Inactive-A Nengine.dll is missing "i was told this is a virus"

[Ryansee]

This all started with me downloading JLAw links which caused me bsod. I removed bit torrent and It let me to scanning with Malwarebyte, MES and then I tried to find help with dealing with a black screen and mouse cursor that appear before window loading.

I used tdsskiller and it caught something called DS3 service. I used spybot, and free superantispyware. Those antiviruses were me reading about ppl with a problem similiar to mine and I am getting depressed over this and im hoping a proffesional can help me.

 

[Ryansee]

Adwcleaner log

 

[Broni]

Welcome aboard

Please, observe following rules:

• Read all of my instructions very carefully. Your mistakes during cleaning process may have very serious consequences, like unbootable computer.
• If you're stuck, or you're not sure about certain step, always ask before doing anything else.
• Please refrain from running any tools, fixes or applying any changes to your computer other than those I suggest.
• Never run more than one scan at a time.
• Keep updating me regarding your computer behavior, good, or bad.
• The cleaning process, once started, has to be completed. Even if your computer appears to act better, it may still be infected. Once the computer is totally clean, I'll certainly let you know.
• If you leave the topic without explanation in the middle of a cleaning process, you may not be eligible to receive any more help in malware removal forum.
• I close my topics if you have not replied in 5 days. If you need more time, simply let me know. If I closed your topic and you need it to be reopened, simply PM me.

=====================================

Please observe forum rules.
All logs have to be pasted not attached.

 

[Ryansee]

Forgive me my bad misunderstood.

Attach.txt:

.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2012-11-20.01)
.
Microsoft Windows 7 Home Premium
Boot Device: \Device\HarddiskVolume1
Install Date: 6/7/2013 11:35:25 AM
System Uptime: 9/2/2014 10:01:50 PM (0 hours ago)
.
Motherboard: Alienware | | M14xR1
Processor: Intel(R) Core(TM) i7-2630QM CPU @ 2.00GHz | CPU1 | 880/1600mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 699 GiB total, 347.756 GiB free.
D: is CDROM (CDFS)
.
==== Disabled Device Manager Items =============
.
Class GUID: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Description: LogMeIn Kernel Information Provider
Device ID: ROOT\LEGACY_LMIINFO\0000
Manufacturer:
Name: LogMeIn Kernel Information Provider
PNP Device ID: ROOT\LEGACY_LMIINFO\0000
Service: LMIInfo
.
Class GUID: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Description: MpKsl01f98610
Device ID: ROOT\LEGACY_MPKSL01F98610\0000
Manufacturer:
Name: MpKsl01f98610
PNP Device ID: ROOT\LEGACY_MPKSL01F98610\0000
Service: MpKsl01f98610
.
==== System Restore Points ===================
.
RP215: 8/24/2014 7:04:06 PM - Removed LogMeIn Hamachi
RP216: 8/25/2014 2:30:59 AM - Installed Daily Alarm Clock
RP217: 8/25/2014 9:38:01 PM - Installed Naga Firmware Updater 1.13.
RP218: 8/25/2014 10:09:49 PM - Removed Razer Synapse 2.0.
RP219: 8/26/2014 4:11:17 PM - Windows Update
RP220: 8/26/2014 4:44:25 PM - Windows Modules Installer
RP221: 8/29/2014 3:51:05 AM - Windows Update
RP222: 9/2/2014 10:48:41 AM - Windows Update
RP223: 9/2/2014 6:56:14 PM - Installed System Requirements Lab Detection
.
==== Installed Programs ======================
.
7-Zip 9.20 (x64 edition)
AccelerometerP11
Adobe AIR
Adobe Digital Editions 2.0
Adobe Flash Player 14 ActiveX
Adobe Flash Player 14 Plugin
Adobe Reader XI (11.0.06)
Adobe Shockwave Player 12.1
AlienAutopsy
Alienware Command Center
Alienware On-Screen Display
Amnesia: A Machine for Pigs
Amnesia: The Dark Descent
AmrAddonInstall
Anki
Anno 2070
Apple Application Support
Apple Mobile Device Support
Apple Software Update
Ask Mr. Robot
Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver
avast! Free Antivirus
Baidu Antivirus
Battle.net
Bloody Trapland
Bonjour
Castle Crashers
CCleaner
Clownfish for Skype
Contagion
Counter-Strike: Source
Curse
Curse Client
Daily Alarm Clock
DaleSearch Chrome Toolbar
Damned
Dawngate
DayZ
Debut Video Capture Software
Defraggler
Dell System Detect
Democracy 3
Diablo III
DivX Setup
Dropbox
Dungeon Crawl Stone Soup
Dungeon Defenders
Dungeon Defenders Eternity
Dungeon Keeper 2
Elsword
EMSC
f.lux
FileHippo.com Update Checker
focus booster
Foxit Cloud
Foxit Reader
FTL: Faster Than Light
Game Fire
Garry's Mod
GeForce Experience NvStream Client Components
GOG.com Dungeon Keeper 2
Google Chrome
Google Update Helper
Guild Wars 2
Gyazo 2.1
Hearthstone
ImgBurn
InfiniteCrisis_410193F41CAE
Intel PROSet Wireless
Intel(R) Management Engine Components
Intel(R) Processor Graphics
Intel(R) PROSet/Wireless WiFi Software
iTunes
Java 7 Update 67
Java 7 Update 67 (64-bit)
Java Auto Updater
KeePass Password Safe 2.27
Killing Floor
Kraven Manor
Left 4 Dead 2
LibUSB-Win32-0.1.10.1
LOLReplay
lucky leap 1.0.0
Magic 2014
Magicka
Magicka: Wizard Wars
Malwarebytes Anti-Malware version 2.0.2.1012
MATLAB R2009b
MediaInfo 0.7.8
Microsoft .NET Framework 4.5.1
Microsoft Office 2003 Web Components
Microsoft Office 2007 Service Pack 3 (SP3)
Microsoft Office Access MUI (English) 2007
Microsoft Office Access Setup Metadata MUI (English) 2007
Microsoft Office Enterprise 2007
Microsoft Office Excel MUI (English) 2007
Microsoft Office Groove MUI (English) 2007
Microsoft Office Groove Setup Metadata MUI (English) 2007
Microsoft Office InfoPath MUI (English) 2007
Microsoft Office Office 64-bit Components 2007
Microsoft Office OneNote MUI (English) 2007
Microsoft Office Outlook MUI (English) 2007
Microsoft Office PowerPoint MUI (English) 2007
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (English) 2007
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
Microsoft Office Publisher MUI (English) 2007
Microsoft Office Shared 64-bit MUI (English) 2007
Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2007
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office Word MUI (English) 2007
Microsoft Security Client
Microsoft Security Essentials
Microsoft Silverlight
Microsoft Visual Basic for Applications 7.1 (x64)
Microsoft Visual Basic for Applications 7.1 (x64) English
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2005 Redistributable (x64)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.60610
Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.60610
Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.60610
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.21005
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005
Microsoft Visual C++ 2013 x64 Additional Runtime - 12.0.21005
Microsoft Visual C++ 2013 x64 Minimum Runtime - 12.0.21005
Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005
Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005
Microsoft Visual Studio 2005 Remote Debugger Light (x64) - ENU
Microsoft Visual Studio 2005 Tools for Applications - ENU
Microsoft XNA Framework Redistributable 3.1
Microsoft XNA Framework Redistributable 4.0 Refresh
Might & Magic: Heroes VI
mIRC
MKV Player 2.1.15
Mobogenie
MotioninJoy Gamepad tool 0.7.1001
Mozilla Firefox 30.0 (x86 en-US)
Mozilla Maintenance Service
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
Mumble 1.2.4
Naga Firmware Updater 1.13
NVIDIA 3D Vision Driver 335.23
NVIDIA Control Panel 335.23
NVIDIA GeForce Experience 1.8.2.1
NVIDIA Graphics Driver 335.23
NVIDIA HD Audio Driver 1.3.30.1
NVIDIA Install Application
NVIDIA LED Visualizer 1.0
NVIDIA Network Service
NVIDIA Optimus Update 11.10.13
NVIDIA PhysX
NVIDIA PhysX System Software 9.13.1220
NVIDIA ShadowPlay 11.10.13
NVIDIA Stereoscopic 3D Driver
NVIDIA Update 11.10.13
NVIDIA Update Core
NVIDIA Virtual Audio 1.2.20
Origin
Paranormal - CLOSED BETA 7.0
PCSX2 - Playstation 2 Emulator
Pharaoh Gold Bundle
Port Forward Network Utilities 2.0.1
Portal 2
Private Internet Access Support Files
RaidCall
Razer Core
Razer Synapse 2.0
Realtek PCIE Card Reader
Renesas Electronics USB 3.0 Host Controller Driver
Rust
Saints Row IV
Security Update for CAPICOM (KB931906)
Security Update for Microsoft .NET Framework 4.5.1 (KB2898869)
Security Update for Microsoft .NET Framework 4.5.1 (KB2901126)
Security Update for Microsoft .NET Framework 4.5.1 (KB2931368)
Security Update for Microsoft Office 2007 suites (KB2596744) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596754) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596792) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596825) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596871) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2597969) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2597973) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2687439) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2760411) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2760415) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2760585) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2760591) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2817330) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2827326) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2850022) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2878233) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2880507) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2880508) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2880513) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2881069) 32-Bit Edition
Security Update for Microsoft Office Excel 2007 (KB2827324) 32-Bit Edition
Security Update for Microsoft Office InfoPath 2007 (KB2687440) 32-Bit Edition
Security Update for Microsoft Office OneNote 2007 (KB2596857) 32-Bit Edition
Security Update for Microsoft Office PowerPoint 2007 (KB2596764) 32-Bit Edition
Security Update for Microsoft Office PowerPoint 2007 (KB2596912) 32-Bit Edition
Security Update for Microsoft Office Publisher 2007 (KB2817565) 32-Bit Edition
Security Update for Microsoft Office Word 2007 (KB2880515) 32-Bit Edition
SHIELD Streaming
Sid Meier's Civilization IV
Sid Meier's Civilization IV: Beyond the Sword
Sid Meier's Civilization IV: Warlords
Sid Meier's Civilization V
SimCity™
Skype Click to Call
Skype™ 6.18
Software Informer 1.3.1107.0
SolidWorks 2014 x64 Edition SP01
SolidWorks Composer Player 2014 SP01 x64 Edition
SolidWorks eDrawings 2014 x64 Edition SP01
SolidWorks Explorer 2014 SP01 x64 Edition
SolidWorks Plastics 2014 SP01 x64 Edition
Sonic & All-Stars Racing Transformed
SpeedFan (remove only)
Spybot - Search & Destroy
Steam
Strife
SumatraPDF
SUPERAntiSpyware
swMSM
Synaptics Pointing Device Driver
System Requirements Lab Detection
TeamSpeak 3 Client
TeamViewer 9
Terraria
The Wolf Among Us
TortoiseSVN 1.8.2.24708 (64 bit)
Tropico 4
Tropico 5
Tunngle beta
Tweaking.com - Windows Repair (All in One)
Ubisoft Game Launcher
Unity Web Player
Unreal Development Kit: 2012-10
Update for 2007 Microsoft Office System (KB967642)
Update for Microsoft Office 2007 Help for Common Features (KB963673)
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition
Update for Microsoft Office Access 2007 Help (KB963663)
Update for Microsoft Office Excel 2007 Help (KB963678)
Update for Microsoft Office Infopath 2007 Help (KB963662)
Update for Microsoft Office OneNote 2007 Help (KB963670)
Update for Microsoft Office Outlook 2007 (KB2687404) 32-Bit Edition
Update for Microsoft Office Outlook 2007 (KB2863811) 32-Bit Edition
Update for Microsoft Office Outlook 2007 Help (KB963677)
Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2883097) 32-Bit Edition
Update for Microsoft Office Powerpoint 2007 Help (KB963669)
Update for Microsoft Office Publisher 2007 Help (KB963667)
Update for Microsoft Office Script Editor Help (KB963671)
Update for Microsoft Office Word 2007 Help (KB963665)
VC80CRTRedist - 8.0.50727.6195
Ventrilo Client for Windows x64
Vista Services Optimizer
Visual Boy Advance Packages
War of the Roses
War of the Roses Balance Beta
War of the Vikings Alpha
WildStar
WinRAR 5.00 beta 6 (64-bit)
Yahoo! Messenger
Yahoo! Software Update
Yahoo! Toolbar
YouTube Accelerator
.
==== Event Viewer Messages From Past Week ========
.
9/2/2014 8:57:38 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {9E175B6D-F52A-11D8-B9A5-505054503030}
9/2/2014 8:48:18 PM, Error: Service Control Manager [7001] - The WinHTTP Web Proxy Auto-Discovery Service service depends on the DHCP Client service which failed to start because of the following error: The dependency service or group failed to start.
9/2/2014 8:38:03 PM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD aswRdr aswRvrt aswSnx aswSP aswTdi aswVmm Bnbase Bndef DfsC discache MpFilter NetBIOS NetBT nsiproxy Psched rdbss SASDIFSV SASKUTIL spldr tdx vwififlt Wanarpv6 WfpLwf ws2ifsl
9/2/2014 8:38:01 PM, Error: Service Control Manager [7001] - The SMB MiniRedirector Wrapper and Engine service depends on the Redirected Buffering Sub Sysytem service which failed to start because of the following error: A device attached to the system is not functioning.
9/2/2014 8:38:01 PM, Error: Service Control Manager [7001] - The SMB 2.0 MiniRedirector service depends on the SMB MiniRedirector Wrapper and Engine service which failed to start because of the following error: The dependency service or group failed to start.
9/2/2014 8:38:01 PM, Error: Service Control Manager [7001] - The SMB 1.x MiniRedirector service depends on the SMB MiniRedirector Wrapper and Engine service which failed to start because of the following error: The dependency service or group failed to start.
9/2/2014 8:38:01 PM, Error: Service Control Manager [7001] - The Network Location Awareness service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.
9/2/2014 8:38:01 PM, Error: Service Control Manager [7001] - The IP Helper service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.
9/2/2014 8:37:53 PM, Error: Service Control Manager [7001] - The Workstation service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.
9/2/2014 8:37:53 PM, Error: Service Control Manager [7001] - The TCP/IP NetBIOS Helper service depends on the Ancillary Function Driver for Winsock service which failed to start because of the following error: A device attached to the system is not functioning.
9/2/2014 8:37:53 PM, Error: Service Control Manager [7001] - The Network Store Interface Service service depends on the NSI proxy service driver. service which failed to start because of the following error: A device attached to the system is not functioning.
9/2/2014 8:37:53 PM, Error: Service Control Manager [7001] - The DNS Client service depends on the NetIO Legacy TDI Support Driver service which failed to start because of the following error: A device attached to the system is not functioning.
9/2/2014 8:37:53 PM, Error: Service Control Manager [7001] - The DHCP Client service depends on the Ancillary Function Driver for Winsock service which failed to start because of the following error: A device attached to the system is not functioning.
9/2/2014 8:33:13 PM, Error: Service Control Manager [7001] - The Network List Service service depends on the Network Location Awareness service which failed to start because of the following error: The dependency service or group failed to start.
9/2/2014 8:33:12 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}
9/2/2014 8:33:10 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service netprofm with arguments "" in order to run the server: {A47979D2-C419-11D9-A5B4-001185AD2B89}
9/2/2014 8:33:10 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service netman with arguments "" in order to run the server: {BA126AD1-2166-11D1-B1D0-00805FC1270E}
9/2/2014 8:33:08 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
9/2/2014 8:32:58 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service ShellHWDetection with arguments "" in order to run the server: {DD522ACC-F821-461A-A407-50B198B896DC}
9/2/2014 6:53:57 PM, Error: Service Control Manager [7030] - The Foxit Cloud Safe Update Service service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.
9/2/2014 4:34:04 PM, Error: Service Control Manager [7034] - The YouTubeAcceleratorService service terminated unexpectedly. It has done this 1 time(s).
9/2/2014 3:08:58 PM, Error: Microsoft-Windows-WER-SystemErrorReporting [1001] - The computer has rebooted from a bugcheck. The bugcheck was: 0x000000d1 (0x0000000000000028, 0x0000000000000002, 0x0000000000000000, 0xfffff880015666fd). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 090214-38750-01.
9/2/2014 10:39:26 AM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the YouTubeAcceleratorService service to connect.
9/2/2014 10:39:26 AM, Error: Service Control Manager [7000] - The YouTubeAcceleratorService service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
9/2/2014 10:38:03 AM, Error: Microsoft-Windows-WER-SystemErrorReporting [1001] - The computer has rebooted from a bugcheck. The bugcheck was: 0x000000d1 (0x0000000000000028, 0x0000000000000002, 0x0000000000000000, 0xfffff880015256fd). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 090214-42494-01.
9/2/2014 10:09:04 PM, Error: Service Control Manager [7022] - The Windows Update service hung on starting.
9/2/2014 10:04:57 PM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Spybot-S&D 2 Scanner Service service to connect.
9/2/2014 10:04:57 PM, Error: Service Control Manager [7000] - The Spybot-S&D 2 Scanner Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
9/2/2014 10:03:13 PM, Error: Service Control Manager [7000] - The LogMeIn Kernel Information Provider service failed to start due to the following error: The system cannot find the path specified.
9/2/2014 10:03:13 PM, Error: Service Control Manager [7000] - The LibUsb-Win32 - Daemon, Version 0.1.10.1 service failed to start due to the following error: The system cannot find the file specified.
9/2/2014 10:02:18 PM, Error: Application Popup [1060] - \SystemRoot\SysWow64\drivers\libusb0.sys has been blocked from loading due to incompatibility with this system. Please contact your software vendor for a compatible version of the driver.
9/1/2014 8:25:47 PM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the SCP DS3 Service service to connect.
9/1/2014 8:25:47 PM, Error: Service Control Manager [7000] - The SCP DS3 Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
9/1/2014 10:36:49 AM, Error: Service Control Manager [7022] - The SCP DS3 Service service hung on starting.
8/31/2014 3:33:25 PM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Steam Client Service service to connect.
8/31/2014 3:33:25 PM, Error: Service Control Manager [7000] - The Steam Client Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
8/26/2014 7:33:35 AM, Error: Service Control Manager [7022] - The Windows Modules Installer service hung on starting.
8/26/2014 7:33:30 AM, Error: Service Control Manager [7022] - The Function Discovery Resource Publication service hung on starting.
8/26/2014 4:05:51 PM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the Schedule service.
8/26/2014 1:32:56 AM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the iphlpsvc service.
.
==== End Of File ===========================

