Solved Bitcoin miner Trojans reappear when rebooting every time I remove them

[qassimnm]

So recently I noticed that my GPU utilization was at a constant 100% so I ran hitman pro and which had informed me of two exe files in windows/temp that were Trojans, Isass.exe and svchost.exe how do I remove them and prevent them from reappearing when I boot up my pc?

 

[qassimnm]

Preliminary instructions: https://www.techspot.com/community/...lware-removal-preliminary-instructions.58138/

 

[qassimnm]

FRST:
Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:08-06-2015
Ran by Qassim (administrator) on QAS_PC on 12-06-2015 15:00:24
Running from C:\Users\Qassim\Downloads
Loaded Profiles: Qassim (Available Profiles: Qassim)
Platform: Windows 8.1 Pro (X64) OS Language: English (United States)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool:

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Advanced Micro Devices, Inc.) C:\Program Files\AMD\ATI.ACE\Fuel\Fuel.Service.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome Remote Desktop\42.0.2311.39\remoting_host.exe
(LogMeIn, Inc.) C:\Program Files (x86)\LogMeIn Hamachi\LMIGuardianSvc.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome Remote Desktop\42.0.2311.39\remoting_host.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
(arvato digital services llc) C:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe
(LogMeIn Inc.) C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\NisSrv.exe
(Microsoft Corporation) C:\Windows\System32\schtasks.exe
(Akamai Technologies, Inc.) C:\Users\Qassim\AppData\Local\Akamai\netsession_win.exe
(Akamai Technologies, Inc.) C:\Users\Qassim\AppData\Local\Akamai\netsession_win.exe
() C:\Program Files (x86)\Standard Mouse Driver\Monitor.EXE
(LogMeIn Inc.) C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office15\ONENOTEM.EXE
(Advanced Micro Devices Inc.) C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\CCC.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [500208 2010-03-06] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [507776 2014-10-07] (Oracle Corporation)
HKLM-x32\...\Run: [SwitchBoard] => C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [AdobeCS5ServiceManager] => C:\Program Files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe [406992 2010-02-22] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [PWRISOVM.EXE] => C:\Program Files\PowerISO\PWRISOVM.EXE [408888 2014-10-25] (Power Software Ltd)
HKLM-x32\...\Run: [LogMeIn Hamachi Ui] => C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe [3978600 2015-03-30] (LogMeIn Inc.)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\amd64\CLIStart.exe [767176 2015-05-26] (Advanced Micro Devices, Inc.)
HKU\S-1-5-21-2302587062-3611041661-3303187194-1001\...\Run: [Steam] => C:\Program Files (x86)\Steam\steam.exe [2892992 2015-06-04] (Valve Corporation)
HKU\S-1-5-21-2302587062-3611041661-3303187194-1001\...\Run: [uTorrent] => C:\Users\Qassim\AppData\Roaming\uTorrent\uTorrent.exe [1694560 2015-05-11] (BitTorrent Inc.)
HKU\S-1-5-21-2302587062-3611041661-3303187194-1001\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [31087200 2015-01-23] (Skype Technologies S.A.)
HKU\S-1-5-21-2302587062-3611041661-3303187194-1001\...\Run: [Akamai NetSession Interface] => C:\Users\Qassim\AppData\Local\Akamai\netsession_win.exe [4673432 2014-10-29] (Akamai Technologies, Inc.)
HKU\S-1-5-21-2302587062-3611041661-3303187194-1001\...\Run: [GalaxyClient] => [X]
HKU\S-1-5-21-2302587062-3611041661-3303187194-1001\...\MountPoints2: E - "E:\setup.exe"
Startup: C:\Users\Qassim\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Monitor - Shortcut.lnk [2015-01-20]
ShortcutTarget: Monitor - Shortcut.lnk -> C:\Program Files (x86)\Standard Mouse Driver\Monitor.EXE ()
Startup: C:\Users\Qassim\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Send to OneNote.lnk [2015-05-02]
ShortcutTarget: Send to OneNote.lnk -> C:\Program Files\Microsoft Office\Office15\ONENOTEM.EXE (Microsoft Corporation)
BootExecute: autocheck autochk * bootdeletebootdelete

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-2302587062-3611041661-3303187194-1001\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/?ocid=iehp
BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office\Office15\OCHelper.dll [2015-02-10] (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_25\bin\ssv.dll [2015-01-19] (Oracle Corporation)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office15\URLREDIR.DLL [2012-10-01] (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL [2015-01-21] (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_25\bin\jp2ssv.dll [2015-01-19] (Oracle Corporation)
BHO-x32: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll [2015-02-10] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\ssv.dll [2015-01-19] (Oracle Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office15\URLREDIR.DLL [2012-10-01] (Microsoft Corporation)
BHO-x32: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\Office15\GROOVEEX.DLL [2015-01-21] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\jp2ssv.dll [2015-01-19] (Oracle Corporation)
Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office\Office15\MSOSB.DLL [2014-10-15] (Microsoft Corporation)

FireFox:
========
FF ProfilePath: C:\Users\Qassim\AppData\Roaming\Mozilla\Firefox\Profiles\thxgi95r.default
FF Plugin: @esn/npbattlelog,version=2.6.2 -> C:\Program Files (x86)\Battlelog Web Plugins\2.6.2\npbattlelogx64.dll [2015-01-13] (EA Digital Illusions CE AB)
FF Plugin: @esn/npbattlelog,version=2.7.0 -> C:\Program Files (x86)\Battlelog Web Plugins\2.7.0\npbattlelogx64.dll [2015-04-23] (EA Digital Illusions CE AB)
FF Plugin: @java.com/DTPlugin,version=11.25.2 -> C:\Program Files\Java\jre1.8.0_25\bin\dtplugin\npDeployJava1.dll [2015-01-19] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.25.2 -> C:\Program Files\Java\jre1.8.0_25\bin\plugin2\npjp2.dll [2015-01-19] (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-16] ( Microsoft Corporation)
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~2\Office15\NPSPWRAP.DLL [2012-10-01] (Microsoft Corporation)
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\SysWOW64\Adobe\Director\np32dsw_1216156.dll [2015-01-09] (Adobe Systems, Inc.)
FF Plugin-x32: @esn/npbattlelog,version=2.6.2 -> C:\Program Files (x86)\Battlelog Web Plugins\2.6.2\npbattlelog.dll [2015-01-13] (EA Digital Illusions CE AB)
FF Plugin-x32: @esn/npbattlelog,version=2.7.0 -> C:\Program Files (x86)\Battlelog Web Plugins\2.7.0\npbattlelog.dll [2015-04-23] (EA Digital Illusions CE AB)
FF Plugin-x32: @java.com/DTPlugin,version=11.25.2 -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\dtplugin\npDeployJava1.dll [2015-01-19] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.25.2 -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\plugin2\npjp2.dll [2015-01-19] (Oracle Corporation)
FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files (x86)\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2014-05-21] (Microsoft Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-15] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~4\Office15\NPSPWRAP.DLL [2012-10-01] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-05-19] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-05-19] (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.2.0 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2015-02-27] (VideoLAN)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npMeetingJoinPluginOC.dll [2014-05-21] (Microsoft Corporation)

Chrome:
=======
CHR Profile: C:\Users\Qassim\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Slides) - C:\Users\Qassim\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-01-19]
CHR Extension: (Google Docs) - C:\Users\Qassim\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-01-19]
CHR Extension: (Google Drive) - C:\Users\Qassim\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-01-19]
CHR Extension: (YouTube) - C:\Users\Qassim\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-01-19]
CHR Extension: (Google Search) - C:\Users\Qassim\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-01-19]
CHR Extension: (Google Sheets) - C:\Users\Qassim\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-01-19]
CHR Extension: (Chrome Remote Desktop) - C:\Users\Qassim\AppData\Local\Google\Chrome\User Data\Default\Extensions\gbchcmhmhahfdphkhkmpfmihenigjmpp [2015-05-26]
CHR Extension: (AdBlock) - C:\Users\Qassim\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2015-02-02]
CHR Extension: (Chrome Hotword Shared Module) - C:\Users\Qassim\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-03-12]
CHR Extension: (Download Master) - C:\Users\Qassim\AppData\Local\Google\Chrome\User Data\Default\Extensions\mcceagdollnkjlogmdckgjakjapmkdjf [2015-01-19]
CHR Extension: (AdFly bypasser) - C:\Users\Qassim\AppData\Local\Google\Chrome\User Data\Default\Extensions\mdlpmihmlgmnnkhfokaolfcfdjpneafh [2015-01-19]
CHR Extension: (Google Wallet) - C:\Users\Qassim\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-01-19]
CHR Extension: (Skipper) - C:\Users\Qassim\AppData\Local\Google\Chrome\User Data\Default\Extensions\ogelglhkekbnacdpabpajccajmdpnpbe [2015-01-19]
CHR Extension: (Gmail) - C:\Users\Qassim\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-01-19]
CHR HKU\S-1-5-21-2302587062-3611041661-3303187194-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [bmkckgpgekmanipelfidlhmkfcjicion] - https://clients2.google.com/service/update2/crx

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 AMD FUEL Service; C:\Program Files\AMD\ATI.ACE\Fuel\Fuel.Service.exe [344064 2015-05-26] (Advanced Micro Devices, Inc.) [File not signed]
S3 BEService; C:\Program Files (x86)\Common Files\BattlEye\BEService.exe [814464 2015-02-20] ()
R2 chromoting; C:\Program Files (x86)\Google\Chrome Remote Desktop\42.0.2311.39\remoting_host.exe [56648 2015-03-08] (Google Inc.)
S3 GalaxyClientService; C:\Program Files (x86)\GalaxyClient\GalaxyClientService.exe [1744952 2015-05-16] (GOG.com)
S3 GalaxyCommunication; C:\ProgramData\GOG.com\Galaxy\redists\GalaxyCommunication.exe [6507576 2015-05-16] (GOG.com)
R2 LMIGuardianSvc; C:\Program Files (x86)\LogMeIn Hamachi\LMIGuardianSvc.exe [417552 2015-03-30] (LogMeIn, Inc.)
S2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [1080120 2015-04-14] (Malwarebytes Corporation)
R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76152 2015-05-10] ()
R2 PSI_SVC_2_x64; C:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe [337776 2014-04-30] (arvato digital services llc)
S2 Service KMSELDI; C:\Program Files\KMSpico\Service_KMS.exe [1050904 2013-12-11] () [File not signed]
S4 SwitchBoard; C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated) [File not signed]
R3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [346872 2013-08-22] (Microsoft Corporation)
R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23840 2013-08-22] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 amdacpksd; C:\Windows\system32\drivers\amdacpksd.sys [294600 2015-05-26] (Advanced Micro Devices)
S0 amdkmafd; C:\Windows\System32\drivers\amdkmafd.sys [21160 2012-09-22] (Advanced Micro Devices, Inc.)
R0 amdkmpfd; C:\Windows\System32\drivers\amdkmpfd.sys [62152 2014-10-27] (Advanced Micro Devices, Inc.)
R2 AODDriver4.3; C:\Program Files\AMD\ATI.ACE\Fuel\amd64\AODDriver2.sys [59616 2014-02-11] (Advanced Micro Devices)
R3 AtiHDAudioService; C:\Windows\system32\drivers\AtihdWB6.sys [223232 2014-12-20] (Advanced Micro Devices)
R3 Hamachi; C:\Windows\system32\DRIVERS\Hamdrv.sys [44296 2015-03-30] (LogMeIn Inc.)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-04-14] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [64216 2015-04-14] (Malwarebytes Corporation)
R3 netr28ux; C:\Windows\system32\DRIVERS\netr28ux.sys [2222736 2014-12-08] (MediaTek Inc.)
R3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [124256 2013-08-22] (Microsoft Corporation)
S3 WUDFWpdComp; C:\Windows\system32\DRIVERS\WUDFRd.sys [230912 2013-08-22] (Microsoft Corporation)
S5 WinDivert1.1; <===== ATTENTION Locked Service

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-06-12 15:00 - 2015-06-12 15:00 - 00016059 _____ C:\Users\Qassim\Downloads\FRST.txt
2015-06-12 15:00 - 2015-06-12 15:00 - 00000000 ____D C:\Users\Qassim\Desktop\New folder
2015-06-12 14:56 - 2015-06-12 14:56 - 02108928 _____ (Farbar) C:\Users\Qassim\Downloads\FRST64 (1).exe
2015-06-12 14:55 - 2015-06-12 15:00 - 00000000 ____D C:\FRST
2015-06-12 14:55 - 2015-06-12 14:55 - 02108928 _____ (Farbar) C:\Users\Qassim\Downloads\FRST64.exe
2015-06-12 14:48 - 2015-06-12 14:50 - 00000128 _____ C:\Windows\system32\bootdelete.lst
2015-06-12 14:14 - 2015-06-12 14:50 - 00012872 _____ (SurfRight B.V.) C:\Windows\system32\bootdelete.exe
2015-06-12 14:01 - 2015-06-12 14:01 - 00002862 _____ C:\Windows\system32\.crusader
2015-06-12 13:40 - 2015-06-12 13:41 - 00136408 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-06-12 13:40 - 2015-06-12 13:40 - 00001135 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2015-06-12 13:40 - 2015-06-12 13:40 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2015-06-12 13:40 - 2015-06-12 13:40 - 00000000 ____D C:\ProgramData\Malwarebytes
2015-06-12 13:40 - 2015-06-12 13:40 - 00000000 ____D C:\Program Files (x86)\Malwarebytes Anti-Malware
2015-06-12 13:40 - 2015-04-14 09:38 - 00064216 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-06-12 13:40 - 2015-04-14 09:37 - 00107736 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-06-12 13:40 - 2015-04-14 09:37 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-06-12 13:39 - 2015-06-12 13:40 - 21546080 _____ (Malwarebytes Corporation ) C:\Users\Qassim\Downloads\mbam-setup-2.1.6.1022.exe
2015-06-12 13:24 - 2015-06-12 13:24 - 00283104 _____ C:\Windows\Minidump\061215-18828-01.dmp
2015-06-11 19:42 - 2015-06-11 19:45 - 00000000 ____D C:\ProgramData\HitmanPro
2015-06-11 19:41 - 2015-06-11 19:42 - 11024496 _____ (SurfRight B.V.) C:\Users\Qassim\Downloads\HitmanPro_x64.exe
2015-06-11 19:35 - 2015-06-11 19:35 - 00000000 ____D C:\Users\Qassim\AppData\Roaming\Process Hacker 2
2015-06-11 19:32 - 2015-06-11 19:32 - 02861361 _____ C:\Users\Qassim\Downloads\processhacker-2.35-bin.zip
2015-06-11 19:21 - 2015-06-11 19:46 - 00000000 ____D C:\Users\Qassim\Downloads\New folder
2015-06-11 18:58 - 2015-06-11 18:58 - 00000000 ____D C:\ProgramData\ATI
2015-06-11 18:56 - 2015-06-11 18:56 - 00058610 _____ C:\Windows\SysWOW64\CCCInstall_201506111856249734.log
2015-06-11 18:56 - 2015-06-11 18:56 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AMD Catalyst Control Center
2015-06-11 18:56 - 2015-06-11 18:56 - 00000000 ____D C:\Program Files (x86)\AMD AVT
2015-06-11 18:55 - 2015-06-11 18:55 - 00000000 ____D C:\Windows\LastGood.Tmp
2015-06-08 19:46 - 2015-06-08 19:46 - 00030857 _____ C:\Users\Qassim\Downloads\test.torrent
2015-06-07 12:25 - 2015-06-07 12:25 - 00001622 _____ C:\Users\Public\Desktop\Fallout.lnk
2015-06-07 12:25 - 2015-06-07 12:25 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Fallout [GOG.com]
2015-06-04 14:42 - 2015-06-04 14:42 - 00416521 _____ C:\Users\Qassim\Downloads\fivem.zip
2015-06-01 23:27 - 2015-06-01 23:27 - 00000000 ____D C:\Users\Default\Documents\Visual Studio 2008
2015-06-01 23:27 - 2015-06-01 23:27 - 00000000 ____D C:\Users\Default User\Documents\Visual Studio 2008
2015-06-01 23:10 - 2014-10-30 18:37 - 00129536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\poqexec.exe
2015-06-01 23:10 - 2014-10-30 18:34 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\poqexec.exe
2015-05-31 10:02 - 2015-05-31 10:53 - 00000000 ____D C:\Users\Qassim\Documents\The Escapists
2015-05-31 10:02 - 2015-05-31 10:02 - 00000000 ____D C:\Users\Qassim\AppData\Roaming\MMFApplications
2015-05-30 14:11 - 2015-05-30 14:11 - 00001669 _____ C:\Users\Qassim\Desktop\Europa Universalis IV.lnk
2015-05-26 22:28 - 2015-05-26 22:28 - 00000000 ____D C:\ProgramData\Google
2015-05-26 22:26 - 2015-05-26 22:26 - 00000000 ____D C:\Users\Qassim\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Google Chrome
2015-05-26 18:41 - 2015-05-26 18:41 - 00450744 _____ C:\Windows\system32\amdmiracast.dll
2015-05-26 18:41 - 2015-05-26 18:41 - 00128384 _____ (Advanced Micro Devices, Inc.) C:\Windows\system32\amdhcp64.dll
2015-05-26 18:41 - 2015-05-26 18:41 - 00118096 _____ (Advanced Micro Devices, Inc.) C:\Windows\SysWOW64\amdhcp32.dll
2015-05-26 18:41 - 2015-05-26 18:41 - 00102128 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\amdave64.dll
2015-05-26 18:41 - 2015-05-26 18:41 - 00100032 _____ (Advanced Micro Devices, Inc. ) C:\Windows\SysWOW64\atiu9pag.dll
2015-05-26 18:41 - 2015-05-26 18:41 - 00096448 _____ (Advanced Micro Devices, Inc. ) C:\Windows\SysWOW64\amdave32.dll
2015-05-26 18:41 - 2015-05-26 18:41 - 00078432 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\atimpc64.dll
2015-05-26 18:41 - 2015-05-26 18:41 - 00078432 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\amdpcom64.dll
2015-05-26 18:41 - 2015-05-26 18:41 - 00071704 _____ (Advanced Micro Devices, Inc. ) C:\Windows\SysWOW64\atimpc32.dll
2015-05-26 18:41 - 2015-05-26 18:41 - 00071704 _____ (Advanced Micro Devices, Inc. ) C:\Windows\SysWOW64\amdpcom32.dll
2015-05-26 18:40 - 2015-05-26 18:40 - 08381280 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\atiumd6a.dll
2015-05-26 18:40 - 2015-05-26 18:40 - 08368872 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\atiumd64.dll
2015-05-26 18:40 - 2015-05-26 18:40 - 07559840 _____ (Advanced Micro Devices, Inc. ) C:\Windows\SysWOW64\atiumdva.dll
2015-05-26 18:40 - 2015-05-26 18:40 - 07077264 _____ (Advanced Micro Devices, Inc. ) C:\Windows\SysWOW64\atiumdag.dll
2015-05-26 18:38 - 2015-05-26 18:38 - 00294600 _____ (Advanced Micro Devices) C:\Windows\system32\Drivers\amdacpksd.sys
2015-05-26 18:35 - 2015-05-26 18:35 - 19339264 _____ (Advanced Micro Devices, Inc.) C:\Windows\system32\Drivers\atikmdag.sys
2015-05-26 18:32 - 2015-05-26 18:32 - 00051200 _____ C:\Windows\system32\kdbsdk64.dll
2015-05-26 18:30 - 2015-05-26 18:30 - 00038912 _____ C:\Windows\SysWOW64\kdbsdk32.dll
2015-05-26 18:28 - 2015-05-26 18:28 - 01187342 _____ C:\Windows\system32\amdocl_as64.exe
2015-05-26 18:28 - 2015-05-26 18:28 - 01061902 _____ C:\Windows\system32\amdocl_ld64.exe
2015-05-26 18:28 - 2015-05-26 18:28 - 00995342 _____ C:\Windows\SysWOW64\amdocl_as32.exe
2015-05-26 18:28 - 2015-05-26 18:28 - 00798734 _____ C:\Windows\SysWOW64\amdocl_ld32.exe
2015-05-26 18:28 - 2015-05-26 18:28 - 00235008 _____ C:\Windows\system32\clinfo.exe
2015-05-26 18:28 - 2015-05-26 18:28 - 00098816 _____ (Advanced Micro Devices Inc.) C:\Windows\system32\OpenVideo64.dll
2015-05-26 18:28 - 2015-05-26 18:28 - 00086528 _____ (Advanced Micro Devices Inc.) C:\Windows\system32\OVDecode64.dll
2015-05-26 18:28 - 2015-05-26 18:28 - 00083456 _____ (Advanced Micro Devices Inc.) C:\Windows\SysWOW64\OpenVideo.dll
2015-05-26 18:28 - 2015-05-26 18:28 - 00073216 _____ (Advanced Micro Devices Inc.) C:\Windows\SysWOW64\OVDecode.dll
2015-05-26 18:27 - 2015-05-26 18:27 - 40989696 _____ (Advanced Micro Devices Inc.) C:\Windows\SysWOW64\amdocl.dll
2015-05-26 18:26 - 2015-05-26 18:26 - 00058880 _____ (Khronos Group) C:\Windows\SysWOW64\OpenCL.dll
2015-05-26 18:25 - 2015-05-26 18:25 - 06375936 _____ (Advanced Micro Devices Inc.) C:\Windows\SysWOW64\amdhsasc.dll
2015-05-26 18:21 - 2015-05-26 18:21 - 00134656 _____ C:\Windows\system32\amdhdl64.dll
2015-05-26 18:21 - 2015-05-26 18:21 - 00123392 _____ C:\Windows\SysWOW64\amdhdl32.dll
2015-05-26 18:20 - 2015-05-26 18:20 - 28354560 _____ (Advanced Micro Devices, Inc.) C:\Windows\system32\atio6axx.dll
2015-05-26 18:14 - 2015-05-26 18:14 - 05837824 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\amdmantle64.dll
2015-05-26 18:14 - 2015-05-26 18:14 - 00127488 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\mantle64.dll
2015-05-26 18:14 - 2015-05-26 18:14 - 00113664 _____ (Advanced Micro Devices, Inc. ) C:\Windows\SysWOW64\mantle32.dll
2015-05-26 18:14 - 2015-05-26 18:14 - 00049664 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\amdmmcl6.dll
2015-05-26 18:14 - 2015-05-26 18:14 - 00038912 _____ (Advanced Micro Devices, Inc. ) C:\Windows\SysWOW64\amdmmcl.dll
2015-05-26 18:12 - 2015-05-26 18:12 - 03437632 _____ C:\Windows\system32\atiumd6a.cap
2015-05-26 18:12 - 2015-05-26 18:12 - 00641088 _____ C:\Windows\SysWOW64\atiapfxx.blb
2015-05-26 18:12 - 2015-05-26 18:12 - 00641088 _____ C:\Windows\system32\atiapfxx.blb
2015-05-26 18:12 - 2015-05-26 18:12 - 00367104 _____ (Advanced Micro Devices, Inc.) C:\Windows\system32\atiapfxx.exe
2015-05-26 18:12 - 2015-05-26 18:12 - 00062464 _____ (Advanced Micro Devices Inc.) C:\Windows\system32\aticalrt64.dll
2015-05-26 18:12 - 2015-05-26 18:12 - 00055808 _____ (Advanced Micro Devices Inc.) C:\Windows\system32\aticalcl64.dll
2015-05-26 18:12 - 2015-05-26 18:12 - 00052224 _____ (Advanced Micro Devices Inc.) C:\Windows\SysWOW64\aticalrt.dll
2015-05-26 18:12 - 2015-05-26 18:12 - 00049152 _____ (Advanced Micro Devices Inc.) C:\Windows\SysWOW64\aticalcl.dll
2015-05-26 18:11 - 2015-05-26 18:11 - 15716352 _____ (Advanced Micro Devices Inc.) C:\Windows\system32\aticaldd64.dll
2015-05-26 18:11 - 2015-05-26 18:11 - 14302208 _____ (Advanced Micro Devices Inc.) C:\Windows\SysWOW64\aticaldd.dll
2015-05-26 18:11 - 2015-05-26 18:11 - 04590592 _____ (Advanced Micro Devices, Inc. ) C:\Windows\SysWOW64\amdmantle32.dll
2015-05-26 18:11 - 2015-05-26 18:11 - 00204952 _____ C:\Windows\SysWOW64\ativvsvl.dat
2015-05-26 18:11 - 2015-05-26 18:11 - 00204952 _____ C:\Windows\system32\ativvsvl.dat
2015-05-26 18:11 - 2015-05-26 18:11 - 00157144 _____ C:\Windows\SysWOW64\ativvsva.dat
2015-05-26 18:11 - 2015-05-26 18:11 - 00157144 _____ C:\Windows\system32\ativvsva.dat
2015-05-26 18:09 - 2015-05-26 18:09 - 00091648 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\mantleaxl64.dll
2015-05-26 18:09 - 2015-05-26 18:09 - 00085504 _____ (Advanced Micro Devices, Inc. ) C:\Windows\SysWOW64\mantleaxl32.dll
2015-05-26 18:08 - 2015-05-26 18:08 - 03471376 _____ C:\Windows\SysWOW64\atiumdva.cap
2015-05-26 18:07 - 2015-05-26 18:07 - 00776192 _____ (AMD) C:\Windows\system32\atieclxx.exe
2015-05-26 18:07 - 2015-05-26 18:07 - 00442368 _____ (Advanced Micro Devices, Inc.) C:\Windows\system32\atidemgy.dll
2015-05-26 18:07 - 2015-05-26 18:07 - 00246272 _____ (AMD) C:\Windows\system32\atiesrxx.exe
2015-05-26 18:07 - 2015-05-26 18:07 - 00190976 _____ (AMD) C:\Windows\system32\atitmm64.dll
2015-05-26 18:07 - 2015-05-26 18:07 - 00031232 _____ (AMD) C:\Windows\system32\atimuixx.dll
2015-05-26 18:04 - 2015-05-26 18:04 - 01218560 _____ (Advanced Micro Devices, Inc.) C:\Windows\system32\atiadlxx.dll
2015-05-26 18:04 - 2015-05-26 18:04 - 00089088 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\atisamu64.dll
2015-05-26 18:04 - 2015-05-26 18:04 - 00080896 _____ (Advanced Micro Devices, Inc. ) C:\Windows\SysWOW64\atisamu32.dll
2015-05-26 18:04 - 2015-05-26 18:04 - 00075264 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\atig6pxx.dll
2015-05-26 18:04 - 2015-05-26 18:04 - 00069632 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\atiglpxx.dll
2015-05-26 18:03 - 2015-05-26 18:03 - 00591872 _____ (Advanced Micro Devices, Inc.) C:\Windows\system32\Drivers\atikmpag.sys
2015-05-26 18:03 - 2015-05-26 18:03 - 00043520 _____ (Advanced Micro Devices, Inc.) C:\Windows\system32\Drivers\ati2erec.dll
2015-05-22 23:20 - 2015-05-22 23:20 - 00000000 ____D C:\Users\Qassim\AppData\Roaming\New Technology Studio
2015-05-22 23:20 - 2015-05-22 23:20 - 00000000 ____D C:\Users\Qassim\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OpenIV
2015-05-22 23:20 - 2015-05-22 23:20 - 00000000 ____D C:\Users\Qassim\AppData\Local\New Technology Studio
2015-05-22 23:19 - 2015-05-22 23:19 - 03984384 _____ (New Technology Studio) C:\Users\Qassim\Downloads\ovisetup.exe
2015-05-22 08:52 - 2015-06-12 14:46 - 00000000 ____D C:\Users\Qassim\AppData\Local\LogMeIn Hamachi
2015-05-22 08:52 - 2015-05-22 08:52 - 00000000 ____D C:\Users\Qassim\AppData\Local\LogMeIn
2015-05-22 08:52 - 2015-05-22 08:52 - 00000000 ____D C:\ProgramData\LogMeIn
2015-05-22 08:51 - 2015-05-22 08:51 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LogMeIn Hamachi
2015-05-22 08:51 - 2015-05-22 08:51 - 00000000 ____D C:\Program Files (x86)\LogMeIn Hamachi
2015-05-22 08:50 - 2015-05-22 08:51 - 08552448 _____ C:\Users\Qassim\Downloads\hamachi.msi
2015-05-20 22:56 - 2015-05-20 22:56 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Game of Thrones A Telltale Games Series
2015-05-18 19:14 - 2015-05-10 11:32 - 00000792 _____ C:\Users\Qassim\Desktop\..lnk
2015-05-16 09:48 - 2015-05-16 09:54 - 00000000 ____D C:\Users\Qassim\Documents\Witcher 2
2015-05-16 09:48 - 2015-05-16 09:48 - 00000000 ____D C:\Users\Qassim\AppData\Local\The Witcher 2
2015-05-14 22:05 - 2015-05-14 22:05 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\The Witcher 2 [GOG.com]
2015-05-14 17:12 - 2015-06-07 12:24 - 00000000 ____D C:\GOG Games
2015-05-14 17:09 - 2015-05-14 17:09 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GOG.com
2015-05-14 17:09 - 2015-05-14 17:09 - 00000000 ____D C:\ProgramData\GOG.com
2015-05-14 17:09 - 2015-05-14 17:09 - 00000000 ____D C:\Program Files (x86)\GalaxyClient
2015-05-13 21:29 - 2015-05-13 21:29 - 00000000 ____D C:\Users\Qassim\Documents\Visual Studio 2008
2015-05-13 21:28 - 2015-05-13 21:28 - 00000000 ____D C:\Program Files (x86)\Microsoft Visual Studio 9.0
2015-05-13 21:28 - 2015-05-13 21:28 - 00000000 ____D C:\Program Files (x86)\Microsoft SDKs
2015-05-13 21:27 - 2015-05-13 21:27 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\XVL Player (Ver. 9 or later) 64-bit Edition
2015-05-13 21:25 - 2015-05-13 21:27 - 00000000 ____D C:\Program Files\Lattice
2015-05-13 21:25 - 2015-05-13 21:27 - 00000000 ____D C:\Program Files (x86)\Lattice
2015-05-13 21:23 - 2015-05-13 21:25 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CorelDRAW Technical Suite X6 (64-Bit)
2015-05-13 20:18 - 2015-05-13 20:18 - 00000000 ____D C:\Users\Qassim\Documents\My Palettes
2015-05-13 20:16 - 2015-05-13 21:29 - 00000000 ____D C:\Users\Qassim\Documents\Corel
2015-05-13 20:16 - 2015-05-13 21:29 - 00000000 ____D C:\Users\Qassim\AppData\Roaming\Corel
2015-05-13 20:14 - 2015-05-13 20:14 - 00000000 ____D C:\Program Files\Common Files\Corel
2015-05-13 20:13 - 2015-05-13 21:23 - 00000000 ____D C:\Users\Public\Documents\Corel
2015-05-13 20:13 - 2015-05-13 20:13 - 00000000 ____D C:\Program Files\Common Files\Protexis
2015-05-13 20:12 - 2015-05-13 21:29 - 00000000 ____D C:\ProgramData\Corel
2015-05-13 20:12 - 2015-05-13 20:15 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CorelDRAW Graphics Suite X7 (64-bit)
2015-05-13 20:12 - 2015-05-13 20:12 - 00000000 ____D C:\Program Files\Corel
2015-05-13 19:17 - 2015-05-13 19:17 - 00000000 ____D C:\Users\Qassim\AppData\Local\Akamai

