0] RHD -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Tablet PC
O43 - CFD: 2014/09/15 07:30:19 - [] D -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN
O43 - CFD: 2014/09/17 05:12:49 - [] D -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VRS Client
O43 - CFD: 2015/05/23 12:32:49 - [] D -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinMX
O43 - CFD: 2014/09/15 07:49:18 - [] D -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR
O43 - CFD: 2015/08/06 22:22:11 - [0] D -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Yahoo! Messenger
O43 - CFD: 2014/09/22 17:23:12 - [] D -- C:\ProgramData\Adobe
O43 - CFD: 2014/09/17 20:22:44 - [] D -- C:\ProgramData\Amadeus
O43 - CFD: 2014/12/15 10:34:09 - [] D -- C:\ProgramData\AMMYY
O43 - CFD: 2009/07/14 08:08:56 - [0] SHD -- C:\ProgramData\Application Data
O43 - CFD: 2014/10/15 19:11:17 - [] D -- C:\ProgramData\AVAST Software
O43 - CFD: 2014/10/15 18:44:08 - [0] D -- C:\ProgramData\Baidu Security
O43 - CFD: 2015/01/11 10:39:22 - [] D -- C:\ProgramData\BDLogging
O43 - CFD: 2014/09/15 09:38:15 - [] D -- C:\ProgramData\Brother
O43 - CFD: 2014/09/17 20:59:14 - [] D -- C:\ProgramData\Citrix
O43 - CFD: 2015/06/10 12:54:51 - [] D -- C:\ProgramData\cmcm
O43 - CFD: 2014/10/04 08:05:03 - [] HD -- C:\ProgramData\Common Files
O43 - CFD: 2014/09/15 09:37:43 - [] D -- C:\ProgramData\ControlCenter4
O43 - CFD: 2009/07/14 08:08:56 - [0] SHD -- C:\ProgramData\Desktop
O43 - CFD: 2009/07/14 08:08:56 - [0] SHD -- C:\ProgramData\Documents
O43 - CFD: 2009/07/14 08:08:56 - [0] SHD -- C:\ProgramData\Favorites
O43 - CFD: 2014/09/15 07:36:58 - [] D -- C:\ProgramData\Freemake
O43 - CFD: 2014/09/16 07:31:16 - [] D -- C:\ProgramData\HP
O43 - CFD: 2014/09/15 07:28:10 - [0] D -- C:\ProgramData\IDM
O43 - CFD: 2015/08/07 18:20:31 - [] D -- C:\ProgramData\Kaspersky Lab
O43 - CFD: 2015/03/25 23:25:14 - [] RASHD -- C:\ProgramData\Key-Base
O43 - CFD: 2015/06/10 12:54:51 - [] D -- C:\ProgramData\Kingsoft
O43 - CFD: 2015/06/14 17:14:09 - [] SD -- C:\ProgramData\Microsoft
O43 - CFD: 2015/07/16 02:55:29 - [] D -- C:\ProgramData\Microsoft Help
O43 - CFD: 2015/07/15 14:05:35 - [0] D -- C:\ProgramData\Mozilla
O43 - CFD: 2015/05/25 09:56:27 - [] D -- C:\ProgramData\ProgDVB
O43 - CFD: 2014/09/15 07:36:58 - [] D -- C:\ProgramData\Real
O43 - CFD: 2014/09/15 07:31:10 - [] D -- C:\ProgramData\RealNetworks
O43 - CFD: 2015/08/06 21:58:04 - [] D -- C:\ProgramData\ReviverSoft
O43 - CFD: 2015/05/30 13:42:52 - [] D -- C:\ProgramData\Samsung
O43 - CFD: 2015/06/17 10:05:07 - [0] D -- C:\ProgramData\Skype
O43 - CFD: 2009/07/14 08:08:56 - [0] SHD -- C:\ProgramData\Start Menu
O43 - CFD: 2014/12/13 22:37:52 - [] D -- C:\ProgramData\TechSmith
O43 - CFD: 2009/07/14 08:08:56 - [0] SHD -- C:\ProgramData\Templates
O43 - CFD: 2014/11/21 21:48:47 - [] D -- C:\ProgramData\TuneUp Software
O43 - CFD: 2014/11/21 21:44:29 - [] SHD -- C:\ProgramData\{FE8D473A-6F06-4F99-B5F4-BED72B2A038C}
O43 - CFD: 2014/09/22 17:23:17 - [] D -- C:\Program Files (x86)\Common Files\Adobe
O43 - CFD: 2014/11/20 19:07:16 - [] D -- C:\Program Files (x86)\Common Files\Ahead
O43 - CFD: 2015/06/16 10:02:00 - [] D -- C:\Program Files (x86)\Common Files\DESIGNER
O43 - CFD: 2015/01/21 10:13:02 - [] D -- C:\Program Files (x86)\Common Files\InstallShield
O43 - CFD: 2014/09/15 06:36:03 - [] D -- C:\Program Files (x86)\Common Files\Intel
O43 - CFD: 2015/06/15 23:10:37 - [] D -- C:\Program Files (x86)\Common Files\microsoft shared
O43 - CFD: 2009/07/14 06:20:08 - [] D -- C:\Program Files (x86)\Common Files\Services
O43 - CFD: 2015/06/15 23:12:42 - [] D -- C:\Program Files (x86)\Common Files\Skype
O43 - CFD: 2009/07/14 06:20:08 - [] D -- C:\Program Files (x86)\Common Files\SpeechEngines
O43 - CFD: 2015/08/04 11:07:20 - [] D -- C:\Program Files (x86)\Common Files\System
O43 - CFD: 2014/12/13 22:36:47 - [] D -- C:\Program Files (x86)\Common Files\Wise Installation Wizard
O43 - CFD: 2014/09/15 07:31:00 - [] D -- C:\Program Files (x86)\Common Files\xing shared
O43 - CFD: 2014/09/22 17:32:58 - [] D -- C:\Users\dell\AppData\Roaming\0F1L1I1P0H1L1E1E1F
O43 - CFD: 2014/09/17 19:45:15 - [] D -- C:\Users\dell\AppData\Roaming\Adobe
O43 - CFD: 2014/12/10 16:37:43 - [] D -- C:\Users\dell\AppData\Roaming\ARHome  =>Trojan.Vonteera
O43 - CFD: 2014/09/17 20:56:22 - [] D -- C:\Users\dell\AppData\Roaming\ASPI
O43 - CFD: 2014/09/16 07:25:58 - [] RD -- C:\Users\dell\AppData\Roaming\Brother
O43 - CFD: 2014/09/15 09:42:25 - [] D -- C:\Users\dell\AppData\Roaming\ControlCenter4
O43 - CFD: 2015/08/07 18:16:36 - [] D -- C:\Users\dell\AppData\Roaming\DMCache
O43 - CFD: 2014/09/17 17:39:06 - [] D -- C:\Users\dell\AppData\Roaming\Downloaded Installations
O43 - CFD: 2014/09/22 17:27:20 - [] D -- C:\Users\dell\AppData\Roaming\Fixs
O43 - CFD: 2015/01/22 23:05:20 - [] D -- C:\Users\dell\AppData\Roaming\Foxit Software
O43 - CFD: 2014/12/15 18:26:23 - [] D -- C:\Users\dell\AppData\Roaming\HTML Executable