 

[Ryansee]

DDS:

DDS (Ver_2012-11-20.01) - NTFS_AMD64
Internet Explorer: 11.0.9600.17239 BrowserJavaVersion: 10.67.2
Run by Ahmed at 22:23:40 on 2014-09-02
#Option Extended Search is enabled.
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.8140.3822 [GMT 3:00]
.
AV: Microsoft Security Essentials *Enabled/Updated* {641105E6-77ED-3F35-A304-765193BCB75F}
AV: avast! Antivirus *Enabled/Outdated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
AV: Baidu Antivirus *Disabled/Updated* {10616E6C-0E20-8594-D377-A7D03F6128A6}
SP: avast! Antivirus *Enabled/Outdated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: Baidu Antivirus *Disabled/Updated* {AB008F88-281A-8A1A-E9C7-9CA244E6621B}
SP: Spybot - Search and Destroy *Disabled/Updated* {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}
SP: Microsoft Security Essentials *Enabled/Updated* {DF70E402-51D7-30BB-99B4-4D23E83BFDE2}
.
============== Running Processes ===============
.
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\nvvsvc.exe
C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
C:\Windows\system32\svchost.exe -k RPCSS
c:\Program Files\Microsoft Security Client\MsMpEng.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
C:\Windows\system32\nvvsvc.exe
C:\Program Files\AVAST Software\Avast\AvastSvc.exe
C:\Windows\system32\WLANExt.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\taskeng.exe
C:\Windows\system32\taskhost.exe
C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE
C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe
C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe
C:\Program Files\Intel\WiFi\bin\EvtEng.exe
C:\Program Files (x86)\Foxit Software\Foxit Reader\Foxit Cloud\FCUpdateService.exe
C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
C:\Program Files (x86)\Razer\Core\64bit\rzovlmon.exe
C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
C:\Program Files\Microsoft Security Client\msseces.exe
C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe
C:\Windows\System32\igfxpers.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\hkcmd.exe
C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\AskMrRobot\AmrTray.exe
C:\Program Files\Software Informer\softinfo.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files (x86)\FileHippo.com\UpdateChecker.exe
C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
C:\Program Files (x86)\Skype\Phone\Skype.exe
C:\Windows\SysWOW64\rundll32.exe
C:\Program Files\TortoiseSVN\bin\TSVNCache.exe
C:\Users\Ahmed\AppData\Local\FluxSoftware\Flux\flux.exe
C:\Program Files\Alienware\Command Center\AWCCServiceController.exe
C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
C:\Program Files (x86)\Alienware On-Screen Display\AlienwareOn-ScreenDisplay.exe
C:\Program Files\AVAST Software\Avast\AvastUI.exe
C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Program Files\Alienware\Command Center\AlienwareAlienFXController.exe
C:\Windows\system32\SearchIndexer.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe
c:\Program Files\Microsoft Security Client\NisSrv.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Windows\System32\WUDFHost.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
C:\Windows\System32\rundll32.exe
C:\Program Files\Alienware\Command Center\AWCCApplicationWatcher32.exe
C:\Program Files\Alienware\Command Center\AWCCApplicationWatcher64.exe
C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Windows\system32\wuauclt.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe
C:\Program Files\TortoiseSVN\bin\TSVNCache.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Windows\System32\cscript.exe
.
============== Pseudo HJT Report ===============
.
uSearch Bar = Preserve
mStart Page = hxxp://www.google.com
mDefault_Page_URL = hxxp://www.google.com
mWinlogon: Userinit = userinit.exe,
BHO: Groove GFS Browser Helper: {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll
BHO: Java(tm) Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll
BHO: avast! Online Security: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
BHO: Skype Click to Call for Internet Explorer: {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll
TB: avast! Online Security: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
uRun: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
uRun: [FileHippo.com] "C:\Program Files (x86)\FileHippo.com\UpdateChecker.exe" /background
uRun: [Skype] "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun
uRun: [NextLive] C:\Windows\SysWOW64\rundll32.exe "C:\Users\Ahmed\AppData\Roaming\newnext.me\nengine.dll",EntryPoint -m l
uRun: [F.lux] "C:\Users\Ahmed\AppData\Local\FluxSoftware\Flux\flux.exe" /noshow
mRun: [SDTray] "C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe"
mRun: [AlienwareOn-ScreenDisplay] C:\Program Files (x86)\Alienware On-Screen Display\AlienwareOn-ScreenDisplay.exe
mRun: [KeePass 2 PreLoad] "C:\Program Files (x86)\KeePass Password Safe 2\KeePass.exe" --preload
mRun: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui
mRun: [NUSB3MON] "C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe"
dRunOnce: [SPReview] "C:\Windows\System32\SPReview\SPReview.exe" /sp:1 /errorfwlink:"http://go.microsoft.com/fwlink/?LinkID=122915" /build:7601
uPolicies-Explorer: NoDriveTypeAutoRun = dword:145
mPolicies-Explorer: NoActiveDesktop = dword:1
mPolicies-Explorer: NoActiveDesktopChanges = dword:1
mPolicies-System: ConsentPromptBehaviorUser = dword:3
mPolicies-System: EnableUIADesktopToggle = dword:0
IE: E&xport to Microsoft Excel - C:\PROGRA~2\MICROS~3\Office12\EXCEL.EXE/3000
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files (x86)\Microsoft Office\Office12\ONBttnIE.dll
IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503}
LSP: C:\Program Files (x86)\YouTube Accelerator\ytalsp.dll
Trusted Zone: dell.com
TCP: NameServer = 192.168.1.1 192.168.1.1
TCP: Interfaces\{388291E2-08A3-4FFB-AA5C-8D2F05E0DECF} : DHCPNameServer = 7.254.254.254
TCP: Interfaces\{3D7DB392-8310-4C99-9194-FDDF34DFB51D} : DHCPNameServer = 172.20.10.1
TCP: Interfaces\{893A7A27-7259-4561-BA20-37C578390A09} : DHCPNameServer = 192.168.1.1 192.168.1.1
TCP: Interfaces\{893A7A27-7259-4561-BA20-37C578390A09}\1426F60214C696 : DHCPNameServer = 192.168.0.1
TCP: Interfaces\{893A7A27-7259-4561-BA20-37C578390A09}\1486D65646 : DHCPNameServer = 172.20.10.1
TCP: Interfaces\{893A7A27-7259-4561-BA20-37C578390A09}\1653735613943505 : DHCPNameServer = 192.168.1.1 0.0.0.0
TCP: Interfaces\{893A7A27-7259-4561-BA20-37C578390A09}\16D627021627166616 : DHCPNameServer = 62.240.110.198 62.240.110.197
TCP: Interfaces\{893A7A27-7259-4561-BA20-37C578390A09}\3334F6D6 : DHCPNameServer = 192.168.101.1 192.168.101.4
TCP: Interfaces\{893A7A27-7259-4561-BA20-37C578390A09}\C494E4B44435C4D286F6D656 : DHCPNameServer = 192.168.1.1
TCP: Interfaces\{9695AEC5-758E-4DB9-811D-6D23A04D41EF} : DHCPNameServer = 209.222.18.222 209.222.18.218
TCP: Interfaces\{CC4F8F04-1967-40BA-ACB9-D35D82530A16} : NameServer = 41.128.225.225,42.128.225.226
TCP: Interfaces\{CC4F8F04-1967-40BA-ACB9-D35D82530A16} : DHCPNameServer = 192.168.1.1 192.168.1.1
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveSystemServices.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll
Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
Notify: SDWinLogon - SDWinLogon.dll
AppInit_DLLs= C:\Windows\SysWOW64\nvinit.dll
SSODL: WebCheck - <orphaned>
SEH: Groove GFS Stub Execution Hook - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll
mASetup: {8A69D345-D564-463c-AFF1-A69D9E530F96} - "C:\Program Files (x86)\Google\Chrome\Application\37.0.2062.102\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --multi-install --chrome
x64-mStart Page = hxxp://www.google.com
x64-mDefault_Page_URL = hxxp://www.google.com
x64-BHO: avast! Online Security: {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll
x64-BHO: Java(tm) Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll
x64-BHO: Skype Click to Call for Internet Explorer: {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll
x64-BHO: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll
x64-TB: avast! Online Security: {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll
x64-Run: [SynTPEnh] C:\Program Files (x86)\Synaptics\SynTP\SynTPEnh.exe
x64-Run: [Command Center Controllers] "C:\Program Files\Alienware\Command Center\AWCCStartupOrchestrator.exe"
x64-Run: [ShadowPlay] C:\Windows\System32\rundll32.exe C:\Windows\System32\nvspcap64.dll,ShadowPlayOnSystemStart
x64-Run: [NvBackend] "C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe"
x64-Run: [MSC] "c:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey
x64-Run: [IntelWireless] "C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe" /tf Intel Wireless Tray
x64-Run: [Persistence] "C:\Windows\System32\igfxpers.exe"
x64-Run: [IgfxTray] "C:\Windows\System32\igfxtray.exe"
x64-Run: [HotKeysCmds] "C:\Windows\System32\hkcmd.exe"
x64-Run: [FreeFallProtection] C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe
x64-Run: [Ask Mr. Robot] C:\Program Files\AskMrRobot\AmrTray.exe
x64-IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll
.
INFO: x64-HKLM has more than 50 listed domains.
If you wish to scan all of them, select the 'Force scan all domains' option.
.
x64-Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - <orphaned>
x64-Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - <orphaned>
x64-Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll
x64-Notify: igfxcui - igfxdev.dll
x64-SSODL: WebCheck - <orphaned>
Hosts: 127.0.0.1 www.spywareinfo.com
.
================= FIREFOX ===================
.
FF - ProfilePath - C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\
FF - prefs.js: browser.search.selectedEngine - Bing
FF - prefs.js: browser.startup.homepage - hxxp://www.msn.com/?pc=UP97&ocid=UP97DHP|http://ar.hao123.com/?tn=pcf_inner_protection_01_hao123_ar
FF - prefs.js: keyword.URL - hxxp://www.bing.com/search?FORM=UP97DF&PC=UP97&q=
FF - plugin: C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll
FF - plugin: C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll
FF - plugin: C:\Program Files (x86)\globalUpdate\Update\1.3.25.0\npGoogleUpdate4.dll
FF - plugin: C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll
FF - plugin: C:\Program Files (x86)\Java\jre7\bin\dtplugin\npdeployJava1.dll
FF - plugin: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll
FF - plugin: c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrlui.dll
FF - plugin: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll
FF - plugin: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll
FF - plugin: C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll
FF - plugin: C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypchub.dll
FF - plugin: C:\Users\Ahmed\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll
FF - plugin: C:\Users\Ahmed\AppData\Roaming\raidcall\plugins\nprcplugin.dll
FF - plugin: C:\Windows\System32\Wat\npWatWeb.dll
FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_14_0_0_145.dll
.
============= SERVICES / DRIVERS ===============
.
R0 aswRvrt;aswRvrt;C:\Windows\System32\drivers\aswRvrt.sys [2013-9-20 65336]
R0 aswVmm;aswVmm;C:\Windows\System32\drivers\aswVmm.sys [2013-9-20 204880]