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-06-12 15:00 - 2013-08-22 11:36 - 00000000 ____D C:\Windows\system32\sru
2015-06-12 14:57 - 2013-08-22 07:36 - 00006656 _____ C:\Windows\system32\lpcio.dll
2015-06-12 14:55 - 2015-01-19 06:56 - 00003598 _____ C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-2302587062-3611041661-3303187194-1001
2015-06-12 14:51 - 2015-01-19 06:56 - 00005388 _____ C:\Windows\system32\PerfStringBackup.INI
2015-06-12 14:49 - 2015-01-19 07:10 - 01178804 _____ C:\Windows\WindowsUpdate.log
2015-06-12 14:46 - 2015-01-19 07:13 - 00000916 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-06-12 14:46 - 2013-08-22 10:45 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2015-06-12 14:45 - 2015-04-07 16:15 - 00065536 _____ C:\Windows\system32\spu_storage.bin
2015-06-12 14:38 - 2015-01-19 06:41 - 00011770 _____ C:\Windows\PFRO.log
2015-06-12 14:36 - 2015-01-19 07:13 - 00000920 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-06-12 13:51 - 2015-01-19 07:15 - 00000000 ____D C:\Program Files (x86)\Steam
2015-06-12 13:24 - 2015-01-19 08:09 - 00000000 ____D C:\Windows\Minidump
2015-06-12 13:24 - 2015-01-19 08:08 - 238539223 _____ C:\Windows\MEMORY.DMP
2015-06-12 01:39 - 2015-02-15 20:15 - 00000000 ____D C:\Users\Qassim\AppData\Roaming\Skype
2015-06-11 19:48 - 2015-04-13 19:27 - 00000080 _____ C:\Users\Qassim\AppData\Local剜捯獫慴⁲慇敭屳呇⁁屖湥楴汴浥湥⹴湩潦
2015-06-11 18:57 - 2013-08-22 09:25 - 00262144 ___SH C:\Windows\system32\config\BBI
2015-06-11 18:56 - 2015-01-19 07:39 - 00000000 ____D C:\ProgramData\AMD
2015-06-11 18:56 - 2015-01-19 07:38 - 00000000 ____D C:\Program Files\AMD
2015-06-11 18:55 - 2013-08-22 10:46 - 00016247 _____ C:\Windows\setupact.log
2015-06-11 18:52 - 2015-01-19 07:37 - 00000000 ____D C:\AMD
2015-06-11 18:18 - 2015-04-13 19:27 - 00000000 ____D C:\Program Files (x86)\Rockstar Games
2015-06-11 18:17 - 2015-04-13 19:27 - 00000000 ____D C:\Program Files\Rockstar Games
2015-06-10 18:04 - 2015-01-19 13:21 - 00000600 _____ C:\Users\Qassim\PUTTY.RND
2015-06-10 18:04 - 2015-01-19 13:21 - 00000000 ____D C:\Users\Qassim\Documents\utmp
2015-06-10 16:06 - 2015-01-19 13:29 - 00000000 ____D C:\Users\Qassim\AppData\Roaming\uTorrent
2015-06-09 22:19 - 2015-01-19 08:40 - 00000000 ____D C:\Users\Qassim\Documents\My Games
2015-06-08 14:54 - 2015-01-19 13:22 - 00000228 _____ C:\Users\Qassim\Documents\u.ini
2015-06-07 16:33 - 2015-03-18 20:50 - 00000000 ____D C:\Users\Qassim\AppData\Roaming\vlc
2015-06-02 22:05 - 2015-01-19 06:51 - 00000000 ____D C:\Users\Qassim\AppData\Local\Packages
2015-06-02 14:33 - 2013-08-22 11:20 - 00000000 ____D C:\Windows\CbsTemp
2015-06-02 06:28 - 2015-01-19 07:13 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2015-06-02 06:28 - 2015-01-19 07:13 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight
2015-06-01 23:27 - 2015-02-05 20:22 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2013
2015-06-01 23:27 - 2015-02-05 20:18 - 00000000 ____D C:\ProgramData\Microsoft Help
2015-06-01 23:24 - 2015-02-05 21:03 - 00000000 ____D C:\Windows\system32\MRT
2015-06-01 23:20 - 2013-08-22 09:25 - 00000167 _____ C:\Windows\win.ini
2015-06-01 23:18 - 2015-01-19 07:14 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2015-05-30 14:11 - 2015-02-16 18:48 - 00000000 ____D C:\Users\Qassim\Documents\Paradox Interactive
2015-05-30 14:09 - 2015-01-31 19:37 - 00000000 ____D C:\Games
2015-05-28 00:00 - 2015-01-19 06:51 - 00000000 ____D C:\Users\Qassim
2015-05-26 22:28 - 2015-01-19 07:13 - 00000000 ____D C:\Program Files (x86)\Google
2015-05-26 18:41 - 2015-03-31 16:46 - 00126848 _____ (Advanced Micro Devices, Inc. ) C:\Windows\SysWOW64\atiuxpag.dll
2015-05-26 18:41 - 2014-11-20 22:44 - 01359752 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\aticfx64.dll
2015-05-26 18:41 - 2014-11-20 22:44 - 00144328 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\atiuxp64.dll
2015-05-26 18:41 - 2014-11-20 22:44 - 00118096 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\atiu9p64.dll
2015-05-26 18:40 - 2015-03-31 16:46 - 09411256 _____ (Advanced Micro Devices, Inc. ) C:\Windows\SysWOW64\atidxx32.dll
2015-05-26 18:40 - 2015-03-31 16:46 - 01136736 _____ (Advanced Micro Devices, Inc. ) C:\Windows\SysWOW64\aticfx32.dll
2015-05-26 18:40 - 2014-11-20 22:44 - 11089120 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\atidxx64.dll
2015-05-26 18:28 - 2015-03-31 16:33 - 47902208 _____ (Advanced Micro Devices Inc.) C:\Windows\system32\amdocl64.dll
2015-05-26 18:26 - 2015-03-31 16:32 - 00065024 _____ (Khronos Group) C:\Windows\system32\OpenCL.dll
2015-05-26 18:25 - 2015-03-31 16:30 - 07915520 _____ (Advanced Micro Devices Inc.) C:\Windows\system32\amdhsasc64.dll
2015-05-26 18:15 - 2015-03-31 16:20 - 23626752 _____ (Advanced Micro Devices, Inc.) C:\Windows\SysWOW64\atioglxx.dll
2015-05-26 18:05 - 2014-11-20 22:10 - 00846848 _____ (AMD) C:\Windows\system32\coinst_14.50.dll
2015-05-26 18:04 - 2015-03-31 16:09 - 00905728 _____ (Advanced Micro Devices, Inc.) C:\Windows\SysWOW64\atiadlxy.dll
2015-05-26 18:04 - 2015-03-31 16:09 - 00146944 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\atig6txx.dll
2015-05-26 18:04 - 2015-03-31 16:09 - 00069632 _____ (Advanced Micro Devices, Inc. ) C:\Windows\SysWOW64\atiglpxx.dll
2015-05-26 18:03 - 2015-03-31 16:09 - 00133632 _____ (Advanced Micro Devices, Inc. ) C:\Windows\SysWOW64\atigktxx.dll
2015-05-25 14:17 - 2013-08-22 11:36 - 00000000 ____D C:\Windows\AppReadiness
2015-05-23 13:01 - 2015-01-22 07:05 - 00000000 ____D C:\Users\Qassim\Documents\Rockstar Games
2015-05-22 08:46 - 2015-01-19 08:40 - 00572122 _____ C:\Windows\DirectX.log
2015-05-20 22:59 - 2015-01-19 06:57 - 00000000 ____D C:\Users\Qassim\Documents\Telltale Games
2015-05-19 14:31 - 2015-01-19 07:13 - 00003892 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2015-05-19 14:31 - 2015-01-19 07:13 - 00003656 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2015-05-16 13:42 - 2015-04-19 21:27 - 00000000 ____D C:\Users\Qassim\Documents\My Cheat Tables
2015-05-14 14:16 - 2013-08-22 10:44 - 05112632 _____ C:\Windows\system32\FNTCACHE.DAT
2015-05-13 21:27 - 2015-01-19 08:05 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2015-05-13 21:25 - 2013-08-22 11:36 - 00000000 ____D C:\Program Files\Common Files\microsoft shared
2015-05-13 20:14 - 2015-01-19 07:39 - 00000000 ____D C:\ProgramData\Package Cache

==================== Files in the root of some directories =======

2015-04-27 16:36 - 2015-04-27 16:36 - 0000000 ___SH () C:\Users\Qassim\AppData\Local\LumaEmu

Some files in TEMP:
====================
C:\Users\Qassim\AppData\Local\Temp\AutoDetectUtilApp.exe
C:\Users\Qassim\AppData\Local\Temp\drm_dyndata_7370014.dll
C:\Users\Qassim\AppData\Local\Temp\drm_dyndata_7380014.dll
C:\Users\Qassim\AppData\Local\Temp\drm_dyndata_7410004.dll
C:\Users\Qassim\AppData\Local\Temp\ose00000.exe
C:\Users\Qassim\AppData\Local\Temp\raptrpatch.exe
C:\Users\Qassim\AppData\Local\Temp\raptr_stub.exe
C:\Users\Qassim\AppData\Local\Temp\SRLDetectionLibrary2803185078105024996.dll


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-06-03 12:20

==================== End of log ============================

 

[qassimnm]

Addition:
Additional scan result of Farbar Recovery Scan Tool (x64) Version:08-06-2015
Ran by Qassim at 2015-06-12 15:00:46
Running from C:\Users\Qassim\Downloads
Boot Mode: Normal
==========================================================


==================== Accounts: =============================

Administrator (S-1-5-21-2302587062-3611041661-3303187194-500 - Administrator - Disabled)
Guest (S-1-5-21-2302587062-3611041661-3303187194-501 - Limited - Disabled)
Qassim (S-1-5-21-2302587062-3611041661-3303187194-1001 - Administrator - Enabled) => C:\Users\Qassim

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

µTorrent (HKU\S-1-5-21-2302587062-3611041661-3303187194-1001\...\uTorrent) (Version: 3.4.3.40298 - BitTorrent Inc.)
A.V.A - Alliance of Valiant Arms (HKLM-x32\...\Steam App 102700) (Version: - RED DUCK Inc.)
ACP Application (Version: 2.15.10.0003 - Advanced Micro Devices, Inc.) Hidden
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 16.0.0.245 - Adobe Systems Incorporated)
Adobe Community Help (HKLM-x32\...\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1) (Version: 3.0.0.400 - Adobe Systems Incorporated)
Adobe Media Player (HKLM-x32\...\com.adobe.amp.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1) (Version: 1.8 - Adobe Systems Incorporated)
Adobe Photoshop CS5 (HKLM-x32\...\{15FEDA5F-141C-4127-8D7E-B962D1742728}) (Version: 12.0 - Adobe Systems Incorporated)
Adobe Shockwave Player 12.1 (HKLM-x32\...\Adobe Shockwave Player) (Version: 12.1.6.156 - Adobe Systems, Inc.)
Akamai NetSession Interface (HKU\S-1-5-21-2302587062-3611041661-3303187194-1001\...\Akamai) (Version: - Akamai Technologies, Inc)
Alien: Isolation (HKLM-x32\...\Steam App 214490) (Version: - Creative Assembly)
AMD Catalyst Install Manager (HKLM\...\{66AD7978-00EE-AE61-889B-CC68818C0135}) (Version: 8.0.916.0 - Advanced Micro Devices, Inc.)
AMDProductVerification (HKU\S-1-5-21-2302587062-3611041661-3303187194-1001\...\4ecb547ba21a923a) (Version: 1.0.25.99 - AMDProductVerification)
Arma 2 (HKLM-x32\...\Steam App 33910) (Version: - Bohemia Interactive)
Arma 3 (HKLM-x32\...\Steam App 107410) (Version: - Bohemia Interactive)
Battlefield 3™ (HKLM-x32\...\{76285C16-411A-488A-BCE3-C83CB933D8CF}) (Version: 1.6.0.0 - Electronic Arts)
Battlefield™ Hardline Beta (HKLM-x32\...\{F5526D9D-13AD-4270-8707-AC921D168299}) (Version: 1.0.0.1 - Electronic Arts)
Battlelog Web Plugins (HKLM-x32\...\Battlelog Web Plugins) (Version: 2.7.0 - EA Digital Illusions CE AB)
Besiege (HKLM-x32\...\Steam App 346010) (Version: - Spiderling Studios)
Borderlands 2 (HKLM-x32\...\Steam App 49520) (Version: - Gearbox Software)
Call of Duty: Modern Warfare 3 - Multiplayer (HKLM-x32\...\Steam App 42690) (Version: - Infinity Ward)
Call of Duty: Modern Warfare 3 (HKLM-x32\...\Steam App 42680) (Version: - Infinity Ward)
CGS17_Setup_x64 (Version: 17.2 - Corel Corporation) Hidden
Cheat Engine 6.4 (HKLM-x32\...\Cheat Engine 6.4_is1) (Version: - Cheat Engine)
Chrome Remote Desktop Host (HKLM-x32\...\{A1A724F3-F1A6-479C-AE98-208946717E2B}) (Version: 42.0.2311.39 - Google Inc.)
Corel Graphics - Windows Shell Extension (HKLM-x32\...\_{F2F3159D-0717-4E4E-909E-07D11ADF9D3E}) (Version: 17.2.0.688 - Corel Corporation)
Corel Graphics - Windows Shell Extension (x32 Version: 17.2.688 - Corel Corporation) Hidden
Corel Graphics - Windows Shell Extension 32 Bit (Version: 17.2.688 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X7 - BR (x64) (Version: 17.2 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X7 - Capture (x64) (Version: 17.2 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X7 - Common (x64) (Version: 17.2 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X7 - Connect (x64) (Version: 17.2 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X7 - CS (x64) (Version: 17.2 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X7 - CT (x64) (Version: 17.2 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X7 - Custom Data (x64) (Version: 17.2 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X7 - CZ (x64) (Version: 17.2 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X7 - DE (x64) (Version: 17.2 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X7 - Draw (x64) (Version: 17.2 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X7 - EN (x64) (Version: 17.2 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X7 - ES (x64) (Version: 17.2 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X7 - Filters (x64) (Version: 17.2 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X7 - FontNav (x64) (Version: 17.2 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X7 - FR (x64) (Version: 17.2 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X7 - IPM (x64) (Version: 17.2 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X7 - IPM Content (x64) (Version: 17.0 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X7 - IT (x64) (Version: 17.2 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X7 - JP (x64) (Version: 17.2 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X7 - NL (x64) (Version: 17.2 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X7 - PHOTO-PAINT (x64) (Version: 17.2 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X7 - Photozoom Plugin (x64) (Version: 17.0 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X7 - PL (x64) (Version: 17.2 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X7 - Redist (x64) (Version: 17.0 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X7 - RU (x64) (Version: 17.2 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X7 - Setup Files (x64) (Version: 17.2 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X7 - VBA (x64) (Version: 17.2 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X7 - VideoBrowser (x64) (Version: 17.2 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X7 - Writing Tools (x64) (Version: 17.2 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X7 (64-Bit) (HKLM\...\_{5CB73140-806C-42C6-A05A-1AFD0E92DEB5}) (Version: 17.2.0.688 - Corel Corporation)
CorelDRAW Technical Suite X6 - Capture (x64) (Version: 16.4 - Corel Corporation) Hidden
CorelDRAW Technical Suite X6 - Common (x64) (Version: 16.4 - Corel Corporation) Hidden
CorelDRAW Technical Suite X6 - Common Apps (x64) (Version: 16.4 - Corel Corporation) Hidden
CorelDRAW Technical Suite X6 - Connect (x64) (Version: 16.4 - Corel Corporation) Hidden
CorelDRAW Technical Suite X6 - Core (x64) (Version: 16.4 - Corel Corporation) Hidden
CorelDRAW Technical Suite X6 - Custom Data (x64) (Version: 16.4 - Corel Corporation) Hidden
CorelDRAW Technical Suite X6 - DE (x64) (Version: 16.4 - Corel Corporation) Hidden
CorelDRAW Technical Suite X6 - Designer (x64) (Version: 16.4 - Corel Corporation) Hidden
CorelDRAW Technical Suite X6 - Draw (x64) (Version: 16.4 - Corel Corporation) Hidden
CorelDRAW Technical Suite X6 - EN (x64) (Version: 16.4 - Corel Corporation) Hidden
CorelDRAW Technical Suite X6 - Filters (x64) (Version: 16.4 - Corel Corporation) Hidden
CorelDRAW Technical Suite X6 - FontNav (x64) (Version: 16.4 - Corel Corporation) Hidden
CorelDRAW Technical Suite X6 - FR (x64) (Version: 16.4 - Corel Corporation) Hidden
CorelDRAW Technical Suite X6 - IPM (x64) (Version: 16.4 - Corel Corporation) Hidden
CorelDRAW Technical Suite X6 - IPM Content (x64) (Version: 16.4 - Corel Corporation) Hidden
CorelDRAW Technical Suite X6 - IPM Lattice (x64) (Version: 16.0 - Corel Corporation) Hidden
CorelDRAW Technical Suite X6 - PHOTO-PAINT (x64) (Version: 16.4 - Corel Corporation) Hidden
CorelDRAW Technical Suite X6 - Photozoom Plugin (x64) (Version: 16.4 - Corel Corporation) Hidden
CorelDRAW Technical Suite X6 - Redist (x64) (Version: 16.4 - Corel Corporation) Hidden
CorelDRAW Technical Suite X6 - Setup Files (x64) (Version: 16.4 - Corel Corporation) Hidden
CorelDRAW Technical Suite X6 - VBA (x64) (Version: 16.4 - Corel Corporation) Hidden
CorelDRAW Technical Suite X6 - VideoBrowser (x64) (Version: 16.4 - Corel Corporation) Hidden
CorelDRAW Technical Suite X6 - VSTA (x64) (Version: 16.4 - Corel Corporation) Hidden
CorelDRAW Technical Suite X6 - Writing Tools (x64) (Version: 16.4 - Corel Corporation) Hidden
CorelDRAW Technical Suite X6 (64-Bit) (HKLM\...\_{E2FC299D-38D5-424F-BAB8-D24E07A3A58A}) (Version: 16.3.0.1114 - Corel Corporation)
Counter-Strike: Global Offensive (HKLM-x32\...\Steam App 730) (Version: - Valve)
DayZ (HKLM-x32\...\Steam App 221100) (Version: - Bohemia Interactive)
Dead Island (HKLM-x32\...\Steam App 91310) (Version: - Techland)
Dead Rising 3 (HKLM-x32\...\Steam App 265550) (Version: - Capcom Game Studio Vancouver)
Dishonored - Game of the Year Edition (HKLM-x32\...\Dishonored - Game of the Year Edition_R.G. Mechanics_is1) (Version: - R.G. Mechanics, Panky)
Europa Universalis IV ver. 1.9.2.0 (HKLM-x32\...\{01109877-10HG-49DR-11F5-43DD6F7886AC}_is1) (Version: 1.9.2.0 - Paradox Interactive)
Fallout (HKLM-x32\...\GOGPACKFALLOUT_is1) (Version: 2.0.0.14 - GOG.com)
Fallout 3 - Game of the Year Edition (HKLM-x32\...\Steam App 22370) (Version: - Bethesda Game Studios)
Fallout 3 - The Garden of Eden Creation Kit (HKLM-x32\...\{B343B0E3-212A-40B9-8207-1BD299228F5D}) (Version: 1.00.0000 - Bethesda Softworks)
Fallout Mod Manager 0.13.21 (HKLM-x32\...\Generic Mod Manager_is1) (Version: - Q, Timeslip)
Fallout: New Vegas (HKLM-x32\...\Steam App 22380) (Version: - Obsidian Entertainment)
Game of Thrones - A Telltale Games Series (HKLM-x32\...\Game of Thrones - A Telltale Games Series_is1) (Version: - Telltale Games)
Game of Thrones A Telltale Games Series (HKLM-x32\...\Game of Thrones A Telltale Games Series_is1) (Version: - )
Garry's Mod (HKLM-x32\...\Steam App 4000) (Version: - Facepunch Studios)
GOG Galaxy (HKLM-x32\...\{7258BA11-600C-430E-A759-27E2C691A335}_is1) (Version: - GOG.com)
Google Chrome (HKLM-x32\...\{7335F348-64B4-3072-97D9-A1A55029C59C}) (Version: 66.30.49251 - Google, Inc.)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.27.5 - Google Inc.) Hidden
Grand Theft Auto V (HKLM-x32\...\Steam App 271590) (Version: - Rockstar North)
Grand Theft Auto: San Andreas (HKLM-x32\...\Steam App 12120) (Version: - Rockstar Games)
Half-Life (HKLM-x32\...\Steam App 70) (Version: - Valve)
Half-Life 2 (HKLM-x32\...\Steam App 220) (Version: - Valve)
Half-Life 2: Update (HKLM-x32\...\Steam App 290930) (Version: - Filip Victor)
Hitman: Absolution (HKLM-x32\...\Steam App 203140) (Version: - IO Interactive)
Insurgency (HKLM-x32\...\Steam App 222880) (Version: - New World Interactive)
Intel(R) C++ Redistributables for Windows* on Intel(R) 64 (HKLM-x32\...\{D2437C5C-2D8C-40D2-8059-689AD7239FA3}) (Version: 11.1.048 - Intel Corporation)
Java 8 Update 25 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86418025F0}) (Version: 8.0.250 - Oracle Corporation)
Java 8 Update 25 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218025F0}) (Version: 8.0.250 - Oracle Corporation)
KMSpico v9.1.3 (HKLM\...\KMSpico_is1) (Version: 9.1.3 - )
Left 4 Dead 2 (HKLM-x32\...\Steam App 550) (Version: - Valve)
LogMeIn Hamachi (HKLM-x32\...\LogMeIn Hamachi) (Version: 2.2.0.328 - LogMeIn, Inc.)
LogMeIn Hamachi (x32 Version: 2.2.0.328 - LogMeIn, Inc.) Hidden
Malwarebytes Anti-Malware version 2.1.6.1022 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.1.6.1022 - Malwarebytes Corporation)
Mediatek RT2870 Wireless LAN Card (HKLM-x32\...\{28DA7D8B-F9A4-4F18-8AA0-551B1E084D0D}) (Version: 1.5.39.93 - MediatekWiFi)
Men of War: Assault Squad (HKLM-x32\...\Steam App 64000) (Version: - Digitalmindsoft)
Metro 2033 (HKLM-x32\...\Steam App 43110) (Version: - 4A Games)
Microsoft Chart Controls for Microsoft .NET Framework 3.5 (HKLM-x32\...\{41785C66-90F2-40CE-8CB5-1C94BFC97280}) (Version: 3.5.0.0 - Microsoft Corporation)
Microsoft Games for Windows - LIVE Redistributable (HKLM-x32\...\{42AA4CA8-DCD8-4308-BCAB-0B6D75856A9D}) (Version: 3.5.95.0 - Microsoft Corporation)
Microsoft Games for Windows Marketplace (HKLM-x32\...\{67F42018-F647-4D3C-BE62-F8CB4FE2FCD5}) (Version: 3.5.67.0 - Microsoft Corporation)
Microsoft Office Professional Plus 2013 (HKLM\...\Office15.PROPLUS) (Version: 15.0.4420.1017 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.40416.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (HKLM-x32\...\{050d4fc8-5d48-4b8f-8972-47c82c46020f}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM-x32\...\{f65db027-aff3-4070-886a-0d87064aabb1}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
Microsoft Visual Studio Tools for Applications 2.0 - ENU (HKLM-x32\...\{AA4A4B2C-0465-3CF8-BA76-27A027D8ACAB}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual Studio Tools for Applications 2.0 Runtime (HKLM-x32\...\{299C0434-4F4E-341F-A916-4E07AEB35E79}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual Studio Tools for Applications 2012 (HKLM-x32\...\{89ca2a32-2b52-4595-8dfd-6fe4757958d0}) (Version: 11.0.51108 - Microsoft Corporation)
Mirror's Edge™ (HKLM-x32\...\{AEDBD563-24BB-4EE3-8366-A654DAC2D988}) (Version: 1.0.1.0 - Electronic Arts)
Mozilla Firefox 35.0 (x86 en-US) (HKLM-x32\...\Mozilla Firefox 35.0 (x86 en-US)) (Version: 35.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 35.0 - Mozilla)
Next Car Game Technology Sneak Peek 2.0 (HKLM-x32\...\Next Car Game Technology Sneak Peek) (Version: - Bugbear Entertainment)
Nexus Mod Manager (HKLM\...\6af12c54-643b-4752-87d0-8335503010de_is1) (Version: 0.54.10 - Black Tree Gaming)
NVIDIA PhysX (HKLM-x32\...\{8B922CF8-8A6C-41CE-A858-F1755D7F5D29}) (Version: 9.12.1031 - NVIDIA Corporation)
OpenAL (HKLM-x32\...\OpenAL) (Version: - )
Outils de vérification linguistique 2013 de Microsoft Office - Français (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden
Pacote de Idiomas do Microsoft Visual Studio Tools for Applications 2012 x64 Hosting Support - PTB (Version: 11.0.51108 - Microsoft Corporation) Hidden
Pacote de Idiomas do Microsoft Visual Studio Tools for Applications 2012 x86 Hosting Support - PTB (x32 Version: 11.0.51108 - Microsoft Corporation) Hidden
PAYDAY: The Heist (HKLM-x32\...\Steam App 24240) (Version: - OVERKILL Software)
PDF Settings CS5 (x32 Version: 10.0 - Adobe Systems Incorporated) Hidden
Portal (HKLM-x32\...\Steam App 400) (Version: - Valve)
Portal 2 (HKLM-x32\...\Steam App 620) (Version: - Valve)
PowerISO (HKLM-x32\...\PowerISO) (Version: 6.1 - Power Software Ltd)
PunkBuster Services (HKLM-x32\...\PunkBusterSvc) (Version: 0.991 - Even Balance, Inc.)
Python 3.4.2 (HKLM-x32\...\{2583CDBA-8A53-4622-BB67-1D163714C1B4}) (Version: 3.4.16349 - Python Software Foundation)
Rockstar Games Social Club (HKLM-x32\...\Rockstar Games Social Club) (Version: 1.1.6.0 - Rockstar Games)
Runtime VS2005 SP1 CRT 6195 (x32 Version: 0 - Lattice Technology Co.,Ltd.) Hidden
Runtime VS2005 SP1 MFC 6195 (x32 Version: 0 - Lattice Technology Co.,Ltd.) Hidden
Runtime VS2005 SP1 x64 All 6195 (x32 Version: 0 - Lattice Technology Co.,Ltd.) Hidden
Runtime VS2005 SP1 x64 CRT 6195 (x32 Version: 0 - Lattice Technology Co.,Ltd.) Hidden
Runtime VS2005 SP1 x64 CRT 762 (x32 Version: 0 - Lattice Technology Co.,Ltd.) Hidden
Runtime VS2005 SP1 x64 MFC 6195 (x32 Version: 0 - Lattice Technology Co.,Ltd.) Hidden
Runtime VS2005 SP1 x64 OpenMP 762 (x32 Version: 0 - Lattice Technology Co.,Ltd.) Hidden
Runtime VS2008 CRT 1 (x32 Version: 0 - Lattice Technology Co.,Ltd.) Hidden
Runtime VS2008 x64 CRT 1 (x32 Version: 0 - Lattice Technology Co.,Ltd.) Hidden
Saints Row IV (HKLM-x32\...\Saints Row IV1.0.0.1) (Version: 1.0.0.1 - Joker_RETURNS)
Setup - Assassin's Creed Rogue (c) Ubisoft ... (HKLM-x32\...\Setup - Assassin's Creed Rogue (c) Ubisoft ...) (Version: ... - Ubisoft Entertainment)
Sid Meier's Civilization: Beyond Earth (HKLM-x32\...\Steam App 65980) (Version: - Firaxis Games)
Skype™ 7.1 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.1.105 - Skype Technologies S.A.)
Sleeping Dogs™ (HKLM-x32\...\Steam App 202170) (Version: - United Front Games)
State of Decay - Breakdown (HKLM-x32\...\State of Decay - Breakdown_is1) (Version: - )
Steam (HKLM-x32\...\Steam) (Version: 2.10.91.91 - Valve Corporation)
Surgeon Simulator (HKLM-x32\...\Steam App 233720) (Version: - Bossa Studios)
swMSM (x32 Version: 12.0.0.1 - Adobe Systems, Inc) Hidden
System Requirements Lab (HKLM-x32\...\{0F659036-14C7-4622-9505-35A0DC93526A}) (Version: 6.1.3.0 - Husdawg, LLC)
System Requirements Lab Detection (HKLM-x32\...\{059F6DDA-423B-4808-B300-FBF849A9E455}) (Version: 2.2.4.0 - Husdawg, LLC)
Team Fortress 2 (HKLM-x32\...\Steam App 440) (Version: - Valve)
The Elder Scrolls III: Morrowind (HKLM-x32\...\Steam App 22320) (Version: - Bethesda Game Studios®)
The Elder Scrolls V: Skyrim (HKLM-x32\...\Steam App 72850) (Version: - Bethesda Game Studios)
The Long Dark (HKLM-x32\...\The Long Dark_is1) (Version: v.192 - Релиз от R.G. Steamgames)
The Witcher 2 - Assassins of Kings Enhanced Edition (HKLM-x32\...\1207658930_is1) (Version: 3.5.0.26 - GOG.com)
Total War Rome II / RePack by Baracuda (HKLM-x32\...\Total War Rome II_is1) (Version: 2.2.0 - )
Tropico 5 Waterborne (HKLM-x32\...\Tropico 5 Waterborne_is1) (Version: - )
Unturned (HKLM-x32\...\Steam App 304930) (Version: - Nelson Sexton)
Update for Skype for Business 2015 (KB2889853) 64-Bit Edition (HKLM\...\{90150000-012B-0409-1000-0000000FF1CE}_Office15.PROPLUS_{40930C8E-A677-414C-A72F-DFDEB10738FB}) (Version: - Microsoft)
VLC media player (HKLM-x32\...\VLC media player) (Version: 2.2.0 - VideoLAN)
War Thunder (HKLM-x32\...\Steam App 236390) (Version: - Gaijin Entertainment)
WinRAR 5.20 (64-bit) (HKLM\...\WinRAR archiver) (Version: 5.20.0 - win.rar GmbH)
Wolfenstein - The Old Blood (HKLM-x32\...\Wolfenstein - The Old Blood_R.G. Mechanics_is1) (Version: - R.G. Mechanics, spider91)
Wolfenstein.The New Order.v 1.0.0.1 (HKLM-x32\...\Wolfenstein.The New Order.v 1.0.0.1_is1) (Version: Wolfenstein.The New Order.v 1.0.0.1 - Repack by Fenixx (21.05.2014))
XVL Player / XVL Player Pro (Ver. 9 or later) 64-bit Edition (HKLM-x32\...\{936575FE-E49B-4CE9-9934-0329727476C8}) (Version: 12.1a - Lattice Technology)
XVL Studio 3D Corel Edition x64 (HKLM-x32\...\{137926AA-703D-4382-81A7-BD30EDAFB6C9}) (Version: 1.0 - Lattice Technology)
Языковой пакет для поддержки размещения набора средств Microsoft Visual Studio Tools для работы с приложениями 2012 (x64) - RUS (Version: 11.0.51108 - Microsoft Corporation) Hidden
Языковой пакет для поддержки размещения набора средств Microsoft Visual Studio Tools для работы с приложениями 2012 (x86) - RUS (x32 Version: 11.0.51108 - Microsoft Corporation) Hidden

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== Restore Points =========================

26-05-2015 22:28:01 Installed Chrome Remote Desktop Host
01-06-2015 23:06:30 Windows Update
10-06-2015 12:51:02 Scheduled Checkpoint
11-06-2015 19:44:20 Checkpoint by HitmanPro

==================== Hosts content: ===============================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2013-08-22 09:25 - 2013-08-22 09:25 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {505E228C-BD62-45D2-8D0A-E953987B3F45} - System32\Tasks\Microsoft\Office\Office 15 Subscription Heartbeat => C:\Program Files\Common Files\Microsoft Shared\Office15\OLicenseHeartbeat.exe [2012-10-01] (Microsoft Corporation)
Task: {5E5EBF5C-2744-408F-AF84-37191B6BA631} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\Windows\system32\MRT.exe [2015-04-30] (Microsoft Corporation)
Task: {7638B86A-071B-4C8B-A05F-A35E20153A90} - System32\Tasks\AutoPico Daily Restart => C:\Program Files\KMSpico\AutoPico.exe [2013-12-11] ()
Task: {B5ECE902-EEB5-4AF6-BA28-FEBA61530412} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack => C:\Program Files\Microsoft Office\Office15\msoia.exe [2012-10-01] (Microsoft Corporation)
Task: {BD4763D0-C46D-4BBE-883E-CBC29A6ED2D2} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn => C:\Program Files\Microsoft Office\Office15\msoia.exe [2012-10-01] (Microsoft Corporation)
Task: {BF8311F2-1848-490E-90AF-4D59D526F282} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-01-19] (Google Inc.)
Task: {DC7960F1-FC70-403A-BC36-9E64DDDE88B7} - \Origin No Task File <==== ATTENTION
Task: {F57A4B98-CCB2-459B-85BF-689EA65154DD} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-01-19] (Google Inc.)
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (Whitelisted) ==============

2015-05-26 18:19 - 2015-05-26 18:19 - 00214528 _____ () C:\Program Files\AMD\ATI.ACE\Fuel\Fuel.Container.PerformanceTuning.dll
2014-02-11 07:08 - 2014-02-11 07:08 - 00817152 _____ () C:\Program Files\AMD\ATI.ACE\Fuel\Device.dll
2014-02-11 07:08 - 2014-02-11 07:08 - 03650560 _____ () C:\Program Files\AMD\ATI.ACE\Fuel\Platform.dll
2015-05-26 18:19 - 2015-05-26 18:19 - 00127488 _____ () C:\Program Files\AMD\ATI.ACE\Fuel\Fuel.Container.Wlan.dll
2015-01-24 17:02 - 2015-05-10 12:53 - 00076152 _____ () C:\Windows\SysWOW64\PnkBstrA.exe
2015-01-18 09:59 - 2012-12-22 08:31 - 00147456 _____ () C:\Program Files (x86)\Standard Mouse Driver\Monitor.EXE
2015-05-26 18:19 - 2015-05-26 18:19 - 00102400 _____ () C:\Program Files\AMD\ATI.ACE\Fuel\Fuel.Proxy.Native.dll
2015-01-21 15:01 - 2015-01-21 15:01 - 08898728 _____ () C:\Program Files\Microsoft Office\Office15\1033\GrooveIntlResource.dll
2015-01-18 09:59 - 2012-12-20 14:05 - 00045056 _____ () C:\Program Files (x86)\Standard Mouse Driver\lan.dll
2015-01-18 09:59 - 2012-08-30 14:24 - 00061440 _____ () C:\Program Files (x86)\Standard Mouse Driver\hiddriver.dll
2015-06-09 21:38 - 2015-06-05 14:22 - 01281864 _____ () C:\Program Files (x86)\Google\Chrome\Application\43.0.2357.124\libglesv2.dll
2015-06-09 21:38 - 2015-06-05 14:22 - 00080712 _____ () C:\Program Files (x86)\Google\Chrome\Application\43.0.2357.124\libegl.dll
2015-06-09 21:38 - 2015-06-05 14:22 - 15003464 _____ () C:\Program Files (x86)\Google\Chrome\Application\43.0.2357.124\PepperFlash\pepflashplayer.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)


==================== Safe Mode (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Hamachi2Svc => ""="Service"

==================== EXE Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)


