Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 15-03-2017
Ran by منير (administrator) on PCWERFLAAH (01-04-2017 21:35:22)
Running from C:\Users\منير\Desktop
Loaded Profiles: منير (Available Profiles: منير)
Platform: Microsoft Windows 7 Ultimate  Service Pack 1 (X86) Language: العربية (السعودية)‏
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avfwsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(Maxthon) C:\Program Files\Maxthon\Modules\Service\Update\MaxthonUpdateSvc.exe
(Conexant Systems, Inc.) C:\Windows\System32\drivers\XAudio.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
() C:\Program Files\Unlocker\UnlockerAssistant.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avmailc7.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avwebg7.exe
(HUAWEI) C:\Program Files\Cela.C.M_HW\Cela.C.M.EXE
(Google Inc.) C:\Program Files\Google\Update\1.3.32.7\GoogleCrashHandler.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avscan.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe

==================== Registry (Whitelisted) ====================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [avgnt] => C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [702768 2014-11-27] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [UnlockerAssistant] => C:\Program Files\Unlocker\UnlockerAssistant.exe [17408 2010-07-04] ()
HKU\S-1-5-21-4218572008-491887988-1106255587-1000\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner.exe [6495144 2015-09-16] (Piriform Ltd)
HKU\S-1-5-21-4218572008-491887988-1106255587-1000\...\Run: [CCleaner] => C:\Program Files\CCleaner\CCleaner.exe [6495144 2015-09-16] (Piriform Ltd)
GroupPolicyScripts: Restriction <======= ATTENTION
GroupPolicyScripts\User: Restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\Parameters: [DhcpNameServer] 62.240.32.5 62.68.42.2
Tcpip\..\Interfaces\{365CA46D-D37E-4C33-B912-59BCFE4A2988}: [DhcpNameServer] 8.8.8.8 8.8.4.4
Tcpip\..\Interfaces\{B37A73C7-CDBB-4D48-A4B5-BBF82E321FF4}: [NameServer] 8.8.8.8,8.8.4.4
Tcpip\..\Interfaces\{B37A73C7-CDBB-4D48-A4B5-BBF82E321FF4}: [DhcpNameServer] 62.240.32.5 62.68.42.2

Internet Explorer:
==================
HKU\S-1-5-21-4218572008-491887988-1106255587-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
HKU\S-1-5-21-4218572008-491887988-1106255587-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/ar-eg/?ocid=iehp

FireFox:
========
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.32.7\npGoogleUpdate3.dll [2017-01-10] (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.32.7\npGoogleUpdate3.dll [2017-01-10] (Google Inc.)

Chrome: 
=======
CHR Profile: C:\Users\منير\AppData\Local\Google\Chrome\User Data\Default [2017-04-01]
CHR Extension: (Chrome Web Store Payments) - C:\Users\منير\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-04-01]
CHR Extension: (Chrome Media Router) - C:\Users\منير\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-04-01]

==================== Services (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 AntiVirFirewallService; C:\Program Files\Avira\AntiVir Desktop\avfwsvc.exe [1044784 2014-11-27] (Avira Operations GmbH & Co. KG)
R2 AntiVirMailService; C:\Program Files\Avira\AntiVir Desktop\avmailc7.exe [807672 2014-11-27] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [431920 2014-11-27] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [431920 2014-11-27] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files\Avira\AntiVir Desktop\avwebg7.exe [993584 2014-11-27] (Avira Operations GmbH & Co. KG)
R2 MaxthonUpdateSvc; C:\Program Files\Maxthon\Modules\Service\Update\MaxthonUpdateSvc.exe [1872152 2015-05-11] (Maxthon)
S2 MBAMService; C:\Program Files\Malwarebytes Anti-Malware\mbamservice.exe [1136608 2016-03-10] (Malwarebytes)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [680960 2013-05-27] (Microsoft Corporation)