R0 EMSC;COMPAL Embedded System Control;C:\Windows\System32\drivers\EMSC.sys [2009-6-26 16752]
R0 MpFilter;Microsoft Malware Protection Driver;C:\Windows\System32\drivers\MpFilter.sys [2014-1-25 268512]
R0 nvpciflt;nvpciflt;C:\Windows\System32\drivers\nvpciflt.sys [2014-4-3 33736]
R0 stdcfltn;Disk Class Filter Driver for Accelerometer;C:\Windows\System32\drivers\stdcfltn.sys [2013-6-7 21616]
R1 aswSnx;aswSnx;C:\Windows\System32\drivers\aswSnx.sys [2013-9-20 1030952]
R1 aswSP;aswSP;C:\Windows\System32\drivers\aswSP.sys [2013-9-20 378944]
R1 Bfilter;Baidu Antivirus Minifilter Driver;C:\Windows\System32\drivers\Bfilter.sys [2014-7-25 56640]
R1 Bfmon;Baidu FS Monitor Driver;C:\Windows\System32\drivers\Bfmon.sys [2014-7-25 37696]
R1 Bnbase;Bnbase;C:\Windows\System32\drivers\bnbasex64.sys [2014-7-25 91616]
R1 Bndef;Baidu NetDefense;C:\Windows\System32\drivers\bndef64.sys [2014-7-25 70912]
R1 Bprotect;Baidu Protect;C:\Windows\System32\drivers\Bprotect.sys [2014-7-25 144960]
R1 nvkflt;nvkflt;C:\Windows\System32\drivers\nvkflt.sys [2014-4-3 300320]
R1 RzFilter;RzFilter;C:\Windows\System32\drivers\RzFilter.sys [2014-7-26 74432]
R1 SASDIFSV;SASDIFSV;C:\Program Files\SUPERAntiSpyware\sasdifsv64.sys [2011-7-22 14928]
R1 SASKUTIL;SASKUTIL;C:\Program Files\SUPERAntiSpyware\saskutil64.sys [2011-7-13 12368]
R2 !SASCORE;SAS Core Service;C:\Program Files\SUPERAntiSpyware\SASCore64.exe [2014-7-23 172344]
R2 aswFsBlk;aswFsBlk;C:\Windows\System32\drivers\aswFsBlk.sys [2013-9-20 33400]
R2 aswMonFlt;aswMonFlt;C:\Windows\System32\drivers\aswMonFlt.sys [2013-9-20 80816]
R2 avast! Antivirus;avast! Antivirus;C:\Program Files\AVAST Software\Avast\AvastSvc.exe [2013-9-20 46808]
R2 c2cautoupdatesvc;Skype Click to Call Updater;C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [2014-7-14 1390176]
R2 c2cpnrsvc;Skype Click to Call PNR Service;C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [2014-7-14 1767520]
R2 FoxitCloudUpdateService;Foxit Cloud Safe Update Service;C:\Program Files (x86)\Foxit Software\Foxit Reader\Foxit Cloud\FCUpdateService.exe [2014-9-2 242216]
R2 LMIRfsDriver;LogMeIn Remote File System Driver;C:\Windows\System32\drivers\LMIRfsDriver.sys [2013-9-21 72216]
R2 NisDrv;Microsoft Network Inspection System;C:\Windows\System32\drivers\NisDrvWFP.sys [2014-3-11 133928]
R2 NvNetworkService;NVIDIA Network Service;C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [2014-4-4 1593632]
R2 NvStreamSvc;NVIDIA Streamer Service;C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [2014-4-4 16941856]
R2 RzOvlMon;Razer Overlay Subsystem Emergency Service;C:\Program Files (x86)\Razer\Core\64bit\RzOvlMon.exe [2014-4-18 32960]
R2 SDUpdateService;Spybot-S&D 2 Updating Service;C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [2014-9-2 2088408]
R2 SDWSCService;Spybot-S&D 2 Security Center Service;C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [2014-9-2 171928]
R2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2014-4-4 411936]
R2 UNS;Intel(R) Management and Security Application User Notification Service;C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2013-6-7 2656280]
R3 Acceler;Accelerometer Service;C:\Windows\System32\drivers\Accelern.sys [2013-6-7 27760]
R3 dcdbas;System Management Driver;C:\Windows\System32\drivers\dcdbas64.sys [2013-6-7 38472]
R3 IntcDAud;Intel(R) Display Audio;C:\Windows\System32\drivers\IntcDAud.sys [2013-6-7 317440]
R3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;C:\Windows\System32\drivers\L1C62x64.sys [2013-6-7 76912]
R3 MBAMSwissArmy;MBAMSwissArmy;C:\Windows\System32\drivers\MBAMSwissArmy.sys [2014-9-2 122584]
R3 MotioninJoyXFilter;MotioninJoy Virtual Xinput device Filter Driver;C:\Windows\System32\drivers\MijXfilt.sys [2014-6-13 121416]
R3 NisSrv;Microsoft Network Inspection;C:\Program Files\Microsoft Security Client\NisSrv.exe [2014-3-11 347872]
R3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;C:\Windows\System32\drivers\nusb3hub.sys [2011-2-1 80384]
R3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;C:\Windows\System32\drivers\nusb3xhc.sys [2011-2-1 181248]
R3 nvvad_WaveExtensible;NVIDIA Virtual Audio Device (Wave Extensible) (WDM);C:\Windows\System32\drivers\nvvad64v.sys [2014-4-3 39200]
R3 RSPCIESTOR;Realtek PCIE CardReader Driver;C:\Windows\System32\drivers\RtsPStor.sys [2013-6-7 333928]
R3 RzDxgk;RzDxgk;C:\Windows\System32\drivers\RzDxgk.sys [2014-7-26 129472]
R3 ScpVBus;Scp Virtual Bus Driver;C:\Windows\System32\drivers\ScpVBus.sys [2014-8-11 39168]
R3 tap0901t;TAP-Win32 Adapter V9 (Tunngle);C:\Windows\System32\drivers\tap0901t.sys [2014-7-27 31232]
R3 USBAAPL64;Apple Mobile USB Driver;C:\Windows\System32\drivers\usbaapl64.sys [2012-12-13 54784]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2013-9-11 105144]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2013-9-11 124088]
S2 libusbd;LibUsb-Win32 - Daemon, Version 0.1.10.1;system32\libusbd-nt.exe --> system32\libusbd-nt.exe [?]
S2 SDScannerService;Spybot-S&D 2 Scanner Service;C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [2014-9-2 1738168]
S2 SkypeUpdate;Skype Updater;C:\Program Files (x86)\Skype\Updater\Updater.exe [2014-4-3 315008]
S3 CoordinatorServiceHost;SW Distributed TS Coordinator Service;C:\Program Files\SolidWorks Corp\SolidWorks\swScheduler\DTSCoordinatorService.exe [2013-11-15 76328]
S3 FLEXnet Licensing Service 64;FLEXnet Licensing Service 64;C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe [2014-1-22 1431888]
S3 IEEtwCollectorService;Internet Explorer ETW Collector Service;C:\Windows\System32\ieetwcollector.exe [2014-8-13 111616]
S3 MyWiFiDHCPDNS;Wireless PAN DHCP Server;C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [2010-12-17 340240]
S3 Netaapl;Apple Mobile Device Ethernet Service;C:\Windows\System32\drivers\netaapl64.sys [2013-7-25 23040]
S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;C:\Windows\System32\drivers\rdpvideominiport.sys [2014-6-29 19456]
S3 rzudd;Razer Mouse Driver;C:\Windows\System32\drivers\rzudd.sys [2014-5-19 155816]
S3 TsUsbFlt;TsUsbFlt;C:\Windows\System32\drivers\TsUsbFlt.sys [2014-6-29 56832]
S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\System32\Wat\WatAdminSvc.exe [2013-6-8 1255736]
S3 WDC_SAM;WD SCSI Pass Thru driver;C:\Windows\System32\drivers\wdcsam64.sys [2008-5-6 14464]
S4 BAVSvc;Baidu Antivirus Service;C:\Program Files (x86)\Baidu Security\Baidu Antivirus\BAVSvc.exe [2014-7-25 2038248]
S4 BHipsSvc;Baidu Hips Service;C:\Program Files (x86)\Baidu Security\Baidu Antivirus\BHipsSvc.exe [2014-7-25 481432]
S4 TeamViewer9;TeamViewer 9;C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe [2014-7-4 5037888]
S4 TunngleService;TunngleService;C:\Program Files (x86)\Tunngle\TnglCtrl.exe [2014-7-27 758224]
S4 YouTubeAcceleratorService;YouTubeAcceleratorService;C:\PROGRA~2\YOUTUB~1\YouTubeAcceleratorService.exe -start -scm --> C:\PROGRA~2\YOUTUB~1\YouTubeAcceleratorService.exe -start -scm [?]
.
=============== Created Last 60 ================
.
2014-09-02 19:20:40 -------- d-----w- C:\logs
2014-09-02 18:31:06 -------- d-----w- C:\TDSSKiller_Quarantine
2014-09-02 17:04:08 -------- d-----w- C:\Users\Ahmed\AppData\Roaming\KeePass
2014-09-02 16:25:54 -------- d-----w- C:\ProgramData\Informer Technologies, Inc
2014-09-02 16:24:27 -------- d-----w- C:\Users\Ahmed\AppData\Roaming\Software Informer
2014-09-02 16:24:26 -------- d-----w- C:\Program Files\Software Informer
2014-09-02 16:14:24 -------- d-----w- C:\Program Files (x86)\FileHippo.com
2014-09-02 16:03:07 -------- d-----w- C:\Program Files (x86)\KeePass Password Safe 2
2014-09-02 16:00:46 -------- d-----w- C:\Users\Ahmed\AppData\Roaming\Dropbox
2014-09-02 15:59:50 -------- d-----w- C:\Users\Ahmed\AppData\Roaming\Gyazo
2014-09-02 15:58:15 -------- d-----w- C:\Program Files (x86)\SystemRequirementsLab
2014-09-02 15:54:23 -------- d-----w- C:\Users\Ahmed\AppData\Roaming\Foxit Software
2014-09-02 14:22:45 -------- d-----w- C:\Program Files (x86)\Foxit Software
2014-09-02 14:01:23 -------- d-----w- C:\Windows\SysWow64\Adobe
2014-09-02 14:00:34 111016 ----a-w- C:\Windows\System32\WindowsAccessBridge-64.dll
2014-09-02 13:57:56 98216 ----a-w- C:\Windows\SysWow64\WindowsAccessBridge-32.dll
2014-09-02 13:46:01 -------- d---a-w- C:\3590F75ABA9E485486C100C1A9D4FF06ZZ.Z..ZZZZZ....Z
2014-09-02 13:45:50 21040 ----a-w- C:\Windows\System32\sdnclean64.exe
2014-09-02 13:45:44 -------- d-----w- C:\ProgramData\Spybot - Search & Destroy
2014-09-02 13:45:15 -------- d-----w- C:\Program Files (x86)\Spybot - Search & Destroy 2
2014-09-02 13:40:42 -------- d-----w- C:\Program Files\Defraggler
2014-09-02 12:40:08 -------- d-----w- C:\SUPERDelete
2014-09-02 12:38:05 -------- d-----w- C:\Users\Ahmed\AppData\Roaming\SUPERAntiSpyware.com
2014-09-02 12:36:55 -------- d-----w- C:\ProgramData\SUPERAntiSpyware.com
2014-09-02 12:36:55 -------- d-----w- C:\Program Files\SUPERAntiSpyware
2014-09-02 12:25:57 1169712 ----a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{748542A2-DAFC-4239-9186-33CE169A7321}\gapaengine.dll
2014-09-02 12:25:47 11319192 ----a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{6BB67563-7113-4011-AED3-D722B41E2734}\mpengine.dll
2014-09-02 12:20:54 122584 ----a-w- C:\Windows\System32\drivers\MBAMSwissArmy.sys
2014-09-02 12:20:19 91352 ----a-w- C:\Windows\System32\drivers\mbamchameleon.sys
2014-09-02 12:20:18 63704 ----a-w- C:\Windows\System32\drivers\mwac.sys
2014-09-02 12:20:17 -------- d-----w- C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-09-02 12:20:03 -------- d-----w- C:\Program Files (x86)\Microsoft Security Client
2014-09-02 12:19:50 -------- d-----w- C:\Program Files\Microsoft Security Client
2014-09-02 07:49:50 11319192 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{1939B7FD-1B0E-46DC-9ED2-DAA779942156}\mpengine.dll
2014-08-31 16:04:06 -------- d-----w- C:\Program Files (x86)\psx emulation cheater
2014-08-28 16:29:11 3163648 ----a-w- C:\Windows\System32\win32k.sys
2014-08-28 16:29:10 404480 ----a-w- C:\Windows\System32\gdi32.dll
2014-08-28 16:29:10 311808 ----a-w- C:\Windows\SysWow64\gdi32.dll
2014-08-25 18:38:37 300408 ----a-r- C:\Users\Ahmed\AppData\Roaming\Microsoft\Installer\{5A336D74-E680-4986-96F4-E9CEBC784F56}\ARPPRODUCTICON.exe
2014-08-25 18:38:37 136568 ----a-r- C:\Users\Ahmed\AppData\Roaming\Microsoft\Installer\{5A336D74-E680-4986-96F4-E9CEBC784F56}\ShortcutUpdater_DF0BD54B5FA14948AAC4D5BDB1FBFCF2.exe
2014-08-24 23:31:57 -------- d-----w- C:\Program Files (x86)\Daily Alarm Clock
2014-08-18 02:01:14 99480 ----a-w- C:\Windows\SysWow64\infocardapi.dll
2014-08-18 02:01:14 619672 ----a-w- C:\Windows\SysWow64\icardagt.exe
2014-08-18 02:01:14 171160 ----a-w- C:\Windows\System32\infocardapi.dll
2014-08-18 02:01:14 1389208 ----a-w- C:\Windows\System32\icardagt.exe
2014-08-18 02:01:11 8856 ----a-w- C:\Windows\SysWow64\icardres.dll
2014-08-18 02:01:11 8856 ----a-w- C:\Windows\System32\icardres.dll
2014-08-18 02:00:55 35480 ----a-w- C:\Windows\SysWow64\TsWpfWrp.exe
2014-08-18 02:00:55 35480 ----a-w- C:\Windows\System32\TsWpfWrp.exe
2014-08-13 20:28:50 7168 ----a-w- C:\Windows\SysWow64\KBDYAK.DLL
2014-08-13 20:28:49 7168 ----a-w- C:\Windows\System32\KBDYAK.DLL
2014-08-13 20:28:49 7168 ----a-w- C:\Windows\System32\KBDBASH.DLL
2014-08-13 20:28:49 6656 ----a-w- C:\Windows\SysWow64\KBDBASH.DLL