==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-2302587062-3611041661-3303187194-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\Qassim\Pictures\FO4.png
DNS Servers: 192.168.1.1

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

MSCONFIG\Services: gupdate => 2
MSCONFIG\Services: gupdatem => 3
MSCONFIG\Services: MozillaMaintenance => 3
MSCONFIG\Services: Origin Client Service => 3
MSCONFIG\Services: Steam Client Service => 3
MSCONFIG\Services: SwitchBoard => 3
HKLM\...\StartupApproved\Run: => "AdobeAAMUpdater-1.0"
HKLM\...\StartupApproved\Run32: => "SunJavaUpdateSched"
HKLM\...\StartupApproved\Run32: => "AdobeCS5ServiceManager"
HKLM\...\StartupApproved\Run32: => "SwitchBoard"
HKLM\...\StartupApproved\Run32: => "PWRISOVM.EXE"
HKLM\...\StartupApproved\Run32: => "Raptr"
HKU\S-1-5-21-2302587062-3611041661-3303187194-1001\...\StartupApproved\Run: => "uTorrent"
HKU\S-1-5-21-2302587062-3611041661-3303187194-1001\...\StartupApproved\Run: => "GoogleChromeAutoLaunch_2F7B80428691697817EAB415D398FFCC"
HKU\S-1-5-21-2302587062-3611041661-3303187194-1001\...\StartupApproved\Run: => "Steam"
HKU\S-1-5-21-2302587062-3611041661-3303187194-1001\...\StartupApproved\Run: => "Skype"

 

[qassimnm]

Addition continued:

==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139
FirewallRules: [SPPSVC-In-TCP] => (Allow) %SystemRoot%\system32\sppextcomobj.exe
FirewallRules: [SPPSVC-In-TCP-NoScope] => (Allow) %SystemRoot%\system32\sppextcomobj.exe
FirewallRules: [{EF539D7D-8AE1-4BCD-A98F-4970A75FF801}] => (Allow) C:\Program Files\KMSpico\KMSELDI.exe
FirewallRules: [{8BF33EE4-0DD2-472D-926B-986F13767643}] => (Allow) C:\Program Files\KMSpico\KMSELDI.exe
FirewallRules: [{43F98D2D-2760-470C-9EDC-4C3EAFBE217E}] => (Allow) C:\Program Files\KMSpico\AutoPico.exe
FirewallRules: [{031C8758-02BF-4CA1-890A-42F15B68E05C}] => (Allow) C:\Program Files\KMSpico\AutoPico.exe
FirewallRules: [{0602B0E4-82F9-4A11-95A2-3ACFE37CE389}] => (Allow) C:\Program Files\KMSpico\Service_KMS.exe
FirewallRules: [{7268FF1E-F152-41C1-9045-5CDBBB5D6EA8}] => (Allow) C:\Program Files\KMSpico\Service_KMS.exe
FirewallRules: [{EF9EF07B-A3B7-4A40-BCD1-EEA15BBE89AC}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{90E24F12-A4F1-41D6-B993-48568CA235BE}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{10FEC69F-BD0F-4347-8321-1DFF1AD9961A}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe
FirewallRules: [{C1F2D0EC-3C4D-43F9-91DF-203588CA1704}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe
FirewallRules: [{3D005032-AEC3-47CF-970C-EE5171018C2E}] => (Allow) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
FirewallRules: [{2F42C4E1-3043-4873-B8C0-6C56D9C368CD}] => (Allow) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
FirewallRules: [{95652BDB-82A7-44E2-8AEC-B5803E3C76BA}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Skyrim\SkyrimLauncher.exe
FirewallRules: [{EA1063F2-D837-4B68-940C-C1BD1706D480}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Skyrim\SkyrimLauncher.exe
FirewallRules: [{3C90EFD4-69BC-48A8-A431-B65A0296CB3F}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Fallout New Vegas\FalloutNVLauncher.exe
FirewallRules: [{63204B98-742B-40D3-83A3-C9391B314F05}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Fallout New Vegas\FalloutNVLauncher.exe
FirewallRules: [{EF35C7DA-FFFA-4290-BF27-38FE4329CE24}] => (Allow) D:\SteamLibrary\steamapps\common\insurgency2\insurgency.exe
FirewallRules: [{FD2B4836-5FCF-4704-9DFA-EE285758519D}] => (Allow) D:\SteamLibrary\steamapps\common\insurgency2\insurgency.exe
FirewallRules: [{4CFE8448-5F70-47F7-A767-29680A0B4FEF}] => (Allow) D:\SteamLibrary\steamapps\common\Arma 3\arma3.exe
FirewallRules: [{8CF6F809-7889-444F-828C-7835ED3047AD}] => (Allow) D:\SteamLibrary\steamapps\common\Arma 3\arma3.exe
FirewallRules: [{F0209E36-8CD7-4719-96FD-9BDE52181EA2}] => (Allow) D:\SteamLibrary\steamapps\common\Arma 3\arma3launcher.exe
FirewallRules: [{B16B3F16-4162-46D9-AC79-37586B4011D4}] => (Allow) D:\SteamLibrary\steamapps\common\Arma 3\arma3launcher.exe
FirewallRules: [{E17E22DD-D6C8-4022-B7FB-84364A8CDB6D}] => (Allow) D:\SteamLibrary\steamapps\common\Alien Isolation\AI.exe
FirewallRules: [{1206FE18-7144-448F-B885-A402E4F52C83}] => (Allow) D:\SteamLibrary\steamapps\common\Alien Isolation\AI.exe
FirewallRules: [{BA44D4D5-FA31-46BF-947F-8722C451B78D}] => (Allow) D:\SteamLibrary\steamapps\common\Dead Island\DeadIslandGame.exe
FirewallRules: [{63E14CDF-B91B-48DE-8A83-EAE690197465}] => (Allow) D:\SteamLibrary\steamapps\common\Dead Island\DeadIslandGame.exe
FirewallRules: [{67476AC3-055E-4D1B-88C8-BC9A46220F9F}] => (Allow) C:\Users\Qassim\AppData\Roaming\uTorrent\uTorrent.exe
FirewallRules: [{44E19A7F-C2D3-44D8-B733-67310955AA0E}] => (Allow) C:\Users\Qassim\AppData\Roaming\uTorrent\uTorrent.exe
FirewallRules: [{BB4CF343-2B4A-42FF-97FE-BC581466761A}] => (Allow) D:\SteamLibrary\steamapps\common\deadrising3\deadrising3.exe
FirewallRules: [{9041EFE3-99F6-411E-BCD9-01CFEF5DDF3D}] => (Allow) D:\SteamLibrary\steamapps\common\deadrising3\deadrising3.exe
FirewallRules: [{EC7B99C9-C064-4603-B686-7E2D0BD190C0}] => (Allow) D:\SteamLibrary\steamapps\common\SleepingDogs\HKShip.exe
FirewallRules: [{471AB89F-29D6-44A5-AA9D-190FF9B29876}] => (Allow) D:\SteamLibrary\steamapps\common\SleepingDogs\HKShip.exe
FirewallRules: [{86D78237-FF54-4BAF-8946-5E92FB18C8CE}] => (Allow) D:\SteamLibrary\steamapps\common\DayZ\DayZ_BE.exe
FirewallRules: [{E692C876-3F32-41B8-9665-A8DA192AE486}] => (Allow) D:\SteamLibrary\steamapps\common\DayZ\DayZ_BE.exe
FirewallRules: [{B5108C8E-30FA-49C3-902B-CC4777F2BA6F}] => (Allow) D:\SteamLibrary\steamapps\common\Metro 2033\metro2033.exe
FirewallRules: [{690932AB-2F37-4888-9113-56EB05947E71}] => (Allow) D:\SteamLibrary\steamapps\common\Metro 2033\metro2033.exe
FirewallRules: [{8E866BC0-769E-49FB-B131-D68B02412EA9}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Fallout 3 goty\FalloutLauncher.exe
FirewallRules: [{2101C921-5EC2-4229-B8E8-219A580CE99E}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Fallout 3 goty\FalloutLauncher.exe
FirewallRules: [TCP Query User{C209024F-0C8A-4CB8-8EB3-14F9CB0F3E04}D:\steamlibrary\steamapps\common\grand theft auto iv\gtaiv\gtaiv.exe] => (Allow) D:\steamlibrary\steamapps\common\grand theft auto iv\gtaiv\gtaiv.exe
FirewallRules: [UDP Query User{C0700464-DE0A-4D6E-8EBB-CEE84683054A}D:\steamlibrary\steamapps\common\grand theft auto iv\gtaiv\gtaiv.exe] => (Allow) D:\steamlibrary\steamapps\common\grand theft auto iv\gtaiv\gtaiv.exe
FirewallRules: [{A418DEFD-D966-4536-8F8B-A2B6E7B1DACB}] => (Allow) D:\SteamLibrary\steamapps\common\Morrowind\Morrowind Launcher.exe
FirewallRules: [{643C14F4-AC0F-4B1F-A6A9-AC80AA9914E8}] => (Allow) D:\SteamLibrary\steamapps\common\Morrowind\Morrowind Launcher.exe
FirewallRules: [TCP Query User{7C1D9EAC-66EF-44BB-A668-B740581F81F9}D:\steamlibrary\steamapps\common\dayz\dayz.exe] => (Allow) D:\steamlibrary\steamapps\common\dayz\dayz.exe
FirewallRules: [UDP Query User{68B16091-935E-40D0-AE60-FEBE5AC4AB37}D:\steamlibrary\steamapps\common\dayz\dayz.exe] => (Allow) D:\steamlibrary\steamapps\common\dayz\dayz.exe
FirewallRules: [{2602B523-AD2E-4BB6-9D86-E6892C7FF6DB}] => (Allow) C:\Program Files\KMSpico\AutoPico.exe
FirewallRules: [{D92A1318-5D2C-43B9-AA55-18698CAC4AB5}] => (Allow) C:\Program Files\KMSpico\AutoPico.exe
FirewallRules: [{2BA94299-4C1F-4953-BBFE-40270F5003DD}] => (Allow) D:\SteamLibrary\steamapps\common\Surgeon Simulator 2013\ss2013.exe
FirewallRules: [{0324212B-D133-4196-AADE-CA12C7BC1AE5}] => (Allow) D:\SteamLibrary\steamapps\common\Surgeon Simulator 2013\ss2013.exe
FirewallRules: [{46125461-76EF-4626-B23A-339B1D490C2F}] => (Allow) D:\SteamLibrary\steamapps\common\PAYDAY The Heist\payday_win32_release.exe
FirewallRules: [{7067CDAF-70A0-4DAE-A162-257A3ABFE677}] => (Allow) D:\SteamLibrary\steamapps\common\PAYDAY The Heist\payday_win32_release.exe
FirewallRules: [{3B34315C-991A-4CE3-993C-2D7164CAF9A2}] => (Allow) D:\SteamLibrary\steamapps\common\Arma 2\arma2.exe
FirewallRules: [{49AD3660-F46C-41D2-B872-9575505F6D9D}] => (Allow) D:\SteamLibrary\steamapps\common\Arma 2\arma2.exe
FirewallRules: [{D8F6C740-DEC9-49F9-A184-032C3A7CF5F1}] => (Allow) D:\SteamLibrary\steamapps\common\Sid Meier's Civilization Beyond Earth\CivilizationBE_DX11.exe
FirewallRules: [{6BDCD32E-8F33-4712-BAAB-531887DC0E7F}] => (Allow) D:\SteamLibrary\steamapps\common\Sid Meier's Civilization Beyond Earth\CivilizationBE_DX11.exe
FirewallRules: [{4602D343-6808-4B6D-A70B-459532BF2EEF}] => (Allow) D:\SteamLibrary\steamapps\common\Sid Meier's Civilization Beyond Earth\CivilizationBE_Mantle.exe
FirewallRules: [{D637192B-F5C1-4DFB-9002-FF82E4609965}] => (Allow) D:\SteamLibrary\steamapps\common\Sid Meier's Civilization Beyond Earth\CivilizationBE_Mantle.exe
FirewallRules: [{7129ABCA-BB6D-40ED-8452-3FFA62FD11DD}] => (Allow) D:\SteamLibrary\steamapps\common\Hitman Absolution\HMA.exe
FirewallRules: [{5F770741-9904-4F66-AF65-CE7C1C9AA43E}] => (Allow) D:\SteamLibrary\steamapps\common\Hitman Absolution\HMA.exe
FirewallRules: [{198AA27F-C996-4537-99B6-F41133917CEB}] => (Allow) D:\SteamLibrary\steamapps\common\Grand Theft Auto San Andreas\gta-sa.exe
FirewallRules: [{1A6BACA9-8908-4027-8C64-D22F4B19895F}] => (Allow) D:\SteamLibrary\steamapps\common\Grand Theft Auto San Andreas\gta-sa.exe
FirewallRules: [TCP Query User{F98AA088-1233-4AB4-BC81-7A82A3225FB2}C:\users\qassim\documents\u1405.exe] => (Allow) C:\users\qassim\documents\u1405.exe
FirewallRules: [UDP Query User{8AF2E2E2-4134-4D04-92BD-09E00ECD6F62}C:\users\qassim\documents\u1405.exe] => (Allow) C:\users\qassim\documents\u1405.exe
FirewallRules: [{81D64270-C830-4D38-AA2D-25567AB28E35}] => (Allow) D:\SteamLibrary\steamapps\common\Half-Life 2\hl2.exe
FirewallRules: [{EAD5798F-D5F9-464F-B694-E1A442353ABE}] => (Allow) D:\SteamLibrary\steamapps\common\Half-Life 2\hl2.exe
FirewallRules: [TCP Query User{B2EF89A2-F72C-4202-BF91-3D10C8E65EDA}D:\games\planet explorers\pe_client.exe] => (Block) D:\games\planet explorers\pe_client.exe
FirewallRules: [UDP Query User{86576AFB-71FC-440C-B801-A0976417E66B}D:\games\planet explorers\pe_client.exe] => (Block) D:\games\planet explorers\pe_client.exe
FirewallRules: [TCP Query User{5FD66F3E-1DEA-417E-8EBD-6F1A9B0F8E57}D:\games\far cry 4 - gold edition\bin\farcry4.exe] => (Block) D:\games\far cry 4 - gold edition\bin\farcry4.exe
FirewallRules: [UDP Query User{FE8064FF-6CD5-4E06-A605-2BF11BDEC244}D:\games\far cry 4 - gold edition\bin\farcry4.exe] => (Block) D:\games\far cry 4 - gold edition\bin\farcry4.exe
FirewallRules: [TCP Query User{7C134E13-7550-41AE-9A91-23E5A5B61755}C:\users\qassim\downloads\runtime\jre-x64\1.8.0_25\bin\javaw.exe] => (Allow) C:\users\qassim\downloads\runtime\jre-x64\1.8.0_25\bin\javaw.exe
FirewallRules: [UDP Query User{50D2E162-1FCE-4CE7-8D76-319C1DE2A4E8}C:\users\qassim\downloads\runtime\jre-x64\1.8.0_25\bin\javaw.exe] => (Allow) C:\users\qassim\downloads\runtime\jre-x64\1.8.0_25\bin\javaw.exe
FirewallRules: [{5B2B3AFB-3770-459B-91D8-69F61558CE38}] => (Allow) C:\Program Files\Microsoft Office\Office15\lync.exe
FirewallRules: [{25791803-1C63-4D7F-9333-BDA65E99C911}] => (Allow) C:\Program Files\Microsoft Office\Office15\lync.exe
FirewallRules: [{22902D9E-670C-4F12-8212-C076CC496B5D}] => (Allow) C:\Program Files\Microsoft Office\Office15\UcMapi.exe
FirewallRules: [{4F7FD319-567A-419D-B004-0F1E25F7B46F}] => (Allow) C:\Program Files\Microsoft Office\Office15\UcMapi.exe
FirewallRules: [{9AD6B7FF-76A5-4B13-A762-7C42B5CBF333}] => (Allow) C:\Program Files (x86)\Origin Games\BFH Beta 2\bfh.exe
FirewallRules: [{610C0929-2E8A-4DED-BD47-3305CDB2E33D}] => (Allow) C:\Program Files (x86)\Origin Games\BFH Beta 2\bfh.exe
FirewallRules: [TCP Query User{DAA0386F-60FE-4693-83F3-B169386810B3}D:\steamlibrary\steamapps\common\sniper elite 3\bin\sniperelite3.exe] => (Allow) D:\steamlibrary\steamapps\common\sniper elite 3\bin\sniperelite3.exe
FirewallRules: [UDP Query User{7AFD4AB4-7B1F-427A-A469-98007ACF817B}D:\steamlibrary\steamapps\common\sniper elite 3\bin\sniperelite3.exe] => (Allow) D:\steamlibrary\steamapps\common\sniper elite 3\bin\sniperelite3.exe
FirewallRules: [{67CD99A2-141E-433C-967D-1B456C5BD5AA}] => (Allow) D:\SteamLibrary\steamapps\common\Team Fortress 2\hl2.exe
FirewallRules: [{D042749F-1AC7-4C35-94A6-BE83CB1B1B97}] => (Allow) D:\SteamLibrary\steamapps\common\Team Fortress 2\hl2.exe
FirewallRules: [{8A96516B-3927-4C0D-96B4-A396890F88C4}] => (Allow) D:\SteamLibrary\steamapps\common\Left 4 Dead 2\left4dead2.exe
FirewallRules: [{7D2D2473-984F-468F-AC25-CF1403E6F12C}] => (Allow) D:\SteamLibrary\steamapps\common\Left 4 Dead 2\left4dead2.exe
FirewallRules: [{2E274835-E4AF-4CDF-B501-F8C3417EC660}] => (Allow) D:\SteamLibrary\steamapps\common\Portal 2\portal2.exe
FirewallRules: [{6983DA3C-BF16-4AB0-BE6C-53EFECA44C2D}] => (Allow) D:\SteamLibrary\steamapps\common\Portal 2\portal2.exe
FirewallRules: [{9C520476-0E3B-434A-BC3B-052432042C59}] => (Allow) D:\SteamLibrary\steamapps\common\Portal\hl2.exe
FirewallRules: [{F78101D5-88C5-457D-820F-4E750B994B6A}] => (Allow) D:\SteamLibrary\steamapps\common\Portal\hl2.exe
FirewallRules: [TCP Query User{7FDD42E2-A8FE-427D-8F46-BC6E5C1E1425}D:\games\dying light\dyinglightgame.exe] => (Allow) D:\games\dying light\dyinglightgame.exe
FirewallRules: [UDP Query User{F769DCD3-0E82-40F8-9906-4A2740722084}D:\games\dying light\dyinglightgame.exe] => (Allow) D:\games\dying light\dyinglightgame.exe
FirewallRules: [TCP Query User{59D7D324-F86E-4B6B-B69E-14A6BEA7061F}D:\games\cod bo2\t6zm.exe] => (Allow) D:\games\cod bo2\t6zm.exe
FirewallRules: [UDP Query User{4ACC1BE2-CC45-47C0-B694-50D427E114C7}D:\games\cod bo2\t6zm.exe] => (Allow) D:\games\cod bo2\t6zm.exe
FirewallRules: [TCP Query User{BCEDDC5D-DA7F-4572-83C4-2B96806CC398}D:\games\cod bo2\t6mp.exe] => (Allow) D:\games\cod bo2\t6mp.exe
FirewallRules: [UDP Query User{98E82274-5378-4676-BAAA-F88CA1C36A01}D:\games\cod bo2\t6mp.exe] => (Allow) D:\games\cod bo2\t6mp.exe
FirewallRules: [TCP Query User{9A29235C-DE81-425A-980F-D2299C3AD707}D:\games\saints row iv\saintsrowiv.exe] => (Block) D:\games\saints row iv\saintsrowiv.exe
FirewallRules: [UDP Query User{869B4262-7C3F-47BA-88FE-B15080100DBE}D:\games\saints row iv\saintsrowiv.exe] => (Block) D:\games\saints row iv\saintsrowiv.exe
FirewallRules: [{81E7EE57-5045-4FDA-99FF-774539915E7A}] => (Allow) D:\SteamLibrary\steamapps\common\Borderlands 2\Binaries\Win32\Launcher.exe
FirewallRules: [{9F8C3E03-501E-46B1-BEAD-EC6BE8831CA3}] => (Allow) D:\SteamLibrary\steamapps\common\Borderlands 2\Binaries\Win32\Launcher.exe
FirewallRules: [{78B74AF1-FAAA-4B0F-BD25-F0097C04788D}] => (Allow) D:\SteamLibrary\steamapps\common\Borderlands 2\Binaries\Win32\Borderlands2.exe
FirewallRules: [{5786C878-0E08-486C-879F-1F16B472FE84}] => (Allow) D:\SteamLibrary\steamapps\common\Borderlands 2\Binaries\Win32\Borderlands2.exe
FirewallRules: [TCP Query User{1739D823-0B86-4EC8-9529-09F58606DC15}C:\program files (x86)\skype\phone\skype.exe] => (Allow) C:\program files (x86)\skype\phone\skype.exe
FirewallRules: [UDP Query User{B035783B-2EA6-49D1-A7C8-B9B04956673A}C:\program files (x86)\skype\phone\skype.exe] => (Allow) C:\program files (x86)\skype\phone\skype.exe
FirewallRules: [{196DCA31-938F-4F98-BB6B-5EF0252D57C1}] => (Allow) D:\SteamLibrary\steamapps\common\GarrysMod\hl2.exe
FirewallRules: [{34839526-58D2-417E-8A51-02E4460FBCDF}] => (Allow) D:\SteamLibrary\steamapps\common\GarrysMod\hl2.exe
FirewallRules: [{61212769-7D33-4E6D-A1C5-D80DDA53715D}] => (Allow) D:\SteamLibrary\steamapps\common\Call of Duty Modern Warfare 3\iw5sp.exe
FirewallRules: [{3BF04C78-9F28-47C6-9E1B-FD06088EA586}] => (Allow) D:\SteamLibrary\steamapps\common\Call of Duty Modern Warfare 3\iw5sp.exe
FirewallRules: [{54A94107-BE97-4A54-917B-ECDA1CEEEEF3}] => (Allow) D:\SteamLibrary\steamapps\common\Call of Duty Modern Warfare 3\iw5mp.exe
FirewallRules: [{9A6250C6-1295-4615-AA51-278E6AC51900}] => (Allow) D:\SteamLibrary\steamapps\common\Call of Duty Modern Warfare 3\iw5mp.exe
FirewallRules: [{EFEC2AC2-ECC8-4E99-BACE-19B5EFA25F0C}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Unturned\Unturned.exe
FirewallRules: [{7F685F67-CC05-4289-B5B5-C2671ECD1631}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Unturned\Unturned.exe
FirewallRules: [TCP Query User{852DC944-C357-4E4B-97D6-AEC4C5918621}D:\games\goat simulator\binaries\win32\goatgame-win32-shipping.exe] => (Allow) D:\games\goat simulator\binaries\win32\goatgame-win32-shipping.exe
FirewallRules: [UDP Query User{60AB972B-2A7D-491F-AFDF-E7A64CD6CEB1}D:\games\goat simulator\binaries\win32\goatgame-win32-shipping.exe] => (Allow) D:\games\goat simulator\binaries\win32\goatgame-win32-shipping.exe
FirewallRules: [TCP Query User{F2670F22-B165-486F-80AD-FDEF7161AA32}D:\steamlibrary\steamapps\common\america's army\aapg\binaries\win32\aagame.exe] => (Allow) D:\steamlibrary\steamapps\common\america's army\aapg\binaries\win32\aagame.exe
FirewallRules: [UDP Query User{855FE924-6478-4031-809C-4F617F36C0CD}D:\steamlibrary\steamapps\common\america's army\aapg\binaries\win32\aagame.exe] => (Allow) D:\steamlibrary\steamapps\common\america's army\aapg\binaries\win32\aagame.exe
FirewallRules: [{770DC1B4-B514-4657-9058-9710A8373E8E}] => (Allow) D:\SteamLibrary\steamapps\common\America's Army\AAPG\Binaries\AALauncher32.exe
FirewallRules: [{96131483-2671-4BCE-8F66-900CD341605C}] => (Allow) D:\SteamLibrary\steamapps\common\America's Army\AAPG\Binaries\AALauncher32.exe
FirewallRules: [TCP Query User{FA1B18C9-1599-4B1F-BE08-C870CC4AB614}D:\games\dishonored - game of the year edition\binaries\win32\dishonored.exe] => (Allow) D:\games\dishonored - game of the year edition\binaries\win32\dishonored.exe
FirewallRules: [UDP Query User{35B3C486-B8B8-44A4-8BB9-A2972D18BCC3}D:\games\dishonored - game of the year edition\binaries\win32\dishonored.exe] => (Allow) D:\games\dishonored - game of the year edition\binaries\win32\dishonored.exe
FirewallRules: [{0CCE6C52-E91B-43CB-AD6A-7FD3F6626708}] => (Allow) D:\Games\Mirrors Edge\Binaries\MirrorsEdge.exe
FirewallRules: [{379FDD6C-453D-47D9-A190-345EDB3BDB69}] => (Allow) D:\Games\Mirrors Edge\Binaries\MirrorsEdge.exe
FirewallRules: [TCP Query User{A62528F0-4199-4C44-A1C0-4A264BB04E27}D:\steamlibrary\steamapps\common\grand theft auto iv episodes from liberty city\eflc\eflc.exe] => (Allow) D:\steamlibrary\steamapps\common\grand theft auto iv episodes from liberty city\eflc\eflc.exe
FirewallRules: [UDP Query User{5BAED80E-491A-44B3-92F2-49D270EE9BFE}D:\steamlibrary\steamapps\common\grand theft auto iv episodes from liberty city\eflc\eflc.exe] => (Allow) D:\steamlibrary\steamapps\common\grand theft auto iv episodes from liberty city\eflc\eflc.exe
FirewallRules: [TCP Query User{6BFDCDE1-DE0C-4F82-904D-75EE8475CB27}D:\games\total war rome ii\rome2.exe] => (Block) D:\games\total war rome ii\rome2.exe
FirewallRules: [UDP Query User{581E44C8-7DFD-4F25-8476-34C9C212BBA1}D:\games\total war rome ii\rome2.exe] => (Block) D:\games\total war rome ii\rome2.exe
FirewallRules: [{ECDE8FEA-00CB-4E6C-9F20-09891607B22E}] => (Allow) C:\Program Files\KMSpico\Service_KMS.exe
FirewallRules: [{206BEACD-3205-449A-8055-7A3F22BF9771}] => (Allow) C:\Program Files\KMSpico\Service_KMS.exe
FirewallRules: [TCP Query User{814BAE69-828B-485D-96E4-12926A541C65}D:\games\wolfenstein.the new order.v 1.0.0.1\wolfneworder_x64.exe] => (Allow) D:\games\wolfenstein.the new order.v 1.0.0.1\wolfneworder_x64.exe
FirewallRules: [UDP Query User{93F4EC77-7F5E-44D3-BC59-79BD36335B88}D:\games\wolfenstein.the new order.v 1.0.0.1\wolfneworder_x64.exe] => (Allow) D:\games\wolfenstein.the new order.v 1.0.0.1\wolfneworder_x64.exe
FirewallRules: [{100D9548-F678-47EA-82D3-C067F109AD82}] => (Allow) D:\SteamLibrary\steamapps\common\Half-Life\hl.exe
FirewallRules: [{F67419BA-11AC-41CC-AF7E-236B32937286}] => (Allow) D:\SteamLibrary\steamapps\common\Half-Life\hl.exe
FirewallRules: [{BE68540B-6B4E-4DCE-BBB2-51D2EFF5897F}] => (Allow) D:\SteamLibrary\steamapps\common\Counter-Strike Global Offensive\csgo.exe
FirewallRules: [{FC8FC335-7D32-42E8-B737-2AA4D339F4F1}] => (Allow) D:\SteamLibrary\steamapps\common\Counter-Strike Global Offensive\csgo.exe
FirewallRules: [{38E69CBA-BC76-42A0-A975-DDBA70878F7F}] => (Allow) D:\SteamLibrary\steamapps\common\Besiege\Besiege.exe
FirewallRules: [{E2618F1B-840C-462C-8F0E-A121BC1992D8}] => (Allow) D:\SteamLibrary\steamapps\common\Besiege\Besiege.exe
FirewallRules: [{363F5B57-31D9-41D8-A3DE-78038436DF5D}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Grand Theft Auto V\GTAVLauncher.exe
FirewallRules: [{F048CE7B-BFE0-4D86-AB99-A8F8A8E4BA60}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Grand Theft Auto V\GTAVLauncher.exe
FirewallRules: [TCP Query User{1B60B8D1-EB05-4500-91F5-7684CEEC12A5}C:\program files (x86)\steam\steamapps\common\grand theft auto v\gta5.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\grand theft auto v\gta5.exe
FirewallRules: [UDP Query User{8A5E8F2B-70FE-43B7-98AE-C0F678359E27}C:\program files (x86)\steam\steamapps\common\grand theft auto v\gta5.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\grand theft auto v\gta5.exe
FirewallRules: [{A6A061AB-137B-4F5A-ACA0-80668880C05A}] => (Allow) C:\Program Files (x86)\Raptr\raptr.exe
FirewallRules: [{1B71DCD9-8BDF-42B9-92B3-E622F877ECFD}] => (Allow) C:\Program Files (x86)\Raptr\raptr.exe
FirewallRules: [{330218EC-DCC7-46AB-A22C-A96B73A3C61F}] => (Allow) C:\Program Files (x86)\Raptr\raptr_im.exe
FirewallRules: [{97D28275-3321-4344-9C96-94AF6AD89ADB}] => (Allow) C:\Program Files (x86)\Raptr\raptr_im.exe
FirewallRules: [{0F01F81F-32AC-4A55-AEA9-695039272BAE}] => (Allow) C:\Windows\SysWOW64\PnkBstrA.exe
FirewallRules: [{45D6C2A9-5B00-46C4-9111-2A9E2280795F}] => (Allow) C:\Windows\SysWOW64\PnkBstrA.exe
FirewallRules: [{F0919BE2-90AF-4B8A-A237-D6CDF6516F09}] => (Allow) C:\Windows\SysWOW64\PnkBstrB.exe
FirewallRules: [{5E016C90-99E3-4B49-81E3-CD698DE190E4}] => (Allow) C:\Windows\SysWOW64\PnkBstrB.exe
FirewallRules: [{3B506AF9-90D2-413E-BE18-EB46B550F954}] => (Allow) D:\Games\Battlefield 3\bf3.exe
FirewallRules: [{E2F09A45-3EBF-4CCE-B957-91B457C07C01}] => (Allow) D:\Games\Battlefield 3\bf3.exe
FirewallRules: [TCP Query User{3BCEDA9E-B070-4779-B49F-2CACAA621C84}C:\users\qassim\appdata\local\akamai\netsession_win.exe] => (Allow) C:\users\qassim\appdata\local\akamai\netsession_win.exe
FirewallRules: [UDP Query User{A0746428-6DE8-4334-8823-7327D16ECCAE}C:\users\qassim\appdata\local\akamai\netsession_win.exe] => (Allow) C:\users\qassim\appdata\local\akamai\netsession_win.exe
FirewallRules: [{91F0294F-80D1-4555-A4D5-C223387B1E08}] => (Block) d:\Tools\CorelDRAW Graphics Suite X7\Programs64\CorelDrw.exe
FirewallRules: [{B9CAF1FC-CE29-42A8-BCEE-A4F1664DF3D8}] => (Block) d:\Tools\CorelDRAW Graphics Suite X7\Programs64\CorelPP.exe
FirewallRules: [TCP Query User{5B05A35A-8FDD-4003-801A-3DB1BE88EA61}D:\games\the witcher 2\bin\witcher2.exe] => (Allow) D:\games\the witcher 2\bin\witcher2.exe
FirewallRules: [UDP Query User{397C7B54-F04E-4B5A-B362-AC2C00A0E192}D:\games\the witcher 2\bin\witcher2.exe] => (Allow) D:\games\the witcher 2\bin\witcher2.exe
FirewallRules: [{14C20A22-59C2-4AAD-853F-38A4518E0D66}] => (Allow) D:\SteamLibrary\steamapps\common\Half-Life 2 Update\hl2.exe
FirewallRules: [{9CCCB86F-BD03-4E40-93D7-D63681016844}] => (Allow) D:\SteamLibrary\steamapps\common\Half-Life 2 Update\hl2.exe
FirewallRules: [{F658D257-7E41-4802-BB05-F3CE3E3FC577}] => (Allow) D:\SteamLibrary\steamapps\common\Men of War Assault Squad\mow_assault_squad.exe
FirewallRules: [{12D73A2C-DC47-4C6A-AB86-B386AD36D100}] => (Allow) D:\SteamLibrary\steamapps\common\Men of War Assault Squad\mow_assault_squad.exe
FirewallRules: [{118F2CD2-5EB1-4D0F-BFE3-31A6FE3A0C8E}] => (Allow) C:\Program Files (x86)\Google\Chrome Remote Desktop\42.0.2311.39\remoting_host.exe
FirewallRules: [{4F50FCA0-1448-42FE-B3CC-AABAE04CFF67}] => (Allow) C:\Program Files\Microsoft Office\Office15\lync.exe
FirewallRules: [{6C55A208-0CCE-49D9-979B-87B7651181EC}] => (Allow) C:\Program Files\Microsoft Office\Office15\lync.exe
FirewallRules: [{DDE2E68B-F26E-460B-BA08-357434D26321}] => (Allow) C:\Program Files\Microsoft Office\Office15\UcMapi.exe
FirewallRules: [{8C3F05A0-AA05-470E-ABFA-8B2E6287424E}] => (Allow) C:\Program Files\Microsoft Office\Office15\UcMapi.exe
FirewallRules: [{E834AE74-F966-4B9C-8118-C270F459C490}] => (Allow) D:\SteamLibrary\steamapps\common\War Thunder\launcher.exe
FirewallRules: [{6AB778C0-F7DD-4D0B-B213-4E58C7414368}] => (Allow) D:\SteamLibrary\steamapps\common\War Thunder\launcher.exe
FirewallRules: [{A36E2F1E-9868-424B-AC05-675AEAA49BC3}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
FirewallRules: [TCP Query User{FA98C375-9E48-43A3-A864-35646C82F0A2}D:\steamlibrary\steamapps\common\war thunder\aces.exe] => (Block) D:\steamlibrary\steamapps\common\war thunder\aces.exe
FirewallRules: [UDP Query User{E10F0A8A-6593-498F-8E67-832012F0D553}D:\steamlibrary\steamapps\common\war thunder\aces.exe] => (Block) D:\steamlibrary\steamapps\common\war thunder\aces.exe
FirewallRules: [{07F88E9D-C5A3-4732-A637-FA18D96DDA4C}] => (Allow) D:\SteamLibrary\steamapps\common\AVA\NWZLauncher.exe
FirewallRules: [{D1D33DE1-5317-46F8-99CD-2805B65737A7}] => (Allow) D:\SteamLibrary\steamapps\common\AVA\NWZLauncher.exe
FirewallRules: [TCP Query User{E1EAC1EF-536C-4B88-A0A3-A950A1ED1FC9}C:\program files (x86)\steam\steamapps\common\fallout 3 goty\fallout3.exe] => (Block) C:\program files (x86)\steam\steamapps\common\fallout 3 goty\fallout3.exe
FirewallRules: [UDP Query User{470CE7D6-0BC1-4DB1-B56F-062815C36D2F}C:\program files (x86)\steam\steamapps\common\fallout 3 goty\fallout3.exe] => (Block) C:\program files (x86)\steam\steamapps\common\fallout 3 goty\fallout3.exe
FirewallRules: [{D82E130D-99D9-4FA8-8B37-7545FC0CBD85}] => (Allow) C:\Program Files (x86)\Raptr\raptr.exe
FirewallRules: [{F78A8C0E-D32D-491D-B2B8-76A41E140D0D}] => (Allow) C:\Program Files (x86)\Raptr\raptr.exe
FirewallRules: [{6DE65806-E215-462F-A62F-FF21395EF886}] => (Allow) C:\Program Files (x86)\Raptr\raptr_im.exe
FirewallRules: [{683A1668-8FF2-4BE2-A3CD-1460130082A2}] => (Allow) C:\Program Files (x86)\Raptr\raptr_im.exe

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (06/12/2015 02:51:05 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT AUTHORITY)
Description: Unloading the performance counter strings for service WmiApRpl (WmiApRpl) failed. The first DWORD in the Data section contains the error code.