O43 - CFD: 2014/09/15 06:27:36 - [] D -- C:\Users\dell\AppData\Roaming\Identities
O43 - CFD: 2015/01/17 14:12:38 - [] D -- C:\Users\dell\AppData\Roaming\IDM
O43 - CFD: 2014/09/15 09:37:08 - [] D -- C:\Users\dell\AppData\Roaming\InstallShield
O43 - CFD: 2014/12/15 18:13:56 - [] D -- C:\Users\dell\AppData\Roaming\JLC's Software
O43 - CFD: 2014/09/15 09:27:44 - [] D -- C:\Users\dell\AppData\Roaming\Macromedia
O43 - CFD: 2009/07/14 10:45:14 - [0] D -- C:\Users\dell\AppData\Roaming\Media Center Programs
O43 - CFD: 2015/06/05 17:44:03 - [] SD -- C:\Users\dell\AppData\Roaming\Microsoft
O43 - CFD: 2014/09/15 07:27:44 - [] D -- C:\Users\dell\AppData\Roaming\Mozilla
O43 - CFD: 2014/10/16 20:17:26 - [] D -- C:\Users\dell\AppData\Roaming\MPC-HC
O43 - CFD: 2014/11/21 21:42:57 - [] D -- C:\Users\dell\AppData\Roaming\OpenCandy  =>PUP.Optional.OpenCandy
O43 - CFD: 2014/11/21 21:43:19 - [] D -- C:\Users\dell\AppData\Roaming\PowerISO
O43 - CFD: 2015/01/11 10:28:26 - [0] D -- C:\Users\dell\AppData\Roaming\QuickScan
O43 - CFD: 2015/04/11 17:09:40 - [] D -- C:\Users\dell\AppData\Roaming\Real
O43 - CFD: 2014/09/15 07:31:30 - [] D -- C:\Users\dell\AppData\Roaming\RealNetworks
O43 - CFD: 2014/10/04 07:59:39 - [] D -- C:\Users\dell\AppData\Roaming\RHEng  =>PUP.Optional.Conduit
O43 - CFD: 2014/10/04 07:59:36 - [] D -- C:\Users\dell\AppData\Roaming\rmi
O43 - CFD: 2014/11/15 12:22:19 - [] D -- C:\Users\dell\AppData\Roaming\Samsung
O43 - CFD: 2015/05/20 17:36:51 - [] D -- C:\Users\dell\AppData\Roaming\Skype
O43 - CFD: 2015/05/21 18:01:49 - [] D -- C:\Users\dell\AppData\Roaming\TeamViewer
O43 - CFD: 2014/11/21 21:47:34 - [] D -- C:\Users\dell\AppData\Roaming\TuneUp Software
O43 - CFD: 2015/08/07 18:40:12 - [] D -- C:\Users\dell\AppData\Roaming\uTorrent
O43 - CFD: 2014/10/16 20:08:19 - [] D -- C:\Users\dell\AppData\Roaming\vlc
O43 - CFD: 2014/11/21 17:14:23 - [] D -- C:\Users\dell\AppData\Roaming\VolIE  =>Trojan.Vonteera
O43 - CFD: 2014/09/15 09:21:50 - [] D -- C:\Users\dell\AppData\Roaming\WinRAR
O43 - CFD: 2015/08/07 18:47:11 - [] D -- C:\Users\dell\AppData\Roaming\ZHP
O43 - CFD: 2015/01/13 09:45:01 - [] D -- C:\Users\dell\AppData\Local\Adobe
O43 - CFD: 2014/09/15 06:27:19 - [0] SHD -- C:\Users\dell\AppData\Local\Application Data
O43 - CFD: 2014/09/17 20:19:31 - [] D -- C:\Users\dell\AppData\Local\Citrix
O43 - CFD: 2015/08/03 10:57:57 - [] D -- C:\Users\dell\AppData\Local\ElevatedDiagnostics
O43 - CFD: 2015/06/10 20:11:15 - [0] SHD -- C:\Users\dell\AppData\Local\EmieBrowserModeList
O43 - CFD: 2015/06/10 20:11:15 - [0] SHD -- C:\Users\dell\AppData\Local\EmieSiteList
O43 - CFD: 2015/06/10 20:11:15 - [0] SHD -- C:\Users\dell\AppData\Local\EmieUserList
O43 - CFD: 2015/01/21 10:10:44 - [] D -- C:\Users\dell\AppData\Local\Google
O43 - CFD: 2015/06/01 10:18:53 - [] D -- C:\Users\dell\AppData\Local\GWX
O43 - CFD: 2014/09/15 06:27:19 - [0] SHD -- C:\Users\dell\AppData\Local\History
O43 - CFD: 2014/09/15 20:21:17 - [] D -- C:\Users\dell\AppData\Local\Macromedia
O43 - CFD: 2015/07/23 14:09:02 - [] D -- C:\Users\dell\AppData\Local\Microsoft
O43 - CFD: 2014/09/17 13:00:36 - [] D -- C:\Users\dell\AppData\Local\Microsoft Games
O43 - CFD: 2014/09/15 07:05:44 - [0] D -- C:\Users\dell\AppData\Local\Microsoft Help
O43 - CFD: 2014/09/15 07:27:44 - [] D -- C:\Users\dell\AppData\Local\Mozilla
O43 - CFD: 2014/09/15 07:27:56 - [] D -- C:\Users\dell\AppData\Local\Programs
O43 - CFD: 2014/09/16 03:28:11 - [] D -- C:\Users\dell\AppData\Local\Sabre Red Workspace
O43 - CFD: 2014/09/15 07:29:52 - [] D -- C:\Users\dell\AppData\Local\Skype
O43 - CFD: 2014/09/17 20:20:51 - [0] D -- C:\Users\dell\AppData\Local\StarSP
O43 - CFD: 2014/12/13 22:37:50 - [] D -- C:\Users\dell\AppData\Local\TechSmith
O43 - CFD: 2015/08/07 18:47:03 - [] D -- C:\Users\dell\AppData\Local\Temp
O43 - CFD: 2014/09/15 06:27:19 - [0] SHD -- C:\Users\dell\AppData\Local\Temporary Internet Files
O43 - CFD: 2014/10/23 10:10:58 - [] D -- C:\Users\dell\AppData\Local\Torch  =>PUP.Optional.Torch
O43 - CFD: 2014/11/21 21:47:35 - [] D -- C:\Users\dell\AppData\Local\TuneUp Software
O43 - CFD: 2014/09/15 07:21:50 - [] D -- C:\Users\dell\AppData\Local\VirtualStore
O43 - CFD: 2009/07/14 07:54:32 - [] RD -- C:\Users\dell\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
O43 - CFD: 2015/03/11 18:30:24 - [] RD -- C:\Users\dell\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
O43 - CFD: 2014/09/15 07:30:35 - [] D -- C:\Users\dell\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\FormatFactory
O43 - CFD: 2014/09/15 07:36:58 - [] D -- C:\Users\dell\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Freemake
O43 - CFD: 2015/03/11 11:09:00 - [] D -- C:\Users\dell\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Google Chrome
O43 - CFD: 2014/11/27 20:27:58 - [] D -- C:\Users\dell\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Download Manager
O43 - CFD: 2014/12/15 18:13:42 - [] D -- C:\Users\dell\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\JLC's Software