===================== Drivers (Whitelisted) ======================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R3 avfwim; C:\Windows\System32\DRIVERS\avfwim.sys [92448 2014-11-27] (Avira GmbH)
R1 avfwot; C:\Windows\System32\DRIVERS\avfwot.sys [113024 2014-11-27] (Avira GmbH)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [98160 2014-11-27] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [136216 2014-11-27] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2014-11-27] (Avira Operations GmbH & Co. KG)
R2 avnetflt; C:\Windows\System32\DRIVERS\avnetflt.sys [37384 2014-11-27] (Avira Operations GmbH & Co. KG)
R3 bcm; C:\Windows\System32\DRIVERS\drxvi314.sys [324096 2010-06-18] (Beceem communications pvt ltd.)
R3 bcmbusctr; C:\Windows\System32\DRIVERS\BcmBusCtr.sys [51072 2010-06-18] (Beceem communications pvt ltd.)
S3 hid8103; C:\Windows\System32\drivers\hid8103.sys [31128 2006-10-25] (Compuware Corporation) [File not signed]
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [24448 2016-03-10] (Malwarebytes)
S3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [170200 2017-03-31] (Malwarebytes)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [53120 2016-03-10] (Malwarebytes Corporation)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2014-11-27] (Avira GmbH)
U5 UnlockerDriver5; C:\Program Files\Unlocker\UnlockerDriver5.sys [4096 2010-07-04] () [File not signed]
S3 VGPU; System32\drivers\rdvgkmd.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2017-04-01 21:25 - 2017-04-01 21:35 - 00012704 _____ C:\Users\منير\Desktop\Addition.txt
2017-04-01 21:15 - 2017-04-01 21:35 - 00007929 _____ C:\Users\منير\Desktop\FRST.txt
2017-04-01 21:14 - 2017-04-01 21:35 - 00000000 ____D C:\FRST
2017-04-01 21:13 - 2017-04-01 21:11 - 01766912 _____ (Farbar) C:\Users\منير\Desktop\FRST.exe
2017-04-01 20:18 - 2017-04-01 20:18 - 00058016 _____ C:\Users\منير\AppData\Local\GDIPFONTCACHEV1.DAT
2017-04-01 11:03 - 2017-03-04 19:39 - 00346320 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2017-04-01 11:03 - 2017-03-04 07:18 - 20281856 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2017-04-01 11:03 - 2017-03-04 06:28 - 00103936 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2017-04-01 11:03 - 2017-03-02 21:16 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2017-04-01 11:03 - 2017-03-02 21:16 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2017-04-01 11:03 - 2017-03-02 21:02 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2017-04-01 11:03 - 2017-03-02 21:01 - 00499200 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2017-04-01 11:03 - 2017-03-02 21:01 - 00341504 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2017-04-01 11:03 - 2017-03-02 21:01 - 00047616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2017-04-01 11:03 - 2017-03-02 21:00 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2017-04-01 11:03 - 2017-03-02 20:55 - 02287104 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2017-04-01 11:03 - 2017-03-02 20:54 - 00047104 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2017-04-01 11:03 - 2017-03-02 20:53 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2017-04-01 11:03 - 2017-03-02 20:51 - 00476160 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2017-04-01 11:03 - 2017-03-02 20:50 - 00115712 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2017-04-01 11:03 - 2017-03-02 20:49 - 00663552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2017-04-01 11:03 - 2017-03-02 20:49 - 00620032 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2017-04-01 11:03 - 2017-03-02 20:44 - 00667648 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2017-04-01 11:03 - 2017-03-02 20:41 - 00416256 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2017-04-01 11:03 - 2017-03-02 20:36 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2017-04-01 11:03 - 2017-03-02 20:35 - 00091136 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