Error: (06/12/2015 02:51:05 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT AUTHORITY)
Description: The performance strings in the Performance registry value is corrupted when process Performance extension counter provider. The BaseIndex value from the Performance registry is the first DWORD in the Data section, LastCounter value is the second DWORD in the Data section, and LastHelp value is the third DWORD in the Data section.

Error: (06/12/2015 02:43:29 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT AUTHORITY)
Description: Unloading the performance counter strings for service WmiApRpl (WmiApRpl) failed. The first DWORD in the Data section contains the error code.

Error: (06/12/2015 02:43:29 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT AUTHORITY)
Description: The performance strings in the Performance registry value is corrupted when process Performance extension counter provider. The BaseIndex value from the Performance registry is the first DWORD in the Data section, LastCounter value is the second DWORD in the Data section, and LastHelp value is the third DWORD in the Data section.

Error: (06/12/2015 02:07:05 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT AUTHORITY)
Description: Unloading the performance counter strings for service WmiApRpl (WmiApRpl) failed. The first DWORD in the Data section contains the error code.

Error: (06/12/2015 02:07:05 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT AUTHORITY)
Description: The performance strings in the Performance registry value is corrupted when process Performance extension counter provider. The BaseIndex value from the Performance registry is the first DWORD in the Data section, LastCounter value is the second DWORD in the Data section, and LastHelp value is the third DWORD in the Data section.

Error: (06/12/2015 01:57:46 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT AUTHORITY)
Description: Unloading the performance counter strings for service WmiApRpl (WmiApRpl) failed. The first DWORD in the Data section contains the error code.

Error: (06/12/2015 01:57:46 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT AUTHORITY)
Description: The performance strings in the Performance registry value is corrupted when process Performance extension counter provider. The BaseIndex value from the Performance registry is the first DWORD in the Data section, LastCounter value is the second DWORD in the Data section, and LastHelp value is the third DWORD in the Data section.

Error: (06/12/2015 01:31:06 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT AUTHORITY)
Description: Unloading the performance counter strings for service WmiApRpl (WmiApRpl) failed. The first DWORD in the Data section contains the error code.

Error: (06/12/2015 01:31:06 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT AUTHORITY)
Description: The performance strings in the Performance registry value is corrupted when process Performance extension counter provider. The BaseIndex value from the Performance registry is the first DWORD in the Data section, LastCounter value is the second DWORD in the Data section, and LastHelp value is the third DWORD in the Data section.


System errors:
=============
Error: (06/12/2015 03:00:37 PM) (Source: DCOM) (EventID: 10010) (User: Qas_PC)
Description: {9AA46009-3CE0-458A-A354-715610A075E6}

Error: (06/12/2015 03:00:07 PM) (Source: DCOM) (EventID: 10010) (User: Qas_PC)
Description: {9AA46009-3CE0-458A-A354-715610A075E6}

Error: (06/12/2015 02:59:36 PM) (Source: DCOM) (EventID: 10010) (User: Qas_PC)
Description: {9AA46009-3CE0-458A-A354-715610A075E6}

Error: (06/12/2015 02:59:06 PM) (Source: DCOM) (EventID: 10010) (User: Qas_PC)
Description: {9AA46009-3CE0-458A-A354-715610A075E6}

Error: (06/12/2015 02:58:36 PM) (Source: DCOM) (EventID: 10010) (User: Qas_PC)
Description: {9AA46009-3CE0-458A-A354-715610A075E6}

Error: (06/12/2015 02:58:06 PM) (Source: DCOM) (EventID: 10010) (User: Qas_PC)
Description: {9AA46009-3CE0-458A-A354-715610A075E6}

Error: (06/12/2015 02:57:36 PM) (Source: DCOM) (EventID: 10010) (User: Qas_PC)
Description: {9AA46009-3CE0-458A-A354-715610A075E6}

Error: (06/12/2015 02:57:06 PM) (Source: DCOM) (EventID: 10010) (User: Qas_PC)
Description: {9AA46009-3CE0-458A-A354-715610A075E6}

Error: (06/12/2015 02:51:55 PM) (Source: DCOM) (EventID: 10010) (User: Qas_PC)
Description: {9AA46009-3CE0-458A-A354-715610A075E6}

Error: (06/12/2015 02:51:25 PM) (Source: DCOM) (EventID: 10010) (User: Qas_PC)
Description: {9AA46009-3CE0-458A-A354-715610A075E6}


Microsoft Office:
=========================
Error: (06/12/2015 02:51:05 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT AUTHORITY)
Description: WmiApRplWmiApRpl8F2030000E5050000

Error: (06/12/2015 02:51:05 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT AUTHORITY)
Description: Performance163707000000000000000000008F020000

Error: (06/12/2015 02:43:29 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT AUTHORITY)
Description: WmiApRplWmiApRpl8F2030000E5050000

Error: (06/12/2015 02:43:29 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT AUTHORITY)
Description: Performance163707000000000000000000008F020000

Error: (06/12/2015 02:07:05 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT AUTHORITY)
Description: WmiApRplWmiApRpl8F2030000E5050000

Error: (06/12/2015 02:07:05 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT AUTHORITY)
Description: Performance163707000000000000000000008F020000

Error: (06/12/2015 01:57:46 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT AUTHORITY)
Description: WmiApRplWmiApRpl8F2030000E5050000

Error: (06/12/2015 01:57:46 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT AUTHORITY)
Description: Performance163707000000000000000000008F020000

Error: (06/12/2015 01:31:06 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT AUTHORITY)
Description: WmiApRplWmiApRpl8F2030000E5050000

Error: (06/12/2015 01:31:06 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT AUTHORITY)
Description: Performance163707000000000000000000008F020000


CodeIntegrity Errors:
===================================
Date: 2015-05-04 19:01:45.192
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\l3codeca.acm because the set of per-page image hashes could not be found on the system.

Date: 2015-05-03 18:56:13.864
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\l3codeca.acm because the set of per-page image hashes could not be found on the system.

Date: 2015-03-27 20:36:34.906
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\l3codeca.acm because the set of per-page image hashes could not be found on the system.

Date: 2015-02-12 14:38:47.567
Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

Date: 2015-02-12 14:38:47.482
Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

Date: 2015-02-12 14:37:39.339
Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

Date: 2015-02-12 14:37:39.187
Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

Date: 2015-02-12 14:37:38.938
Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

Date: 2015-02-12 14:37:38.869
Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

Date: 2015-02-12 14:33:50.866
Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.


==================== Memory info ===========================

Processor: AMD FX(tm)-8320 Eight-Core Processor
Percentage of memory in use: 21%
Total physical RAM: 8156.63 MB
Available physical RAM: 6400.01 MB
Total Pagefile: 16348.63 MB
Available Pagefile: 14318.15 MB
Total Virtual: 131072 MB
Available Virtual: 131071.83 MB

==================== Drives ================================

Drive c: (Windows and GTA V) (Fixed) (Total:223.23 GB) (Free:72.7 GB) NTFS
Drive d: (Not GTA V) (Fixed) (Total:931.51 GB) (Free:453.35 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 223.6 GB) (Disk ID: EA755FC6)
Partition 1: (Active) - (Size=350 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=223.2 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 931.5 GB) (Disk ID: 207734C9)
Partition 1: (Not Active) - (Size=931.5 GB) - (Type=07 NTFS)

==================== End of log ============================

 

[Broni]

Welcome aboard

Please, observe following rules:

• Read all of my instructions very carefully. Your mistakes during cleaning process may have very serious consequences, like unbootable computer.
• If you're stuck, or you're not sure about certain step, always ask before doing anything else.
• Please refrain from running any tools, fixes or applying any changes to your computer other than those I suggest.
• Never run more than one scan at a time.
• Keep updating me regarding your computer behavior, good, or bad.
• The cleaning process, once started, has to be completed. Even if your computer appears to act better, it may still be infected. Once the computer is totally clean, I'll certainly let you know.
• If you leave the topic without explanation in the middle of a cleaning process, you may not be eligible to receive any more help in malware removal forum.
• I close my topics if you have not replied in 5 days. If you need more time, simply let me know. If I closed your topic and you need it to be reopened, simply PM me.

======================================

Be careful with using Hitman Pro as it often produces false positive.

Download RogueKiller from one of the following links and save it to your Desktop:

Link 1
Link 2

• Close all the running programs
• Windows Vista/7/8 users: right click on RogueKiller.exe, click Run as Administrator
• Otherwise just double-click on RogueKiller.exe
• Pre-scan will start. Let it finish.
• Click on SCAN button.
• Wait until the Status box shows Scan Finished
• Click on Delete.
• Wait until the Status box shows Deleting Finished.
• Click on Report and copy/paste the content of the Notepad into your next reply.
• RKreport.txt could also be found on your desktop.
• If more than one log is produced post all logs.
• If RogueKiller has been blocked, do not hesitate to try a few times more. If really won't run, rename it to winlogon.exe (or winlogon.com) and try again

Please download Malwarebytes Anti-Malware (MBAM) to your desktop.
NOTE. If you already have MBAM 2.0 installed scroll down.

• Double-click mbam-setup-2.0.0.1000.exe and follow the prompts to install the program.
  
• At the end, be sure a checkmark is placed next to the following:
  
  • Launch Malwarebytes Anti-Malware
  • A 14 day trial of the Premium features is pre-selected. You may deselect this if you wish, and it will not diminish the scanning and removal capabilities of the program.
• Click Finish.
• On the Dashboard, click the 'Update Now >>' link
• After the update completes, click the 'Scan Now >>' button.
  
• Or, on the Dashboard, click the Scan Now >> button.
• If an update is available, click the Update Now button.
  
• A Threat Scan will begin.
• When the scan is complete, if there have been detections, click Apply Actions to allow MBAM to clean what was detected.
• In most cases, a restart will be required.
• Wait for the prompt to restart the computer to appear, then click on Yes.

If you already have MBAM 2.0 installed:

• On the Dashboard, click the 'Update Now >>' link
• After the update completes, click the 'Scan Now >>' button.
  
• Or, on the Dashboard, click the Scan Now >> button.
• If an update is available, click the Update Now button.
  
• A Threat Scan will begin.
• When the scan is complete, if there have been detections, click Apply Actions to allow MBAM to clean what was detected.
• In most cases, a restart will be required.
• Wait for the prompt to restart the computer to appear, then click on Yes.

How to get logs:
(Export log to save as txt)

• After the restart once you are back at your desktop, open MBAM once more.
• Click on the History tab > Application Logs.
• Double click on the Scan Log which shows the Date and time of the scan just performed.
• Click 'Export'.
• Click 'Text file (*.txt)'
• In the Save File dialog box which appears, click on Desktop.
• In the File name: box type a name for your scan log.
• A message box named 'File Saved' should appear stating "Your file has been successfully exported".
• Click Ok
• Attach that saved log to your next reply.

(Copy to clipboard for pasting into forum replies or tickets)

• After the restart once you are back at your desktop, open MBAM once more.
• Click on the History tab > Application Logs.
• Double click on the Scan Log which shows the Date and time of the scan just performed.
• Click 'Copy to Clipboard'
• Paste the contents of the clipboard into your reply.

Please download AdwCleaner by Xplode onto your desktop.

• Close all open programs and internet browsers.
• Double click on adwcleaner.exe to run the tool.
• Click on Scan button.
• When the scan has finished click on Clean button.
• Your computer will be rebooted automatically. A text file will open after the restart.
• Please post the contents of that logfile with your next reply.
• You can find the logfile at C:\AdwCleaner[S1].txt as well.

Please download Junkware Removal Tool to your desktop.

• Shut down your protection software now to avoid potential conflicts.
• Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
• The tool will open and start scanning your system.
• Please be patient as this can take a while to complete depending on your system's specifications.
• On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
• Post the contents of JRT.txt into your next message.

 

[qassimnm]

Hi Broni, thanks for helping me out
Rouguekiller:
RogueKiller V10.8.2.0 [Jun 9 2015] by Adlice Software
mail : http://www.adlice.com/contact/
Feedback : http://forum.adlice.com
Website : http://www.adlice.com/softwares/roguekiller/
Blog : http://www.adlice.com

Operating System : Windows 8.1 (6.3.9200 ) 64 bits version
Started in : Normal mode
User : Qassim [Administrator]
Started from : C:\Users\Qassim\Downloads\New folder\RogueKiller.exe
Mode : Delete -- Date : 06/12/2015 18:06:55

¤¤¤ Processes : 0 ¤¤¤

¤¤¤ Registry : 0 ¤¤¤

¤¤¤ Tasks : 0 ¤¤¤

¤¤¤ Files : 0 ¤¤¤

¤¤¤ Hosts File : 0 ¤¤¤

¤¤¤ Antirootkit : 0 (Driver: Not loaded [0xc000036b]) ¤¤¤

¤¤¤ Web browsers : 0 ¤¤¤

¤¤¤ MBR Check : ¤¤¤
+++++ PhysicalDrive0: INTEL SSDSC2CW240A3 ATA Device +++++
--- User ---
[MBR] fc3061712b3bd9d57b28f10503949567
[BSP] 5dc3d3f5cfde7a264d8a0dae3e5b0a51 : Windows Vista/7/8|VT.Unknown MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 2048 | Size: 350 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
1 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 718848 | Size: 228584 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
User = LL1 ... OK
User = LL2 ... OK

+++++ PhysicalDrive1: WDC WD1003FZEX-00MK2A0 ATA Device +++++
--- User ---
[MBR] c71ca200a217032d5d1e9b25ebc94851
[BSP] a26a4dcb3afea69e44439a7bd85f4617 : Windows Vista/7/8|VT.Unknown MBR Code
Partition table:
0 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 2048 | Size: 953867 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
User = LL1 ... OK
User = LL2 ... OK


============================================
RKreport_SCN_06122015_180639.log

 

[qassimnm]

I just rebooted my pc between the rouguekiller scan and malware bytes scan apparently since rebooting, the malware did not reappear however I will still finish this if you feel it is necessary
Malwarebytes log:
Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 6/12/2015
Scan Time: 6:13:23 PM
Logfile:
Administrator: Yes

Version: 2.01.6.1022
Malware Database: v2015.06.12.07
Rootkit Database: v2015.06.02.01
License: Free
Malware Protection: Disabled
Malicious Website Protection: Disabled
Self-protection: Disabled

OS: Windows 8.1
CPU: x64
File System: NTFS
User: Qassim

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 371011
Time Elapsed: 9 min, 58 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Enabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 0
(No malicious items detected)

Registry Values: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Folders: 0
(No malicious items detected)

Files: 0
(No malicious items detected)

Physical Sectors: 0
(No malicious items detected)


(end)

 

[qassimnm]

AdwCleaner:
# AdwCleaner v4.206 - Logfile created 12/06/2015 at 18:30:48
# Updated 01/06/2015 by Xplode
# Database : 2015-06-09.1 [Server]
# Operating system : Windows 8.1 Pro (x64)
# Username : Qassim - QAS_PC
# Running from : C:\Users\Qassim\Downloads\adwcleaner_4.206.exe
# Option : Cleaning

***** [ Services ] *****


***** [ Files / Folders ] *****

Folder Deleted : C:\Users\Qassim\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg
File Deleted : C:\Users\Qassim\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_st.chatango.com_0.localstorage
File Deleted : C:\Users\Qassim\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_st.chatango.com_0.localstorage-journal

***** [ Scheduled tasks ] *****


***** [ Shortcuts ] *****


***** [ Registry ] *****

Key Deleted : HKCU\Software\Google\Chrome\Extensions\bmkckgpgekmanipelfidlhmkfcjicion
Data Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings [ProxyOverride] - <local>

***** [ Web browsers ] *****

-\\ Internet Explorer v11.0.9600.16384


-\\ Mozilla Firefox v35.0 (x86 en-US)


-\\ Google Chrome v43.0.2357.124

[C:\Users\Qassim\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Deleted [Search Provider] : hxxp://search.aol.com/aol/search?q={searchTerms}

*************************

AdwCleaner[R0].txt - [1501 bytes] - [12/06/2015 18:28:03]
AdwCleaner[S0].txt - [1438 bytes] - [12/06/2015 18:30:48]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [1497 bytes] ##########

 

[qassimnm]

JRT:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.9.2 (06.12.2015:1)
OS: Windows 8.1 Pro x64
Ran by Qassim on Fri 06/12/2015 at 18:33:56.11
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Tasks



~~~ Registry Values



~~~ Registry Keys



~~~ Files

Successfully deleted: [File] C:\Users\Qassim\appdata\local\google\chrome\user data\default\local storage\hxxps_static.olark.com_0.localstorage
Successfully deleted: [File] C:\Users\Qassim\appdata\local\google\chrome\user data\default\local storage\hxxps_static.olark.com_0.localstorage-journal