2014-08-13 20:28:01 2048 ----a-w- C:\Windows\SysWow64\tzres.dll
2014-08-13 20:28:01 2048 ----a-w- C:\Windows\System32\tzres.dll
2014-08-13 20:24:03 1216000 ----a-w- C:\Windows\System32\rpcrt4.dll
2014-08-13 20:24:02 664064 ----a-w- C:\Windows\SysWow64\rpcrt4.dll
2014-08-12 02:28:38 -------- d-----w- C:\Users\Ahmed\AppData\Local\Installer
2014-08-12 02:20:34 -------- d-sh--w- C:\Users\Ahmed\AppData\Local\EmieUserList
2014-08-12 02:20:34 -------- d-sh--w- C:\Users\Ahmed\AppData\Local\EmieSiteList
2014-08-12 02:11:12 -------- d-----w- C:\Program Files (x86)\YouTube Accelerator
2014-08-12 02:11:03 172032 ----a-w- C:\Windows\SysWow64\AniGIF.ocx
2014-08-12 02:10:15 -------- d-----w- C:\Program Files (x86)\PCSXR
2014-08-12 02:10:05 -------- d-----w- C:\Users\Ahmed\AppData\Local\globalUpdate
2014-08-12 02:10:05 -------- d-----w- C:\Program Files (x86)\globalUpdate
2014-08-11 18:12:59 39168 ----a-w- C:\Windows\System32\drivers\ScpVBus.sys
2014-08-11 18:12:59 1002728 ----a-w- C:\Windows\System32\WinUSBCoInstaller2.dll
2014-08-11 18:11:49 -------- d-----w- C:\Program Files\Scarlet.Crush Productions
2014-08-10 21:22:21 -------- d-----w- C:\Users\Ahmed\AppData\Roaming\AVG
2014-08-10 21:22:21 -------- d-----w- C:\Users\Ahmed\AppData\Local\AVG
2014-08-10 21:20:26 -------- d-----w- C:\ProgramData\AVG
2014-08-10 21:20:19 -------- d-sh--w- C:\ProgramData\{01BD4FC9-2F86-4706-A62E-774BB7E9D308}
2014-08-10 21:20:19 -------- d--h--w- C:\ProgramData\Common Files
2014-08-10 20:56:59 -------- d-----w- C:\Program Files (x86)\PCSX2 1.2.1
2014-08-09 18:36:14 455328 ----a-w- C:\Windows\SysWow64\msvcp120.dll
2014-08-09 18:36:08 660128 ----a-w- C:\Windows\System32\msvcp120.dll
2014-08-09 18:35:16 -------- d-----w- C:\ProgramData\Logs
2014-08-09 18:35:12 19392 ----a-w- C:\Windows\System32\roboot64.exe
2014-08-03 20:13:44 -------- d-----w- C:\Program Files\Echobit
2014-07-31 18:25:53 -------- d-----w- C:\ProgramData\Echobit
2014-07-31 18:25:52 -------- d-----w- C:\Users\Ahmed\AppData\Local\Echobit
2014-07-27 20:07:32 -------- d-----w- C:\Users\Ahmed\AppData\Roaming\PortForward.com
2014-07-27 20:07:30 -------- d-----w- C:\Program Files (x86)\Portforward.com
2014-07-27 13:38:05 -------- d-----w- C:\Users\Ahmed\AppData\Roaming\Tunngle
2014-07-27 13:38:05 -------- d-----w- C:\ProgramData\Tunngle
2014-07-27 13:38:02 31232 ----a-w- C:\Windows\System32\drivers\tap0901t.sys
2014-07-27 13:38:00 -------- d-----w- C:\Program Files (x86)\Tunngle
2014-07-27 11:16:12 -------- d-----w- C:\Users\Ahmed\AppData\Local\Razer
2014-07-26 21:28:24 -------- d-----w- C:\Program Files (x86)\Dungeon Defenders 2
2014-07-26 16:41:56 74432 ----a-w- C:\Windows\System32\drivers\RzFilter.sys
2014-07-26 16:41:51 129472 ----a-w- C:\Windows\System32\drivers\RzDxgk.sys
2014-07-26 16:40:02 -------- d-----w- C:\Windows\Razer Core
2014-07-25 20:46:51 -------- d-----w- C:\Users\Ahmed\AppData\Local\Razer_Inc
2014-07-25 16:22:06 91616 ----a-w- C:\Windows\System32\drivers\Bnbasex.sys
2014-07-25 16:22:06 70912 ----a-w- C:\Windows\System32\drivers\Bndef.sys
2014-07-25 16:04:08 -------- d-----w- C:\Users\Ahmed\AppData\Roaming\Baidu
2014-07-25 16:04:07 144960 ----a-w- C:\Windows\System32\drivers\Bprotect.sys
2014-07-25 16:04:02 37696 ----a-w- C:\Windows\System32\drivers\Bfmon.sys
2014-07-25 16:03:58 56640 ----a-w- C:\Windows\System32\drivers\Bfilter.sys
2014-07-25 16:03:55 91616 ----a-w- C:\Windows\System32\drivers\bnbasex64.sys
2014-07-25 16:03:55 70912 ----a-w- C:\Windows\System32\drivers\bndef64.sys
2014-07-25 16:03:46 -------- d-----w- C:\ProgramData\baidu
2014-07-21 03:00:33 294912 ----a-w- C:\Windows\System32\browserchoice.exe
2014-07-19 18:01:06 -------- d-----w- C:\Users\Ahmed\AppData\Roaming\Titanium
2014-07-19 17:59:54 31232 ----a-w- C:\Windows\System32\drivers\tap0901.sys
2014-07-19 17:59:45 -------- d-----w- C:\Program Files\pia_manager
2014-07-16 15:47:24 -------- d-----w- C:\ProgramData\Riot Games
2014-07-12 13:40:23 -------- d-----w- C:\Users\Ahmed\AppData\Roaming\UDP Software
2014-07-11 21:55:34 -------- d-----w- C:\df
2014-07-09 17:04:14 497152 ----a-w- C:\Windows\System32\drivers\afd.sys
2014-07-09 17:04:13 1719296 ----a-w- C:\Program Files\Windows Journal\NBDoc.DLL
2014-07-09 17:04:13 1380864 ----a-w- C:\Program Files\Windows Journal\JNTFiltr.dll
2014-07-09 17:04:12 936960 ----a-w- C:\Program Files (x86)\Common Files\Microsoft Shared\ink\journal.dll
2014-07-09 17:04:12 1389568 ----a-w- C:\Program Files\Windows Journal\JNWDRV.dll
2014-07-09 17:04:12 1354240 ----a-w- C:\Program Files\Common Files\Microsoft Shared\ink\journal.dll
2014-07-09 17:01:20 1460736 ----a-w- C:\Windows\System32\lsasrv.dll
2014-07-09 17:01:19 22016 ----a-w- C:\Windows\SysWow64\secur32.dll
2014-07-09 17:01:18 96768 ----a-w- C:\Windows\SysWow64\sspicli.dll
2014-07-09 15:27:51 -------- d-----w- C:\PeridexisErrant LNP r65
.
==================== Find6M ====================
.
2014-07-25 14:02:12 2724864 ----a-w- C:\Windows\System32\mshtml.tlb
2014-07-25 14:01:41 4096 ----a-w- C:\Windows\System32\ieetwcollectorres.dll
2014-07-25 13:30:30 66048 ----a-w- C:\Windows\System32\iesetup.dll
2014-07-25 13:28:35 48640 ----a-w- C:\Windows\System32\ieetwproxystub.dll
2014-07-25 13:28:27 548352 ----a-w- C:\Windows\System32\vbscript.dll
2014-07-25 13:25:45 83968 ----a-w- C:\Windows\System32\MshtmlDac.dll
2014-07-25 13:04:40 2724864 ----a-w- C:\Windows\SysWow64\mshtml.tlb
2014-07-25 13:00:51 139264 ----a-w- C:\Windows\System32\ieUnatt.exe
2014-07-25 13:00:25 111616 ----a-w- C:\Windows\System32\ieetwcollector.exe
2014-07-25 12:59:28 758272 ----a-w- C:\Windows\System32\jscript9diag.dll
2014-07-25 12:47:25 940032 ----a-w- C:\Windows\System32\MsSpellCheckingFacility.exe
2014-07-25 12:34:49 61952 ----a-w- C:\Windows\SysWow64\iesetup.dll
2014-07-25 12:34:03 455168 ----a-w- C:\Windows\SysWow64\vbscript.dll
2014-07-25 12:33:08 51200 ----a-w- C:\Windows\SysWow64\ieetwproxystub.dll
2014-07-25 12:30:32 61952 ----a-w- C:\Windows\SysWow64\MshtmlDac.dll
2014-07-25 12:28:15 5824512 ----a-w- C:\Windows\System32\jscript9.dll
2014-07-25 12:28:05 72704 ----a-w- C:\Windows\System32\JavaScriptCollectionAgent.dll
2014-07-25 12:10:15 112128 ----a-w- C:\Windows\SysWow64\ieUnatt.exe
2014-07-25 12:08:47 597504 ----a-w- C:\Windows\SysWow64\jscript9diag.dll
2014-07-25 12:06:47 4204032 ----a-w- C:\Windows\SysWow64\jscript9.dll
2014-07-25 11:43:16 60416 ----a-w- C:\Windows\SysWow64\JavaScriptCollectionAgent.dll
2014-07-25 11:39:29 2087936 ----a-w- C:\Windows\System32\inetcpl.cpl
2014-07-25 11:39:25 1249280 ----a-w- C:\Windows\System32\mshtmlmedia.dll
2014-07-25 11:07:49 2001920 ----a-w- C:\Windows\SysWow64\inetcpl.cpl
2014-07-25 11:07:10 1068032 ----a-w- C:\Windows\SysWow64\mshtmlmedia.dll
2014-07-25 10:52:06 2266624 ----a-w- C:\Windows\System32\wininet.dll
2014-07-25 10:05:23 1792512 ----a-w- C:\Windows\SysWow64\wininet.dll
2014-07-09 14:15:35 71344 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
2014-07-09 14:15:35 699056 ----a-w- C:\Windows\SysWow64\FlashPlayerApp.exe
2014-06-18 02:18:30 692736 ----a-w- C:\Windows\System32\osk.exe
2014-06-18 01:51:32 646144 ----a-w- C:\Windows\SysWow64\osk.exe
2014-06-16 02:10:19 985536 ----a-w- C:\Windows\System32\drivers\dxgkrnl.sys
2014-06-06 10:10:34 624128 ----a-w- C:\Windows\System32\qedit.dll
2014-06-06 09:44:17 509440 ----a-w- C:\Windows\SysWow64\qedit.dll
2014-06-03 10:02:37 112064 ----a-w- C:\Windows\System32\consent.exe
2014-06-03 10:02:21 504320 ----a-w- C:\Windows\System32\msihnd.dll
2014-06-03 10:02:21 3241984 ----a-w- C:\Windows\System32\msi.dll
2014-06-03 10:02:12 1941504 ----a-w- C:\Windows\System32\authui.dll
2014-06-03 09:29:50 337408 ----a-w- C:\Windows\SysWow64\msihnd.dll
2014-06-03 09:29:50 2363392 ----a-w- C:\Windows\SysWow64\msi.dll
2014-06-03 09:29:40 1805824 ----a-w- C:\Windows\SysWow64\authui.dll
2014-05-30 08:08:52 210944 ----a-w- C:\Windows\System32\wdigest.dll
2014-05-30 08:08:49 86528 ----a-w- C:\Windows\System32\TSpkg.dll
2014-05-30 08:08:47 340992 ----a-w- C:\Windows\System32\schannel.dll
2014-05-30 08:08:41 314880 ----a-w- C:\Windows\System32\msv1_0.dll
2014-05-30 08:08:41 307200 ----a-w- C:\Windows\System32\ncrypt.dll
2014-05-30 08:08:36 728064 ----a-w- C:\Windows\System32\kerberos.dll
2014-05-30 08:08:31 22016 ----a-w- C:\Windows\System32\credssp.dll
2014-05-30 07:52:51 172032 ----a-w- C:\Windows\SysWow64\wdigest.dll
2014-05-30 07:52:49 65536 ----a-w- C:\Windows\SysWow64\TSpkg.dll
2014-05-30 07:52:45 247808 ----a-w- C:\Windows\SysWow64\schannel.dll
2014-05-30 07:52:41 220160 ----a-w- C:\Windows\SysWow64\ncrypt.dll
2014-05-30 07:52:40 259584 ----a-w- C:\Windows\SysWow64\msv1_0.dll
2014-05-30 07:52:36 550912 ----a-w- C:\Windows\SysWow64\kerberos.dll
2014-05-30 07:52:30 17408 ----a-w- C:\Windows\SysWow64\credssp.dll
2014-05-29 05:32:14 80384 ----a-w- C:\Windows\System32\RazerCoinstaller.dll
2014-05-19 06:47:28 155816 ----a-w- C:\Windows\System32\drivers\rzudd.sys
2014-05-19 06:26:50 89088 ----a-w- C:\Windows\SysWow64\rzdevinfo.dll
2014-05-14 16:21:04 2620928 ----a-w- C:\Windows\System32\wucltux.dll
2014-05-14 16:20:45 97792 ----a-w- C:\Windows\System32\wudriver.dll
2014-05-14 16:17:10 92672 ----a-w- C:\Windows\SysWow64\wudriver.dll
2014-05-14 07:23:04 198600 ----a-w- C:\Windows\System32\wuwebv.dll
2014-05-14 07:23:04 179656 ----a-w- C:\Windows\SysWow64\wuwebv.dll
2014-05-14 07:20:46 36864 ----a-w- C:\Windows\System32\wuapp.exe
2014-05-14 07:17:14 33792 ----a-w- C:\Windows\SysWow64\wuapp.exe
2014-05-12 04:25:56 25816 ----a-w- C:\Windows\System32\drivers\mbam.sys
2014-05-09 06:14:03 477184 ----a-w- C:\Windows\System32\aepdu.dll
2014-05-09 06:11:23 424448 ----a-w- C:\Windows\System32\aeinv.dll
2014-05-08 09:32:11 3178496 ----a-w- C:\Windows\System32\rdpcorets.dll
2014-05-08 09:32:11 16384 ----a-w- C:\Windows\System32\RdpGroupPolicyExtension.dll
2014-04-25 02:34:59 801280 ----a-w- C:\Windows\System32\usp10.dll
2014-04-25 02:06:17 626688 ----a-w- C:\Windows\SysWow64\usp10.dll
2014-04-12 02:22:05 95680 ----a-w- C:\Windows\System32\drivers\ksecdd.sys
2014-04-12 02:22:05 155072 ----a-w- C:\Windows\System32\drivers\ksecpkg.sys
2014-04-12 02:19:38 29184 ----a-w- C:\Windows\System32\sspisrv.dll
2014-04-12 02:19:38 136192 ----a-w- C:\Windows\System32\sspicli.dll
2014-04-12 02:19:37 28160 ----a-w- C:\Windows\System32\secur32.dll
2014-04-12 02:19:05 31232 ----a-w- C:\Windows\System32\lsass.exe
2014-04-05 02:47:20 1903552 ----a-w- C:\Windows\System32\drivers\tcpip.sys
2014-04-05 02:47:09 288192 ----a-w- C:\Windows\System32\drivers\FWPKCLNT.SYS
2014-03-31 20:46:48 130712 ----a-w- C:\Windows\SysWow64\MSSTDFMT.DLL
2014-03-26 14:44:48 2002432 ----a-w- C:\Windows\System32\msxml6.dll
2014-03-26 14:44:48 1882112 ----a-w- C:\Windows\System32\msxml3.dll
2014-03-26 14:41:39 2048 ----a-w- C:\Windows\System32\msxml6r.dll
2014-03-26 14:41:39 2048 ----a-w- C:\Windows\System32\msxml3r.dll
2014-03-26 14:27:50 1389056 ----a-w- C:\Windows\SysWow64\msxml6.dll
2014-03-26 14:27:50 1237504 ----a-w- C:\Windows\SysWow64\msxml3.dll
2014-03-26 14:25:14 2048 ----a-w- C:\Windows\SysWow64\msxml6r.dll
2014-03-26 14:25:14 2048 ----a-w- C:\Windows\SysWow64\msxml3r.dll
2014-03-11 06:52:30 133928 ----a-w- C:\Windows\System32\drivers\NisDrvWFP.sys
.
============= FINISH: 22:25:09.55 ===============