2017-04-01 11:03 - 2017-03-02 20:32 - 00168960 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2017-04-01 11:03 - 2017-03-02 20:31 - 00076288 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2017-04-01 11:03 - 2017-03-02 20:29 - 00279040 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2017-04-01 11:03 - 2017-03-02 20:28 - 00130048 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2017-04-01 11:03 - 2017-03-02 20:22 - 04604416 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2017-04-01 11:03 - 2017-03-02 20:21 - 00230400 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2017-04-01 11:03 - 2017-03-02 20:19 - 00693248 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2017-04-01 11:03 - 2017-03-02 20:19 - 00689664 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2017-04-01 11:03 - 2017-03-02 20:17 - 02055680 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2017-04-01 11:03 - 2017-03-02 20:17 - 01155072 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2017-04-01 11:03 - 2017-03-02 20:11 - 13654528 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2017-04-01 11:03 - 2017-03-02 19:53 - 02767360 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2017-04-01 11:03 - 2017-03-02 19:50 - 01312768 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2017-04-01 11:03 - 2017-03-02 19:50 - 00710144 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2017-04-01 11:03 - 2017-02-11 18:50 - 00311808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srv.sys
2017-04-01 11:03 - 2017-02-10 19:17 - 00628736 _____ (Microsoft Corporation) C:\Windows\system32\usp10.dll
2017-04-01 11:03 - 2017-02-10 19:17 - 00306688 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2017-04-01 11:03 - 2017-02-10 17:33 - 01251328 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2017-04-01 11:03 - 2017-02-10 17:33 - 00909824 _____ (Microsoft Corporation) C:\Windows\system32\FntCache.dll
2017-04-01 11:03 - 2017-02-09 19:19 - 04000488 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe
2017-04-01 11:03 - 2017-02-09 19:19 - 03945192 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2017-04-01 11:03 - 2017-02-09 19:19 - 00137960 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2017-04-01 11:03 - 2017-02-09 19:19 - 00067304 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2017-04-01 11:03 - 2017-02-09 19:16 - 01310528 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2017-04-01 11:03 - 2017-02-09 19:14 - 01062912 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2017-04-01 11:03 - 2017-02-09 19:14 - 00690688 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2017-04-01 11:03 - 2017-02-09 19:14 - 00655360 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2017-04-01 11:03 - 2017-02-09 19:14 - 00644096 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
2017-04-01 11:03 - 2017-02-09 19:14 - 00553472 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2017-04-01 11:03 - 2017-02-09 19:14 - 00481792 _____ (Microsoft Corporation) C:\Windows\system32\mscms.dll
2017-04-01 11:03 - 2017-02-09 19:14 - 00400896 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2017-04-01 11:03 - 2017-02-09 19:14 - 00261120 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2017-04-01 11:03 - 2017-02-09 19:14 - 00254464 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2017-04-01 11:03 - 2017-02-09 19:14 - 00223232 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2017-04-01 11:03 - 2017-02-09 19:14 - 00215040 _____ (Microsoft Corporation) C:\Windows\system32\icm32.dll
2017-04-01 11:03 - 2017-02-09 19:14 - 00172032 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2017-04-01 11:03 - 2017-02-09 19:14 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2017-04-01 11:03 - 2017-02-09 19:14 - 00141312 _____ (Microsoft Corporation) C:\Windows\system32\rpchttp.dll
2017-04-01 11:03 - 2017-02-09 19:14 - 00099840 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2017-04-01 11:03 - 2017-02-09 19:14 - 00082432 _____ (Microsoft Corporation) C:\Windows\system32\bcrypt.dll
2017-04-01 11:03 - 2017-02-09 19:14 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2017-04-01 11:03 - 2017-02-09 19:14 - 00050688 _____ (Microsoft Corporation) C:\Windows\system32\appidapi.dll
2017-04-01 11:03 - 2017-02-09 19:14 - 00038912 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2017-04-01 11:03 - 2017-02-09 18:53 - 00097792 _____ (Microsoft Corporation) C:\Windows\system32\appidpolicyconverter.exe
2017-04-01 11:03 - 2017-02-09 18:53 - 00050688 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\appid.sys
2017-04-01 11:03 - 2017-02-09 18:53 - 00029696 _____ (Microsoft Corporation) C:\Windows\system32\appidsvc.dll
2017-04-01 11:03 - 2017-02-09 18:53 - 00016896 _____ (Microsoft Corporation) C:\Windows\system32\appidcertstorecheck.exe