O43 - CFD: 2014/10/15 19:05:17 - [] D -- C:\Users\dell\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Kaspersky Security Scan
O43 - CFD: 2009/07/14 07:49:38 - [] RD -- C:\Users\dell\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
O43 - CFD: 2015/03/25 23:24:01 - [] D -- C:\Users\dell\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Medad Educational
O43 - CFD: 2014/12/15 10:44:38 - [] D -- C:\Users\dell\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Sabre Red Workspace
O43 - CFD: 2015/07/28 20:46:31 - [] RD -- C:\Users\dell\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
O43 - CFD: 2015/05/23 12:32:49 - [0] D -- C:\Users\dell\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinMX
O43 - CFD: 2014/09/15 07:49:18 - [] D -- C:\Users\dell\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
O43 - CFD: 2015/03/11 11:09:02 - [] D -- C:\Users\dell\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\‏تطبيقات Chrome

---\\ ShareTools MSconfig StartupReg (SMSR) (O53) (8) - 0s
O53 - SMSR:HKLM\...\startupreg\Adobe ARM  [Key] . (.Adobe Systems Incorporated - Adobe Reader and Acrobat Manager.) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
O53 - SMSR:HKLM\...\startupreg\BrStsMon00  [Key] . (.Brother Industries, Ltd. - Status Monitor Application.) -- C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe
O53 - SMSR:HKLM\...\startupreg\ControlCenter4  [Key] . (.Brother Industries, Ltd. - ControlCenter Launcher.) -- C:\Program Files (x86)\ControlCenter4\BrCcBoot.exe
O53 - SMSR:HKLM\...\startupreg\GrooveMonitor  [Key] . (.Microsoft Corporation - GrooveMonitor Utility.) -- C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe
O53 - SMSR:HKLM\...\startupreg\RTHDVCPL  [Key] . (.Realtek Semiconductor - Realtek HD Audio Manager.) -- C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
O53 - SMSR:HKLM\...\startupreg\Skype  [Key] . (.Skype Technologies S.A. - Skype.) -- C:\Program Files (x86)\Skype\Phone\Skype.exe
O53 - SMSR:HKLM\...\startupreg\SunJavaUpdateSched  [Key] . (.Sun Microsystems, Inc. - Java(TM) Platform SE binary.) -- C:\Program Files (x86)\Java\jre6\bin\jusched.exe
O53 - SMSR:HKLM\...\startupreg\TkBellExe  [Key] . (.RealNetworks, Inc. - RealNetworks Scheduler.) -- C:\Program Files (x86)\Real\RealPlayer\Update\realsched.exe

---\\ System Drivers List (SDL) (O58) (76) - 31s
O58 - SDL:2009/07/14 04:52:21 A . (.Adaptec, Inc. - Adaptec Windows SAS/SATA Storport Driver.) -- C:\Windows\System32\drivers\adp94xx.sys   [491088]
O58 - SDL:2009/07/14 04:52:21 A . (.Adaptec, Inc. - Adaptec Windows SATA Storport Driver.) -- C:\Windows\System32\drivers\adpahci.sys   [339536]
O58 - SDL:2009/07/14 04:52:21 A . (.Adaptec, Inc. - Adaptec StorPort Ultra320 SCSI Driver (X64).) -- C:\Windows\System32\drivers\adpu320.sys   [182864]
O58 - SDL:2009/07/14 04:52:21 A . (.Acer Laboratories Inc. - ALi mini IDE Driver.) -- C:\Windows\System32\drivers\aliide.sys   [15440]
O58 - SDL:2011/03/11 09:41:12 A . (.Advanced Micro Devices - AHCI 1.2 Device Driver.) -- C:\Windows\System32\drivers\amdsata.sys   [107904]
O58 - SDL:2009/07/14 04:52:20 A . (.AMD Technologies Inc. - AMD Technology AHCI Compatible Controller D.) -- C:\Windows\System32\drivers\amdsbs.sys   [194128]
O58 - SDL:2011/03/11 09:41:12 A . (.Advanced Micro Devices - Storage Filter Driver.) -- C:\Windows\System32\drivers\amdxata.sys   [27008]
O58 - SDL:2009/07/14 04:52:21 A . (.Adaptec, Inc. - Adaptec RAID Storport Driver.) -- C:\Windows\System32\drivers\arc.sys   [87632]
O58 - SDL:2009/07/14 04:52:21 A . (.Adaptec, Inc. - Adaptec SAS RAID WS03 Driver.) -- C:\Windows\System32\drivers\arcsas.sys   [97856]
O58 - SDL:2007/08/17 10:15:22 A . (.Atheros Communications, Inc. - Atheros Extensible Wireless LAN device driv.) -- C:\Windows\System32\drivers\athrxusb.sys   [1061888]
O58 - SDL:2009/06/10 23:34:23 A . (.Broadcom Corporation - Broadcom NetXtreme Gigabit Ethernet NDIS6.x.) -- C:\Windows\System32\drivers\b57nd60a.sys   [270848]
O58 - SDL:2009/06/10 23:41:06 A . (.Brother Industries, Ltd. - Windows ME USB Mass-Storage Bulk-Only Lower.) -- C:\Windows\System32\drivers\BrFiltLo.sys   [18432]
O58 - SDL:2009/06/10 23:41:06 A . (.Brother Industries, Ltd. - Windows ME USB Mass-Storage Bulk-Only Upper.) -- C:\Windows\System32\drivers\BrFiltUp.sys   [8704]
O58 - SDL:2012/07/31 14:56:58 A . (.Brother Industries Ltd. - Brother MFC Serial Interface Driver(WDM).) -- C:\Windows\System32\drivers\BrSerIb.sys   [95344]
O58 - SDL:2009/07/14 04:19:07 A . (.Brother Industries Ltd. - Brotehr Serial I/F Driver (WDM).) -- C:\Windows\System32\drivers\BrSerId.sys   [286720]
O58 - SDL:2009/06/10 23:41:10 A . (.Brother Industries Ltd. - Brother Serial driver (WDM version).) -- C:\Windows\System32\drivers\BrSerWdm.sys   [47104]
O58 - SDL:2009/06/10 23:41:10 A . (.Brother Industries Ltd. - Brother USB MDM Driver.) -- C:\Windows\System32\drivers\BrUsbMdm.sys   [14976]