 

[Ryansee]

Malwarebyte log 1:

Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 9/2/2014
Scan Time: 8:57:37 PM
Logfile: Log 1.txt
Administrator: Yes

Version: 2.00.2.1012
Malware Database: v2014.09.02.04
Rootkit Database: v2014.08.21.01
License: Free
Malware Protection: Disabled
Malicious Website Protection: Disabled
Self-protection: Disabled

OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: Ahmed

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 367099
Time Elapsed: 16 min, 14 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Enabled
Heuristics: Enabled
PUP: Warn
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 0
(No malicious items detected)

Registry Values: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Folders: 0
(No malicious items detected)

Files: 5
PUP.Optional.OutBrowse, C:\Users\Ahmed\Desktop\Week 1\setup (1).exe, Quarantined, [efaaf9d0aecd2214d210c7e41ae759a7],
PUP.Optional.OutBrowse, C:\Users\Ahmed\Desktop\Week 1\setup.exe, Quarantined, [2d6ca9206e0d58de0dd59d0e1ce5d42c],
PUP.Optional.OpenCandy, C:\Users\Ahmed\Desktop\Week 1\SetupImgBurn_2.5.8.0.exe, Quarantined, [1b7ea920f883ce684c152ae4bb4aa25e],
PUP.Optional.Superfish.A, C:\Users\Ahmed\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_www.superfish.com_0.localstorage, Quarantined, [8c0db415d5a64fe75336cb3c73900af6],
PUP.Optional.Superfish.A, C:\Users\Ahmed\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_www.superfish.com_0.localstorage-journal, Quarantined, [0099f0d9304b0432345557b032d1619f],

Physical Sectors: 0
(No malicious items detected)


(end)

 

[Ryansee]

MBAM log 2:

Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 9/2/2014
Scan Time: 3:22:42 PM
Logfile: log 2.txt
Administrator: Yes

Version: 2.00.2.1012
Malware Database: v2014.09.02.04
Rootkit Database: v2014.08.21.01
License: Free
Malware Protection: Disabled
Malicious Website Protection: Disabled
Self-protection: Disabled

OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: Ahmed

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 366273
Time Elapsed: 50 min, 38 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Warn
PUM: Enabled

Processes: 2
PUP.Optional.GeForce.A, C:\Program Files (x86)\Ge-Force\d4809700-4200-4dc7-964d-8305d49a89fc-6.exe, 2344, Delete-on-Reboot, [c814b731a4d7ef475fff158c778a7f81]
PUP.Optional.Sense.A, C:\Program Files (x86)\Sense\c0bc3bff-370e-4b36-b76a-4bd2c9c5e6ec-6.exe, 2640, Delete-on-Reboot, [00dceafeec8fca6c54334e0abe437f81]

Modules: 2
PUP.Optional.Sense.A, C:\Program Files (x86)\Sense\ceda7ba7-8761-445a-aecc-28ac6e68466f.dll, Delete-on-Reboot, [e2fa39aff685f0466fba0e0efb08639d],
PUP.Optional.GeForce.A, C:\Program Files (x86)\Ge-Force\11ad77be-193b-4112-996e-9a01659ee7f7.dll, Delete-on-Reboot, [77651eca2853c96dbd075b847e84e31d],