2017-04-01 11:03 - 2017-02-09 18:52 - 02400256 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2017-04-01 11:03 - 2017-02-09 18:51 - 00262656 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2017-04-01 11:03 - 2017-02-09 18:49 - 00226304 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb10.sys
2017-04-01 11:03 - 2017-02-09 18:49 - 00124416 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb.sys
2017-04-01 11:03 - 2017-02-09 18:49 - 00098304 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb20.sys
2017-04-01 11:03 - 2017-02-09 18:49 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2017-04-01 11:03 - 2017-02-09 18:49 - 00036352 _____ (Microsoft Corporation) C:\Windows\system32\cryptbase.dll
2017-04-01 11:03 - 2017-02-09 18:49 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2017-04-01 11:03 - 2017-02-06 19:03 - 00497152 _____ (Microsoft Corporation) C:\Windows\HelpPane.exe
2017-04-01 11:03 - 2017-01-13 20:45 - 00741888 _____ (Microsoft Corporation) C:\Windows\system32\inetcomm.dll
2017-04-01 11:03 - 2017-01-11 20:43 - 01241088 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2017-04-01 11:03 - 2017-01-06 20:44 - 01329664 _____ (Microsoft Corporation) C:\Windows\system32\quartz.dll
2017-04-01 11:02 - 2017-02-11 18:50 - 00313856 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srv2.sys
2017-04-01 11:02 - 2017-02-11 18:50 - 00116224 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srvnet.sys
2017-04-01 11:02 - 2017-02-09 19:14 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2017-04-01 11:02 - 2017-02-09 19:14 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\setbcdlocale.dll
2017-04-01 11:02 - 2017-02-09 19:14 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2017-04-01 11:02 - 2017-02-09 19:14 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2017-04-01 11:02 - 2017-02-09 19:14 - 00017408 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2017-04-01 11:02 - 2017-02-09 19:14 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2017-04-01 11:02 - 2017-02-09 18:53 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2017-04-01 11:02 - 2017-02-09 18:51 - 00032768 _____ (Microsoft Corporation) C:\Windows\system32\WcsPlugInService.dll
2017-04-01 11:02 - 2017-02-09 18:49 - 00015872 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2017-04-01 11:02 - 2017-01-13 20:45 - 00084480 _____ (Microsoft Corporation) C:\Windows\system32\INETRES.dll
2017-04-01 11:02 - 2017-01-11 20:43 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll
2017-04-01 00:45 - 2017-04-01 00:45 - 00000831 _____ C:\Users\منير\Desktop\ZHPCleaner.lnk
2017-04-01 00:39 - 2017-04-01 00:20 - 02713088 _____ C:\Users\منير\Desktop\ZHPDiag3.exe
2017-03-31 14:19 - 2017-01-15 14:49 - 00141203 _____ C:\Users\منير\Desktop\ت.xps
2017-03-31 13:58 - 2017-02-23 02:29 - 00071400 _____ (Microsoft Corporation) C:\Windows\system32\CompatTelRunner.exe
2017-03-31 13:58 - 2017-02-23 02:24 - 00971776 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2017-03-31 13:58 - 2017-02-18 17:05 - 01331200 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2017-03-31 13:58 - 2017-02-18 17:05 - 00505344 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2017-03-31 13:58 - 2016-12-31 18:36 - 00442368 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2017-03-31 13:58 - 2016-12-31 18:36 - 00270848 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2017-03-31 13:58 - 2016-12-31 18:36 - 00212480 _____ (Microsoft Corporation) C:\Windows\system32\centel.dll
2017-03-31 13:58 - 2016-12-31 18:36 - 00183808 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll
2017-03-31 13:58 - 2016-12-31 18:36 - 00104960 _____ (Microsoft Corporation) C:\Windows\system32\acmigration.dll
2017-03-31 01:19 - 2017-03-31 01:19 - 00000185 _____ C:\Users\منير\AppData\Roaming\Microsoft\Windows\Start Menu\QuickStores.url
2017-03-31 01:18 - 2017-03-31 23:42 - 00000000 ____D C:\Program Files\Unlocker
2017-03-31 01:18 - 2017-03-31 01:19 - 00000000 ____D C:\Users\منير\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Unlocker
2017-03-25 23:16 - 2017-03-25 23:16 - 00001799 _____ C:\Users\Public\Desktop\Recuva.lnk
2017-03-25 23:16 - 2006-01-10 01:09 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Recuva
2017-03-25 23:16 - 2006-01-10 01:09 - 00000000 ____D C:\Program Files\Recuva
2017-03-25 22:33 - 2017-03-25 22:34 - 00000000 ____D C:\Users\منير\Downloads\مجلد جديد ‫‬
2017-03-16 18:47 - 2017-03-29 22:45 - 00000000 ____D C:\Windows\Minidump