O58 - SDL:2009/06/10 23:41:10 A . (.Brother Industries Ltd. - Brother USB Serial Driver.) -- C:\Windows\System32\drivers\BrUsbSer.sys   [14720]
O58 - SDL:2012/06/22 04:59:36 A . (.Brother Industries Ltd. - Brother MFC Serial USB Driver(WDM).) -- C:\Windows\System32\drivers\BrUsbSib.sys   [21872]
O58 - SDL:2009/06/10 23:34:28 A . (.Broadcom Corporation - Broadcom NetXtreme II GigE VBD.) -- C:\Windows\System32\drivers\bxvbda.sys   [468480]
O58 - SDL:2009/07/14 04:52:31 A . (.CMD Technology, Inc. - CMD PCI IDE Bus Driver.) -- C:\Windows\System32\drivers\cmdide.sys   [17488]
O58 - SDL:2014/05/02 20:02:50 A . (.Intel Corporation - Intel(R) Gigabit Adapter NDIS 6.x driver.) -- C:\Windows\System32\drivers\e1c62x64.sys   [495376]
O58 - SDL:2009/07/14 04:47:48 A . (.Emulex - Storport Miniport Driver for LightPulse HBA.) -- C:\Windows\System32\drivers\elxstor.sys   [530496]
O58 - SDL:2009/06/10 23:34:33 A . (.Broadcom Corporation - Broadcom NetXtreme II 10 GigE VBD.) -- C:\Windows\System32\drivers\evbda.sys   [3286016]
O58 - SDL:2009/03/06 21:38:24 A . (.Intel Corporation - BIOS Update Driver.) -- C:\Windows\System32\drivers\flashud.sys   [51712]
O58 - SDL:2009/06/10 23:31:59 A . (.Hauppauge Computer Works, Inc. - Hauppauge WinTV 885 Consumer IR Driver for.) -- C:\Windows\System32\drivers\hcw85cir.sys   [31232]
O58 - SDL:2013/01/23 17:57:32 A . (.Intel Corporation - Intel(R) Management Engine Interface.) -- C:\Windows\System32\drivers\HECIx64.sys   [64624]
O58 - SDL:2010/11/20 16:33:35 A . (.Hewlett-Packard Company - Smart Array SAS/SATA Controller Media Drive.) -- C:\Windows\System32\drivers\HpSAMD.sys   [78720]
O58 - SDL:2013/09/20 15:41:20 A . (.Intel Corporation - Intel Rapid Storage Technology driver - x64.) -- C:\Windows\System32\drivers\iaStorA.sys   [630632]
O58 - SDL:2013/09/20 15:41:16 A . (.Intel Corporation - Intel Rapid Storage Technology Filter drive.) -- C:\Windows\System32\drivers\iaStorF.sys   [28008]
O58 - SDL:2011/03/11 09:41:26 A . (.Intel Corporation - Intel Matrix Storage Manager driver - x64.) -- C:\Windows\System32\drivers\iaStorV.sys   [410496]
O58 - SDL:2011/06/30 01:04:58 A . (.Intel Corporation - Intel(R) Watchdog Timer Driver (Intel(R) WD.) -- C:\Windows\System32\drivers\ICCWDT.sys   [26136]
O58 - SDL:2014/10/01 07:19:10 A . (.Tonec Inc. - Internet Download Manager WFP Driver.) -- C:\Windows\System32\drivers\idmwfp.sys   [180136]
O58 - SDL:2015/06/05 01:46:26 A . (.Intel Corporation - Intel Graphics Kernel Mode Driver.) -- C:\Windows\System32\drivers\igdkmd64.sys   [3788728]
O58 - SDL:2009/07/14 04:48:04 A . (.Intel Corp./ICP vortex GmbH - Intel/ICP Raid Storport Driver.) -- C:\Windows\System32\drivers\iirsp.sys   [44112]
O58 - SDL:2014/10/03 16:35:54 A . (.Intel(R) Corporation - Intel(R) Display Audio Driver.) -- C:\Windows\System32\drivers\IntcDAud.sys   [454416]
O58 - SDL:2013/07/18 00:43:40 A . (.Intel Corporation - Intel(R) USB 3.0 Host Controller Switch Dri.) -- C:\Windows\System32\drivers\iusb3hcs.sys   [20464]
O58 - SDL:2013/07/18 00:43:40 A . (.Intel Corporation - Intel(R) USB 3.0 eXtensible Host Controller.) -- C:\Windows\System32\drivers\iusb3xhc.sys   [795632]
O58 - SDL:2014/02/20 12:59:04 A . (.Kaspersky Lab ZAO - Kaspersky Unified Driver.) -- C:\Windows\System32\drivers\kl1.sys   [457824]
O58 - SDL:2015/01/15 19:27:28 A . (.Kaspersky Lab ZAO - Filter Core [fre_wlh_x64].) -- C:\Windows\System32\drivers\klflt.sys   [141320]
O58 - SDL:2014/04/10 17:25:34 A . (.Kaspersky Lab ZAO - KLHK [fre_wlh_x64].) -- C:\Windows\System32\drivers\klhk.sys   [243808]
O58 - SDL:2015/01/15 19:27:29 A . (.Kaspersky Lab ZAO - Klif Mini-Filter [fre_wlh_x64].) -- C:\Windows\System32\drivers\klif.sys   [793800]
O58 - SDL:2014/02/25 13:09:02 A . (.Kaspersky Lab ZAO - Kaspersky Lab Intermediate Network Driver.) -- C:\Windows\System32\drivers\klim6.sys   [30304]
O58 - SDL:2014/03/28 17:51:04 A . (.Kaspersky Lab ZAO - KLKBDFLT Keyboard Device Filter [fre_wlh_x6.) -- C:\Windows\System32\drivers\klkbdflt.sys   [28768]
O58 - SDL:2013/08/08 17:11:00 A . (.Kaspersky Lab ZAO - KLMOUFLT Mouse Device Filter [fre_wlh_x64].) -- C:\Windows\System32\drivers\klmouflt.sys   [29280]
O58 - SDL:2013/04/12 15:34:48 A . (.Kaspersky Lab ZAO - KLPD [fre_wnet_x64].) -- C:\Windows\System32\drivers\klpd.sys   [15456]
O58 - SDL:2014/03/25 16:26:04 A . (.Kaspersky Lab ZAO - Network filtering component [fre_wnet_amd64.) -- C:\Windows\System32\drivers\kltdi.sys   [55904]
O58 - SDL:2014/03/26 17:05:28 A . (.Kaspersky Lab ZAO - KNEPS Power [fre_wnet_amd64].) -- C:\Windows\System32\drivers\kneps.sys   [179296]
O58 - SDL:2015/06/10 12:54:49 A . (.Kingsoft Corporation - Kingsoft KSAPI Module.) -- C:\Windows\System32\drivers\ksapi.sys   [81768]
O58 - SDL:2015/06/10 12:54:49 A . (.Kingsoft Corporation - Kingsoft KSAPI Module.) -- C:\Windows\System32\drivers\ksapi64.sys   [56680]