~~~ Folders

Successfully deleted: [Folder] C:\Users\Qassim\appdata\local\crashrpt



~~~ Chrome


[C:\Users\Qassim\appdata\local\Google\Chrome\User Data\Default\Preferences] - default search provider reset

[C:\Users\Qassim\appdata\local\Google\Chrome\User Data\Default\Preferences] - Extensions Deleted:

[C:\Users\Qassim\appdata\local\Google\Chrome\User Data\Default\Secure Preferences] - default search provider reset

[C:\Users\Qassim\appdata\local\Google\Chrome\User Data\Default\Secure Preferences] - Extensions Deleted:
[]





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on Fri 06/12/2015 at 18:35:57.63
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

 

[Broni]

Re-run Farbar Recovery Scan Tool (FRST/FRST64) you ran at the very beginning of this topic.

• Double-click to run it. When the tool opens click Yes to disclaimer.
• Make sure you checkmark Addition.txt box.
• Press Scan button.
• Scan will create two logs, FRST.txt and Addition.txt in the same directory the tool is run. Please copy and paste them to your reply.

 

[qassimnm]

FRST:
Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:08-06-2015
Ran by Qassim (administrator) on QAS_PC on 12-06-2015 18:48:43
Running from C:\Users\Qassim\Downloads
Loaded Profiles: Qassim (Available Profiles: Qassim)
Platform: Windows 8.1 Pro (X64) OS Language: English (United States)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool:

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(LogMeIn, Inc.) C:\Program Files (x86)\LogMeIn Hamachi\LMIGuardianSvc.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\NisSrv.exe
() C:\Program Files (x86)\Standard Mouse Driver\Monitor.EXE
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office15\ONENOTEM.EXE
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome Remote Desktop\42.0.2311.39\remoting_host.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome Remote Desktop\42.0.2311.39\remoting_host.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [500208 2010-03-06] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [507776 2014-10-07] (Oracle Corporation)
HKLM-x32\...\Run: [SwitchBoard] => C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [AdobeCS5ServiceManager] => C:\Program Files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe [406992 2010-02-22] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [PWRISOVM.EXE] => C:\Program Files\PowerISO\PWRISOVM.EXE [408888 2014-10-25] (Power Software Ltd)
HKLM-x32\...\Run: [LogMeIn Hamachi Ui] => C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe [3978600 2015-03-30] (LogMeIn Inc.)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\amd64\CLIStart.exe [767176 2015-05-26] (Advanced Micro Devices, Inc.)
HKU\S-1-5-21-2302587062-3611041661-3303187194-1001\...\Run: [Steam] => C:\Program Files (x86)\Steam\steam.exe [2892992 2015-06-04] (Valve Corporation)
HKU\S-1-5-21-2302587062-3611041661-3303187194-1001\...\Run: [uTorrent] => C:\Users\Qassim\AppData\Roaming\uTorrent\uTorrent.exe [1694560 2015-05-11] (BitTorrent Inc.)
HKU\S-1-5-21-2302587062-3611041661-3303187194-1001\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [31087200 2015-01-23] (Skype Technologies S.A.)
HKU\S-1-5-21-2302587062-3611041661-3303187194-1001\...\Run: [Akamai NetSession Interface] => C:\Users\Qassim\AppData\Local\Akamai\netsession_win.exe [4673432 2014-10-29] (Akamai Technologies, Inc.)
HKU\S-1-5-21-2302587062-3611041661-3303187194-1001\...\Run: [GalaxyClient] => [X]
HKU\S-1-5-21-2302587062-3611041661-3303187194-1001\...\MountPoints2: E - "E:\setup.exe"
Startup: C:\Users\Qassim\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Monitor - Shortcut.lnk [2015-01-20]
ShortcutTarget: Monitor - Shortcut.lnk -> C:\Program Files (x86)\Standard Mouse Driver\Monitor.EXE ()
Startup: C:\Users\Qassim\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Send to OneNote.lnk [2015-05-02]
ShortcutTarget: Send to OneNote.lnk -> C:\Program Files\Microsoft Office\Office15\ONENOTEM.EXE (Microsoft Corporation)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-2302587062-3611041661-3303187194-1001\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/?ocid=iehp
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office\Office15\OCHelper.dll [2015-02-10] (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_25\bin\ssv.dll [2015-01-19] (Oracle Corporation)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office15\URLREDIR.DLL [2012-10-01] (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL [2015-01-21] (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_25\bin\jp2ssv.dll [2015-01-19] (Oracle Corporation)
BHO-x32: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll [2015-02-10] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\ssv.dll [2015-01-19] (Oracle Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office15\URLREDIR.DLL [2012-10-01] (Microsoft Corporation)
BHO-x32: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\Office15\GROOVEEX.DLL [2015-01-21] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\jp2ssv.dll [2015-01-19] (Oracle Corporation)
Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office\Office15\MSOSB.DLL [2014-10-15] (Microsoft Corporation)

FireFox:
========
FF ProfilePath: C:\Users\Qassim\AppData\Roaming\Mozilla\Firefox\Profiles\thxgi95r.default
FF Plugin: @esn/npbattlelog,version=2.6.2 -> C:\Program Files (x86)\Battlelog Web Plugins\2.6.2\npbattlelogx64.dll [2015-01-13] (EA Digital Illusions CE AB)
FF Plugin: @esn/npbattlelog,version=2.7.0 -> C:\Program Files (x86)\Battlelog Web Plugins\2.7.0\npbattlelogx64.dll [2015-04-23] (EA Digital Illusions CE AB)
FF Plugin: @java.com/DTPlugin,version=11.25.2 -> C:\Program Files\Java\jre1.8.0_25\bin\dtplugin\npDeployJava1.dll [2015-01-19] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.25.2 -> C:\Program Files\Java\jre1.8.0_25\bin\plugin2\npjp2.dll [2015-01-19] (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-16] ( Microsoft Corporation)
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~2\Office15\NPSPWRAP.DLL [2012-10-01] (Microsoft Corporation)
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\SysWOW64\Adobe\Director\np32dsw_1216156.dll [2015-01-09] (Adobe Systems, Inc.)
FF Plugin-x32: @esn/npbattlelog,version=2.6.2 -> C:\Program Files (x86)\Battlelog Web Plugins\2.6.2\npbattlelog.dll [2015-01-13] (EA Digital Illusions CE AB)
FF Plugin-x32: @esn/npbattlelog,version=2.7.0 -> C:\Program Files (x86)\Battlelog Web Plugins\2.7.0\npbattlelog.dll [2015-04-23] (EA Digital Illusions CE AB)
FF Plugin-x32: @java.com/DTPlugin,version=11.25.2 -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\dtplugin\npDeployJava1.dll [2015-01-19] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.25.2 -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\plugin2\npjp2.dll [2015-01-19] (Oracle Corporation)
FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files (x86)\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2014-05-21] (Microsoft Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-15] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~4\Office15\NPSPWRAP.DLL [2012-10-01] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-05-19] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-05-19] (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.2.0 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2015-02-27] (VideoLAN)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npMeetingJoinPluginOC.dll [2014-05-21] (Microsoft Corporation)

Chrome:
=======
CHR Profile: C:\Users\Qassim\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Slides) - C:\Users\Qassim\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-01-19]
CHR Extension: (Google Docs) - C:\Users\Qassim\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-01-19]
CHR Extension: (Google Drive) - C:\Users\Qassim\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-01-19]
CHR Extension: (YouTube) - C:\Users\Qassim\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-01-19]
CHR Extension: (Google Search) - C:\Users\Qassim\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-01-19]
CHR Extension: (Google Sheets) - C:\Users\Qassim\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-01-19]
CHR Extension: (Chrome Remote Desktop) - C:\Users\Qassim\AppData\Local\Google\Chrome\User Data\Default\Extensions\gbchcmhmhahfdphkhkmpfmihenigjmpp [2015-05-26]
CHR Extension: (AdBlock) - C:\Users\Qassim\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2015-02-02]
CHR Extension: (Download Master) - C:\Users\Qassim\AppData\Local\Google\Chrome\User Data\Default\Extensions\mcceagdollnkjlogmdckgjakjapmkdjf [2015-01-19]
CHR Extension: (AdFly bypasser) - C:\Users\Qassim\AppData\Local\Google\Chrome\User Data\Default\Extensions\mdlpmihmlgmnnkhfokaolfcfdjpneafh [2015-01-19]
CHR Extension: (Google Wallet) - C:\Users\Qassim\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-01-19]
CHR Extension: (Skipper) - C:\Users\Qassim\AppData\Local\Google\Chrome\User Data\Default\Extensions\ogelglhkekbnacdpabpajccajmdpnpbe [2015-01-19]
CHR Extension: (Gmail) - C:\Users\Qassim\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-01-19]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S2 AMD FUEL Service; C:\Program Files\AMD\ATI.ACE\Fuel\Fuel.Service.exe [344064 2015-05-26] (Advanced Micro Devices, Inc.) [File not signed]
S3 BEService; C:\Program Files (x86)\Common Files\BattlEye\BEService.exe [814464 2015-02-20] ()
R2 chromoting; C:\Program Files (x86)\Google\Chrome Remote Desktop\42.0.2311.39\remoting_host.exe [56648 2015-03-08] (Google Inc.)
S3 GalaxyClientService; C:\Program Files (x86)\GalaxyClient\GalaxyClientService.exe [1744952 2015-05-16] (GOG.com)
S3 GalaxyCommunication; C:\ProgramData\GOG.com\Galaxy\redists\GalaxyCommunication.exe [6507576 2015-05-16] (GOG.com)
R2 LMIGuardianSvc; C:\Program Files (x86)\LogMeIn Hamachi\LMIGuardianSvc.exe [417552 2015-03-30] (LogMeIn, Inc.)
S2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [1080120 2015-04-14] (Malwarebytes Corporation)
S2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76152 2015-05-10] ()
S2 PSI_SVC_2_x64; C:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe [337776 2014-04-30] (arvato digital services llc)
S2 Service KMSELDI; C:\Program Files\KMSpico\Service_KMS.exe [1050904 2013-12-11] () [File not signed]
S4 SwitchBoard; C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated) [File not signed]
R3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [346872 2013-08-22] (Microsoft Corporation)
R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23840 2013-08-22] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 amdacpksd; C:\Windows\system32\drivers\amdacpksd.sys [294600 2015-05-26] (Advanced Micro Devices)
S0 amdkmafd; C:\Windows\System32\drivers\amdkmafd.sys [21160 2012-09-22] (Advanced Micro Devices, Inc.)
R0 amdkmpfd; C:\Windows\System32\drivers\amdkmpfd.sys [62152 2014-10-27] (Advanced Micro Devices, Inc.)
R2 AODDriver4.3; C:\Program Files\AMD\ATI.ACE\Fuel\amd64\AODDriver2.sys [59616 2014-02-11] (Advanced Micro Devices)
R3 AtiHDAudioService; C:\Windows\system32\drivers\AtihdWB6.sys [223232 2014-12-20] (Advanced Micro Devices)
R3 Hamachi; C:\Windows\system32\DRIVERS\Hamdrv.sys [44296 2015-03-30] (LogMeIn Inc.)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-04-14] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [64216 2015-04-14] (Malwarebytes Corporation)
R3 netr28ux; C:\Windows\system32\DRIVERS\netr28ux.sys [2222736 2014-12-08] (MediaTek Inc.)
U3 TrueSight; C:\Windows\System32\drivers\TrueSight.sys [35064 2015-06-12] ()
R3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [124256 2013-08-22] (Microsoft Corporation)
S3 WUDFWpdComp; C:\Windows\system32\DRIVERS\WUDFRd.sys [230912 2013-08-22] (Microsoft Corporation)
S5 WinDivert1.1; <===== ATTENTION Locked Service

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-06-12 18:35 - 2015-06-12 18:35 - 00001435 _____ C:\Users\Qassim\Desktop\JRT.txt
2015-06-12 18:33 - 2015-06-12 18:33 - 02943090 _____ (Thisisu) C:\Users\Qassim\Downloads\JRT.exe
2015-06-12 18:33 - 2015-06-12 18:33 - 00000207 _____ C:\Windows\tweaking.com-regbackup-QAS_PC-Windows-8.1-Pro-(64-bit).dat
2015-06-12 18:33 - 2015-06-12 18:33 - 00000000 ____D C:\RegBackup
2015-06-12 18:26 - 2015-06-12 18:30 - 00000000 ____D C:\AdwCleaner
2015-06-12 18:26 - 2015-06-12 18:26 - 02231296 _____ C:\Users\Qassim\Downloads\adwcleaner_4.206.exe
2015-06-12 18:01 - 2015-06-12 18:08 - 00000000 ____D C:\ProgramData\RogueKiller
2015-06-12 18:01 - 2015-06-12 18:01 - 00035064 _____ C:\Windows\system32\Drivers\TrueSight.sys
2015-06-12 18:00 - 2015-06-12 18:00 - 21546080 _____ (Malwarebytes Corporation ) C:\Users\Qassim\Downloads\mbam-setup-2.1.6.1022 (1).exe
2015-06-12 15:00 - 2015-06-12 18:48 - 00015339 _____ C:\Users\Qassim\Downloads\FRST.txt
2015-06-12 15:00 - 2015-06-12 15:02 - 00000000 ____D C:\Users\Qassim\Desktop\New folder
2015-06-12 15:00 - 2015-06-12 15:00 - 00064483 _____ C:\Users\Qassim\Downloads\Addition.txt
2015-06-12 14:56 - 2015-06-12 14:56 - 02108928 _____ (Farbar) C:\Users\Qassim\Downloads\FRST64 (1).exe
2015-06-12 14:55 - 2015-06-12 18:48 - 00000000 ____D C:\FRST
2015-06-12 14:55 - 2015-06-12 14:55 - 02108928 _____ (Farbar) C:\Users\Qassim\Downloads\FRST64.exe
2015-06-12 14:14 - 2015-06-12 14:50 - 00012872 _____ (SurfRight B.V.) C:\Windows\system32\bootdelete.exe
2015-06-12 14:01 - 2015-06-12 14:01 - 00002862 _____ C:\Windows\system32\.crusader
2015-06-12 13:40 - 2015-06-12 18:13 - 00136408 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-06-12 13:40 - 2015-06-12 13:40 - 00001135 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2015-06-12 13:40 - 2015-06-12 13:40 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2015-06-12 13:40 - 2015-06-12 13:40 - 00000000 ____D C:\ProgramData\Malwarebytes
2015-06-12 13:40 - 2015-06-12 13:40 - 00000000 ____D C:\Program Files (x86)\Malwarebytes Anti-Malware
2015-06-12 13:40 - 2015-04-14 09:38 - 00064216 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-06-12 13:40 - 2015-04-14 09:37 - 00107736 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-06-12 13:40 - 2015-04-14 09:37 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-06-12 13:39 - 2015-06-12 13:40 - 21546080 _____ (Malwarebytes Corporation ) C:\Users\Qassim\Downloads\mbam-setup-2.1.6.1022.exe
2015-06-12 13:24 - 2015-06-12 13:24 - 00283104 _____ C:\Windows\Minidump\061215-18828-01.dmp
2015-06-11 19:42 - 2015-06-11 19:45 - 00000000 ____D C:\ProgramData\HitmanPro
2015-06-11 19:41 - 2015-06-11 19:42 - 11024496 _____ (SurfRight B.V.) C:\Users\Qassim\Downloads\HitmanPro_x64.exe
2015-06-11 19:35 - 2015-06-11 19:35 - 00000000 ____D C:\Users\Qassim\AppData\Roaming\Process Hacker 2
2015-06-11 19:32 - 2015-06-11 19:32 - 02861361 _____ C:\Users\Qassim\Downloads\processhacker-2.35-bin.zip
2015-06-11 19:21 - 2015-06-12 18:01 - 00000000 ____D C:\Users\Qassim\Downloads\New folder
2015-06-11 18:58 - 2015-06-11 18:58 - 00000000 ____D C:\ProgramData\ATI
2015-06-11 18:56 - 2015-06-11 18:56 - 00058610 _____ C:\Windows\SysWOW64\CCCInstall_201506111856249734.log
2015-06-11 18:56 - 2015-06-11 18:56 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AMD Catalyst Control Center
2015-06-11 18:56 - 2015-06-11 18:56 - 00000000 ____D C:\Program Files (x86)\AMD AVT
2015-06-11 18:55 - 2015-06-11 18:55 - 00000000 ____D C:\Windows\LastGood.Tmp
2015-06-08 19:46 - 2015-06-08 19:46 - 00030857 _____ C:\Users\Qassim\Downloads\test.torrent
2015-06-07 12:25 - 2015-06-07 12:25 - 00001622 _____ C:\Users\Public\Desktop\Fallout.lnk
2015-06-07 12:25 - 2015-06-07 12:25 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Fallout [GOG.com]
2015-06-04 14:42 - 2015-06-04 14:42 - 00416521 _____ C:\Users\Qassim\Downloads\fivem.zip
2015-06-01 23:27 - 2015-06-01 23:27 - 00000000 ____D C:\Users\Default\Documents\Visual Studio 2008
2015-06-01 23:27 - 2015-06-01 23:27 - 00000000 ____D C:\Users\Default User\Documents\Visual Studio 2008
2015-06-01 23:10 - 2014-10-30 18:37 - 00129536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\poqexec.exe
2015-06-01 23:10 - 2014-10-30 18:34 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\poqexec.exe
2015-05-31 10:02 - 2015-05-31 10:53 - 00000000 ____D C:\Users\Qassim\Documents\The Escapists
2015-05-31 10:02 - 2015-05-31 10:02 - 00000000 ____D C:\Users\Qassim\AppData\Roaming\MMFApplications
2015-05-30 14:11 - 2015-05-30 14:11 - 00001669 _____ C:\Users\Qassim\Desktop\Europa Universalis IV.lnk
2015-05-26 22:28 - 2015-05-26 22:28 - 00000000 ____D C:\ProgramData\Google
2015-05-26 22:26 - 2015-05-26 22:26 - 00000000 ____D C:\Users\Qassim\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Google Chrome
2015-05-26 18:41 - 2015-05-26 18:41 - 00450744 _____ C:\Windows\system32\amdmiracast.dll
2015-05-26 18:41 - 2015-05-26 18:41 - 00128384 _____ (Advanced Micro Devices, Inc.) C:\Windows\system32\amdhcp64.dll
2015-05-26 18:41 - 2015-05-26 18:41 - 00118096 _____ (Advanced Micro Devices, Inc.) C:\Windows\SysWOW64\amdhcp32.dll
2015-05-26 18:41 - 2015-05-26 18:41 - 00102128 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\amdave64.dll
2015-05-26 18:41 - 2015-05-26 18:41 - 00100032 _____ (Advanced Micro Devices, Inc. ) C:\Windows\SysWOW64\atiu9pag.dll
2015-05-26 18:41 - 2015-05-26 18:41 - 00096448 _____ (Advanced Micro Devices, Inc. ) C:\Windows\SysWOW64\amdave32.dll
2015-05-26 18:41 - 2015-05-26 18:41 - 00078432 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\atimpc64.dll
2015-05-26 18:41 - 2015-05-26 18:41 - 00078432 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\amdpcom64.dll
2015-05-26 18:41 - 2015-05-26 18:41 - 00071704 _____ (Advanced Micro Devices, Inc. ) C:\Windows\SysWOW64\atimpc32.dll
2015-05-26 18:41 - 2015-05-26 18:41 - 00071704 _____ (Advanced Micro Devices, Inc. ) C:\Windows\SysWOW64\amdpcom32.dll
2015-05-26 18:40 - 2015-05-26 18:40 - 08381280 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\atiumd6a.dll
2015-05-26 18:40 - 2015-05-26 18:40 - 08368872 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\atiumd64.dll
2015-05-26 18:40 - 2015-05-26 18:40 - 07559840 _____ (Advanced Micro Devices, Inc. ) C:\Windows\SysWOW64\atiumdva.dll
2015-05-26 18:40 - 2015-05-26 18:40 - 07077264 _____ (Advanced Micro Devices, Inc. ) C:\Windows\SysWOW64\atiumdag.dll
2015-05-26 18:38 - 2015-05-26 18:38 - 00294600 _____ (Advanced Micro Devices) C:\Windows\system32\Drivers\amdacpksd.sys
2015-05-26 18:35 - 2015-05-26 18:35 - 19339264 _____ (Advanced Micro Devices, Inc.) C:\Windows\system32\Drivers\atikmdag.sys
2015-05-26 18:32 - 2015-05-26 18:32 - 00051200 _____ C:\Windows\system32\kdbsdk64.dll
2015-05-26 18:30 - 2015-05-26 18:30 - 00038912 _____ C:\Windows\SysWOW64\kdbsdk32.dll
2015-05-26 18:28 - 2015-05-26 18:28 - 01187342 _____ C:\Windows\system32\amdocl_as64.exe
2015-05-26 18:28 - 2015-05-26 18:28 - 01061902 _____ C:\Windows\system32\amdocl_ld64.exe
2015-05-26 18:28 - 2015-05-26 18:28 - 00995342 _____ C:\Windows\SysWOW64\amdocl_as32.exe
2015-05-26 18:28 - 2015-05-26 18:28 - 00798734 _____ C:\Windows\SysWOW64\amdocl_ld32.exe
2015-05-26 18:28 - 2015-05-26 18:28 - 00235008 _____ C:\Windows\system32\clinfo.exe
2015-05-26 18:28 - 2015-05-26 18:28 - 00098816 _____ (Advanced Micro Devices Inc.) C:\Windows\system32\OpenVideo64.dll
2015-05-26 18:28 - 2015-05-26 18:28 - 00086528 _____ (Advanced Micro Devices Inc.) C:\Windows\system32\OVDecode64.dll
2015-05-26 18:28 - 2015-05-26 18:28 - 00083456 _____ (Advanced Micro Devices Inc.) C:\Windows\SysWOW64\OpenVideo.dll
2015-05-26 18:28 - 2015-05-26 18:28 - 00073216 _____ (Advanced Micro Devices Inc.) C:\Windows\SysWOW64\OVDecode.dll
2015-05-26 18:27 - 2015-05-26 18:27 - 40989696 _____ (Advanced Micro Devices Inc.) C:\Windows\SysWOW64\amdocl.dll
2015-05-26 18:26 - 2015-05-26 18:26 - 00058880 _____ (Khronos Group) C:\Windows\SysWOW64\OpenCL.dll
2015-05-26 18:25 - 2015-05-26 18:25 - 06375936 _____ (Advanced Micro Devices Inc.) C:\Windows\SysWOW64\amdhsasc.dll
2015-05-26 18:21 - 2015-05-26 18:21 - 00134656 _____ C:\Windows\system32\amdhdl64.dll
2015-05-26 18:21 - 2015-05-26 18:21 - 00123392 _____ C:\Windows\SysWOW64\amdhdl32.dll
2015-05-26 18:20 - 2015-05-26 18:20 - 28354560 _____ (Advanced Micro Devices, Inc.) C:\Windows\system32\atio6axx.dll
2015-05-26 18:14 - 2015-05-26 18:14 - 05837824 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\amdmantle64.dll
2015-05-26 18:14 - 2015-05-26 18:14 - 00127488 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\mantle64.dll
2015-05-26 18:14 - 2015-05-26 18:14 - 00113664 _____ (Advanced Micro Devices, Inc. ) C:\Windows\SysWOW64\mantle32.dll
2015-05-26 18:14 - 2015-05-26 18:14 - 00049664 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\amdmmcl6.dll
2015-05-26 18:14 - 2015-05-26 18:14 - 00038912 _____ (Advanced Micro Devices, Inc. ) C:\Windows\SysWOW64\amdmmcl.dll
2015-05-26 18:12 - 2015-05-26 18:12 - 03437632 _____ C:\Windows\system32\atiumd6a.cap
2015-05-26 18:12 - 2015-05-26 18:12 - 00641088 _____ C:\Windows\SysWOW64\atiapfxx.blb
2015-05-26 18:12 - 2015-05-26 18:12 - 00641088 _____ C:\Windows\system32\atiapfxx.blb
2015-05-26 18:12 - 2015-05-26 18:12 - 00367104 _____ (Advanced Micro Devices, Inc.) C:\Windows\system32\atiapfxx.exe
2015-05-26 18:12 - 2015-05-26 18:12 - 00062464 _____ (Advanced Micro Devices Inc.) C:\Windows\system32\aticalrt64.dll
2015-05-26 18:12 - 2015-05-26 18:12 - 00055808 _____ (Advanced Micro Devices Inc.) C:\Windows\system32\aticalcl64.dll
2015-05-26 18:12 - 2015-05-26 18:12 - 00052224 _____ (Advanced Micro Devices Inc.) C:\Windows\SysWOW64\aticalrt.dll
2015-05-26 18:12 - 2015-05-26 18:12 - 00049152 _____ (Advanced Micro Devices Inc.) C:\Windows\SysWOW64\aticalcl.dll
2015-05-26 18:11 - 2015-05-26 18:11 - 15716352 _____ (Advanced Micro Devices Inc.) C:\Windows\system32\aticaldd64.dll
2015-05-26 18:11 - 2015-05-26 18:11 - 14302208 _____ (Advanced Micro Devices Inc.) C:\Windows\SysWOW64\aticaldd.dll
2015-05-26 18:11 - 2015-05-26 18:11 - 04590592 _____ (Advanced Micro Devices, Inc. ) C:\Windows\SysWOW64\amdmantle32.dll
2015-05-26 18:11 - 2015-05-26 18:11 - 00204952 _____ C:\Windows\SysWOW64\ativvsvl.dat
2015-05-26 18:11 - 2015-05-26 18:11 - 00204952 _____ C:\Windows\system32\ativvsvl.dat
2015-05-26 18:11 - 2015-05-26 18:11 - 00157144 _____ C:\Windows\SysWOW64\ativvsva.dat
2015-05-26 18:11 - 2015-05-26 18:11 - 00157144 _____ C:\Windows\system32\ativvsva.dat
2015-05-26 18:09 - 2015-05-26 18:09 - 00091648 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\mantleaxl64.dll
2015-05-26 18:09 - 2015-05-26 18:09 - 00085504 _____ (Advanced Micro Devices, Inc. ) C:\Windows\SysWOW64\mantleaxl32.dll
2015-05-26 18:08 - 2015-05-26 18:08 - 03471376 _____ C:\Windows\SysWOW64\atiumdva.cap
2015-05-26 18:07 - 2015-05-26 18:07 - 00776192 _____ (AMD) C:\Windows\system32\atieclxx.exe
2015-05-26 18:07 - 2015-05-26 18:07 - 00442368 _____ (Advanced Micro Devices, Inc.) C:\Windows\system32\atidemgy.dll
2015-05-26 18:07 - 2015-05-26 18:07 - 00246272 _____ (AMD) C:\Windows\system32\atiesrxx.exe
2015-05-26 18:07 - 2015-05-26 18:07 - 00190976 _____ (AMD) C:\Windows\system32\atitmm64.dll
2015-05-26 18:07 - 2015-05-26 18:07 - 00031232 _____ (AMD) C:\Windows\system32\atimuixx.dll
2015-05-26 18:04 - 2015-05-26 18:04 - 01218560 _____ (Advanced Micro Devices, Inc.) C:\Windows\system32\atiadlxx.dll
2015-05-26 18:04 - 2015-05-26 18:04 - 00089088 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\atisamu64.dll
2015-05-26 18:04 - 2015-05-26 18:04 - 00080896 _____ (Advanced Micro Devices, Inc. ) C:\Windows\SysWOW64\atisamu32.dll
2015-05-26 18:04 - 2015-05-26 18:04 - 00075264 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\atig6pxx.dll
2015-05-26 18:04 - 2015-05-26 18:04 - 00069632 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\atiglpxx.dll
2015-05-26 18:03 - 2015-05-26 18:03 - 00591872 _____ (Advanced Micro Devices, Inc.) C:\Windows\system32\Drivers\atikmpag.sys
2015-05-26 18:03 - 2015-05-26 18:03 - 00043520 _____ (Advanced Micro Devices, Inc.) C:\Windows\system32\Drivers\ati2erec.dll
2015-05-22 23:20 - 2015-05-22 23:20 - 00000000 ____D C:\Users\Qassim\AppData\Roaming\New Technology Studio
2015-05-22 23:20 - 2015-05-22 23:20 - 00000000 ____D C:\Users\Qassim\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OpenIV
2015-05-22 23:20 - 2015-05-22 23:20 - 00000000 ____D C:\Users\Qassim\AppData\Local\New Technology Studio
2015-05-22 23:19 - 2015-05-22 23:19 - 03984384 _____ (New Technology Studio) C:\Users\Qassim\Downloads\ovisetup.exe
2015-05-22 08:52 - 2015-06-12 18:32 - 00000000 ____D C:\Users\Qassim\AppData\Local\LogMeIn Hamachi
2015-05-22 08:52 - 2015-05-22 08:52 - 00000000 ____D C:\Users\Qassim\AppData\Local\LogMeIn
2015-05-22 08:52 - 2015-05-22 08:52 - 00000000 ____D C:\ProgramData\LogMeIn
2015-05-22 08:51 - 2015-05-22 08:51 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LogMeIn Hamachi
2015-05-22 08:51 - 2015-05-22 08:51 - 00000000 ____D C:\Program Files (x86)\LogMeIn Hamachi
2015-05-22 08:50 - 2015-05-22 08:51 - 08552448 _____ C:\Users\Qassim\Downloads\hamachi.msi
2015-05-20 22:56 - 2015-05-20 22:56 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Game of Thrones A Telltale Games Series
2015-05-18 19:14 - 2015-05-10 11:32 - 00000792 _____ C:\Users\Qassim\Desktop\..lnk
2015-05-16 09:48 - 2015-05-16 09:54 - 00000000 ____D C:\Users\Qassim\Documents\Witcher 2
2015-05-16 09:48 - 2015-05-16 09:48 - 00000000 ____D C:\Users\Qassim\AppData\Local\The Witcher 2
2015-05-14 22:05 - 2015-05-14 22:05 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\The Witcher 2 [GOG.com]
2015-05-14 17:12 - 2015-06-07 12:24 - 00000000 ____D C:\GOG Games
2015-05-14 17:09 - 2015-05-14 17:09 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GOG.com
2015-05-14 17:09 - 2015-05-14 17:09 - 00000000 ____D C:\ProgramData\GOG.com
2015-05-14 17:09 - 2015-05-14 17:09 - 00000000 ____D C:\Program Files (x86)\GalaxyClient
2015-05-13 21:29 - 2015-05-13 21:29 - 00000000 ____D C:\Users\Qassim\Documents\Visual Studio 2008
2015-05-13 21:28 - 2015-05-13 21:28 - 00000000 ____D C:\Program Files (x86)\Microsoft Visual Studio 9.0
2015-05-13 21:28 - 2015-05-13 21:28 - 00000000 ____D C:\Program Files (x86)\Microsoft SDKs
2015-05-13 21:27 - 2015-05-13 21:27 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\XVL Player (Ver. 9 or later) 64-bit Edition
2015-05-13 21:25 - 2015-05-13 21:27 - 00000000 ____D C:\Program Files\Lattice
2015-05-13 21:25 - 2015-05-13 21:27 - 00000000 ____D C:\Program Files (x86)\Lattice
2015-05-13 21:23 - 2015-05-13 21:25 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CorelDRAW Technical Suite X6 (64-Bit)
2015-05-13 20:18 - 2015-05-13 20:18 - 00000000 ____D C:\Users\Qassim\Documents\My Palettes
2015-05-13 20:16 - 2015-05-13 21:29 - 00000000 ____D C:\Users\Qassim\Documents\Corel
2015-05-13 20:16 - 2015-05-13 21:29 - 00000000 ____D C:\Users\Qassim\AppData\Roaming\Corel
2015-05-13 20:14 - 2015-05-13 20:14 - 00000000 ____D C:\Program Files\Common Files\Corel
2015-05-13 20:13 - 2015-05-13 21:23 - 00000000 ____D C:\Users\Public\Documents\Corel
2015-05-13 20:13 - 2015-05-13 20:13 - 00000000 ____D C:\Program Files\Common Files\Protexis
2015-05-13 20:12 - 2015-05-13 21:29 - 00000000 ____D C:\ProgramData\Corel
2015-05-13 20:12 - 2015-05-13 20:15 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CorelDRAW Graphics Suite X7 (64-bit)
2015-05-13 20:12 - 2015-05-13 20:12 - 00000000 ____D C:\Program Files\Corel
2015-05-13 19:17 - 2015-05-13 19:17 - 00000000 ____D C:\Users\Qassim\AppData\Local\Akamai

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-06-12 18:45 - 2015-01-19 07:10 - 01236894 _____ C:\Windows\WindowsUpdate.log
2015-06-12 18:38 - 2013-08-22 07:36 - 00006656 _____ C:\Windows\system32\lpcio.dll
2015-06-12 18:36 - 2015-01-19 07:13 - 00000920 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-06-12 18:36 - 2015-01-19 06:56 - 00005388 _____ C:\Windows\system32\PerfStringBackup.INI
2015-06-12 18:32 - 2015-01-19 07:13 - 00000916 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-06-12 18:31 - 2015-04-07 16:15 - 00065536 _____ C:\Windows\system32\spu_storage.bin
2015-06-12 18:31 - 2013-08-22 10:45 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2015-06-12 18:02 - 2015-01-19 07:15 - 00000000 ____D C:\Program Files (x86)\Steam
2015-06-12 18:00 - 2013-08-22 11:36 - 00000000 ____D C:\Windows\system32\sru
2015-06-12 15:11 - 2015-01-19 06:56 - 00003600 _____ C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-2302587062-3611041661-3303187194-1001
2015-06-12 14:38 - 2015-01-19 06:41 - 00011770 _____ C:\Windows\PFRO.log
2015-06-12 13:24 - 2015-01-19 08:09 - 00000000 ____D C:\Windows\Minidump
2015-06-12 13:24 - 2015-01-19 08:08 - 238539223 _____ C:\Windows\MEMORY.DMP
2015-06-12 01:39 - 2015-02-15 20:15 - 00000000 ____D C:\Users\Qassim\AppData\Roaming\Skype
2015-06-11 19:48 - 2015-04-13 19:27 - 00000080 _____ C:\Users\Qassim\AppData\Local剜捯獫慴⁲慇敭屳呇⁁屖湥楴汴浥湥⹴湩潦
2015-06-11 18:57 - 2013-08-22 09:25 - 00262144 ___SH C:\Windows\system32\config\BBI
2015-06-11 18:56 - 2015-01-19 07:39 - 00000000 ____D C:\ProgramData\AMD
2015-06-11 18:56 - 2015-01-19 07:38 - 00000000 ____D C:\Program Files\AMD
2015-06-11 18:55 - 2013-08-22 10:46 - 00016247 _____ C:\Windows\setupact.log
2015-06-11 18:52 - 2015-01-19 07:37 - 00000000 ____D C:\AMD
2015-06-11 18:18 - 2015-04-13 19:27 - 00000000 ____D C:\Program Files (x86)\Rockstar Games
2015-06-11 18:17 - 2015-04-13 19:27 - 00000000 ____D C:\Program Files\Rockstar Games
2015-06-10 18:04 - 2015-01-19 13:21 - 00000600 _____ C:\Users\Qassim\PUTTY.RND
2015-06-10 18:04 - 2015-01-19 13:21 - 00000000 ____D C:\Users\Qassim\Documents\utmp
2015-06-10 16:06 - 2015-01-19 13:29 - 00000000 ____D C:\Users\Qassim\AppData\Roaming\uTorrent
2015-06-09 22:19 - 2015-01-19 08:40 - 00000000 ____D C:\Users\Qassim\Documents\My Games
2015-06-08 14:54 - 2015-01-19 13:22 - 00000228 _____ C:\Users\Qassim\Documents\u.ini
2015-06-07 16:33 - 2015-03-18 20:50 - 00000000 ____D C:\Users\Qassim\AppData\Roaming\vlc
2015-06-02 22:05 - 2015-01-19 06:51 - 00000000 ____D C:\Users\Qassim\AppData\Local\Packages
2015-06-02 14:33 - 2013-08-22 11:20 - 00000000 ____D C:\Windows\CbsTemp
2015-06-02 06:28 - 2015-01-19 07:13 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2015-06-02 06:28 - 2015-01-19 07:13 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight
2015-06-01 23:27 - 2015-02-05 20:22 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2013
2015-06-01 23:27 - 2015-02-05 20:18 - 00000000 ____D C:\ProgramData\Microsoft Help
2015-06-01 23:24 - 2015-02-05 21:03 - 00000000 ____D C:\Windows\system32\MRT
2015-06-01 23:20 - 2013-08-22 09:25 - 00000167 _____ C:\Windows\win.ini
2015-06-01 23:18 - 2015-01-19 07:14 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2015-05-30 14:11 - 2015-02-16 18:48 - 00000000 ____D C:\Users\Qassim\Documents\Paradox Interactive
2015-05-30 14:09 - 2015-01-31 19:37 - 00000000 ____D C:\Games
2015-05-28 00:00 - 2015-01-19 06:51 - 00000000 ____D C:\Users\Qassim