Registry Keys: 110
PUP.Optional.Sense.A, HKLM\SOFTWARE\CLASSES\CLSID\{11111111-1111-1111-1111-110611191115}, Quarantined, [bc209c4c413a90a65532aaae3bc6a35d],
PUP.Optional.Sense.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{11111111-1111-1111-1111-110611191115}, Quarantined, [bc209c4c413a90a65532aaae3bc6a35d],
PUP.Optional.Sense.A, HKLM\SOFTWARE\CLASSES\TYPELIB\{44444444-4444-4444-4444-440644194415}, Quarantined, [bc209c4c413a90a65532aaae3bc6a35d],
PUP.Optional.Sense.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{55555555-5555-5555-5555-550655195515}, Quarantined, [bc209c4c413a90a65532aaae3bc6a35d],
PUP.Optional.Sense.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{66666666-6666-6666-6666-660666196615}, Quarantined, [bc209c4c413a90a65532aaae3bc6a35d],
PUP.Optional.Sense.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{55555555-5555-5555-5555-550655195515}, Quarantined, [bc209c4c413a90a65532aaae3bc6a35d],
PUP.Optional.Sense.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{66666666-6666-6666-6666-660666196615}, Quarantined, [bc209c4c413a90a65532aaae3bc6a35d],
PUP.Optional.Sense.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\TYPELIB\{44444444-4444-4444-4444-440644194415}, Quarantined, [bc209c4c413a90a65532aaae3bc6a35d],
PUP.Optional.Sense.A, HKLM\SOFTWARE\CLASSES\CrossriderApp0061915.BHO.1, Quarantined, [bc209c4c413a90a65532aaae3bc6a35d],
PUP.Optional.Sense.A, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{11111111-1111-1111-1111-110611191115}, Quarantined, [bc209c4c413a90a65532aaae3bc6a35d],
PUP.Optional.Sense.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{11111111-1111-1111-1111-110611191115}, Quarantined, [bc209c4c413a90a65532aaae3bc6a35d],
PUP.Optional.Sense.A, HKLM\SOFTWARE\CLASSES\CrossriderApp0061915.BHO, Quarantined, [bc209c4c413a90a65532aaae3bc6a35d],
PUP.Optional.Sense.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CrossriderApp0061915.BHO, Quarantined, [bc209c4c413a90a65532aaae3bc6a35d],
PUP.Optional.Sense.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CrossriderApp0061915.BHO.1, Quarantined, [bc209c4c413a90a65532aaae3bc6a35d],
PUP.Optional.Sense.A, HKU\S-1-5-21-4037467554-2527304460-3365707105-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{11111111-1111-1111-1111-110611191115}, Quarantined, [bc209c4c413a90a65532aaae3bc6a35d],
PUP.Optional.Sense.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{22222222-2222-2222-2222-220622192215}, Quarantined, [bc209c4c413a90a65532aaae3bc6a35d],
PUP.Optional.Sense.A, HKLM\SOFTWARE\CLASSES\CrossriderApp0061915.Sandbox.1, Quarantined, [bc209c4c413a90a65532aaae3bc6a35d],
PUP.Optional.Sense.A, HKLM\SOFTWARE\CLASSES\CrossriderApp0061915.Sandbox, Quarantined, [bc209c4c413a90a65532aaae3bc6a35d],
PUP.Optional.Sense.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CrossriderApp0061915.Sandbox, Quarantined, [bc209c4c413a90a65532aaae3bc6a35d],
PUP.Optional.Sense.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CrossriderApp0061915.Sandbox.1, Quarantined, [bc209c4c413a90a65532aaae3bc6a35d],
PUP.Optional.Sense.A, HKLM\SOFTWARE\CLASSES\CLSID\{22222222-2222-2222-2222-220622192215}, Quarantined, [bc209c4c413a90a65532aaae3bc6a35d],
PUP.Optional.Sense.A, HKLM\SOFTWARE\CLASSES\CLSID\{11111111-1111-1111-1111-110611191115}\INPROCSERVER32, Quarantined, [bc209c4c413a90a65532aaae3bc6a35d],
PUP.Optional.GeForce.A, HKLM\SOFTWARE\CLASSES\CLSID\{11111111-1111-1111-1111-110611191111}, Quarantined, [53890bdd463500368bd3544d8f727e82],
PUP.Optional.GeForce.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{11111111-1111-1111-1111-110611191111}, Quarantined, [53890bdd463500368bd3544d8f727e82],
PUP.Optional.GeForce.A, HKLM\SOFTWARE\CLASSES\TYPELIB\{44444444-4444-4444-4444-440644194411}, Quarantined, [53890bdd463500368bd3544d8f727e82],
PUP.Optional.GeForce.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{55555555-5555-5555-5555-550655195511}, Quarantined, [53890bdd463500368bd3544d8f727e82],
PUP.Optional.GeForce.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{66666666-6666-6666-6666-660666196611}, Quarantined, [53890bdd463500368bd3544d8f727e82],
PUP.Optional.GeForce.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{55555555-5555-5555-5555-550655195511}, Quarantined, [53890bdd463500368bd3544d8f727e82],
PUP.Optional.GeForce.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{66666666-6666-6666-6666-660666196611}, Quarantined, [53890bdd463500368bd3544d8f727e82],
PUP.Optional.GeForce.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\TYPELIB\{44444444-4444-4444-4444-440644194411}, Quarantined, [53890bdd463500368bd3544d8f727e82],
PUP.Optional.GeForce.A, HKLM\SOFTWARE\CLASSES\CrossriderApp0061911.BHO.1, Quarantined, [53890bdd463500368bd3544d8f727e82],
PUP.Optional.GeForce.A, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{11111111-1111-1111-1111-110611191111}, Quarantined, [53890bdd463500368bd3544d8f727e82],
PUP.Optional.GeForce.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{11111111-1111-1111-1111-110611191111}, Quarantined, [53890bdd463500368bd3544d8f727e82],
PUP.Optional.GeForce.A, HKLM\SOFTWARE\CLASSES\CrossriderApp0061911.BHO, Quarantined, [53890bdd463500368bd3544d8f727e82],
PUP.Optional.GeForce.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CrossriderApp0061911.BHO, Quarantined, [53890bdd463500368bd3544d8f727e82],
PUP.Optional.GeForce.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CrossriderApp0061911.BHO.1, Quarantined, [53890bdd463500368bd3544d8f727e82],
PUP.Optional.GeForce.A, HKU\S-1-5-21-4037467554-2527304460-3365707105-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{11111111-1111-1111-1111-110611191111}, Quarantined, [53890bdd463500368bd3544d8f727e82],
PUP.Optional.GeForce.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{22222222-2222-2222-2222-220622192211}, Quarantined, [53890bdd463500368bd3544d8f727e82],
PUP.Optional.GeForce.A, HKLM\SOFTWARE\CLASSES\CrossriderApp0061911.Sandbox.1, Quarantined, [53890bdd463500368bd3544d8f727e82],
PUP.Optional.GeForce.A, HKLM\SOFTWARE\CLASSES\CrossriderApp0061911.Sandbox, Quarantined, [53890bdd463500368bd3544d8f727e82],
PUP.Optional.GeForce.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CrossriderApp0061911.Sandbox, Quarantined, [53890bdd463500368bd3544d8f727e82],
PUP.Optional.GeForce.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CrossriderApp0061911.Sandbox.1, Quarantined, [53890bdd463500368bd3544d8f727e82],
PUP.Optional.GeForce.A, HKLM\SOFTWARE\CLASSES\CLSID\{22222222-2222-2222-2222-220622192211}, Quarantined, [53890bdd463500368bd3544d8f727e82],
PUP.Optional.GeForce.A, HKLM\SOFTWARE\CLASSES\CLSID\{11111111-1111-1111-1111-110611191111}\INPROCSERVER32, Quarantined, [53890bdd463500368bd3544d8f727e82],
PUP.Optional.BrowseFox.A, HKLM\SOFTWARE\CLASSES\CLSID\{4AA46D49-459F-4358-B4D1-169048547C23}, Quarantined, [3e9e8662631840f6d3fa2e8334cebd43],
PUP.Optional.Softonic.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{5018CFD2-804D-4C99-9F81-25EAEA2769DE}, Quarantined, [ebf107e1ec8fbf7797c37506887af60a],
PUP.Optional.Softonic.A, HKU\S-1-5-21-4037467554-2527304460-3365707105-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{5018CFD2-804D-4C99-9F81-25EAEA2769DE}, Quarantined, [ebf107e1ec8fbf7797c37506887af60a],
PUP.Optional.Softonic.A, HKU\S-1-5-21-4037467554-2527304460-3365707105-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{5018CFD2-804D-4C99-9F81-25EAEA2769DE}, Quarantined, [ebf107e1ec8fbf7797c37506887af60a],
PUP.Optional.Outbrowse, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{6D4506CE-F855-4657-AA38-DB6B1F733982}, Quarantined, [24b8c3251e5d2c0a78b17b3a70928f71],
PUP.Optional.Outbrowse, HKLM\SOFTWARE\CLASSES\TYPELIB\{03771AEF-400D-4A13-B712-25878EC4A3F5}, Quarantined, [24b8c3251e5d2c0a78b17b3a70928f71],
PUP.Optional.Outbrowse, HKLM\SOFTWARE\CLASSES\INTERFACE\{3408AC0D-510E-4808-8F7B-6B70B1F88534}, Quarantined, [24b8c3251e5d2c0a78b17b3a70928f71],
PUP.Optional.Outbrowse, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{3408AC0D-510E-4808-8F7B-6B70B1F88534}, Quarantined, [24b8c3251e5d2c0a78b17b3a70928f71],
PUP.Optional.Outbrowse, HKLM\SOFTWARE\WOW6432NODE\CLASSES\TYPELIB\{03771AEF-400D-4A13-B712-25878EC4A3F5}, Quarantined, [24b8c3251e5d2c0a78b17b3a70928f71],
PUP.Optional.Softonic.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{E87806B5-E908-45FD-AF5E-957D83E58E68}, Quarantined, [7468ac3ce29976c0e576afcc09f947b9],