O58 - SDL:2009/07/14 04:48:04 A . (.LSI Corporation - LSI Fusion-MPT FC Driver (StorPort).) -- C:\Windows\System32\drivers\lsi_fc.sys   [114752]
O58 - SDL:2009/07/14 04:48:04 A . (.LSI Corporation - LSI Fusion-MPT SAS Driver (StorPort).) -- C:\Windows\System32\drivers\lsi_sas.sys   [106560]
O58 - SDL:2009/07/14 04:48:04 A . (.LSI Corporation - LSI SAS Gen2 Driver (StorPort).) -- C:\Windows\System32\drivers\lsi_sas2.sys   [65600]
O58 - SDL:2009/07/14 04:48:04 A . (.LSI Corporation - LSI Fusion-MPT SCSI Driver (StorPort).) -- C:\Windows\System32\drivers\lsi_scsi.sys   [115776]
O58 - SDL:2009/07/14 04:48:04 A . (.LSI Corporation - MEGASAS RAID Controller Driver for Windows.) -- C:\Windows\System32\drivers\megasas.sys   [35392]
O58 - SDL:2009/07/14 04:48:04 A . (.LSI Corporation, Inc. - LSI MegaRAID Software RAID Driver.) -- C:\Windows\System32\drivers\MegaSR.sys   [284736]
O58 - SDL:2015/02/26 12:00:03 A . (.SoftEther VPN Project at University of Tsukuba, Japan - SoftEther VPN.) -- C:\Windows\System32\drivers\Neo_0005.sys   [28640]
O58 - SDL:2009/07/14 04:48:26 A . (.IBM Corporation - IBM ServeRAID Controller Driver.) -- C:\Windows\System32\drivers\nfrd960.sys   [51264]
O58 - SDL:2011/03/11 09:41:34 A . (.NVIDIA Corporation - NVIDIA® nForce(TM) RAID Driver.) -- C:\Windows\System32\drivers\nvraid.sys   [148352]
O58 - SDL:2011/03/11 09:41:34 A . (.NVIDIA Corporation - NVIDIA® nForce(TM) Sata Performance Driver.) -- C:\Windows\System32\drivers\nvstor.sys   [166272]
O58 - SDL:2009/07/14 04:45:46 A . (.QLogic Corporation - QLogic Fibre Channel Stor Miniport Driver.) -- C:\Windows\System32\drivers\ql2300.sys   [1524816]
O58 - SDL:2009/07/14 04:45:45 A . (.QLogic Corporation - QLogic iSCSI Storport Miniport Driver.) -- C:\Windows\System32\drivers\ql40xx.sys   [128592]
O58 - SDL:2015/04/08 02:20:02 A . (.Realtek Semiconductor Corp. - Realtek(r) High Definition Audio Function D.) -- C:\Windows\System32\drivers\RTDVHD64.sys   [2740056]
O58 - SDL:2013/11/05 18:47:54 A . (.Realtek Semiconductor Corp. - Realtek(r) High Definition Audio Function D.) -- C:\Windows\System32\drivers\RTKVHD64.sys   [3707864]
O58 - SDL:2009/06/10 23:37:19 A . (.Macrovision Corporation, Macrovision Europe Limited, - Macrovision SECURITY Driver.) -- C:\Windows\System32\drivers\secdrv.sys   [23040]
O58 - SDL:2015/02/26 11:59:43 A . (.SoftEther VPN Project at University of Tsukuba, Japan - SoftEther VPN.) -- C:\Windows\System32\drivers\see.sys   [38240]
O58 - SDL:2009/07/14 04:45:45 A . (.Silicon Integrated Systems Corp. - SiS RAID Stor Miniport Driver.) -- C:\Windows\System32\drivers\sisraid2.sys   [43584]
O58 - SDL:2009/07/14 04:45:46 A . (.Silicon Integrated Systems - SiS AHCI Stor-Miniport Driver.) -- C:\Windows\System32\drivers\sisraid4.sys   [80464]
O58 - SDL:2015/02/27 04:49:08 A . (.Synaptics Incorporated - Synaptics SMBus Driver.) -- C:\Windows\System32\drivers\Smb_driver_Intel.sys   [33448]
O58 - SDL:2014/06/16 09:01:38 A . (.DEVGURU Co., LTD.(www.devguru.co.kr) - SAMSUNG USB Composite Device Driver (MSS Ve.) -- C:\Windows\System32\drivers\ssudbus.sys   [110336]
O58 - SDL:2014/06/16 09:01:38 A . (.DEVGURU Co., LTD.(www.devguru.co.kr) - SAMSUNG Android Modem Device Driver (MSS Ve.) -- C:\Windows\System32\drivers\ssudmdm.sys   [206080]
O58 - SDL:2009/07/14 04:45:55 A . (.Promise Technology - Promise  SuperTrak EX Series Driver for Win.) -- C:\Windows\System32\drivers\stexstor.sys   [24656]
O58 - SDL:2014/05/17 03:42:38 A . (.Anchorfree Inc. - Anchorfree HSS VPN Adapter.) -- C:\Windows\System32\drivers\taphss6.sys   [42184]
O58 - SDL:2015/07/08 06:45:10 A . (.Intel Corporation - Intel(R) Management Engine Interface.) -- C:\Windows\System32\drivers\TeeDriverx64.sys   [178976]
O58 - SDL:2009/07/14 04:45:55 A . (.VIA Technologies, Inc. - VIA Generic PCI IDE Bus Driver.) -- C:\Windows\System32\drivers\viaide.sys   [17488]
O58 - SDL:2009/07/14 04:45:55 A . (.VIA Technologies Inc.,Ltd - VIA RAID DRIVER FOR AMD-X86-64.) -- C:\Windows\System32\drivers\vsmraid.sys   [161872]

---\\ Last modified or created user files (O61) (12) - 23s
O61 - LFC: 2015/08/07 17:08:11 A . (.Sabre Holdings.) -- C:\Users\dell\Sabre Red Workspace\Settings\Z93H_1069\emulator_files\emuapi.dll   [385099]
O61 - LFC: 2015/08/01 09:47:02 A . (.BitTorrent Inc..) -- C:\Users\dell\AppData\Roaming\uTorrent\uTorrent.exe   [1693024]
O61 - LFC: 2015/08/01 09:47:02 A . (.BitTorrent Inc..) -- C:\Users\dell\AppData\Roaming\uTorrent\updates\3.4.3_40760.exe   [1693024]
O61 - LFC: 2015/08/07 18:19:02 A . (.Tonec Inc..) -- C:\Users\dell\AppData\Roaming\IDM\idmmzcc5\components2\idmcchandler2.dll   [326168]
O61 - LFC: 2015/08/07 18:19:02 A . (.Tonec Inc..) -- C:\Users\dell\AppData\Roaming\IDM\idmmzcc5\components2\idmcchandler2_64.dll   [452632]
O61 - LFC: 2015/08/07 18:19:02 A . (.Tonec Inc..) -- C:\Users\dell\AppData\Roaming\IDM\idmmzcc5\components2\idmmzcc.dll   [34216]
O61 - LFC: 2015/08/07 18:19:02 A . (.Tonec Inc..) -- C:\Users\dell\AppData\Roaming\IDM\idmmzcc5\components2\idmmzcc64.dll   [28512]