2015-05-26 22:28 - 2015-01-19 07:13 - 00000000 ____D C:\Program Files (x86)\Google
2015-05-26 18:41 - 2015-03-31 16:46 - 00126848 _____ (Advanced Micro Devices, Inc. ) C:\Windows\SysWOW64\atiuxpag.dll
2015-05-26 18:41 - 2014-11-20 22:44 - 01359752 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\aticfx64.dll
2015-05-26 18:41 - 2014-11-20 22:44 - 00144328 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\atiuxp64.dll
2015-05-26 18:41 - 2014-11-20 22:44 - 00118096 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\atiu9p64.dll
2015-05-26 18:40 - 2015-03-31 16:46 - 09411256 _____ (Advanced Micro Devices, Inc. ) C:\Windows\SysWOW64\atidxx32.dll
2015-05-26 18:40 - 2015-03-31 16:46 - 01136736 _____ (Advanced Micro Devices, Inc. ) C:\Windows\SysWOW64\aticfx32.dll
2015-05-26 18:40 - 2014-11-20 22:44 - 11089120 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\atidxx64.dll
2015-05-26 18:28 - 2015-03-31 16:33 - 47902208 _____ (Advanced Micro Devices Inc.) C:\Windows\system32\amdocl64.dll
2015-05-26 18:26 - 2015-03-31 16:32 - 00065024 _____ (Khronos Group) C:\Windows\system32\OpenCL.dll
2015-05-26 18:25 - 2015-03-31 16:30 - 07915520 _____ (Advanced Micro Devices Inc.) C:\Windows\system32\amdhsasc64.dll
2015-05-26 18:15 - 2015-03-31 16:20 - 23626752 _____ (Advanced Micro Devices, Inc.) C:\Windows\SysWOW64\atioglxx.dll
2015-05-26 18:05 - 2014-11-20 22:10 - 00846848 _____ (AMD) C:\Windows\system32\coinst_14.50.dll
2015-05-26 18:04 - 2015-03-31 16:09 - 00905728 _____ (Advanced Micro Devices, Inc.) C:\Windows\SysWOW64\atiadlxy.dll
2015-05-26 18:04 - 2015-03-31 16:09 - 00146944 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\atig6txx.dll
2015-05-26 18:04 - 2015-03-31 16:09 - 00069632 _____ (Advanced Micro Devices, Inc. ) C:\Windows\SysWOW64\atiglpxx.dll
2015-05-26 18:03 - 2015-03-31 16:09 - 00133632 _____ (Advanced Micro Devices, Inc. ) C:\Windows\SysWOW64\atigktxx.dll
2015-05-25 14:17 - 2013-08-22 11:36 - 00000000 ____D C:\Windows\AppReadiness
2015-05-23 13:01 - 2015-01-22 07:05 - 00000000 ____D C:\Users\Qassim\Documents\Rockstar Games
2015-05-22 08:46 - 2015-01-19 08:40 - 00572122 _____ C:\Windows\DirectX.log
2015-05-20 22:59 - 2015-01-19 06:57 - 00000000 ____D C:\Users\Qassim\Documents\Telltale Games
2015-05-19 14:31 - 2015-01-19 07:13 - 00003892 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2015-05-19 14:31 - 2015-01-19 07:13 - 00003656 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2015-05-16 13:42 - 2015-04-19 21:27 - 00000000 ____D C:\Users\Qassim\Documents\My Cheat Tables
2015-05-14 14:16 - 2013-08-22 10:44 - 05112632 _____ C:\Windows\system32\FNTCACHE.DAT
2015-05-13 21:27 - 2015-01-19 08:05 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2015-05-13 21:25 - 2013-08-22 11:36 - 00000000 ____D C:\Program Files\Common Files\microsoft shared
2015-05-13 20:14 - 2015-01-19 07:39 - 00000000 ____D C:\ProgramData\Package Cache

==================== Files in the root of some directories =======

2015-04-27 16:36 - 2015-04-27 16:36 - 0000000 ___SH () C:\Users\Qassim\AppData\Local\LumaEmu

Some files in TEMP:
====================
C:\Users\Qassim\AppData\Local\Temp\AutoDetectUtilApp.exe
C:\Users\Qassim\AppData\Local\Temp\dllnt_dump.dll
C:\Users\Qassim\AppData\Local\Temp\drm_dyndata_7370014.dll
C:\Users\Qassim\AppData\Local\Temp\drm_dyndata_7380014.dll
C:\Users\Qassim\AppData\Local\Temp\drm_dyndata_7410004.dll
C:\Users\Qassim\AppData\Local\Temp\ose00000.exe
C:\Users\Qassim\AppData\Local\Temp\Quarantine.exe
C:\Users\Qassim\AppData\Local\Temp\raptrpatch.exe
C:\Users\Qassim\AppData\Local\Temp\raptr_stub.exe
C:\Users\Qassim\AppData\Local\Temp\sqlite3.dll
C:\Users\Qassim\AppData\Local\Temp\SRLDetectionLibrary2803185078105024996.dll


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-06-03 12:20

==================== End of log ============================

 

[qassimnm]

Addition:
Additional scan result of Farbar Recovery Scan Tool (x64) Version:08-06-2015
Ran by Qassim at 2015-06-12 18:49:11
Running from C:\Users\Qassim\Downloads
Boot Mode: Normal
==========================================================


==================== Accounts: =============================

Administrator (S-1-5-21-2302587062-3611041661-3303187194-500 - Administrator - Disabled)
Guest (S-1-5-21-2302587062-3611041661-3303187194-501 - Limited - Disabled)
Qassim (S-1-5-21-2302587062-3611041661-3303187194-1001 - Administrator - Enabled) => C:\Users\Qassim

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

µTorrent (HKU\S-1-5-21-2302587062-3611041661-3303187194-1001\...\uTorrent) (Version: 3.4.3.40298 - BitTorrent Inc.)
A.V.A - Alliance of Valiant Arms (HKLM-x32\...\Steam App 102700) (Version: - RED DUCK Inc.)
ACP Application (Version: 2.15.10.0003 - Advanced Micro Devices, Inc.) Hidden
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 16.0.0.245 - Adobe Systems Incorporated)
Adobe Community Help (HKLM-x32\...\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1) (Version: 3.0.0.400 - Adobe Systems Incorporated)
Adobe Media Player (HKLM-x32\...\com.adobe.amp.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1) (Version: 1.8 - Adobe Systems Incorporated)
Adobe Photoshop CS5 (HKLM-x32\...\{15FEDA5F-141C-4127-8D7E-B962D1742728}) (Version: 12.0 - Adobe Systems Incorporated)
Adobe Shockwave Player 12.1 (HKLM-x32\...\Adobe Shockwave Player) (Version: 12.1.6.156 - Adobe Systems, Inc.)
Akamai NetSession Interface (HKU\S-1-5-21-2302587062-3611041661-3303187194-1001\...\Akamai) (Version: - Akamai Technologies, Inc)
Alien: Isolation (HKLM-x32\...\Steam App 214490) (Version: - Creative Assembly)
AMD Catalyst Install Manager (HKLM\...\{66AD7978-00EE-AE61-889B-CC68818C0135}) (Version: 8.0.916.0 - Advanced Micro Devices, Inc.)
AMDProductVerification (HKU\S-1-5-21-2302587062-3611041661-3303187194-1001\...\4ecb547ba21a923a) (Version: 1.0.25.99 - AMDProductVerification)
Arma 2 (HKLM-x32\...\Steam App 33910) (Version: - Bohemia Interactive)
Arma 3 (HKLM-x32\...\Steam App 107410) (Version: - Bohemia Interactive)
Battlefield 3™ (HKLM-x32\...\{76285C16-411A-488A-BCE3-C83CB933D8CF}) (Version: 1.6.0.0 - Electronic Arts)
Battlefield™ Hardline Beta (HKLM-x32\...\{F5526D9D-13AD-4270-8707-AC921D168299}) (Version: 1.0.0.1 - Electronic Arts)
Battlelog Web Plugins (HKLM-x32\...\Battlelog Web Plugins) (Version: 2.7.0 - EA Digital Illusions CE AB)
Besiege (HKLM-x32\...\Steam App 346010) (Version: - Spiderling Studios)
Borderlands 2 (HKLM-x32\...\Steam App 49520) (Version: - Gearbox Software)
Call of Duty: Modern Warfare 3 - Multiplayer (HKLM-x32\...\Steam App 42690) (Version: - Infinity Ward)
Call of Duty: Modern Warfare 3 (HKLM-x32\...\Steam App 42680) (Version: - Infinity Ward)
CGS17_Setup_x64 (Version: 17.2 - Corel Corporation) Hidden
Cheat Engine 6.4 (HKLM-x32\...\Cheat Engine 6.4_is1) (Version: - Cheat Engine)
Chrome Remote Desktop Host (HKLM-x32\...\{A1A724F3-F1A6-479C-AE98-208946717E2B}) (Version: 42.0.2311.39 - Google Inc.)
Corel Graphics - Windows Shell Extension (HKLM-x32\...\_{F2F3159D-0717-4E4E-909E-07D11ADF9D3E}) (Version: 17.2.0.688 - Corel Corporation)
Corel Graphics - Windows Shell Extension (x32 Version: 17.2.688 - Corel Corporation) Hidden
Corel Graphics - Windows Shell Extension 32 Bit (Version: 17.2.688 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X7 - BR (x64) (Version: 17.2 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X7 - Capture (x64) (Version: 17.2 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X7 - Common (x64) (Version: 17.2 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X7 - Connect (x64) (Version: 17.2 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X7 - CS (x64) (Version: 17.2 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X7 - CT (x64) (Version: 17.2 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X7 - Custom Data (x64) (Version: 17.2 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X7 - CZ (x64) (Version: 17.2 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X7 - DE (x64) (Version: 17.2 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X7 - Draw (x64) (Version: 17.2 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X7 - EN (x64) (Version: 17.2 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X7 - ES (x64) (Version: 17.2 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X7 - Filters (x64) (Version: 17.2 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X7 - FontNav (x64) (Version: 17.2 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X7 - FR (x64) (Version: 17.2 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X7 - IPM (x64) (Version: 17.2 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X7 - IPM Content (x64) (Version: 17.0 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X7 - IT (x64) (Version: 17.2 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X7 - JP (x64) (Version: 17.2 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X7 - NL (x64) (Version: 17.2 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X7 - PHOTO-PAINT (x64) (Version: 17.2 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X7 - Photozoom Plugin (x64) (Version: 17.0 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X7 - PL (x64) (Version: 17.2 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X7 - Redist (x64) (Version: 17.0 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X7 - RU (x64) (Version: 17.2 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X7 - Setup Files (x64) (Version: 17.2 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X7 - VBA (x64) (Version: 17.2 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X7 - VideoBrowser (x64) (Version: 17.2 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X7 - Writing Tools (x64) (Version: 17.2 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X7 (64-Bit) (HKLM\...\_{5CB73140-806C-42C6-A05A-1AFD0E92DEB5}) (Version: 17.2.0.688 - Corel Corporation)
CorelDRAW Technical Suite X6 - Capture (x64) (Version: 16.4 - Corel Corporation) Hidden
CorelDRAW Technical Suite X6 - Common (x64) (Version: 16.4 - Corel Corporation) Hidden
CorelDRAW Technical Suite X6 - Common Apps (x64) (Version: 16.4 - Corel Corporation) Hidden
CorelDRAW Technical Suite X6 - Connect (x64) (Version: 16.4 - Corel Corporation) Hidden
CorelDRAW Technical Suite X6 - Core (x64) (Version: 16.4 - Corel Corporation) Hidden
CorelDRAW Technical Suite X6 - Custom Data (x64) (Version: 16.4 - Corel Corporation) Hidden
CorelDRAW Technical Suite X6 - DE (x64) (Version: 16.4 - Corel Corporation) Hidden
CorelDRAW Technical Suite X6 - Designer (x64) (Version: 16.4 - Corel Corporation) Hidden
CorelDRAW Technical Suite X6 - Draw (x64) (Version: 16.4 - Corel Corporation) Hidden
CorelDRAW Technical Suite X6 - EN (x64) (Version: 16.4 - Corel Corporation) Hidden
CorelDRAW Technical Suite X6 - Filters (x64) (Version: 16.4 - Corel Corporation) Hidden
CorelDRAW Technical Suite X6 - FontNav (x64) (Version: 16.4 - Corel Corporation) Hidden
CorelDRAW Technical Suite X6 - FR (x64) (Version: 16.4 - Corel Corporation) Hidden
CorelDRAW Technical Suite X6 - IPM (x64) (Version: 16.4 - Corel Corporation) Hidden
CorelDRAW Technical Suite X6 - IPM Content (x64) (Version: 16.4 - Corel Corporation) Hidden
CorelDRAW Technical Suite X6 - IPM Lattice (x64) (Version: 16.0 - Corel Corporation) Hidden
CorelDRAW Technical Suite X6 - PHOTO-PAINT (x64) (Version: 16.4 - Corel Corporation) Hidden
CorelDRAW Technical Suite X6 - Photozoom Plugin (x64) (Version: 16.4 - Corel Corporation) Hidden
CorelDRAW Technical Suite X6 - Redist (x64) (Version: 16.4 - Corel Corporation) Hidden
CorelDRAW Technical Suite X6 - Setup Files (x64) (Version: 16.4 - Corel Corporation) Hidden
CorelDRAW Technical Suite X6 - VBA (x64) (Version: 16.4 - Corel Corporation) Hidden
CorelDRAW Technical Suite X6 - VideoBrowser (x64) (Version: 16.4 - Corel Corporation) Hidden
CorelDRAW Technical Suite X6 - VSTA (x64) (Version: 16.4 - Corel Corporation) Hidden
CorelDRAW Technical Suite X6 - Writing Tools (x64) (Version: 16.4 - Corel Corporation) Hidden
CorelDRAW Technical Suite X6 (64-Bit) (HKLM\...\_{E2FC299D-38D5-424F-BAB8-D24E07A3A58A}) (Version: 16.3.0.1114 - Corel Corporation)
Counter-Strike: Global Offensive (HKLM-x32\...\Steam App 730) (Version: - Valve)
DayZ (HKLM-x32\...\Steam App 221100) (Version: - Bohemia Interactive)
Dead Island (HKLM-x32\...\Steam App 91310) (Version: - Techland)
Dead Rising 3 (HKLM-x32\...\Steam App 265550) (Version: - Capcom Game Studio Vancouver)
Dishonored - Game of the Year Edition (HKLM-x32\...\Dishonored - Game of the Year Edition_R.G. Mechanics_is1) (Version: - R.G. Mechanics, Panky)
Europa Universalis IV ver. 1.9.2.0 (HKLM-x32\...\{01109877-10HG-49DR-11F5-43DD6F7886AC}_is1) (Version: 1.9.2.0 - Paradox Interactive)
Fallout (HKLM-x32\...\GOGPACKFALLOUT_is1) (Version: 2.0.0.14 - GOG.com)
Fallout 3 - Game of the Year Edition (HKLM-x32\...\Steam App 22370) (Version: - Bethesda Game Studios)
Fallout 3 - The Garden of Eden Creation Kit (HKLM-x32\...\{B343B0E3-212A-40B9-8207-1BD299228F5D}) (Version: 1.00.0000 - Bethesda Softworks)
Fallout Mod Manager 0.13.21 (HKLM-x32\...\Generic Mod Manager_is1) (Version: - Q, Timeslip)
Fallout: New Vegas (HKLM-x32\...\Steam App 22380) (Version: - Obsidian Entertainment)
Game of Thrones - A Telltale Games Series (HKLM-x32\...\Game of Thrones - A Telltale Games Series_is1) (Version: - Telltale Games)
Game of Thrones A Telltale Games Series (HKLM-x32\...\Game of Thrones A Telltale Games Series_is1) (Version: - )
Garry's Mod (HKLM-x32\...\Steam App 4000) (Version: - Facepunch Studios)
GOG Galaxy (HKLM-x32\...\{7258BA11-600C-430E-A759-27E2C691A335}_is1) (Version: - GOG.com)
Google Chrome (HKLM-x32\...\{7335F348-64B4-3072-97D9-A1A55029C59C}) (Version: 66.30.49251 - Google, Inc.)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.27.5 - Google Inc.) Hidden
Grand Theft Auto V (HKLM-x32\...\Steam App 271590) (Version: - Rockstar North)
Grand Theft Auto: San Andreas (HKLM-x32\...\Steam App 12120) (Version: - Rockstar Games)
Half-Life (HKLM-x32\...\Steam App 70) (Version: - Valve)
Half-Life 2 (HKLM-x32\...\Steam App 220) (Version: - Valve)
Half-Life 2: Update (HKLM-x32\...\Steam App 290930) (Version: - Filip Victor)
Hitman: Absolution (HKLM-x32\...\Steam App 203140) (Version: - IO Interactive)
Insurgency (HKLM-x32\...\Steam App 222880) (Version: - New World Interactive)
Intel(R) C++ Redistributables for Windows* on Intel(R) 64 (HKLM-x32\...\{D2437C5C-2D8C-40D2-8059-689AD7239FA3}) (Version: 11.1.048 - Intel Corporation)
Java 8 Update 25 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86418025F0}) (Version: 8.0.250 - Oracle Corporation)
Java 8 Update 25 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218025F0}) (Version: 8.0.250 - Oracle Corporation)
KMSpico v9.1.3 (HKLM\...\KMSpico_is1) (Version: 9.1.3 - )
Left 4 Dead 2 (HKLM-x32\...\Steam App 550) (Version: - Valve)
LogMeIn Hamachi (HKLM-x32\...\LogMeIn Hamachi) (Version: 2.2.0.328 - LogMeIn, Inc.)
LogMeIn Hamachi (x32 Version: 2.2.0.328 - LogMeIn, Inc.) Hidden
Malwarebytes Anti-Malware version 2.1.6.1022 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.1.6.1022 - Malwarebytes Corporation)
Mediatek RT2870 Wireless LAN Card (HKLM-x32\...\{28DA7D8B-F9A4-4F18-8AA0-551B1E084D0D}) (Version: 1.5.39.93 - MediatekWiFi)
Men of War: Assault Squad (HKLM-x32\...\Steam App 64000) (Version: - Digitalmindsoft)
Metro 2033 (HKLM-x32\...\Steam App 43110) (Version: - 4A Games)
Microsoft Chart Controls for Microsoft .NET Framework 3.5 (HKLM-x32\...\{41785C66-90F2-40CE-8CB5-1C94BFC97280}) (Version: 3.5.0.0 - Microsoft Corporation)
Microsoft Games for Windows - LIVE Redistributable (HKLM-x32\...\{42AA4CA8-DCD8-4308-BCAB-0B6D75856A9D}) (Version: 3.5.95.0 - Microsoft Corporation)
Microsoft Games for Windows Marketplace (HKLM-x32\...\{67F42018-F647-4D3C-BE62-F8CB4FE2FCD5}) (Version: 3.5.67.0 - Microsoft Corporation)
Microsoft Office Professional Plus 2013 (HKLM\...\Office15.PROPLUS) (Version: 15.0.4420.1017 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.40416.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (HKLM-x32\...\{050d4fc8-5d48-4b8f-8972-47c82c46020f}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM-x32\...\{f65db027-aff3-4070-886a-0d87064aabb1}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
Microsoft Visual Studio Tools for Applications 2.0 - ENU (HKLM-x32\...\{AA4A4B2C-0465-3CF8-BA76-27A027D8ACAB}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual Studio Tools for Applications 2.0 Runtime (HKLM-x32\...\{299C0434-4F4E-341F-A916-4E07AEB35E79}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual Studio Tools for Applications 2012 (HKLM-x32\...\{89ca2a32-2b52-4595-8dfd-6fe4757958d0}) (Version: 11.0.51108 - Microsoft Corporation)
Mirror's Edge™ (HKLM-x32\...\{AEDBD563-24BB-4EE3-8366-A654DAC2D988}) (Version: 1.0.1.0 - Electronic Arts)
Mozilla Firefox 35.0 (x86 en-US) (HKLM-x32\...\Mozilla Firefox 35.0 (x86 en-US)) (Version: 35.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 35.0 - Mozilla)
Next Car Game Technology Sneak Peek 2.0 (HKLM-x32\...\Next Car Game Technology Sneak Peek) (Version: - Bugbear Entertainment)
Nexus Mod Manager (HKLM\...\6af12c54-643b-4752-87d0-8335503010de_is1) (Version: 0.54.10 - Black Tree Gaming)
NVIDIA PhysX (HKLM-x32\...\{8B922CF8-8A6C-41CE-A858-F1755D7F5D29}) (Version: 9.12.1031 - NVIDIA Corporation)
OpenAL (HKLM-x32\...\OpenAL) (Version: - )
Outils de vérification linguistique 2013 de Microsoft Office - Français (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden
Pacote de Idiomas do Microsoft Visual Studio Tools for Applications 2012 x64 Hosting Support - PTB (Version: 11.0.51108 - Microsoft Corporation) Hidden
Pacote de Idiomas do Microsoft Visual Studio Tools for Applications 2012 x86 Hosting Support - PTB (x32 Version: 11.0.51108 - Microsoft Corporation) Hidden
PAYDAY: The Heist (HKLM-x32\...\Steam App 24240) (Version: - OVERKILL Software)
PDF Settings CS5 (x32 Version: 10.0 - Adobe Systems Incorporated) Hidden
Portal (HKLM-x32\...\Steam App 400) (Version: - Valve)
Portal 2 (HKLM-x32\...\Steam App 620) (Version: - Valve)
PowerISO (HKLM-x32\...\PowerISO) (Version: 6.1 - Power Software Ltd)
PunkBuster Services (HKLM-x32\...\PunkBusterSvc) (Version: 0.991 - Even Balance, Inc.)
Python 3.4.2 (HKLM-x32\...\{2583CDBA-8A53-4622-BB67-1D163714C1B4}) (Version: 3.4.16349 - Python Software Foundation)
Rockstar Games Social Club (HKLM-x32\...\Rockstar Games Social Club) (Version: 1.1.6.0 - Rockstar Games)
Runtime VS2005 SP1 CRT 6195 (x32 Version: 0 - Lattice Technology Co.,Ltd.) Hidden
Runtime VS2005 SP1 MFC 6195 (x32 Version: 0 - Lattice Technology Co.,Ltd.) Hidden
Runtime VS2005 SP1 x64 All 6195 (x32 Version: 0 - Lattice Technology Co.,Ltd.) Hidden
Runtime VS2005 SP1 x64 CRT 6195 (x32 Version: 0 - Lattice Technology Co.,Ltd.) Hidden
Runtime VS2005 SP1 x64 CRT 762 (x32 Version: 0 - Lattice Technology Co.,Ltd.) Hidden
Runtime VS2005 SP1 x64 MFC 6195 (x32 Version: 0 - Lattice Technology Co.,Ltd.) Hidden
Runtime VS2005 SP1 x64 OpenMP 762 (x32 Version: 0 - Lattice Technology Co.,Ltd.) Hidden
Runtime VS2008 CRT 1 (x32 Version: 0 - Lattice Technology Co.,Ltd.) Hidden
Runtime VS2008 x64 CRT 1 (x32 Version: 0 - Lattice Technology Co.,Ltd.) Hidden
Saints Row IV (HKLM-x32\...\Saints Row IV1.0.0.1) (Version: 1.0.0.1 - Joker_RETURNS)
Setup - Assassin's Creed Rogue (c) Ubisoft ... (HKLM-x32\...\Setup - Assassin's Creed Rogue (c) Ubisoft ...) (Version: ... - Ubisoft Entertainment)
Sid Meier's Civilization: Beyond Earth (HKLM-x32\...\Steam App 65980) (Version: - Firaxis Games)
Skype™ 7.1 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.1.105 - Skype Technologies S.A.)
Sleeping Dogs™ (HKLM-x32\...\Steam App 202170) (Version: - United Front Games)
State of Decay - Breakdown (HKLM-x32\...\State of Decay - Breakdown_is1) (Version: - )
Steam (HKLM-x32\...\Steam) (Version: 2.10.91.91 - Valve Corporation)
Surgeon Simulator (HKLM-x32\...\Steam App 233720) (Version: - Bossa Studios)
swMSM (x32 Version: 12.0.0.1 - Adobe Systems, Inc) Hidden
System Requirements Lab (HKLM-x32\...\{0F659036-14C7-4622-9505-35A0DC93526A}) (Version: 6.1.3.0 - Husdawg, LLC)
System Requirements Lab Detection (HKLM-x32\...\{059F6DDA-423B-4808-B300-FBF849A9E455}) (Version: 2.2.4.0 - Husdawg, LLC)
Team Fortress 2 (HKLM-x32\...\Steam App 440) (Version: - Valve)
The Elder Scrolls III: Morrowind (HKLM-x32\...\Steam App 22320) (Version: - Bethesda Game Studios®)
The Elder Scrolls V: Skyrim (HKLM-x32\...\Steam App 72850) (Version: - Bethesda Game Studios)
The Long Dark (HKLM-x32\...\The Long Dark_is1) (Version: v.192 - Релиз от R.G. Steamgames)
The Witcher 2 - Assassins of Kings Enhanced Edition (HKLM-x32\...\1207658930_is1) (Version: 3.5.0.26 - GOG.com)
Total War Rome II / RePack by Baracuda (HKLM-x32\...\Total War Rome II_is1) (Version: 2.2.0 - )
Tropico 5 Waterborne (HKLM-x32\...\Tropico 5 Waterborne_is1) (Version: - )
Unturned (HKLM-x32\...\Steam App 304930) (Version: - Nelson Sexton)
Update for Skype for Business 2015 (KB2889853) 64-Bit Edition (HKLM\...\{90150000-012B-0409-1000-0000000FF1CE}_Office15.PROPLUS_{40930C8E-A677-414C-A72F-DFDEB10738FB}) (Version: - Microsoft)
VLC media player (HKLM-x32\...\VLC media player) (Version: 2.2.0 - VideoLAN)
War Thunder (HKLM-x32\...\Steam App 236390) (Version: - Gaijin Entertainment)
WinRAR 5.20 (64-bit) (HKLM\...\WinRAR archiver) (Version: 5.20.0 - win.rar GmbH)
Wolfenstein - The Old Blood (HKLM-x32\...\Wolfenstein - The Old Blood_R.G. Mechanics_is1) (Version: - R.G. Mechanics, spider91)
Wolfenstein.The New Order.v 1.0.0.1 (HKLM-x32\...\Wolfenstein.The New Order.v 1.0.0.1_is1) (Version: Wolfenstein.The New Order.v 1.0.0.1 - Repack by Fenixx (21.05.2014))
XVL Player / XVL Player Pro (Ver. 9 or later) 64-bit Edition (HKLM-x32\...\{936575FE-E49B-4CE9-9934-0329727476C8}) (Version: 12.1a - Lattice Technology)
XVL Studio 3D Corel Edition x64 (HKLM-x32\...\{137926AA-703D-4382-81A7-BD30EDAFB6C9}) (Version: 1.0 - Lattice Technology)
Языковой пакет для поддержки размещения набора средств Microsoft Visual Studio Tools для работы с приложениями 2012 (x64) - RUS (Version: 11.0.51108 - Microsoft Corporation) Hidden
Языковой пакет для поддержки размещения набора средств Microsoft Visual Studio Tools для работы с приложениями 2012 (x86) - RUS (x32 Version: 11.0.51108 - Microsoft Corporation) Hidden

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== Restore Points =========================

26-05-2015 22:28:01 Installed Chrome Remote Desktop Host
01-06-2015 23:06:30 Windows Update
10-06-2015 12:51:02 Scheduled Checkpoint
11-06-2015 19:44:20 Checkpoint by HitmanPro

==================== Hosts content: ===============================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2013-08-22 09:25 - 2013-08-22 09:25 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {505E228C-BD62-45D2-8D0A-E953987B3F45} - System32\Tasks\Microsoft\Office\Office 15 Subscription Heartbeat => C:\Program Files\Common Files\Microsoft Shared\Office15\OLicenseHeartbeat.exe [2012-10-01] (Microsoft Corporation)
Task: {7638B86A-071B-4C8B-A05F-A35E20153A90} - System32\Tasks\AutoPico Daily Restart => C:\Program Files\KMSpico\AutoPico.exe [2013-12-11] ()
Task: {B5ECE902-EEB5-4AF6-BA28-FEBA61530412} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack => C:\Program Files\Microsoft Office\Office15\msoia.exe [2012-10-01] (Microsoft Corporation)
Task: {BD4763D0-C46D-4BBE-883E-CBC29A6ED2D2} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn => C:\Program Files\Microsoft Office\Office15\msoia.exe [2012-10-01] (Microsoft Corporation)
Task: {BF8311F2-1848-490E-90AF-4D59D526F282} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-01-19] (Google Inc.)
Task: {DC7960F1-FC70-403A-BC36-9E64DDDE88B7} - \Origin No Task File <==== ATTENTION
Task: {F3037A15-FF13-4167-BCA0-B9BB1D9ABB14} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\Windows\system32\MRT.exe [2015-04-30] (Microsoft Corporation)
Task: {F57A4B98-CCB2-459B-85BF-689EA65154DD} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-01-19] (Google Inc.)
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (Whitelisted) ==============

2015-01-21 15:01 - 2015-01-21 15:01 - 08898728 _____ () C:\Program Files\Microsoft Office\Office15\1033\GrooveIntlResource.dll
2015-01-18 09:59 - 2012-12-22 08:31 - 00147456 _____ () C:\Program Files (x86)\Standard Mouse Driver\Monitor.EXE
2015-01-18 09:59 - 2012-12-20 14:05 - 00045056 _____ () C:\Program Files (x86)\Standard Mouse Driver\lan.dll
2015-01-18 09:59 - 2012-08-30 14:24 - 00061440 _____ () C:\Program Files (x86)\Standard Mouse Driver\hiddriver.dll
2015-06-09 21:38 - 2015-06-05 14:22 - 01281864 _____ () C:\Program Files (x86)\Google\Chrome\Application\43.0.2357.124\libglesv2.dll
2015-06-09 21:38 - 2015-06-05 14:22 - 00080712 _____ () C:\Program Files (x86)\Google\Chrome\Application\43.0.2357.124\libegl.dll
2015-06-09 21:38 - 2015-06-05 14:22 - 15003464 _____ () C:\Program Files (x86)\Google\Chrome\Application\43.0.2357.124\PepperFlash\pepflashplayer.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)


==================== Safe Mode (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Hamachi2Svc => ""="Service"

==================== EXE Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)


==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-2302587062-3611041661-3303187194-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\Qassim\Pictures\FO4.png
DNS Servers: 192.168.1.1

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

MSCONFIG\Services: gupdate => 2
MSCONFIG\Services: gupdatem => 3
MSCONFIG\Services: MozillaMaintenance => 3
MSCONFIG\Services: Origin Client Service => 3
MSCONFIG\Services: Steam Client Service => 3
MSCONFIG\Services: SwitchBoard => 3
HKLM\...\StartupApproved\Run: => "AdobeAAMUpdater-1.0"
HKLM\...\StartupApproved\Run32: => "SunJavaUpdateSched"
HKLM\...\StartupApproved\Run32: => "AdobeCS5ServiceManager"
HKLM\...\StartupApproved\Run32: => "SwitchBoard"
HKLM\...\StartupApproved\Run32: => "PWRISOVM.EXE"
HKLM\...\StartupApproved\Run32: => "Raptr"
HKU\S-1-5-21-2302587062-3611041661-3303187194-1001\...\StartupApproved\Run: => "uTorrent"
HKU\S-1-5-21-2302587062-3611041661-3303187194-1001\...\StartupApproved\Run: => "GoogleChromeAutoLaunch_2F7B80428691697817EAB415D398FFCC"
HKU\S-1-5-21-2302587062-3611041661-3303187194-1001\...\StartupApproved\Run: => "Steam"
HKU\S-1-5-21-2302587062-3611041661-3303187194-1001\...\StartupApproved\Run: => "Skype"

 

[qassimnm]

Addition continued:
==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139
FirewallRules: [SPPSVC-In-TCP] => (Allow) %SystemRoot%\system32\sppextcomobj.exe
FirewallRules: [SPPSVC-In-TCP-NoScope] => (Allow) %SystemRoot%\system32\sppextcomobj.exe
FirewallRules: [{EF539D7D-8AE1-4BCD-A98F-4970A75FF801}] => (Allow) C:\Program Files\KMSpico\KMSELDI.exe
FirewallRules: [{8BF33EE4-0DD2-472D-926B-986F13767643}] => (Allow) C:\Program Files\KMSpico\KMSELDI.exe
FirewallRules: [{43F98D2D-2760-470C-9EDC-4C3EAFBE217E}] => (Allow) C:\Program Files\KMSpico\AutoPico.exe
FirewallRules: [{031C8758-02BF-4CA1-890A-42F15B68E05C}] => (Allow) C:\Program Files\KMSpico\AutoPico.exe
FirewallRules: [{0602B0E4-82F9-4A11-95A2-3ACFE37CE389}] => (Allow) C:\Program Files\KMSpico\Service_KMS.exe
FirewallRules: [{7268FF1E-F152-41C1-9045-5CDBBB5D6EA8}] => (Allow) C:\Program Files\KMSpico\Service_KMS.exe
FirewallRules: [{EF9EF07B-A3B7-4A40-BCD1-EEA15BBE89AC}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{90E24F12-A4F1-41D6-B993-48568CA235BE}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{10FEC69F-BD0F-4347-8321-1DFF1AD9961A}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe
FirewallRules: [{C1F2D0EC-3C4D-43F9-91DF-203588CA1704}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe
FirewallRules: [{3D005032-AEC3-47CF-970C-EE5171018C2E}] => (Allow) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
FirewallRules: [{2F42C4E1-3043-4873-B8C0-6C56D9C368CD}] => (Allow) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
FirewallRules: [{95652BDB-82A7-44E2-8AEC-B5803E3C76BA}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Skyrim\SkyrimLauncher.exe
FirewallRules: [{EA1063F2-D837-4B68-940C-C1BD1706D480}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Skyrim\SkyrimLauncher.exe
FirewallRules: [{3C90EFD4-69BC-48A8-A431-B65A0296CB3F}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Fallout New Vegas\FalloutNVLauncher.exe
FirewallRules: [{63204B98-742B-40D3-83A3-C9391B314F05}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Fallout New Vegas\FalloutNVLauncher.exe
FirewallRules: [{EF35C7DA-FFFA-4290-BF27-38FE4329CE24}] => (Allow) D:\SteamLibrary\steamapps\common\insurgency2\insurgency.exe
FirewallRules: [{FD2B4836-5FCF-4704-9DFA-EE285758519D}] => (Allow) D:\SteamLibrary\steamapps\common\insurgency2\insurgency.exe
FirewallRules: [{4CFE8448-5F70-47F7-A767-29680A0B4FEF}] => (Allow) D:\SteamLibrary\steamapps\common\Arma 3\arma3.exe
FirewallRules: [{8CF6F809-7889-444F-828C-7835ED3047AD}] => (Allow) D:\SteamLibrary\steamapps\common\Arma 3\arma3.exe
FirewallRules: [{F0209E36-8CD7-4719-96FD-9BDE52181EA2}] => (Allow) D:\SteamLibrary\steamapps\common\Arma 3\arma3launcher.exe
FirewallRules: [{B16B3F16-4162-46D9-AC79-37586B4011D4}] => (Allow) D:\SteamLibrary\steamapps\common\Arma 3\arma3launcher.exe
FirewallRules: [{E17E22DD-D6C8-4022-B7FB-84364A8CDB6D}] => (Allow) D:\SteamLibrary\steamapps\common\Alien Isolation\AI.exe
FirewallRules: [{1206FE18-7144-448F-B885-A402E4F52C83}] => (Allow) D:\SteamLibrary\steamapps\common\Alien Isolation\AI.exe
FirewallRules: [{BA44D4D5-FA31-46BF-947F-8722C451B78D}] => (Allow) D:\SteamLibrary\steamapps\common\Dead Island\DeadIslandGame.exe
FirewallRules: [{63E14CDF-B91B-48DE-8A83-EAE690197465}] => (Allow) D:\SteamLibrary\steamapps\common\Dead Island\DeadIslandGame.exe
FirewallRules: [{67476AC3-055E-4D1B-88C8-BC9A46220F9F}] => (Allow) C:\Users\Qassim\AppData\Roaming\uTorrent\uTorrent.exe
FirewallRules: [{44E19A7F-C2D3-44D8-B733-67310955AA0E}] => (Allow) C:\Users\Qassim\AppData\Roaming\uTorrent\uTorrent.exe
FirewallRules: [{BB4CF343-2B4A-42FF-97FE-BC581466761A}] => (Allow) D:\SteamLibrary\steamapps\common\deadrising3\deadrising3.exe
FirewallRules: [{9041EFE3-99F6-411E-BCD9-01CFEF5DDF3D}] => (Allow) D:\SteamLibrary\steamapps\common\deadrising3\deadrising3.exe
FirewallRules: [{EC7B99C9-C064-4603-B686-7E2D0BD190C0}] => (Allow) D:\SteamLibrary\steamapps\common\SleepingDogs\HKShip.exe
FirewallRules: [{471AB89F-29D6-44A5-AA9D-190FF9B29876}] => (Allow) D:\SteamLibrary\steamapps\common\SleepingDogs\HKShip.exe
FirewallRules: [{86D78237-FF54-4BAF-8946-5E92FB18C8CE}] => (Allow) D:\SteamLibrary\steamapps\common\DayZ\DayZ_BE.exe
FirewallRules: [{E692C876-3F32-41B8-9665-A8DA192AE486}] => (Allow) D:\SteamLibrary\steamapps\common\DayZ\DayZ_BE.exe
FirewallRules: [{B5108C8E-30FA-49C3-902B-CC4777F2BA6F}] => (Allow) D:\SteamLibrary\steamapps\common\Metro 2033\metro2033.exe