PUP.Optional.Softonic.A, HKU\S-1-5-21-4037467554-2527304460-3365707105-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{E87806B5-E908-45FD-AF5E-957D83E58E68}, Quarantined, [7468ac3ce29976c0e576afcc09f947b9],
PUP.Optional.Softonic.A, HKU\S-1-5-21-4037467554-2527304460-3365707105-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{E87806B5-E908-45FD-AF5E-957D83E58E68}, Quarantined, [7468ac3ce29976c0e576afcc09f947b9],
PUP.Optional.Multiplug, HKLM\SOFTWARE\CLASSES\TYPELIB\{157B1AA6-3E5C-404A-9118-C1D91F537040}, Quarantined, [657706e27ffcac8a2cf2e7904db513ed],
PUP.Optional.Multiplug, HKLM\SOFTWARE\CLASSES\INTERFACE\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}, Quarantined, [657706e27ffcac8a2cf2e7904db513ed],
PUP.Optional.Multiplug, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}, Quarantined, [657706e27ffcac8a2cf2e7904db513ed],
PUP.Optional.Multiplug, HKLM\SOFTWARE\WOW6432NODE\CLASSES\TYPELIB\{157B1AA6-3E5C-404A-9118-C1D91F537040}, Quarantined, [657706e27ffcac8a2cf2e7904db513ed],
PUP.Optional.Babylon.A, HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}, Quarantined, [d309e206ceadbc7a4fecbdbbae5451af],
PUP.Optional.DaleSearch.A, HKLM\SOFTWARE\CLASSES\dalesearch.dalesearchdskBnd, Quarantined, [27b55593eb90979f74aa9023b44ee020],
PUP.Optional.DaleSearch.A, HKLM\SOFTWARE\CLASSES\dalesearch.dalesearchdskBnd.1, Quarantined, [b329a048601bbe788b93e5ce47bb4bb5],
PUP.Optional.DaleSearch.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\dalesearch.dalesearchdskBnd, Quarantined, [b329a048601bbe788b93e5ce47bb4bb5],
PUP.Optional.DaleSearch.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\dalesearch.dalesearchdskBnd.1, Quarantined, [b329a048601bbe788b93e5ce47bb4bb5],
PUP.Optional.DaleSearch.A, HKLM\SOFTWARE\CLASSES\dalesearch.dalesearchHlpr, Quarantined, [ab31e8003b406cca5ac5a60d15edb44c],
PUP.Optional.DaleSearch.A, HKLM\SOFTWARE\CLASSES\dalesearch.dalesearchHlpr.1, Quarantined, [924ac22628536dc956c98e25da28ae52],
PUP.Optional.DaleSearch.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\dalesearch.dalesearchHlpr, Quarantined, [924ac22628536dc956c98e25da28ae52],
PUP.Optional.DaleSearch.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\dalesearch.dalesearchHlpr.1, Quarantined, [924ac22628536dc956c98e25da28ae52],
PUP.Optional.Sense.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\Sense, Quarantined, [e2fa39aff685f0466fba0e0efb08639d],
PUP.Optional.GeForce.A, HKLM\SOFTWARE\Ge-Force, Quarantined, [76664b9d6f0c01357a7d5bfb966e9f61],
PUP.Optional.CrossRider.A, HKLM\SOFTWARE\INSTALLEDBROWSEREXTENSIONS\20891, Quarantined, [79639355e89370c6ce5ddc3710f3d030],
PUP.Optional.CrossRider.A, HKLM\SOFTWARE\INSTALLEDBROWSEREXTENSIONS\21836, Quarantined, [93493dab23589d99e942de35649f6b95],
PUP.Optional.GeForce.A, HKLM\SOFTWARE\WOW6432NODE\Ge-Force, Quarantined, [f5e738b0f982e056a453aaac659f55ab],
PUP.Optional.GlobalUpdate.T, HKLM\SOFTWARE\WOW6432NODE\GLOBALUPDATE\UPDATE, Quarantined, [805ce305bbc0e551c8388b6dcb37b050],
PUP.Optional.Spigot.A, HKLM\SOFTWARE\WOW6432NODE\GOOGLE\CHROME\EXTENSIONS\cflheckfmhopnialghigdlggahiomebp, Quarantined, [0cd06583f8834aec81539b6129d91fe1],
PUP.Optional.LuckyLeap.A, HKLM\SOFTWARE\WOW6432NODE\GOOGLE\CHROME\EXTENSIONS\eiimolhnbbbdagljikeckdkldgemmmlj, Quarantined, [98440edad0abd3634fd6bb4042c0b749],
PUP.Optional.Softonic.A, HKLM\SOFTWARE\WOW6432NODE\GOOGLE\CHROME\EXTENSIONS\elchiiiejkobdbblfejjkbphbddgmljf, Quarantined, [8e4ecb1d9fdc072f426c5cb5ba498b75],
PUP.Optional.CrossRider.A, HKLM\SOFTWARE\WOW6432NODE\INSTALLEDBROWSEREXTENSIONS\20891, Quarantined, [30ac6d7b95e6b284210a7b98946f5aa6],
PUP.Optional.CrossRider.A, HKLM\SOFTWARE\WOW6432NODE\INSTALLEDBROWSEREXTENSIONS\21836, Quarantined, [518b07e1a4d7eb4b8c9fbb5838cb22de],
PUP.Optional.GlobalUpdate.A, HKLM\SOFTWARE\WOW6432NODE\MOZILLAPLUGINS\@staging.google.com/globalUpdate Update;version=10, Quarantined, [7e5e6d7b7efdfc3a79a51a3f36ce8c74],
PUP.Optional.GlobalUpdate.A, HKLM\SOFTWARE\WOW6432NODE\MOZILLAPLUGINS\@staging.google.com/globalUpdate Update;version=4, Quarantined, [02dad018611a5fd71906fd5c8381d42c],
PUP.Optional.Sense.A, HKLM\SOFTWARE\WOW6432NODE\SENSE\IE, Quarantined, [e0fc6f79463592a459d2ff1d867dac54],
PUP.Optional.CrossRider.A, HKLM\SOFTWARE\WOW6432NODE\SENSE, Quarantined, [03d93cacfe7d2a0cdd595faa50b3ac54],
PUP.Optional.ObjectBrowser.A, HKLM\SOFTWARE\WOW6432NODE\SENSE\INSTALLER, Quarantined, [29b3f0f80b7068ce52c639db9c6750b0],
PUP.Optional.CrossRider.A, HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\Crossrider, Quarantined, [4c901ccc0774b581b671103a9a6a629e],
PUP.Optional.GeForce.A, HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\Ge-Force, Quarantined, [9c405692d7a488ae17e2e0760103718f],
PUP.Optional.CrossRider.A, HKU\S-1-5-21-4037467554-2527304460-3365707105-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\Crossrider, Quarantined, [9f3d16d2136855e19295ea601be9f907],
PUP.Optional.GeForce.A, HKU\S-1-5-21-4037467554-2527304460-3365707105-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\Ge-Force, Quarantined, [a537e20696e541f5ce2b183e5aaa9c64],
PUP.Optional.CrossRider.A, HKU\S-1-5-21-4037467554-2527304460-3365707105-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\INSTALLEDBROWSEREXTENSIONS\20891, Quarantined, [0ad2d513de9dda5cd75118daf111f60a],
PUP.Optional.CrossRider.A, HKU\S-1-5-21-4037467554-2527304460-3365707105-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\INSTALLEDBROWSEREXTENSIONS\21836, Quarantined, [3f9d9355c8b3989e40e8a9495ba7d62a],
PUP.Optional.iWebar.A, HKU\S-1-5-21-4037467554-2527304460-3365707105-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\INSTALLEDBROWSEREXTENSIONS\iWebar, Quarantined, [cc1055931d5e8da988d459c36a9927d9],
PUP.Optional.CrossRider.A, HKU\S-1-5-21-4037467554-2527304460-3365707105-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\INSTALLEDBROWSEREXTENSIONS\Object Browser, Quarantined, [b626b7317a01d46220e7a2a9ef157e82],
PUP.Optional.GlobalUpdate.T, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\globalUpdate, Quarantined, [fbe187614a314aec44d74e916c966997],
PUP.Optional.GlobalUpdate.T, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\globalUpdatem, Quarantined, [fbe187614a314aec44d74e916c966997],
PUP.Optional.GlobalUpdate.T, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\GOOGLEUPDATE.EXE, Quarantined, [fbe187614a314aec44d74e916c966997],
PUP.Optional.GlobalUpdate.T, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\GOOGLEUPDATE.EXE, Quarantined, [fbe187614a314aec44d74e916c966997],
PUP.Optional.GlobalUpdate.T, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{5645E0E7-FC12-43BF-A6E4-F9751942B298}, Quarantined, [fbe187614a314aec44d74e916c966997],
PUP.Optional.GlobalUpdate.T, HKLM\SOFTWARE\CLASSES\globalUpdate.OneClickCtrl.10, Quarantined, [fbe187614a314aec44d74e916c966997],
PUP.Optional.GlobalUpdate.T, HKLM\SOFTWARE\WOW6432NODE\CLASSES\globalUpdate.OneClickCtrl.10, Quarantined, [fbe187614a314aec44d74e916c966997],
PUP.Optional.GlobalUpdate.T, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{5645E0E7-FC12-43BF-A6E4-F9751942B298}, Quarantined, [fbe187614a314aec44d74e916c966997],
PUP.Optional.GlobalUpdate.T, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\PREAPPROVED\{5645E0E7-FC12-43BF-A6E4-F9751942B298}, Quarantined, [fbe187614a314aec44d74e916c966997],
PUP.Optional.GlobalUpdate.T, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{C7BF8F4B-7BC7-4F42-B944-3D28A3A86D8A}, Quarantined, [fbe187614a314aec44d74e916c966997],
PUP.Optional.GlobalUpdate.T, HKLM\SOFTWARE\CLASSES\globalUpdate.Update3WebControl.4, Quarantined, [fbe187614a314aec44d74e916c966997],
PUP.Optional.GlobalUpdate.T, HKLM\SOFTWARE\WOW6432NODE\CLASSES\globalUpdate.Update3WebControl.4, Quarantined, [fbe187614a314aec44d74e916c966997],
PUP.Optional.GlobalUpdate.T, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{C7BF8F4B-7BC7-4F42-B944-3D28A3A86D8A}, Quarantined, [fbe187614a314aec44d74e916c966997],
PUP.Optional.GlobalUpdate.T, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\PREAPPROVED\{C7BF8F4B-7BC7-4F42-B944-3D28A3A86D8A}, Quarantined, [fbe187614a314aec44d74e916c966997],
PUP.Optional.GlobalUpdate.T, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{CFC47BB5-5FB5-4AD0-8427-6AA04334A3FC}, Quarantined, [fbe187614a314aec44d74e916c966997],
PUP.Optional.GlobalUpdate.T, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{E0ADB535-D7B5-4D8B-B15D-578BDD20D76A}, Quarantined, [fbe187614a314aec44d74e916c966997],
PUP.Optional.GeForce.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\Ge-Force, Quarantined, [77651eca2853c96dbd075b847e84e31d],