O61 - LFC: 2015/08/07 18:19:02 A . (.Tonec Inc..) -- C:\Users\dell\AppData\Roaming\IDM\idmmzcc5\components10\idmmzcc.dll   [26136]
O61 - LFC: 2015/08/07 18:19:02 A . (.Tonec Inc..) -- C:\Users\dell\AppData\Roaming\IDM\idmmzcc5\components10\idmmzcc64.dll   [30232]
O61 - LFC: 2015/08/07 18:19:02 A . (.Tonec Inc..) -- C:\Users\dell\AppData\Roaming\IDM\idmmzcc5\components\idmmzcc.dll   [34216]
O61 - LFC: 2015/08/07 18:16:33 A . (..) -- C:\Users\dell\AppData\Local\TechSmith\SnagIt\Tray.bin   [1818]
O61 - LFC: 2015/08/07 18:19:20 A . (..) -- C:\Users\dell\AppData\Local\Google\Chrome\User Data\ev_hashes_whitelist.bin   [1113849]

---\\ File Associations Shell Spawning (O67) (1) - 0s
O67 - Shell Spawning: <.evt> <evtfile>[HKLM\..\open\Command] (.Microsoft Corporation - Event Viewer Snapin Launcher.) -- C:\Windows\System32\eventvwr.exe

---\\ Start Menu Internet (SMI) (O68) (12) - 1s
O68 - StartMenuInternet: <FIREFOX.EXE> <Mozilla Firefox>[HKLM\..\Shell\open\Command] (.Mozilla Corporation - Firefox.) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe 
O68 - StartMenuInternet: <Google Chrome> <Google Chrome>[HKLM\..\Shell\open\Command] (.Google Inc. - Google Chrome.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe 
O68 - StartMenuInternet: <IEXPLORE.EXE> <Internet Explorer>[HKLM\..\Shell\open\Command] (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe 
O68 - StartMenuInternet: <FIREFOX.EXE> <Mozilla Firefox>[HKLM\..\InstallInfo\ShowIconsCommand] (.Mozilla Corporation - Firefox Helper.) -- C:\Program Files (x86)\Mozilla Firefox\uninstall\helper.exe
O68 - StartMenuInternet: <Google Chrome> <Google Chrome>[HKLM\..\InstallInfo\ShowIconsCommand] (.Google Inc. - Google Chrome.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
O68 - StartMenuInternet: <IEXPLORE.EXE> <Internet Explorer>[HKLM\..\InstallInfo\ShowIconsCommand] (.Microsoft Corporation - IE Per-User Initialization Utility.) -- C:\Windows\System32\ie4uinit.exe
O68 - StartMenuInternet: <FIREFOX.EXE> <Mozilla Firefox>[HKLM\..\InstallInfo\ReinstallCommand] (.Mozilla Corporation - Firefox Helper.) -- C:\Program Files (x86)\Mozilla Firefox\uninstall\helper.exe
O68 - StartMenuInternet: <Google Chrome> <Google Chrome>[HKLM\..\InstallInfo\ReinstallCommand] (.Google Inc. - Google Chrome.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
O68 - StartMenuInternet: <IEXPLORE.EXE> <Internet Explorer>[HKLM\..\InstallInfo\ReinstallCommand] (.Microsoft Corporation - IE Per-User Initialization Utility.) -- C:\Windows\System32\ie4uinit.exe
O68 - StartMenuInternet: <FIREFOX.EXE> <Mozilla Firefox>[HKLM\..\InstallInfo\HideIconsCommand] (.Mozilla Corporation - Firefox Helper.) -- C:\Program Files (x86)\Mozilla Firefox\uninstall\helper.exe
O68 - StartMenuInternet: <Google Chrome> <Google Chrome>[HKLM\..\InstallInfo\HideIconsCommand] (.Google Inc. - Google Chrome.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
O68 - StartMenuInternet: <IEXPLORE.EXE> <Internet Explorer>[HKLM\..\InstallInfo\HideIconsCommand] (.Microsoft Corporation - IE Per-User Initialization Utility.) -- C:\Windows\System32\ie4uinit.exe

---\\ Search Browser Infection (SBI) (O69) (16) - 4s
O69 - SBI: prefs.js [dell - xwibiqxs.default] user_pref("browser.startup.homepage", "http://www.arabyonline.com/?scr=90Qw8888");  =>Trojan.Vonteera
O69 - SBI: prefs.js [dell - xwibiqxs.default] user_pref("extensions.addon@Vonteera.com.install-event-fired", true);  =>Trojan.Vonteera
O69 - SBI: prefs.js [dell - xwibiqxs.default] user_pref("keyword.URL", "http://www.arabyonline.com/search.php?src=1000&q={searchTerms}");  =>Trojan.Vonteera
O69 - SBI: prefs.js [dell - xwibiqxs.default] user_pref("vonteera.randurls", "{\"tpwww.advantagzcom:SR1myJs\":1,\"tpswww.adnetworkus:srv1analytics\":1}");  =>Trojan.Vonteera
O69 - SBI: prefs.js [dell - xwibiqxs.default] user_pref("vonteera.randurlsdate", "1437499969446");  =>Trojan.Vonteera
O69 - SBI: SearchScopes [HKCU] {012E1000-F331-11DB-8314-0800200C9A66} - (Google) - http://www.google.com/
O69 - SBI: SearchScopes [HKCU] {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} - (Trovi search) - http://www.trovi.com/  =>PUP.Optional.Trovigo
O69 - SBI: SearchScopes [HKCU] {0633EE93-D776-472f-A0FF-E1416B8B2E3A} [DefaultScope] - (Bing) - http://www.bing.com/
O69 - SBI: SearchScopes [HKCU] {56992C66-17F3-48BD-866B-5202D2CA40B5} - (Bing) - http://www.bing.com/

---\\ Search Svchost Services (SSS) (O83) (33) - 1s
O83 - Search Svchost Services: AeLookupSvc (AeLookupSvc) . (.Microsoft Corporation - Application Experience Service.) -- C:\Windows\System32\aelupsvc.dll   [72192]
O83 - Search Svchost Services: CertPropSvc (CertPropSvc) . (.Microsoft Corporation - Microsoft Smartcard Certificate Propagation.) -- C:\Windows\System32\certprop.dll   [80384]
O83 - Search Svchost Services: SCPolicySvc (SCPolicySvc) . (.Microsoft Corporation - Microsoft Smartcard Certificate Propagation.) -- C:\Windows\System32\certprop.dll   [80384]