FirewallRules: [{690932AB-2F37-4888-9113-56EB05947E71}] => (Allow) D:\SteamLibrary\steamapps\common\Metro 2033\metro2033.exe
FirewallRules: [{8E866BC0-769E-49FB-B131-D68B02412EA9}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Fallout 3 goty\FalloutLauncher.exe
FirewallRules: [{2101C921-5EC2-4229-B8E8-219A580CE99E}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Fallout 3 goty\FalloutLauncher.exe
FirewallRules: [TCP Query User{C209024F-0C8A-4CB8-8EB3-14F9CB0F3E04}D:\steamlibrary\steamapps\common\grand theft auto iv\gtaiv\gtaiv.exe] => (Allow) D:\steamlibrary\steamapps\common\grand theft auto iv\gtaiv\gtaiv.exe
FirewallRules: [UDP Query User{C0700464-DE0A-4D6E-8EBB-CEE84683054A}D:\steamlibrary\steamapps\common\grand theft auto iv\gtaiv\gtaiv.exe] => (Allow) D:\steamlibrary\steamapps\common\grand theft auto iv\gtaiv\gtaiv.exe
FirewallRules: [{A418DEFD-D966-4536-8F8B-A2B6E7B1DACB}] => (Allow) D:\SteamLibrary\steamapps\common\Morrowind\Morrowind Launcher.exe
FirewallRules: [{643C14F4-AC0F-4B1F-A6A9-AC80AA9914E8}] => (Allow) D:\SteamLibrary\steamapps\common\Morrowind\Morrowind Launcher.exe
FirewallRules: [TCP Query User{7C1D9EAC-66EF-44BB-A668-B740581F81F9}D:\steamlibrary\steamapps\common\dayz\dayz.exe] => (Allow) D:\steamlibrary\steamapps\common\dayz\dayz.exe
FirewallRules: [UDP Query User{68B16091-935E-40D0-AE60-FEBE5AC4AB37}D:\steamlibrary\steamapps\common\dayz\dayz.exe] => (Allow) D:\steamlibrary\steamapps\common\dayz\dayz.exe
FirewallRules: [{2602B523-AD2E-4BB6-9D86-E6892C7FF6DB}] => (Allow) C:\Program Files\KMSpico\AutoPico.exe
FirewallRules: [{D92A1318-5D2C-43B9-AA55-18698CAC4AB5}] => (Allow) C:\Program Files\KMSpico\AutoPico.exe
FirewallRules: [{2BA94299-4C1F-4953-BBFE-40270F5003DD}] => (Allow) D:\SteamLibrary\steamapps\common\Surgeon Simulator 2013\ss2013.exe
FirewallRules: [{0324212B-D133-4196-AADE-CA12C7BC1AE5}] => (Allow) D:\SteamLibrary\steamapps\common\Surgeon Simulator 2013\ss2013.exe
FirewallRules: [{46125461-76EF-4626-B23A-339B1D490C2F}] => (Allow) D:\SteamLibrary\steamapps\common\PAYDAY The Heist\payday_win32_release.exe
FirewallRules: [{7067CDAF-70A0-4DAE-A162-257A3ABFE677}] => (Allow) D:\SteamLibrary\steamapps\common\PAYDAY The Heist\payday_win32_release.exe
FirewallRules: [{3B34315C-991A-4CE3-993C-2D7164CAF9A2}] => (Allow) D:\SteamLibrary\steamapps\common\Arma 2\arma2.exe
FirewallRules: [{49AD3660-F46C-41D2-B872-9575505F6D9D}] => (Allow) D:\SteamLibrary\steamapps\common\Arma 2\arma2.exe
FirewallRules: [{D8F6C740-DEC9-49F9-A184-032C3A7CF5F1}] => (Allow) D:\SteamLibrary\steamapps\common\Sid Meier's Civilization Beyond Earth\CivilizationBE_DX11.exe
FirewallRules: [{6BDCD32E-8F33-4712-BAAB-531887DC0E7F}] => (Allow) D:\SteamLibrary\steamapps\common\Sid Meier's Civilization Beyond Earth\CivilizationBE_DX11.exe
FirewallRules: [{4602D343-6808-4B6D-A70B-459532BF2EEF}] => (Allow) D:\SteamLibrary\steamapps\common\Sid Meier's Civilization Beyond Earth\CivilizationBE_Mantle.exe
FirewallRules: [{D637192B-F5C1-4DFB-9002-FF82E4609965}] => (Allow) D:\SteamLibrary\steamapps\common\Sid Meier's Civilization Beyond Earth\CivilizationBE_Mantle.exe
FirewallRules: [{7129ABCA-BB6D-40ED-8452-3FFA62FD11DD}] => (Allow) D:\SteamLibrary\steamapps\common\Hitman Absolution\HMA.exe
FirewallRules: [{5F770741-9904-4F66-AF65-CE7C1C9AA43E}] => (Allow) D:\SteamLibrary\steamapps\common\Hitman Absolution\HMA.exe
FirewallRules: [{198AA27F-C996-4537-99B6-F41133917CEB}] => (Allow) D:\SteamLibrary\steamapps\common\Grand Theft Auto San Andreas\gta-sa.exe
FirewallRules: [{1A6BACA9-8908-4027-8C64-D22F4B19895F}] => (Allow) D:\SteamLibrary\steamapps\common\Grand Theft Auto San Andreas\gta-sa.exe
FirewallRules: [TCP Query User{F98AA088-1233-4AB4-BC81-7A82A3225FB2}C:\users\qassim\documents\u1405.exe] => (Allow) C:\users\qassim\documents\u1405.exe
FirewallRules: [UDP Query User{8AF2E2E2-4134-4D04-92BD-09E00ECD6F62}C:\users\qassim\documents\u1405.exe] => (Allow) C:\users\qassim\documents\u1405.exe
FirewallRules: [{81D64270-C830-4D38-AA2D-25567AB28E35}] => (Allow) D:\SteamLibrary\steamapps\common\Half-Life 2\hl2.exe
FirewallRules: [{EAD5798F-D5F9-464F-B694-E1A442353ABE}] => (Allow) D:\SteamLibrary\steamapps\common\Half-Life 2\hl2.exe
FirewallRules: [TCP Query User{B2EF89A2-F72C-4202-BF91-3D10C8E65EDA}D:\games\planet explorers\pe_client.exe] => (Block) D:\games\planet explorers\pe_client.exe
FirewallRules: [UDP Query User{86576AFB-71FC-440C-B801-A0976417E66B}D:\games\planet explorers\pe_client.exe] => (Block) D:\games\planet explorers\pe_client.exe
FirewallRules: [TCP Query User{5FD66F3E-1DEA-417E-8EBD-6F1A9B0F8E57}D:\games\far cry 4 - gold edition\bin\farcry4.exe] => (Block) D:\games\far cry 4 - gold edition\bin\farcry4.exe
FirewallRules: [UDP Query User{FE8064FF-6CD5-4E06-A605-2BF11BDEC244}D:\games\far cry 4 - gold edition\bin\farcry4.exe] => (Block) D:\games\far cry 4 - gold edition\bin\farcry4.exe
FirewallRules: [TCP Query User{7C134E13-7550-41AE-9A91-23E5A5B61755}C:\users\qassim\downloads\runtime\jre-x64\1.8.0_25\bin\javaw.exe] => (Allow) C:\users\qassim\downloads\runtime\jre-x64\1.8.0_25\bin\javaw.exe
FirewallRules: [UDP Query User{50D2E162-1FCE-4CE7-8D76-319C1DE2A4E8}C:\users\qassim\downloads\runtime\jre-x64\1.8.0_25\bin\javaw.exe] => (Allow) C:\users\qassim\downloads\runtime\jre-x64\1.8.0_25\bin\javaw.exe
FirewallRules: [{5B2B3AFB-3770-459B-91D8-69F61558CE38}] => (Allow) C:\Program Files\Microsoft Office\Office15\lync.exe
FirewallRules: [{25791803-1C63-4D7F-9333-BDA65E99C911}] => (Allow) C:\Program Files\Microsoft Office\Office15\lync.exe
FirewallRules: [{22902D9E-670C-4F12-8212-C076CC496B5D}] => (Allow) C:\Program Files\Microsoft Office\Office15\UcMapi.exe
FirewallRules: [{4F7FD319-567A-419D-B004-0F1E25F7B46F}] => (Allow) C:\Program Files\Microsoft Office\Office15\UcMapi.exe
FirewallRules: [{9AD6B7FF-76A5-4B13-A762-7C42B5CBF333}] => (Allow) C:\Program Files (x86)\Origin Games\BFH Beta 2\bfh.exe
FirewallRules: [{610C0929-2E8A-4DED-BD47-3305CDB2E33D}] => (Allow) C:\Program Files (x86)\Origin Games\BFH Beta 2\bfh.exe
FirewallRules: [TCP Query User{DAA0386F-60FE-4693-83F3-B169386810B3}D:\steamlibrary\steamapps\common\sniper elite 3\bin\sniperelite3.exe] => (Allow) D:\steamlibrary\steamapps\common\sniper elite 3\bin\sniperelite3.exe
FirewallRules: [UDP Query User{7AFD4AB4-7B1F-427A-A469-98007ACF817B}D:\steamlibrary\steamapps\common\sniper elite 3\bin\sniperelite3.exe] => (Allow) D:\steamlibrary\steamapps\common\sniper elite 3\bin\sniperelite3.exe
FirewallRules: [{67CD99A2-141E-433C-967D-1B456C5BD5AA}] => (Allow) D:\SteamLibrary\steamapps\common\Team Fortress 2\hl2.exe
FirewallRules: [{D042749F-1AC7-4C35-94A6-BE83CB1B1B97}] => (Allow) D:\SteamLibrary\steamapps\common\Team Fortress 2\hl2.exe
FirewallRules: [{8A96516B-3927-4C0D-96B4-A396890F88C4}] => (Allow) D:\SteamLibrary\steamapps\common\Left 4 Dead 2\left4dead2.exe
FirewallRules: [{7D2D2473-984F-468F-AC25-CF1403E6F12C}] => (Allow) D:\SteamLibrary\steamapps\common\Left 4 Dead 2\left4dead2.exe
FirewallRules: [{2E274835-E4AF-4CDF-B501-F8C3417EC660}] => (Allow) D:\SteamLibrary\steamapps\common\Portal 2\portal2.exe
FirewallRules: [{6983DA3C-BF16-4AB0-BE6C-53EFECA44C2D}] => (Allow) D:\SteamLibrary\steamapps\common\Portal 2\portal2.exe
FirewallRules: [{9C520476-0E3B-434A-BC3B-052432042C59}] => (Allow) D:\SteamLibrary\steamapps\common\Portal\hl2.exe
FirewallRules: [{F78101D5-88C5-457D-820F-4E750B994B6A}] => (Allow) D:\SteamLibrary\steamapps\common\Portal\hl2.exe
FirewallRules: [TCP Query User{7FDD42E2-A8FE-427D-8F46-BC6E5C1E1425}D:\games\dying light\dyinglightgame.exe] => (Allow) D:\games\dying light\dyinglightgame.exe
FirewallRules: [UDP Query User{F769DCD3-0E82-40F8-9906-4A2740722084}D:\games\dying light\dyinglightgame.exe] => (Allow) D:\games\dying light\dyinglightgame.exe
FirewallRules: [TCP Query User{59D7D324-F86E-4B6B-B69E-14A6BEA7061F}D:\games\cod bo2\t6zm.exe] => (Allow) D:\games\cod bo2\t6zm.exe
FirewallRules: [UDP Query User{4ACC1BE2-CC45-47C0-B694-50D427E114C7}D:\games\cod bo2\t6zm.exe] => (Allow) D:\games\cod bo2\t6zm.exe
FirewallRules: [TCP Query User{BCEDDC5D-DA7F-4572-83C4-2B96806CC398}D:\games\cod bo2\t6mp.exe] => (Allow) D:\games\cod bo2\t6mp.exe
FirewallRules: [UDP Query User{98E82274-5378-4676-BAAA-F88CA1C36A01}D:\games\cod bo2\t6mp.exe] => (Allow) D:\games\cod bo2\t6mp.exe
FirewallRules: [TCP Query User{9A29235C-DE81-425A-980F-D2299C3AD707}D:\games\saints row iv\saintsrowiv.exe] => (Block) D:\games\saints row iv\saintsrowiv.exe
FirewallRules: [UDP Query User{869B4262-7C3F-47BA-88FE-B15080100DBE}D:\games\saints row iv\saintsrowiv.exe] => (Block) D:\games\saints row iv\saintsrowiv.exe
FirewallRules: [{81E7EE57-5045-4FDA-99FF-774539915E7A}] => (Allow) D:\SteamLibrary\steamapps\common\Borderlands 2\Binaries\Win32\Launcher.exe
FirewallRules: [{9F8C3E03-501E-46B1-BEAD-EC6BE8831CA3}] => (Allow) D:\SteamLibrary\steamapps\common\Borderlands 2\Binaries\Win32\Launcher.exe
FirewallRules: [{78B74AF1-FAAA-4B0F-BD25-F0097C04788D}] => (Allow) D:\SteamLibrary\steamapps\common\Borderlands 2\Binaries\Win32\Borderlands2.exe
FirewallRules: [{5786C878-0E08-486C-879F-1F16B472FE84}] => (Allow) D:\SteamLibrary\steamapps\common\Borderlands 2\Binaries\Win32\Borderlands2.exe
FirewallRules: [TCP Query User{1739D823-0B86-4EC8-9529-09F58606DC15}C:\program files (x86)\skype\phone\skype.exe] => (Allow) C:\program files (x86)\skype\phone\skype.exe
FirewallRules: [UDP Query User{B035783B-2EA6-49D1-A7C8-B9B04956673A}C:\program files (x86)\skype\phone\skype.exe] => (Allow) C:\program files (x86)\skype\phone\skype.exe
FirewallRules: [{196DCA31-938F-4F98-BB6B-5EF0252D57C1}] => (Allow) D:\SteamLibrary\steamapps\common\GarrysMod\hl2.exe
FirewallRules: [{34839526-58D2-417E-8A51-02E4460FBCDF}] => (Allow) D:\SteamLibrary\steamapps\common\GarrysMod\hl2.exe
FirewallRules: [{61212769-7D33-4E6D-A1C5-D80DDA53715D}] => (Allow) D:\SteamLibrary\steamapps\common\Call of Duty Modern Warfare 3\iw5sp.exe
FirewallRules: [{3BF04C78-9F28-47C6-9E1B-FD06088EA586}] => (Allow) D:\SteamLibrary\steamapps\common\Call of Duty Modern Warfare 3\iw5sp.exe
FirewallRules: [{54A94107-BE97-4A54-917B-ECDA1CEEEEF3}] => (Allow) D:\SteamLibrary\steamapps\common\Call of Duty Modern Warfare 3\iw5mp.exe
FirewallRules: [{9A6250C6-1295-4615-AA51-278E6AC51900}] => (Allow) D:\SteamLibrary\steamapps\common\Call of Duty Modern Warfare 3\iw5mp.exe
FirewallRules: [{EFEC2AC2-ECC8-4E99-BACE-19B5EFA25F0C}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Unturned\Unturned.exe
FirewallRules: [{7F685F67-CC05-4289-B5B5-C2671ECD1631}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Unturned\Unturned.exe
FirewallRules: [TCP Query User{852DC944-C357-4E4B-97D6-AEC4C5918621}D:\games\goat simulator\binaries\win32\goatgame-win32-shipping.exe] => (Allow) D:\games\goat simulator\binaries\win32\goatgame-win32-shipping.exe
FirewallRules: [UDP Query User{60AB972B-2A7D-491F-AFDF-E7A64CD6CEB1}D:\games\goat simulator\binaries\win32\goatgame-win32-shipping.exe] => (Allow) D:\games\goat simulator\binaries\win32\goatgame-win32-shipping.exe
FirewallRules: [TCP Query User{F2670F22-B165-486F-80AD-FDEF7161AA32}D:\steamlibrary\steamapps\common\america's army\aapg\binaries\win32\aagame.exe] => (Allow) D:\steamlibrary\steamapps\common\america's army\aapg\binaries\win32\aagame.exe
FirewallRules: [UDP Query User{855FE924-6478-4031-809C-4F617F36C0CD}D:\steamlibrary\steamapps\common\america's army\aapg\binaries\win32\aagame.exe] => (Allow) D:\steamlibrary\steamapps\common\america's army\aapg\binaries\win32\aagame.exe
FirewallRules: [{770DC1B4-B514-4657-9058-9710A8373E8E}] => (Allow) D:\SteamLibrary\steamapps\common\America's Army\AAPG\Binaries\AALauncher32.exe
FirewallRules: [{96131483-2671-4BCE-8F66-900CD341605C}] => (Allow) D:\SteamLibrary\steamapps\common\America's Army\AAPG\Binaries\AALauncher32.exe
FirewallRules: [TCP Query User{FA1B18C9-1599-4B1F-BE08-C870CC4AB614}D:\games\dishonored - game of the year edition\binaries\win32\dishonored.exe] => (Allow) D:\games\dishonored - game of the year edition\binaries\win32\dishonored.exe
FirewallRules: [UDP Query User{35B3C486-B8B8-44A4-8BB9-A2972D18BCC3}D:\games\dishonored - game of the year edition\binaries\win32\dishonored.exe] => (Allow) D:\games\dishonored - game of the year edition\binaries\win32\dishonored.exe
FirewallRules: [{0CCE6C52-E91B-43CB-AD6A-7FD3F6626708}] => (Allow) D:\Games\Mirrors Edge\Binaries\MirrorsEdge.exe
FirewallRules: [{379FDD6C-453D-47D9-A190-345EDB3BDB69}] => (Allow) D:\Games\Mirrors Edge\Binaries\MirrorsEdge.exe
FirewallRules: [TCP Query User{A62528F0-4199-4C44-A1C0-4A264BB04E27}D:\steamlibrary\steamapps\common\grand theft auto iv episodes from liberty city\eflc\eflc.exe] => (Allow) D:\steamlibrary\steamapps\common\grand theft auto iv episodes from liberty city\eflc\eflc.exe
FirewallRules: [UDP Query User{5BAED80E-491A-44B3-92F2-49D270EE9BFE}D:\steamlibrary\steamapps\common\grand theft auto iv episodes from liberty city\eflc\eflc.exe] => (Allow) D:\steamlibrary\steamapps\common\grand theft auto iv episodes from liberty city\eflc\eflc.exe
FirewallRules: [TCP Query User{6BFDCDE1-DE0C-4F82-904D-75EE8475CB27}D:\games\total war rome ii\rome2.exe] => (Block) D:\games\total war rome ii\rome2.exe
FirewallRules: [UDP Query User{581E44C8-7DFD-4F25-8476-34C9C212BBA1}D:\games\total war rome ii\rome2.exe] => (Block) D:\games\total war rome ii\rome2.exe
FirewallRules: [{ECDE8FEA-00CB-4E6C-9F20-09891607B22E}] => (Allow) C:\Program Files\KMSpico\Service_KMS.exe
FirewallRules: [{206BEACD-3205-449A-8055-7A3F22BF9771}] => (Allow) C:\Program Files\KMSpico\Service_KMS.exe
FirewallRules: [TCP Query User{814BAE69-828B-485D-96E4-12926A541C65}D:\games\wolfenstein.the new order.v 1.0.0.1\wolfneworder_x64.exe] => (Allow) D:\games\wolfenstein.the new order.v 1.0.0.1\wolfneworder_x64.exe
FirewallRules: [UDP Query User{93F4EC77-7F5E-44D3-BC59-79BD36335B88}D:\games\wolfenstein.the new order.v 1.0.0.1\wolfneworder_x64.exe] => (Allow) D:\games\wolfenstein.the new order.v 1.0.0.1\wolfneworder_x64.exe
FirewallRules: [{100D9548-F678-47EA-82D3-C067F109AD82}] => (Allow) D:\SteamLibrary\steamapps\common\Half-Life\hl.exe
FirewallRules: [{F67419BA-11AC-41CC-AF7E-236B32937286}] => (Allow) D:\SteamLibrary\steamapps\common\Half-Life\hl.exe
FirewallRules: [{BE68540B-6B4E-4DCE-BBB2-51D2EFF5897F}] => (Allow) D:\SteamLibrary\steamapps\common\Counter-Strike Global Offensive\csgo.exe
FirewallRules: [{FC8FC335-7D32-42E8-B737-2AA4D339F4F1}] => (Allow) D:\SteamLibrary\steamapps\common\Counter-Strike Global Offensive\csgo.exe
FirewallRules: [{38E69CBA-BC76-42A0-A975-DDBA70878F7F}] => (Allow) D:\SteamLibrary\steamapps\common\Besiege\Besiege.exe
FirewallRules: [{E2618F1B-840C-462C-8F0E-A121BC1992D8}] => (Allow) D:\SteamLibrary\steamapps\common\Besiege\Besiege.exe
FirewallRules: [{363F5B57-31D9-41D8-A3DE-78038436DF5D}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Grand Theft Auto V\GTAVLauncher.exe
FirewallRules: [{F048CE7B-BFE0-4D86-AB99-A8F8A8E4BA60}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Grand Theft Auto V\GTAVLauncher.exe
FirewallRules: [TCP Query User{1B60B8D1-EB05-4500-91F5-7684CEEC12A5}C:\program files (x86)\steam\steamapps\common\grand theft auto v\gta5.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\grand theft auto v\gta5.exe
FirewallRules: [UDP Query User{8A5E8F2B-70FE-43B7-98AE-C0F678359E27}C:\program files (x86)\steam\steamapps\common\grand theft auto v\gta5.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\grand theft auto v\gta5.exe
FirewallRules: [{A6A061AB-137B-4F5A-ACA0-80668880C05A}] => (Allow) C:\Program Files (x86)\Raptr\raptr.exe
FirewallRules: [{1B71DCD9-8BDF-42B9-92B3-E622F877ECFD}] => (Allow) C:\Program Files (x86)\Raptr\raptr.exe
FirewallRules: [{330218EC-DCC7-46AB-A22C-A96B73A3C61F}] => (Allow) C:\Program Files (x86)\Raptr\raptr_im.exe
FirewallRules: [{97D28275-3321-4344-9C96-94AF6AD89ADB}] => (Allow) C:\Program Files (x86)\Raptr\raptr_im.exe
FirewallRules: [{0F01F81F-32AC-4A55-AEA9-695039272BAE}] => (Allow) C:\Windows\SysWOW64\PnkBstrA.exe
FirewallRules: [{45D6C2A9-5B00-46C4-9111-2A9E2280795F}] => (Allow) C:\Windows\SysWOW64\PnkBstrA.exe
FirewallRules: [{F0919BE2-90AF-4B8A-A237-D6CDF6516F09}] => (Allow) C:\Windows\SysWOW64\PnkBstrB.exe
FirewallRules: [{5E016C90-99E3-4B49-81E3-CD698DE190E4}] => (Allow) C:\Windows\SysWOW64\PnkBstrB.exe
FirewallRules: [{3B506AF9-90D2-413E-BE18-EB46B550F954}] => (Allow) D:\Games\Battlefield 3\bf3.exe
FirewallRules: [{E2F09A45-3EBF-4CCE-B957-91B457C07C01}] => (Allow) D:\Games\Battlefield 3\bf3.exe
FirewallRules: [TCP Query User{3BCEDA9E-B070-4779-B49F-2CACAA621C84}C:\users\qassim\appdata\local\akamai\netsession_win.exe] => (Allow) C:\users\qassim\appdata\local\akamai\netsession_win.exe
FirewallRules: [UDP Query User{A0746428-6DE8-4334-8823-7327D16ECCAE}C:\users\qassim\appdata\local\akamai\netsession_win.exe] => (Allow) C:\users\qassim\appdata\local\akamai\netsession_win.exe
FirewallRules: [{91F0294F-80D1-4555-A4D5-C223387B1E08}] => (Block) d:\Tools\CorelDRAW Graphics Suite X7\Programs64\CorelDrw.exe
FirewallRules: [{B9CAF1FC-CE29-42A8-BCEE-A4F1664DF3D8}] => (Block) d:\Tools\CorelDRAW Graphics Suite X7\Programs64\CorelPP.exe
FirewallRules: [TCP Query User{5B05A35A-8FDD-4003-801A-3DB1BE88EA61}D:\games\the witcher 2\bin\witcher2.exe] => (Allow) D:\games\the witcher 2\bin\witcher2.exe
FirewallRules: [UDP Query User{397C7B54-F04E-4B5A-B362-AC2C00A0E192}D:\games\the witcher 2\bin\witcher2.exe] => (Allow) D:\games\the witcher 2\bin\witcher2.exe
FirewallRules: [{14C20A22-59C2-4AAD-853F-38A4518E0D66}] => (Allow) D:\SteamLibrary\steamapps\common\Half-Life 2 Update\hl2.exe
FirewallRules: [{9CCCB86F-BD03-4E40-93D7-D63681016844}] => (Allow) D:\SteamLibrary\steamapps\common\Half-Life 2 Update\hl2.exe
FirewallRules: [{F658D257-7E41-4802-BB05-F3CE3E3FC577}] => (Allow) D:\SteamLibrary\steamapps\common\Men of War Assault Squad\mow_assault_squad.exe
FirewallRules: [{12D73A2C-DC47-4C6A-AB86-B386AD36D100}] => (Allow) D:\SteamLibrary\steamapps\common\Men of War Assault Squad\mow_assault_squad.exe
FirewallRules: [{118F2CD2-5EB1-4D0F-BFE3-31A6FE3A0C8E}] => (Allow) C:\Program Files (x86)\Google\Chrome Remote Desktop\42.0.2311.39\remoting_host.exe
FirewallRules: [{4F50FCA0-1448-42FE-B3CC-AABAE04CFF67}] => (Allow) C:\Program Files\Microsoft Office\Office15\lync.exe
FirewallRules: [{6C55A208-0CCE-49D9-979B-87B7651181EC}] => (Allow) C:\Program Files\Microsoft Office\Office15\lync.exe
FirewallRules: [{DDE2E68B-F26E-460B-BA08-357434D26321}] => (Allow) C:\Program Files\Microsoft Office\Office15\UcMapi.exe
FirewallRules: [{8C3F05A0-AA05-470E-ABFA-8B2E6287424E}] => (Allow) C:\Program Files\Microsoft Office\Office15\UcMapi.exe
FirewallRules: [{E834AE74-F966-4B9C-8118-C270F459C490}] => (Allow) D:\SteamLibrary\steamapps\common\War Thunder\launcher.exe
FirewallRules: [{6AB778C0-F7DD-4D0B-B213-4E58C7414368}] => (Allow) D:\SteamLibrary\steamapps\common\War Thunder\launcher.exe
FirewallRules: [{A36E2F1E-9868-424B-AC05-675AEAA49BC3}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
FirewallRules: [TCP Query User{FA98C375-9E48-43A3-A864-35646C82F0A2}D:\steamlibrary\steamapps\common\war thunder\aces.exe] => (Block) D:\steamlibrary\steamapps\common\war thunder\aces.exe
FirewallRules: [UDP Query User{E10F0A8A-6593-498F-8E67-832012F0D553}D:\steamlibrary\steamapps\common\war thunder\aces.exe] => (Block) D:\steamlibrary\steamapps\common\war thunder\aces.exe
FirewallRules: [{07F88E9D-C5A3-4732-A637-FA18D96DDA4C}] => (Allow) D:\SteamLibrary\steamapps\common\AVA\NWZLauncher.exe
FirewallRules: [{D1D33DE1-5317-46F8-99CD-2805B65737A7}] => (Allow) D:\SteamLibrary\steamapps\common\AVA\NWZLauncher.exe
FirewallRules: [TCP Query User{E1EAC1EF-536C-4B88-A0A3-A950A1ED1FC9}C:\program files (x86)\steam\steamapps\common\fallout 3 goty\fallout3.exe] => (Block) C:\program files (x86)\steam\steamapps\common\fallout 3 goty\fallout3.exe
FirewallRules: [UDP Query User{470CE7D6-0BC1-4DB1-B56F-062815C36D2F}C:\program files (x86)\steam\steamapps\common\fallout 3 goty\fallout3.exe] => (Block) C:\program files (x86)\steam\steamapps\common\fallout 3 goty\fallout3.exe
FirewallRules: [{D82E130D-99D9-4FA8-8B37-7545FC0CBD85}] => (Allow) C:\Program Files (x86)\Raptr\raptr.exe
FirewallRules: [{F78A8C0E-D32D-491D-B2B8-76A41E140D0D}] => (Allow) C:\Program Files (x86)\Raptr\raptr.exe
FirewallRules: [{6DE65806-E215-462F-A62F-FF21395EF886}] => (Allow) C:\Program Files (x86)\Raptr\raptr_im.exe
FirewallRules: [{683A1668-8FF2-4BE2-A3CD-1460130082A2}] => (Allow) C:\Program Files (x86)\Raptr\raptr_im.exe

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (06/12/2015 06:36:07 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT AUTHORITY)
Description: Unloading the performance counter strings for service WmiApRpl (WmiApRpl) failed. The first DWORD in the Data section contains the error code.

Error: (06/12/2015 06:36:07 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT AUTHORITY)
Description: The performance strings in the Performance registry value is corrupted when process Performance extension counter provider. The BaseIndex value from the Performance registry is the first DWORD in the Data section, LastCounter value is the second DWORD in the Data section, and LastHelp value is the third DWORD in the Data section.

Error: (06/12/2015 06:19:56 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT AUTHORITY)
Description: Unloading the performance counter strings for service WmiApRpl (WmiApRpl) failed. The first DWORD in the Data section contains the error code.

Error: (06/12/2015 06:19:56 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT AUTHORITY)
Description: The performance strings in the Performance registry value is corrupted when process Performance extension counter provider. The BaseIndex value from the Performance registry is the first DWORD in the Data section, LastCounter value is the second DWORD in the Data section, and LastHelp value is the third DWORD in the Data section.

Error: (06/12/2015 05:51:34 PM) (Source: Microsoft-Windows-Defrag) (EventID: 257) (User: )
Description: The volume System Reserved was not optimized because an error was encountered: The parameter is incorrect. (0x80070057)

Error: (06/12/2015 05:17:45 PM) (Source: Microsoft-Windows-Defrag) (EventID: 257) (User: )
Description: The volume System Reserved was not optimized because an error was encountered: The parameter is incorrect. (0x80070057)

Error: (06/12/2015 03:27:48 PM) (Source: Microsoft-Windows-Defrag) (EventID: 257) (User: )
Description: The volume System Reserved was not optimized because an error was encountered: The parameter is incorrect. (0x80070057)

Error: (06/12/2015 03:11:52 PM) (Source: Microsoft-Windows-Defrag) (EventID: 257) (User: )
Description: The volume System Reserved was not optimized because an error was encountered: The parameter is incorrect. (0x80070057)

Error: (06/12/2015 02:51:05 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT AUTHORITY)
Description: Unloading the performance counter strings for service WmiApRpl (WmiApRpl) failed. The first DWORD in the Data section contains the error code.

Error: (06/12/2015 02:51:05 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT AUTHORITY)
Description: The performance strings in the Performance registry value is corrupted when process Performance extension counter provider. The BaseIndex value from the Performance registry is the first DWORD in the Data section, LastCounter value is the second DWORD in the Data section, and LastHelp value is the third DWORD in the Data section.


System errors:
=============
Error: (06/12/2015 06:34:12 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The LogMeIn Hamachi Tunneling Engine service terminated unexpectedly. It has done this 1 time(s).

Error: (06/12/2015 06:34:12 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The Corel License Validation Service V2 x64, Powered by arvato service terminated unexpectedly. It has done this 1 time(s).

Error: (06/12/2015 06:34:12 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The PnkBstrA service terminated unexpectedly. It has done this 1 time(s).

Error: (06/12/2015 06:34:12 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: The Chrome Remote Desktop Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.

Error: (06/12/2015 06:34:12 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The AMD FUEL Service service terminated unexpectedly. It has done this 1 time(s).

Error: (06/12/2015 06:34:12 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: The Print Spooler service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 5000 milliseconds: Restart the service.

Error: (06/12/2015 06:34:11 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The AMD External Events Utility service terminated unexpectedly. It has done this 1 time(s).

Error: (06/12/2015 06:31:46 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The Service KMSELDI service terminated unexpectedly. It has done this 1 time(s).

Error: (06/12/2015 06:30:48 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: The Windows Search service terminated unexpectedly. It has done this 2 time(s). The following corrective action will be taken in 30000 milliseconds: Restart the service.

Error: (06/12/2015 06:30:48 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: The Windows Search service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 30000 milliseconds: Restart the service.


Microsoft Office:
=========================
Error: (06/12/2015 06:36:07 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT AUTHORITY)
Description: WmiApRplWmiApRpl8F2030000E5050000

Error: (06/12/2015 06:36:07 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT AUTHORITY)
Description: Performance163707000000000000000000008F020000

Error: (06/12/2015 06:19:56 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT AUTHORITY)
Description: WmiApRplWmiApRpl8F2030000E5050000

Error: (06/12/2015 06:19:56 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT AUTHORITY)
Description: Performance163707000000000000000000008F020000

Error: (06/12/2015 05:51:34 PM) (Source: Microsoft-Windows-Defrag) (EventID: 257) (User: )
Description: System ReservedThe parameter is incorrect. (0x80070057)

Error: (06/12/2015 05:17:45 PM) (Source: Microsoft-Windows-Defrag) (EventID: 257) (User: )
Description: System ReservedThe parameter is incorrect. (0x80070057)

Error: (06/12/2015 03:27:48 PM) (Source: Microsoft-Windows-Defrag) (EventID: 257) (User: )
Description: System ReservedThe parameter is incorrect. (0x80070057)

Error: (06/12/2015 03:11:52 PM) (Source: Microsoft-Windows-Defrag) (EventID: 257) (User: )
Description: System ReservedThe parameter is incorrect. (0x80070057)

Error: (06/12/2015 02:51:05 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT AUTHORITY)
Description: WmiApRplWmiApRpl8F2030000E5050000

Error: (06/12/2015 02:51:05 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT AUTHORITY)
Description: Performance163707000000000000000000008F020000


CodeIntegrity Errors:
===================================
Date: 2015-05-04 19:01:45.192
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\l3codeca.acm because the set of per-page image hashes could not be found on the system.

Date: 2015-05-03 18:56:13.864
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\l3codeca.acm because the set of per-page image hashes could not be found on the system.

Date: 2015-03-27 20:36:34.906
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\l3codeca.acm because the set of per-page image hashes could not be found on the system.

Date: 2015-02-12 14:38:47.567
Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

Date: 2015-02-12 14:38:47.482
Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

Date: 2015-02-12 14:37:39.339
Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

Date: 2015-02-12 14:37:39.187
Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

Date: 2015-02-12 14:37:38.938
Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

Date: 2015-02-12 14:37:38.869
Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

Date: 2015-02-12 14:33:50.866
Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.


==================== Memory info ===========================

Processor: AMD FX(tm)-8320 Eight-Core Processor
Percentage of memory in use: 22%
Total physical RAM: 8156.63 MB
Available physical RAM: 6302.64 MB
Total Pagefile: 16348.63 MB
Available Pagefile: 14210.04 MB
Total Virtual: 131072 MB
Available Virtual: 131071.83 MB

==================== Drives ================================

Drive c: (Windows and GTA V) (Fixed) (Total:223.23 GB) (Free:72.26 GB) NTFS
Drive d: (Not GTA V) (Fixed) (Total:931.51 GB) (Free:444.45 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 223.6 GB) (Disk ID: EA755FC6)
Partition 1: (Active) - (Size=350 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=223.2 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 931.5 GB) (Disk ID: 207734C9)
Partition 1: (Not Active) - (Size=931.5 GB) - (Type=07 NTFS)

==================== End of log ============================

 

[Broni]

Download attached fixlist.txt file and save it to the Desktop.
NOTE. It's important that both files, FRST and fixlist.txt are in the same location or the fix will not work.

NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

Run FRST(FRST64) and press the Fix button just once and wait.
The tool will make a log on the Desktop (Fixlog.txt). Please post it to your reply.

 

[qassimnm]

#note: when running frst the first time, it suddenly stopped working and the message box for "this program has stopped working" appeared so I closed it and ran it a second time at which point it worked
Fixlog:
Fix result of Farbar Recovery Scan Tool (x64) Version:08-06-2015
Ran by Qassim at 2015-06-12 22:51:07 Run:4
Running from C:\Users\Qassim\Downloads
Loaded Profiles: Qassim (Available Profiles: Qassim)
Boot Mode: Normal
==============================================

fixlist content:
*****************
HKU\S-1-5-21-2302587062-3611041661-3303187194-1001\...\Run: [GalaxyClient] => [X]
HKU\S-1-5-21-2302587062-3611041661-3303187194-1001\...\MountPoints2: E - "E:\setup.exe"
2015-04-27 16:36 - 2015-04-27 16:36 - 0000000 ___SH () C:\Users\Qassim\AppData\Local\LumaEmu
Task: {DC7960F1-FC70-403A-BC36-9E64DDDE88B7} - \Origin No Task File <==== ATTENTION

*****************

HKU\S-1-5-21-2302587062-3611041661-3303187194-1001\Software\Microsoft\Windows\CurrentVersion\Run\\GalaxyClient => value not found.
HKU\S-1-5-21-2302587062-3611041661-3303187194-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\E => key not found.
"C:\Users\Qassim\AppData\Local\LumaEmu" => File/Folder not found.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{DC7960F1-FC70-403A-BC36-9E64DDDE88B7}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{DC7960F1-FC70-403A-BC36-9E64DDDE88B7}" => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Origin => key not found.

==== End of Fixlog 22:51:07 ====

 

[Broni]

Last scans...