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2017-04-01 18:49 - 2009-07-14 07:34 - 00030352 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2017-04-01 18:49 - 2009-07-14 07:34 - 00030352 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2017-04-01 18:46 - 2010-11-21 16:37 - 00682012 _____ C:\Windows\system32\perfh00C.dat
2017-04-01 18:46 - 2010-11-21 16:37 - 00478512 _____ C:\Windows\system32\perfh001.dat
2017-04-01 18:46 - 2010-11-21 16:37 - 00129684 _____ C:\Windows\system32\perfc00C.dat
2017-04-01 18:46 - 2010-11-21 16:37 - 00094306 _____ C:\Windows\system32\perfc001.dat
2017-04-01 18:46 - 2010-11-21 00:01 - 02154000 _____ C:\Windows\system32\PerfStringBackup.INI
2017-04-01 18:46 - 2009-07-14 05:37 - 00000000 ____D C:\Windows\inf
2017-04-01 18:41 - 2017-01-31 11:08 - 00000000 ____D C:\Users\منير\AppData\Roaming\MPC-HC
2017-04-01 11:12 - 2017-01-10 14:37 - 00000858 _____ C:\Users\منير\Desktop\puk.txt
2017-04-01 01:06 - 2017-02-01 22:07 - 00000000 ____D C:\Program Files\CCleaner
2017-04-01 01:04 - 2017-01-29 22:17 - 00000000 ____D C:\Users\منير\AppData\Roaming\ZHP
2017-03-31 23:30 - 2017-01-09 21:06 - 00170200 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2017-03-31 14:27 - 2017-01-13 17:05 - 00000000 ____D C:\Windows\system32\MRT
2017-03-31 14:23 - 2017-01-13 17:05 - 135706696 ____C (Microsoft Corporation) C:\Windows\system32\MRT.exe
2017-03-28 23:09 - 2017-01-09 21:33 - 00000000 ____D C:\Users\منير\AppData\Roaming\ViberPC
2017-03-25 23:26 - 2017-01-30 14:29 - 00000000 ____D C:\Users\منير\Documents\KONAMI
2017-03-25 20:12 - 2017-01-31 12:26 - 00012288 _____ C:\Users\منير\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2017-03-13 13:35 - 2017-01-09 20:40 - 00002145 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2017-03-13 13:35 - 2017-01-09 20:40 - 00002133 _____ C:\Users\Public\Desktop\Google Chrome.lnk

==================== Files in the root of some directories =======

2017-01-31 12:26 - 2017-03-25 20:12 - 0012288 _____ () C:\Users\منير\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

Some files in TEMP:
====================
2006-01-10 00:04 - 2006-01-10 00:04 - 0000000 ____D () C:\Users\منير\AppData\Local\Temp\avgnt.exe

==================== Bamital & volsnap ======================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2017-01-09 19:45

==================== End of FRST.txt ============================