O83 - Search Svchost Services: lanmanserver (lanmanserver) . (.Microsoft Corporation - Server Service DLL.) -- C:\Windows\system32\srvsvc.dll   [236032]
O83 - Search Svchost Services: gpsvc (gpsvc) . (.Microsoft Corporation - Group Policy Client.) -- C:\Windows\System32\gpsvc.dll   [777728]
O83 - Search Svchost Services: IKEEXT (IKEEXT) . (.Microsoft Corporation - IKE extension.) -- C:\Windows\System32\ikeext.dll   [859648]
O83 - Search Svchost Services: AudioSrv (AudioSrv) . (.Microsoft Corporation - Windows Audio Service.) -- C:\Windows\System32\Audiosrv.dll   [680960]
O83 - Search Svchost Services: Rasauto (Rasauto) . (.Microsoft Corporation - Remote Access AutoDial Manager.) -- C:\Windows\System32\rasauto.dll   [99328]
O83 - Search Svchost Services: Rasman (Rasman) . (.Microsoft Corporation - Remote Access Connection Manager.) -- C:\Windows\System32\rasmans.dll   [344064]
O83 - Search Svchost Services: Remoteaccess (Remoteaccess) . (.Microsoft Corporation - Dynamic Interface Manager.) -- C:\Windows\System32\mprdim.dll   [97792]
O83 - Search Svchost Services: SENS (SENS) . (.Microsoft Corporation - System Event Notification Service (SENS).) -- C:\Windows\System32\Sens.dll   [64512]
O83 - Search Svchost Services: Sharedaccess (Sharedaccess) . (.Microsoft Corporation - Microsoft NAT Helper Components.) -- C:\Windows\System32\ipnathlp.dll   [359424]
O83 - Search Svchost Services: Tapisrv (Tapisrv) . (.Microsoft Corporation - Microsoft® Windows(TM) Telephony Server.) -- C:\Windows\System32\tapisrv.dll   [316928]
O83 - Search Svchost Services: TermService (TermService) . (.Microsoft Corporation - Remote Desktop Session Host Server Remote C.) -- C:\Windows\System32\termsrv.dll   [683520]
O83 - Search Svchost Services: wuauserv (wuauserv) . (.Microsoft Corporation - Windows Update Agent.) -- C:\Windows\system32\wuaueng.dll   [2606080]
O83 - Search Svchost Services: BITS (BITS) . (.Microsoft Corporation - Background Intelligent Transfer Service.) -- C:\Windows\System32\qmgr.dll   [849920]
O83 - Search Svchost Services: ShellHWDetection (ShellHWDetection) . (.Microsoft Corporation - Windows Shell Services Dll.) -- C:\Windows\System32\shsvcs.dll   [370688]
O83 - Search Svchost Services: iphlpsvc (iphlpsvc) . (.Microsoft Corporation - Service that offers IPv6 connectivity over.) -- C:\Windows\System32\iphlpsvc.dll   [569344]
O83 - Search Svchost Services: seclogon (seclogon) . (.Microsoft Corporation - Secondary Logon Service DLL.) -- C:\Windows\system32\seclogon.dll   [30720]
O83 - Search Svchost Services: AppInfo (AppInfo) . (.Microsoft Corporation - Application Information Service.) -- C:\Windows\System32\appinfo.dll   [70656]
O83 - Search Svchost Services: msiscsi (msiscsi) . (.Microsoft Corporation - iSCSI Discovery service.) -- C:\Windows\system32\iscsiexe.dll   [156672]
O83 - Search Svchost Services: MMCSS (MMCSS) . (.Microsoft Corporation - Multimedia Class Scheduler Service.) -- C:\Windows\system32\mmcss.dll   [67584]
O83 - Search Svchost Services: winmgmt (winmgmt) . (.Microsoft Corporation - WMI.) -- C:\Windows\system32\wbem\WMIsvc.dll   [242688]
O83 - Search Svchost Services: SessionEnv (SessionEnv) . (.Microsoft Corporation - Remote Desktop Configuration service.) -- C:\Windows\System32\SessEnv.dll   [121856]
O83 - Search Svchost Services: browser (browser) . (.Microsoft Corporation - Computer Browser Service DLL.) -- C:\Windows\System32\browser.dll   [136704]
O83 - Search Svchost Services: EapHost (EapHost) . (.Microsoft Corporation - Microsoft EAPHost service.) -- C:\Windows\System32\eapsvc.dll   [111104]
O83 - Search Svchost Services: schedule (schedule) . (.Microsoft Corporation - Task Scheduler Service.) -- C:\Windows\system32\schedsvc.dll   [1110016]
O83 - Search Svchost Services: hkmsvc (hkmsvc) . (.Microsoft Corporation - Key Management Service.) -- C:\Windows\system32\kmsvc.dll   [90624]
O83 - Search Svchost Services: wercplsupport (wercplsupport) . (.Microsoft Corporation - Problem Reports and Solutions.) -- C:\Windows\System32\wercplsupport.dll   [84480]
O83 - Search Svchost Services: ProfSvc (ProfSvc) . (.Microsoft Corporation - ProfSvc.) -- C:\Windows\system32\profsvc.dll   [210432]
O83 - Search Svchost Services: Themes (Themes) . (.Microsoft Corporation - Windows Shell Theme Service Dll.) -- C:\Windows\system32\themeservice.dll   [44544]
O83 - Search Svchost Services: BDESVC (BDESVC) . (.Microsoft Corporation - BDE Service.) -- C:\Windows\System32\bdesvc.dll   [100864]
O83 - Search Svchost Services: AppMgmt (AppMgmt) . (.Microsoft Corporation - Software installation Service.) -- C:\Windows\System32\appmgmts.dll   [193536]

---\\ Firewall Active Exception List (FirewallRules) (O87) (14) - 2s
O87 - FAEL: "{48D21963-33C9-437C-A7C9-947FE317C47C}" [In-None-P6-TRUE] .(...) -- C:\Program Files (x86)\Yahoo!\Messenger\YahooMessenger.exe (.not file.)