Download Security Check from here or here and save it to your Desktop.

• Double-click SecurityCheck.exe
• Follow the onscreen instructions inside of the black box.
• A Notepad document should open automatically called checkup.txt; please post the contents of that document.

NOTE 1. If one of your security applications (e.g., third-party firewall) requests permission to allow DIG.EXE access the Internet, allow it to do so.
NOTE 2. SecurityCheck may produce some false warning(s), so leave the results reading to me.
NOTE 3. If you receive UNSUPPORTED OPERATING SYSTEM! ABORTED! message restart computer and Security Check should run

Please download Farbar Service Scanner (FSS) and run it on the computer with the issue.

• Make sure the following options are checked:
  • Internet Services
  • Windows Firewall
  • System Restore
  • Security Center
  • Windows Update
  • Windows Defender
  • Other Services
• Press "Scan".
• It will create a log (FSS.txt) in the same directory the tool is run.
• Please copy and paste the log to your reply.

Download Temp File Cleaner (TFC)
Alternate download: http://www.itxassociates.com/OT-Tools/TFC.exe

• Double click on TFC.exe to run the program.
• Click on Start button to begin cleaning process.
• TFC will close all running programs, and it may ask you to restart computer.

Download Sophos Free Virus Removal Tool and save it to your desktop.

• Double click the icon and select Run
• Click Next
• Select I accept the terms in this license agreement, then click Next twice
• Click Install
• Click Finish to launch the program
• Once the virus database has been updated click Start Scanning
• If any threats are found click Details, then View log file... (bottom left hand corner)
• Copy and paste the results in your reply
• Close the Notepad document, close the Threat Details screen, then click Start cleanup
• Click Exit to close the program

 

[qassimnm]

Security check:
Results of screen317's Security Check version 1.004
x64 (UAC is enabled)
Internet Explorer 11
``````````````Antivirus/Firewall Check:``````````````
Windows Firewall Enabled!
Windows Defender
[size=1]WMI entry may not exist for antivirus; attempting automatic update.[/size]
`````````Anti-malware/Other Utilities Check:`````````
Java 8 Update 25
Java version 32-bit out of Date!
Mozilla Firefox 35.0 Firefox out of Date!
Google Chrome (43.0.2357.124)
Google Chrome (43.0.2357.81)
````````Process Check: objlist.exe by Laurent````````
Windows Defender MSMpEng.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C: %
````````````````````End of Log``````````````````````

 

[qassimnm]

FSS:
Farbar Service Scanner Version: 17-01-2015
Ran by Qassim (administrator) on 13-06-2015 at 12:30:48
Running from "C:\Users\Qassim\Downloads"
Microsoft Windows 8.1 Pro (X64)
Boot Mode: Normal
****************************************************************

Internet Services:
============

Connection Status:
==============
Localhost is accessible.
LAN connected.
Google IP is accessible.
Google.com is accessible.
Yahoo.com is accessible.


Windows Firewall:
=============

Firewall Disabled Policy:
==================


System Restore:
============

System Restore Policy:
========================


Action Center:
============


Windows Update:
============

Windows Autoupdate Disabled Policy:
============================


Windows Defender:
==============

Other Services:
==============


File Check:
========
C:\Windows\System32\nsisvc.dll => File is digitally signed
C:\Windows\System32\drivers\nsiproxy.sys => File is digitally signed
C:\Windows\System32\dhcpcore.dll => File is digitally signed
C:\Windows\System32\drivers\afd.sys => File is digitally signed
C:\Windows\System32\drivers\tdx.sys => File is digitally signed
C:\Windows\System32\Drivers\tcpip.sys => File is digitally signed
C:\Windows\System32\dnsrslvr.dll => File is digitally signed
C:\Windows\System32\mpssvc.dll => File is digitally signed
C:\Windows\System32\bfe.dll => File is digitally signed
C:\Windows\System32\drivers\mpsdrv.sys => File is digitally signed
C:\Windows\System32\wscsvc.dll => File is digitally signed
C:\Windows\System32\wbem\WMIsvc.dll => File is digitally signed
C:\Windows\System32\wuaueng.dll => File is digitally signed
C:\Windows\System32\qmgr.dll => File is digitally signed
C:\Windows\System32\es.dll => File is digitally signed
C:\Windows\System32\cryptsvc.dll => File is digitally signed
C:\Program Files\Windows Defender\MpSvc.dll => File is digitally signed
C:\Program Files\Windows Defender\MsMpEng.exe => File is digitally signed
C:\Windows\System32\ipnathlp.dll => File is digitally signed
C:\Windows\System32\iphlpsvc.dll => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed


**** End of log ****

 

[qassimnm]

Not sure if you wanted this but TFC:
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 57311 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Public

User: Qassim
->Temp folder emptied: 312659545 bytes
->Temporary Internet Files folder emptied: 3634828 bytes
->Java cache emptied: 361373 bytes
->FireFox cache emptied: 2278168 bytes
->Google Chrome cache emptied: 24213353 bytes
->Flash cache emptied: 78602 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 287500192 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 151940222 bytes

Emptying RecycleBin. Do not interrupt.

RecycleBin emptied: 15521358007 bytes
Process complete!

Total Files Cleaned = 15,549.00 mb

 

[qassimnm]

Sorry, the sophos removal tool is taking a long time

 

[qassimnm]

Sophos virus removal tool:
2015-06-13 16:34:36.266 Sophos Virus Removal Tool version 2.5.4
2015-06-13 16:34:36.266 Copyright (c) 2009-2014 Sophos Limited. All rights reserved.

2015-06-13 16:34:36.266 This tool will scan your computer for viruses and other threats. If it finds any, it will give you the option to remove them.

2015-06-13 16:34:36.266 Windows version 6.2 SP 0.0 build 9200 SM=0x100 PT=0x1 WOW64
2015-06-13 16:34:36.266 Checking for updates...
2015-06-13 16:34:36.266 Update progress: proxy server not available
2015-06-13 16:34:43.437 Option all = no
2015-06-13 16:34:43.437 Option recurse = yes
2015-06-13 16:34:43.437 Option archive = no
2015-06-13 16:34:43.437 Option service = yes
2015-06-13 16:34:43.437 Option confirm = yes
2015-06-13 16:34:43.437 Option sxl = yes
2015-06-13 16:34:43.439 Option max-data-age = 35
2015-06-13 16:34:43.439 Option EnableSafeClean = yes
2015-06-13 16:34:44.596 Option vdl-logging = yes
2015-06-13 16:34:44.596 Customer ID: 094260ca9b3af99f9d4a3909fc47a743
2015-06-13 16:34:44.596 Machine ID: 14f6d732a5424326852e18a6bbf9d2c4
2015-06-13 16:34:44.596 Component SVRTcli.exe version 2.5.4
2015-06-13 16:34:44.596 Component control.dll version 2.5.4
2015-06-13 16:34:44.596 Component SVRTservice.exe version 2.5.4
2015-06-13 16:34:44.596 Component engine\osdp.dll version 1.44.1.2200
2015-06-13 16:34:44.596 Component engine\veex.dll version 3.60.0.2200
2015-06-13 16:34:44.596 Component engine\savi.dll version 8.1.7.2200
2015-06-13 16:34:44.596 Component rkdisk.dll version 1.5.30.0
2015-06-13 16:34:44.596 Version info: Product version 2.5.4
2015-06-13 16:34:44.596 Version info: Detection engine 3.60.0
2015-06-13 16:34:44.596 Version info: Detection data 5.15
2015-06-13 16:34:44.596 Version info: Build date 5/26/2015
2015-06-13 16:34:44.596 Version info: Data files added 279
2015-06-13 16:34:44.596 Version info: Last successful update (not yet updated)
2015-06-13 16:34:48.967 Downloading updates...
2015-06-13 16:34:48.970 Update progress: [I96736] Looking for package C1A903B2-E63E-483b-982D-04BB9C457C60 1.0
2015-06-13 16:34:48.970 Update progress: [I49502] Found supplement SAVIW32 LATEST
2015-06-13 16:34:48.970 Update progress: [I49502] Found supplement IDE516 LATEST
2015-06-13 16:34:48.970 Update progress: [I49502] Found supplement IDE517 LATEST
2015-06-13 16:34:48.970 Update progress: [I49502] Found supplement IDE518 LATEST
2015-06-13 16:34:48.970 Update progress: [I19463] Syncing product C1A903B2-E63E-483b-982D-04BB9C457C60 1
2015-06-13 16:34:48.970 Update progress: [I19463] Syncing product SAVIW32 55
2015-06-13 16:34:50.724 Update progress: [I19463] Syncing product IDE516 178
2015-06-13 16:34:51.122 Installing updates...
2015-06-13 16:34:51.756 Error level 1
2015-06-13 16:34:51.787 Update progress: [I19463] Syncing product IDE517 104
2015-06-13 16:34:51.787 Update progress: [I19463] Syncing product IDE518 1
2015-06-13 16:34:56.367 Update successful
2015-06-13 16:35:03.238 Option all = no
2015-06-13 16:35:03.238 Option recurse = yes
2015-06-13 16:35:03.238 Option archive = no
2015-06-13 16:35:03.238 Option service = yes
2015-06-13 16:35:03.238 Option confirm = yes
2015-06-13 16:35:03.238 Option sxl = yes
2015-06-13 16:35:03.238 Option max-data-age = 35
2015-06-13 16:35:03.238 Option EnableSafeClean = yes
2015-06-13 16:35:03.395 Option vdl-logging = yes
2015-06-13 16:35:03.395 Customer ID: 094260ca9b3af99f9d4a3909fc47a743
2015-06-13 16:35:03.395 Machine ID: 14f6d732a5424326852e18a6bbf9d2c4
2015-06-13 16:35:03.395 Component SVRTcli.exe version 2.5.4
2015-06-13 16:35:03.395 Component control.dll version 2.5.4
2015-06-13 16:35:03.395 Component SVRTservice.exe version 2.5.4
2015-06-13 16:35:03.395 Component engine\osdp.dll version 1.44.1.2200
2015-06-13 16:35:03.395 Component engine\veex.dll version 3.60.0.2200
2015-06-13 16:35:03.395 Component engine\savi.dll version 8.1.7.2200
2015-06-13 16:35:03.395 Component rkdisk.dll version 1.5.30.0
2015-06-13 16:35:03.395 Version info: Product version 2.5.4
2015-06-13 16:35:03.395 Version info: Detection engine 3.60.0
2015-06-13 16:35:03.395 Version info: Detection data 5.15G
2015-06-13 16:35:03.395 Version info: Build date 5/26/2015
2015-06-13 16:35:03.395 Version info: Data files added 278
2015-06-13 16:35:03.395 Version info: Last successful update 6/13/2015 12:34:56 PM

2015-06-13 17:20:16.289 >>> Virus 'Mal/VMProtBad-A' found in file C:\Games\Europa Universalis IV\steam_api.dll
2015-06-13 17:20:18.892 Could not open C:\hiberfil.sys
2015-06-13 17:20:19.186 Could not open C:\pagefile.sys
2015-06-13 17:24:53.123 Could not open C:\swapfile.sys
2015-06-13 17:24:53.152 Could not open C:\System Volume Information\{17bfca4a-0b92-11e5-82f5-fcaa14289981}{3808876b-c176-4e48-b7ae-04046e6cc752}
2015-06-13 17:24:53.152 Could not open C:\System Volume Information\{3808876b-c176-4e48-b7ae-04046e6cc752}
2015-06-13 17:24:53.152 Could not open C:\System Volume Information\{440c060c-11e8-11e5-82ff-fcaa14289981}{3808876b-c176-4e48-b7ae-04046e6cc752}
2015-06-13 17:24:53.152 Could not open C:\System Volume Information\{5291dba9-108d-11e5-82f7-fcaa14289981}{3808876b-c176-4e48-b7ae-04046e6cc752}
2015-06-13 17:24:53.152 Could not open C:\System Volume Information\{8e2ad421-0794-11e5-82ef-fcaa14289981}{3808876b-c176-4e48-b7ae-04046e6cc752}
2015-06-13 17:24:53.152 Could not open C:\System Volume Information\{928f6927-03d7-11e5-82ec-fcaa14289981}{3808876b-c176-4e48-b7ae-04046e6cc752}
2015-06-13 17:24:57.578 Could not open C:\Users\Qassim\AppData\Local\Google\Chrome\User Data\Default\Current Session
2015-06-13 17:24:57.578 Could not open C:\Users\Qassim\AppData\Local\Google\Chrome\User Data\Default\Current Tabs
2015-06-13 17:24:57.606 Could not check C:\Users\Qassim\AppData\Local\Google\Chrome\User Data\Default\Extension Rules\LOCK (virus scan failed)
2015-06-13 17:24:57.611 Could not check C:\Users\Qassim\AppData\Local\Google\Chrome\User Data\Default\Extension State\LOCK (virus scan failed)
2015-06-13 17:24:58.818 Could not check C:\Users\Qassim\AppData\Local\Google\Chrome\User Data\Default\GCM Store\LOCK (virus scan failed)
2015-06-13 17:24:58.995 Could not check C:\Users\Qassim\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_docs.google.com_0.indexeddb.leveldb\LOCK (virus scan failed)
2015-06-13 17:24:59.057 Could not check C:\Users\Qassim\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.google.com_0.indexeddb.leveldb\LOCK (virus scan failed)
2015-06-13 17:24:59.110 Could not check C:\Users\Qassim\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\http_www.netflix.com_0.indexeddb.leveldb\LOCK (virus scan failed)
2015-06-13 17:24:59.142 Could not check C:\Users\Qassim\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pafkbggdmjlpgkdkcbjmhmfcdpncadgh\LOCK (virus scan failed)
2015-06-13 17:25:00.857 Could not check C:\Users\Qassim\AppData\Local\Google\Chrome\User Data\Default\Session Storage\LOCK (virus scan failed)
2015-06-13 17:28:08.028 Could not open C:\Windows\System32\catroot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\catdb
2015-06-13 17:28:08.028 Could not open C:\Windows\System32\catroot2\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\catdb
2015-06-13 17:28:08.725 Could not open C:\Windows\System32\config\BBI
2015-06-13 17:28:08.738 Could not open C:\Windows\System32\config\RegBack\DEFAULT
2015-06-13 17:28:08.738 Could not open C:\Windows\System32\config\RegBack\SAM
2015-06-13 17:28:08.739 Could not open C:\Windows\System32\config\RegBack\SECURITY
2015-06-13 17:28:08.739 Could not open C:\Windows\System32\config\RegBack\SOFTWARE
2015-06-13 17:28:08.740 Could not open C:\Windows\System32\config\RegBack\SYSTEM
2015-06-13 17:36:13.812 >>> Virus 'Mal/VMProtBad-A' found in file D:\Games\CoD BO2\redacted\Emulation\SP\buddha.dll
2015-06-13 17:36:23.211 >>> Virus 'Mal/VMProtBad-A' found in file D:\Games\Dishonored - Game of the Year Edition\Binaries\Win32\steam_api.dll
2015-06-13 17:36:36.592 >>> Virus 'Mal/VMProtBad-A' found in file D:\Games\Medieval Engineers\Bin\steam_api.dll
2015-06-13 17:36:40.950 >>> Virus 'Mal/VMProtBad-A' found in file D:\Games\Medieval Engineers\Bin64\steam_api.dll
2015-06-13 17:39:37.327 >>> Virus 'Mal/Generic-S' found in file D:\Games\Wolfenstein The Old Blood\steam_api64.dll
2015-06-13 17:39:37.327 >>> Virus 'Mal/Generic-S' found in file D:\Games\Wolfenstein The Old Blood\steam_api64.dll
2015-06-13 17:47:12.914 The following items will be cleaned up:
2015-06-13 17:47:12.914 Mal/VMProtBad-A
2015-06-13 17:47:12.914 Mal/Generic-S

 

[qassimnm]

After clean up sophos log:
2015-06-13 16:34:36.266 Sophos Virus Removal Tool version 2.5.4
2015-06-13 16:34:36.266 Copyright (c) 2009-2014 Sophos Limited. All rights reserved.

2015-06-13 16:34:36.266 This tool will scan your computer for viruses and other threats. If it finds any, it will give you the option to remove them.

2015-06-13 16:34:36.266 Windows version 6.2 SP 0.0 build 9200 SM=0x100 PT=0x1 WOW64
2015-06-13 16:34:36.266 Checking for updates...
2015-06-13 16:34:36.266 Update progress: proxy server not available
2015-06-13 16:34:43.437 Option all = no
2015-06-13 16:34:43.437 Option recurse = yes
2015-06-13 16:34:43.437 Option archive = no
2015-06-13 16:34:43.437 Option service = yes
2015-06-13 16:34:43.437 Option confirm = yes
2015-06-13 16:34:43.437 Option sxl = yes
2015-06-13 16:34:43.439 Option max-data-age = 35
2015-06-13 16:34:43.439 Option EnableSafeClean = yes
2015-06-13 16:34:44.596 Option vdl-logging = yes
2015-06-13 16:34:44.596 Customer ID: 094260ca9b3af99f9d4a3909fc47a743
2015-06-13 16:34:44.596 Machine ID: 14f6d732a5424326852e18a6bbf9d2c4
2015-06-13 16:34:44.596 Component SVRTcli.exe version 2.5.4
2015-06-13 16:34:44.596 Component control.dll version 2.5.4
2015-06-13 16:34:44.596 Component SVRTservice.exe version 2.5.4
2015-06-13 16:34:44.596 Component engine\osdp.dll version 1.44.1.2200
2015-06-13 16:34:44.596 Component engine\veex.dll version 3.60.0.2200
2015-06-13 16:34:44.596 Component engine\savi.dll version 8.1.7.2200
2015-06-13 16:34:44.596 Component rkdisk.dll version 1.5.30.0
2015-06-13 16:34:44.596 Version info: Product version 2.5.4
2015-06-13 16:34:44.596 Version info: Detection engine 3.60.0
2015-06-13 16:34:44.596 Version info: Detection data 5.15
2015-06-13 16:34:44.596 Version info: Build date 5/26/2015
2015-06-13 16:34:44.596 Version info: Data files added 279
2015-06-13 16:34:44.596 Version info: Last successful update (not yet updated)
2015-06-13 16:34:48.967 Downloading updates...
2015-06-13 16:34:48.970 Update progress: [I96736] Looking for package C1A903B2-E63E-483b-982D-04BB9C457C60 1.0
2015-06-13 16:34:48.970 Update progress: [I49502] Found supplement SAVIW32 LATEST
2015-06-13 16:34:48.970 Update progress: [I49502] Found supplement IDE516 LATEST
2015-06-13 16:34:48.970 Update progress: [I49502] Found supplement IDE517 LATEST
2015-06-13 16:34:48.970 Update progress: [I49502] Found supplement IDE518 LATEST
2015-06-13 16:34:48.970 Update progress: [I19463] Syncing product C1A903B2-E63E-483b-982D-04BB9C457C60 1
2015-06-13 16:34:48.970 Update progress: [I19463] Syncing product SAVIW32 55
2015-06-13 16:34:50.724 Update progress: [I19463] Syncing product IDE516 178
2015-06-13 16:34:51.122 Installing updates...
2015-06-13 16:34:51.756 Error level 1
2015-06-13 16:34:51.787 Update progress: [I19463] Syncing product IDE517 104
2015-06-13 16:34:51.787 Update progress: [I19463] Syncing product IDE518 1
2015-06-13 16:34:56.367 Update successful
2015-06-13 16:35:03.238 Option all = no
2015-06-13 16:35:03.238 Option recurse = yes
2015-06-13 16:35:03.238 Option archive = no
2015-06-13 16:35:03.238 Option service = yes
2015-06-13 16:35:03.238 Option confirm = yes
2015-06-13 16:35:03.238 Option sxl = yes
2015-06-13 16:35:03.238 Option max-data-age = 35
2015-06-13 16:35:03.238 Option EnableSafeClean = yes
2015-06-13 16:35:03.395 Option vdl-logging = yes
2015-06-13 16:35:03.395 Customer ID: 094260ca9b3af99f9d4a3909fc47a743
2015-06-13 16:35:03.395 Machine ID: 14f6d732a5424326852e18a6bbf9d2c4
2015-06-13 16:35:03.395 Component SVRTcli.exe version 2.5.4
2015-06-13 16:35:03.395 Component control.dll version 2.5.4
2015-06-13 16:35:03.395 Component SVRTservice.exe version 2.5.4
2015-06-13 16:35:03.395 Component engine\osdp.dll version 1.44.1.2200
2015-06-13 16:35:03.395 Component engine\veex.dll version 3.60.0.2200
2015-06-13 16:35:03.395 Component engine\savi.dll version 8.1.7.2200
2015-06-13 16:35:03.395 Component rkdisk.dll version 1.5.30.0
2015-06-13 16:35:03.395 Version info: Product version 2.5.4
2015-06-13 16:35:03.395 Version info: Detection engine 3.60.0
2015-06-13 16:35:03.395 Version info: Detection data 5.15G
2015-06-13 16:35:03.395 Version info: Build date 5/26/2015
2015-06-13 16:35:03.395 Version info: Data files added 278
2015-06-13 16:35:03.395 Version info: Last successful update 6/13/2015 12:34:56 PM

2015-06-13 17:20:16.289 >>> Virus 'Mal/VMProtBad-A' found in file C:\Games\Europa Universalis IV\steam_api.dll
2015-06-13 17:20:18.892 Could not open C:\hiberfil.sys
2015-06-13 17:20:19.186 Could not open C:\pagefile.sys
2015-06-13 17:24:53.123 Could not open C:\swapfile.sys
2015-06-13 17:24:53.152 Could not open C:\System Volume Information\{17bfca4a-0b92-11e5-82f5-fcaa14289981}{3808876b-c176-4e48-b7ae-04046e6cc752}
2015-06-13 17:24:53.152 Could not open C:\System Volume Information\{3808876b-c176-4e48-b7ae-04046e6cc752}
2015-06-13 17:24:53.152 Could not open C:\System Volume Information\{440c060c-11e8-11e5-82ff-fcaa14289981}{3808876b-c176-4e48-b7ae-04046e6cc752}
2015-06-13 17:24:53.152 Could not open C:\System Volume Information\{5291dba9-108d-11e5-82f7-fcaa14289981}{3808876b-c176-4e48-b7ae-04046e6cc752}
2015-06-13 17:24:53.152 Could not open C:\System Volume Information\{8e2ad421-0794-11e5-82ef-fcaa14289981}{3808876b-c176-4e48-b7ae-04046e6cc752}
2015-06-13 17:24:53.152 Could not open C:\System Volume Information\{928f6927-03d7-11e5-82ec-fcaa14289981}{3808876b-c176-4e48-b7ae-04046e6cc752}
2015-06-13 17:24:57.578 Could not open C:\Users\Qassim\AppData\Local\Google\Chrome\User Data\Default\Current Session
2015-06-13 17:24:57.578 Could not open C:\Users\Qassim\AppData\Local\Google\Chrome\User Data\Default\Current Tabs
2015-06-13 17:24:57.606 Could not check C:\Users\Qassim\AppData\Local\Google\Chrome\User Data\Default\Extension Rules\LOCK (virus scan failed)
2015-06-13 17:24:57.611 Could not check C:\Users\Qassim\AppData\Local\Google\Chrome\User Data\Default\Extension State\LOCK (virus scan failed)
2015-06-13 17:24:58.818 Could not check C:\Users\Qassim\AppData\Local\Google\Chrome\User Data\Default\GCM Store\LOCK (virus scan failed)
2015-06-13 17:24:58.995 Could not check C:\Users\Qassim\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_docs.google.com_0.indexeddb.leveldb\LOCK (virus scan failed)
2015-06-13 17:24:59.057 Could not check C:\Users\Qassim\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.google.com_0.indexeddb.leveldb\LOCK (virus scan failed)
2015-06-13 17:24:59.110 Could not check C:\Users\Qassim\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\http_www.netflix.com_0.indexeddb.leveldb\LOCK (virus scan failed)
2015-06-13 17:24:59.142 Could not check C:\Users\Qassim\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pafkbggdmjlpgkdkcbjmhmfcdpncadgh\LOCK (virus scan failed)
2015-06-13 17:25:00.857 Could not check C:\Users\Qassim\AppData\Local\Google\Chrome\User Data\Default\Session Storage\LOCK (virus scan failed)
2015-06-13 17:28:08.028 Could not open C:\Windows\System32\catroot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\catdb
2015-06-13 17:28:08.028 Could not open C:\Windows\System32\catroot2\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\catdb
2015-06-13 17:28:08.725 Could not open C:\Windows\System32\config\BBI
2015-06-13 17:28:08.738 Could not open C:\Windows\System32\config\RegBack\DEFAULT
2015-06-13 17:28:08.738 Could not open C:\Windows\System32\config\RegBack\SAM
2015-06-13 17:28:08.739 Could not open C:\Windows\System32\config\RegBack\SECURITY
2015-06-13 17:28:08.739 Could not open C:\Windows\System32\config\RegBack\SOFTWARE
2015-06-13 17:28:08.740 Could not open C:\Windows\System32\config\RegBack\SYSTEM
2015-06-13 17:36:13.812 >>> Virus 'Mal/VMProtBad-A' found in file D:\Games\CoD BO2\redacted\Emulation\SP\buddha.dll
2015-06-13 17:36:23.211 >>> Virus 'Mal/VMProtBad-A' found in file D:\Games\Dishonored - Game of the Year Edition\Binaries\Win32\steam_api.dll
2015-06-13 17:36:36.592 >>> Virus 'Mal/VMProtBad-A' found in file D:\Games\Medieval Engineers\Bin\steam_api.dll
2015-06-13 17:36:40.950 >>> Virus 'Mal/VMProtBad-A' found in file D:\Games\Medieval Engineers\Bin64\steam_api.dll
2015-06-13 17:39:37.327 >>> Virus 'Mal/Generic-S' found in file D:\Games\Wolfenstein The Old Blood\steam_api64.dll
2015-06-13 17:39:37.327 >>> Virus 'Mal/Generic-S' found in file D:\Games\Wolfenstein The Old Blood\steam_api64.dll
2015-06-13 17:47:12.914 The following items will be cleaned up:
2015-06-13 17:47:12.914 Mal/VMProtBad-A
2015-06-13 17:47:12.914 Mal/Generic-S
2015-06-13 17:50:52.047 Threat 'Mal/VMProtBad-A' has been cleaned up.
2015-06-13 17:50:52.048 File "C:\Games\Europa Universalis IV\steam_api.dll" belongs to malware 'Mal/VMProtBad-A'.
2015-06-13 17:50:52.048 File "C:\Games\Europa Universalis IV\steam_api.dll" has been cleaned up.
2015-06-13 17:50:52.048 File "D:\Games\CoD BO2\redacted\Emulation\SP\buddha.dll" belongs to malware 'Mal/VMProtBad-A'.
2015-06-13 17:50:52.048 File "D:\Games\CoD BO2\redacted\Emulation\SP\buddha.dll" has been cleaned up.
2015-06-13 17:50:52.048 File "D:\Games\Dishonored - Game of the Year Edition\Binaries\Win32\steam_api.dll" belongs to malware 'Mal/VMProtBad-A'.
2015-06-13 17:50:52.049 File "D:\Games\Dishonored - Game of the Year Edition\Binaries\Win32\steam_api.dll" has been cleaned up.
2015-06-13 17:50:52.049 File "D:\Games\Medieval Engineers\Bin\steam_api.dll" belongs to malware 'Mal/VMProtBad-A'.
2015-06-13 17:50:52.049 File "D:\Games\Medieval Engineers\Bin\steam_api.dll" has been cleaned up.
2015-06-13 17:50:52.049 File "D:\Games\Medieval Engineers\Bin64\steam_api.dll" belongs to malware 'Mal/VMProtBad-A'.
2015-06-13 17:50:52.049 File "D:\Games\Medieval Engineers\Bin64\steam_api.dll" has been cleaned up.
2015-06-13 17:50:52.049 Removal successful
2015-06-13 17:50:55.685 Threat 'Mal/Generic-S' has been cleaned up.
2015-06-13 17:50:55.685 File "D:\Games\Wolfenstein The Old Blood\steam_api64.dll" belongs to malware 'Mal/Generic-S'.
2015-06-13 17:50:55.685 File "D:\Games\Wolfenstein The Old Blood\steam_api64.dll" has been cleaned up.
2015-06-13 17:50:55.685 Removal successful
2015-06-13 17:50:55.768 Contents of SafeClean bin directory:
2015-06-13 17:50:55.769 {
2015-06-13 17:50:55.769 RecordID : "0000000000000001",
2015-06-13 17:50:55.769 ItemType : "1",
2015-06-13 17:50:55.769 Location : "C:\Games\Europa Universalis IV\",
2015-06-13 17:50:55.769 FileName : "steam_api.dll",
2015-06-13 17:50:55.769 ThreatName : "Mal/VMProtBad-A",
2015-06-13 17:50:55.769 Checksum : "745ea252c8eb584ca38091f03f084125c605efc36fee944969b8a8a4fb091204",
2015-06-13 17:50:55.769 TimeStamp : "Sat Jun 13 13:50:33 2015"
2015-06-13 17:50:55.769 }
2015-06-13 17:50:55.769 {
2015-06-13 17:50:55.769 RecordID : "0000000000000002",
2015-06-13 17:50:55.769 ItemType : "1",
2015-06-13 17:50:55.769 Location : "D:\Games\CoD BO2\redacted\Emulation\SP\",
2015-06-13 17:50:55.769 FileName : "buddha.dll",
2015-06-13 17:50:55.770 ThreatName : "Mal/VMProtBad-A",
2015-06-13 17:50:55.770 Checksum : "2b19fa42e98a3b02a8dd6e0d2509881fc9e327add13420c1e978039699c638eb",
2015-06-13 17:50:55.770 TimeStamp : "Sat Jun 13 13:50:33 2015"
2015-06-13 17:50:55.770 }
2015-06-13 17:50:55.770 {
2015-06-13 17:50:55.770 RecordID : "0000000000000003",
2015-06-13 17:50:55.770 ItemType : "1",
2015-06-13 17:50:55.770 Location : "D:\Games\Dishonored - Game of the Year Edition\Binaries\Win32\",
2015-06-13 17:50:55.770 FileName : "steam_api.dll",
2015-06-13 17:50:55.770 ThreatName : "Mal/VMProtBad-A",
2015-06-13 17:50:55.770 Checksum : "7d47f2b02f36fab432e8febecc0939bd169a05c34253f8ae4f060fefcb5372af",
2015-06-13 17:50:55.770 TimeStamp : "Sat Jun 13 13:50:33 2015"
2015-06-13 17:50:55.770 }
2015-06-13 17:50:55.770 {
2015-06-13 17:50:55.770 RecordID : "0000000000000004",
2015-06-13 17:50:55.770 ItemType : "1",
2015-06-13 17:50:55.770 Location : "D:\Games\Medieval Engineers\Bin\",
2015-06-13 17:50:55.770 FileName : "steam_api.dll",
2015-06-13 17:50:55.770 ThreatName : "Mal/VMProtBad-A",
2015-06-13 17:50:55.770 Checksum : "c15f28dd19a3610cac1f111e51673fe0514d276c2bf556be2b39d2ed90da6066",
2015-06-13 17:50:55.770 TimeStamp : "Sat Jun 13 13:50:33 2015"
2015-06-13 17:50:55.770 }
2015-06-13 17:50:55.770 {
2015-06-13 17:50:55.770 RecordID : "0000000000000005",
2015-06-13 17:50:55.770 ItemType : "1",
2015-06-13 17:50:55.770 Location : "D:\Games\Medieval Engineers\Bin64\",
2015-06-13 17:50:55.770 FileName : "steam_api.dll",
2015-06-13 17:50:55.771 ThreatName : "Mal/VMProtBad-A",
2015-06-13 17:50:55.771 Checksum : "c15f28dd19a3610cac1f111e51673fe0514d276c2bf556be2b39d2ed90da6066",
2015-06-13 17:50:55.771 TimeStamp : "Sat Jun 13 13:50:33 2015"
2015-06-13 17:50:55.771 }
2015-06-13 17:50:55.771 {
2015-06-13 17:50:55.771 RecordID : "0000000000000006",
2015-06-13 17:50:55.771 ItemType : "1",
2015-06-13 17:50:55.771 Location : "D:\Games\Wolfenstein The Old Blood\",
2015-06-13 17:50:55.771 FileName : "steam_api64.dll",
2015-06-13 17:50:55.771 ThreatName : "Mal/Generic-S",
2015-06-13 17:50:55.771 Checksum : "96ceac033dadbba07197a6c4fd768ef7006ab32b8c9652742cc9655ae652fc4e",
2015-06-13 17:50:55.771 TimeStamp : "Sat Jun 13 13:50:52 2015"
2015-06-13 17:50:55.771 }
2015-06-13 17:50:56.333 Error level 0

 

[Broni]

Update Firefox to the current version.

Update your Java version here: https://www.techspot.com/downloads/6463-java-se.html
Alternate download: http://www.java.com/en/download/manual.jsp

Note 1: UNCHECK any pre-checked toolbar and/or software offered with the Java update. The pre-checked toolbars/software are not part of the Java update.
Note 2: If you're running 64-bit system make sure you install BOTH, 32-bit and 64-bit Java.

=================================

Your computer is clean

1. This step will remove all cleaning tools we used, it'll reset restore points (so you won't get reinfected by accidentally using some older restore point) and it'll make some other minor adjustments...
This is a very crucial step so make sure you don't skip it.
Download

DelFix by Xplode to your desktop. Delfix will delete all the used tools and logfiles.

Double-click Delfix.exe to start the tool.
Make sure the following items are checked:

• Activate UAC (optional; some users prefer to keep it off)
• Remove disinfection tools
• Create registry backup
• Purge System Restore
• Reset system settings

Now click "Run" and wait patiently.
Once finished a logfile will be created. You don't have to attach it to your next reply.

2. Make sure Windows Updates are current.

3. If any trojans, rootkits or bootkits were listed among your infection(s), make sure, you change all of your on-line important passwords (bank account(s), secured web sites, etc.) immediately!

4. Check if your browser plugins are up to date.
Firefox - https://www.mozilla.org/en-US/plugincheck/
other browsers: https://browsercheck.qualys.com/ (click on "Scan without installing plugin" and then on "Scan now")

5. Download, and install WOT (Web OF Trust): http://www.mywot.com/. It'll warn you (in most cases) about dangerous web sites.

6. Run Malwarebytes "Quick scan" once in a while to assure safety of your computer.

7. Run Temporary File Cleaner (TFC), AdwCleaner and Junkware Removal Tool (JRT) weekly (you need to redownload these tools since they were removed by DelFix).

8. Download and install Secunia Personal Software Inspector (PSI): https://www.techspot.com/downloads/4898-secunia-personal-software-inspector-psi.html. The Secunia PSI is a FREE security tool designed to detect vulnerable and out-dated programs and plug-ins which expose your PC to attacks. Run it weekly.

9. (optional) If you want to keep all your programs up to date, download and install FileHippo Update Checker.
The Update Checker will scan your computer for installed software, check the versions and then send this information to FileHippo.com to see if there are any newer releases.

10. When installing\updating ANY program, make sure you always select "Custom " installation, so you can UN-check any possible "drive-by-install" (foistware), like toolbars etc., which may try to install along with the legitimate program. Do NOT click "Next" button without looking at any given page.

11. Read:
How did I get infected?, With steps so it does not happen again!: http://www.bleepingcomputer.com/forums/topic2520.html
Simple and easy ways to keep your computer safe and secure on the Internet: http://www.bleepingcomputer.com/tutorials/keep-your-computer-safe-online/
About those Toolbars and Add-ons - Potentially Unwanted Programs (PUPs) which change your browser settings: http://www.bleepingcomputer.com/for...curity-questions-best-practices/#entry3187642

12. Please, let me know, how your computer is doing.

 

[qassimnm]

Thank you for your help, its much appreciated. Since following your steps my PC has been running rather well and I gotta say, the WOT extension is very useful, I wish I would have known about it earlier.