O87 - FAEL: "{C98FD990-645C-43EB-995D-448927FED786}" [In-None-P17-TRUE] .(...) -- C:\Program Files (x86)\Yahoo!\Messenger\YahooMessenger.exe (.not file.)
O87 - FAEL: "TCP Query User{C051F065-A1A6-4B58-98AC-F880DD743D77}C:\users\dell\appdata\local\sabre red workspace\profiles\l4ah_1034\mysabre.exe" [In-None-P6-TRUE] .(...) -- C:\users\dell\appdata\local\sabre red workspace\profiles\l4ah_1034\mysabre.exe
O87 - FAEL: "UDP Query User{AD66F9B0-395E-4372-8060-EE088350FDE0}C:\users\dell\appdata\local\sabre red workspace\profiles\l4ah_1034\mysabre.exe" [In-None-P17-TRUE] .(...) -- C:\users\dell\appdata\local\sabre red workspace\profiles\l4ah_1034\mysabre.exe
O87 - FAEL: "{ABEAD382-5CB9-4C45-ADAB-CF54FD311471}" [In-None-P6-TRUE] .(.BitTorrent Inc. - µTorrent.) -- C:\Users\dell\AppData\Roaming\uTorrent\uTorrent.exe
O87 - FAEL: "{D618521C-78F2-4031-B6E8-0BE2FAC6796C}" [In-None-P17-TRUE] .(.BitTorrent Inc. - µTorrent.) -- C:\Users\dell\AppData\Roaming\uTorrent\uTorrent.exe
O87 - FAEL: "{F04BF585-5199-45B8-A2AE-D15693581EF0}" [In-None-P6-TRUE] .(...) -- C:\Program Files (x86)\KONAMI\Pro Evolution Soccer 2013\pes2013.exe (.not file.)
O87 - FAEL: "{53D3B5F6-2B8A-41C2-9F70-B80729DBFCEA}" [In-None-P17-TRUE] .(...) -- C:\Program Files (x86)\KONAMI\Pro Evolution Soccer 2013\pes2013.exe (.not file.)
O87 - FAEL: "{903589FC-2118-46F0-8EF7-CB532946B705}" [In-None-P17-TRUE] .(.SoftEther VPN Project at University of Tsukuba, Japan - SoftEther VPN.) -- C:\Program Files\SoftEther VPN Client\vpnclient_x64.exe
O87 - FAEL: "{B781998F-C089-4C66-AB20-5401DCE9EBCC}" [In-None-P17-TRUE] .(.SoftEther VPN Project at University of Tsukuba, Japan - SoftEther VPN.) -- C:\Program Files\SoftEther VPN Client\vpnclient.exe
O87 - FAEL: "{51D19752-5245-469F-B40D-F5C0A483A916}" [In-None-P17-TRUE] .(.SoftEther VPN Project at University of Tsukuba, Japan - SoftEther VPN.) -- C:\Program Files\SoftEther VPN Client\vpncmgr.exe
O87 - FAEL: "{33799640-4B95-4C7D-800D-7E3495ADB56F}" [In-None-P17-TRUE] .(.SoftEther VPN Project at University of Tsukuba, Japan - SoftEther VPN.) -- C:\Program Files\SoftEther VPN Client\vpncmgr_x64.exe
O87 - FAEL: "{136733EB-6217-4F81-852F-7A6FF21A3AD5}" [In-None-P17-TRUE] .(.SoftEther VPN Project at University of Tsukuba, Japan - SoftEther VPN.) -- C:\Program Files\SoftEther VPN Client\vpncmd.exe
O87 - FAEL: "{5740E020-31D6-4E8D-9A5B-37818519A874}" [In-None-P17-TRUE] .(.SoftEther VPN Project at University of Tsukuba, Japan - SoftEther VPN.) -- C:\Program Files\SoftEther VPN Client\vpncmd_x64.exe

---\\ Additional Scan (O88) (20) - 0s
C:\Program Files (x86)\Mozilla Firefox\browser\searchplugins\yahoo.xml  =>PUP.Optional.BDYahoo
HKLM\SOFTWARE\Wow6432Node\Torch  =>PUP.Optional.Torch
HKCU\SOFTWARE\APN PIP  =>PUP.Optional.Conduit
HKCU\SOFTWARE\ARHome  =>Trojan.Vonteera
HKCU\SOFTWARE\InstallCore  =>PUP.Optional.InstallCore
HKCU\SOFTWARE\NoVooIT  =>Trojan.Vonteera
HKCU\SOFTWARE\NoVooITSet  =>Trojan.Vonteera
HKCU\SOFTWARE\Tbccint  =>PUP.Optional.Conduit
HKCU\SOFTWARE\Tbccint_HKLM  =>PUP.Optional.Conduit
HKCU\SOFTWARE\Torch  =>PUP.Optional.Torch
HKCU\SOFTWARE\Vonteera Safe ads  =>Trojan.Vonteera
HKCU\SOFTWARE\AppDataLow\Software\Smartbar  =>PUP.Optional.SmartBar  =>PUP.Optional.SmartBar
HKCU\SOFTWARE\AppDataLow\Software\Tbccint  =>PUP.Optional.Conduit  =>PUP.Optional.Conduit
HKCU\SOFTWARE\AppDataLow\Software\TbccintSearchScopes  =>PUP.Optional.Conduit  =>PUP.Optional.Conduit
C:\Program Files (x86)\Tbccint  =>PUP.Optional.Conduit
C:\Users\dell\AppData\Roaming\ARHome  =>Trojan.Vonteera
C:\Users\dell\AppData\Roaming\OpenCandy  =>PUP.Optional.OpenCandy
C:\Users\dell\AppData\Roaming\RHEng  =>PUP.Optional.Conduit
C:\Users\dell\AppData\Roaming\VolIE  =>Trojan.Vonteera
C:\Users\dell\AppData\Local\Torch  =>PUP.Optional.Torch

---\\ Summary of the elements found on your workstation (8) - 0s
http://www.nicolascoolman.fr/trojan-vonteera/  =>Trojan.Vonteera
http://www.nicolascoolman.fr/blog  =>PUP.Optional.BDYahoo
http://www.nicolascoolman.fr/blog  =>PUP.Optional.Torch
http://www.nicolascoolman.fr/toolbar-conduit/  =>PUP.Optional.Conduit
http://www.nicolascoolman.fr/adware-installcore/  =>PUP.Optional.InstallCore
http://www.nicolascoolman.fr/hijacker-smartbar/  =>PUP.Optional.SmartBar
http://www.nicolascoolman.fr/adware-opencandy/  =>PUP.Optional.OpenCandy
http://www.nicolascoolman.fr/hijacker-trovigo/  =>PUP.Optional.Trovigo

~ End of the scan, 23670 items in 125 seconds (806)(0)()