Registry Values: 4
PUP.Optional.GlobalUpdate.T, HKLM\SOFTWARE\WOW6432NODE\GLOBALUPDATE\UPDATE|path, C:\Program Files (x86)\globalUpdate\Update\GoogleUpdate.exe, Quarantined, [805ce305bbc0e551c8388b6dcb37b050]
PUP.Optional.CrossRider.A, HKLM\SOFTWARE\WOW6432NODE\SENSE|ActiveAppId, 61915, Quarantined, [03d93cacfe7d2a0cdd595faa50b3ac54]
PUP.Optional.ObjectBrowser.A, HKLM\SOFTWARE\WOW6432NODE\SENSE\INSTALLER|BundledIe, 1, Quarantined, [29b3f0f80b7068ce52c639db9c6750b0]
PUP.Optional.ConduitSearchProtect, HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|SearchProtect, \SearchProtect\bin\cltmng.exe, Quarantined, [f9e3c127ceadd95ddeff43ef0301d927]

Registry Data: 1
PUP.Optional.Qone8, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES|DefaultScope, {33BB0A4E-99AF-4226-BDF6-49120163DE86}, Good: ({0633EE93-D776-472f-A0FF-E1416B8B2E3A}), Bad: ({33BB0A4E-99AF-4226-BDF6-49120163DE86}),Replaced,[3aa21dcb5f1c81b59f79e504af55c838]

Folders: 34
PUP.Optional.Sense.A, C:\Program Files (x86)\Sense, Delete-on-Reboot, [e2fa39aff685f0466fba0e0efb08639d],
PUP.Optional.OpenCandy, C:\Users\Ahmed\AppData\Roaming\OpenCandy, Quarantined, [f3e9cc1c4239ca6c7890bb0a6a98659b],
PUP.Optional.OpenCandy, C:\Users\Ahmed\AppData\Roaming\OpenCandy\6519755221624733852190E9A68E2680, Quarantined, [f3e9cc1c4239ca6c7890bb0a6a98659b],
PUP.Optional.OpenCandy, C:\Users\Ahmed\AppData\Roaming\OpenCandy\CA6E4234FDB448899DC3F6273EEBADB9, Quarantined, [f3e9cc1c4239ca6c7890bb0a6a98659b],
PUP.Optional.GlobalUpdate.T, C:\Program Files (x86)\globalUpdate\Update, Quarantined, [fbe187614a314aec44d74e916c966997],
PUP.Optional.GlobalUpdate.T, C:\Program Files (x86)\globalUpdate\Update\1.3.25.0, Quarantined, [fbe187614a314aec44d74e916c966997],
PUP.Optional.GlobalUpdate.T, C:\Program Files (x86)\globalUpdate\Update\Download, Quarantined, [fbe187614a314aec44d74e916c966997],
PUP.Optional.GlobalUpdate.T, C:\Program Files (x86)\globalUpdate\Update\Install, Quarantined, [fbe187614a314aec44d74e916c966997],
PUP.Optional.GlobalUpdate.T, C:\Program Files (x86)\globalUpdate\Update\Offline, Quarantined, [fbe187614a314aec44d74e916c966997],
PUP.Optional.GlobalUpdate.T, C:\Program Files (x86)\globalUpdate\Update\Offline\{C5F72330-F5A3-42EC-814C-52CC8D2C581C}, Quarantined, [fbe187614a314aec44d74e916c966997],
PUP.Optional.GeForce.A, C:\Program Files (x86)\Ge-Force, Delete-on-Reboot, [77651eca2853c96dbd075b847e84e31d],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\chrome, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\chrome\content, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\chrome\content\core, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\defaults, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\defaults\preferences, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\extensionData, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\extensionData\plugins, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\extensionData\userCode, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\locale, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\locale\en-US, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\chrome, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\chrome\content, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\chrome\content\api, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\chrome\content\core, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\defaults, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\defaults\preferences, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\extensionData, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\extensionData\plugins, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\extensionData\userCode, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\locale, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\locale\en-US, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],

Files: 293
PUP.Optional.GeForce.A, C:\Program Files (x86)\Ge-Force\d4809700-4200-4dc7-964d-8305d49a89fc-6.exe, Delete-on-Reboot, [c814b731a4d7ef475fff158c778a7f81],
PUP.Optional.Sense.A, C:\Program Files (x86)\Sense\c0bc3bff-370e-4b36-b76a-4bd2c9c5e6ec-6.exe, Delete-on-Reboot, [00dceafeec8fca6c54334e0abe437f81],
PUP.Optional.Sense.A, C:\Program Files (x86)\Sense\Sense-bho64.dll, Quarantined, [bc209c4c413a90a65532aaae3bc6a35d],
PUP.Optional.Sense.A, C:\Program Files (x86)\Sense\Sense-bho.dll, Quarantined, [bc209c4c413a90a65532aaae3bc6a35d],
PUP.Optional.GeForce.A, C:\Program Files (x86)\Ge-Force\Ge-Force-bho64.dll, Quarantined, [53890bdd463500368bd3544d8f727e82],
PUP.Optional.GeForce.A, C:\Program Files (x86)\Ge-Force\Ge-Force-bho.dll, Quarantined, [53890bdd463500368bd3544d8f727e82],
PUP.Optional.Multiplug, C:\Users\Ahmed\Desktop\Week 1\Downloader_for_GameShark Version 5.0.exe, Quarantined, [657706e27ffcac8a2cf2e7904db513ed],
PUP.Optional.InstallCore.A, C:\Users\Ahmed\Downloads\VisualBoyAdvance_Setup.exe, Quarantined, [e5f7cf1986f5f343365e9519ba4a55ab],
PUP.Optional.CodecPerformer.A, C:\Users\Ahmed\Downloads\CodecPerformerSetup.exe, Quarantined, [4f8d8860205b6cca22ca641614ed8a76],
PUP.Optional.InstallCore, C:\Users\Ahmed\Downloads\CR_Downloader_voor_pokemon-firered.exe, Quarantined, [0fcdf6f21c5f2214d2e6bfeece36c33d],
PUP.Optional.InstallCore, C:\Users\Ahmed\Downloads\CR_Downloader_voor_pokemon-gold.exe, Quarantined, [4399fbed423951e560585c5127ddf907],
PUP.Optional.InstallCore, C:\Users\Ahmed\Downloads\CR_Downloader_voor_pokemon-yellow.exe, Quarantined, [706c895fd4a7f4424177129b05ff59a7],
PUP.Optional.Softonic.A, C:\Users\Ahmed\Downloads\SoftonicDownloader_for_mkv-player.exe, Quarantined, [dffd697f6714b086662bbe6fd03144bc],
PUP.Optional.WorldSetup, C:\Users\Ahmed\Downloads\CR_Downloader_voor_tgb-dual (1).exe, Quarantined, [637924c498e39c9a761130812dd73dc3],
PUP.Optional.OpenCandy, C:\Users\Ahmed\Downloads\MediaInfo_GUI_0.7.8_Windows_i386.exe, Quarantined, [be1e6088592281b56ef3e32b1fe6bd43],
PUP.Optional.Amonetize, C:\Users\Ahmed\Downloads\TVapp__8821_i846768588_il485160.exe, Quarantined, [30acc91faecd0135ae7b2e7d26dbd729],
PUP.Optional.OutBrowse, C:\Users\Ahmed\Downloads\install-flashplayer (1).exe, Quarantined, [9e3ee30569122b0b4f09a2fb9071c739],
PUP.Optional.OutBrowse, C:\Users\Ahmed\Downloads\install-flashplayer.exe, Quarantined, [03d97b6d740763d3f167a0fd08f942be],
PUP.Optional.WorldSetup, C:\Users\Ahmed\Downloads\CR_Downloader_voor_tgb-dual.exe, Quarantined, [677524c42c4f49ed5037bcf51aeaa25e],
PUP.Optional.InstallCore, C:\Users\Ahmed\Downloads\FirefoxSetup.exe, Quarantined, [cd0f86626813bc7ac4e1923618ec4eb2],
PUP.Optional.CrossRider.T, C:\Windows\System32\Tasks\c0bc3bff-370e-4b36-b76a-4bd2c9c5e6ec-1, Quarantined, [4e8edb0d304bd165fdfef5026a98c63a],
PUP.Optional.CrossRider.T, C:\Windows\System32\Tasks\c0bc3bff-370e-4b36-b76a-4bd2c9c5e6ec-11, Quarantined, [21bbe4042f4cc96dc8336592cc36fa06],
PUP.Optional.CrossRider.T, C:\Windows\System32\Tasks\c0bc3bff-370e-4b36-b76a-4bd2c9c5e6ec-2, Quarantined, [99430ade8af135013cbf35c258aaff01],
PUP.Optional.CrossRider.T, C:\Windows\System32\Tasks\c0bc3bff-370e-4b36-b76a-4bd2c9c5e6ec-3, Quarantined, [6676e107235812243bc08c6b62a0a25e],
PUP.Optional.CrossRider.T, C:\Windows\System32\Tasks\c0bc3bff-370e-4b36-b76a-4bd2c9c5e6ec-4, Quarantined, [aa3276726417cf67659622d51de5916f],
PUP.Optional.CrossRider.T, C:\Windows\System32\Tasks\c0bc3bff-370e-4b36-b76a-4bd2c9c5e6ec-5, Quarantined, [ddfff7f1b8c376c088737285d032ee12],
PUP.Optional.CrossRider.T, C:\Windows\System32\Tasks\c0bc3bff-370e-4b36-b76a-4bd2c9c5e6ec-5_user, Quarantined, [09d305e389f23cfa9a614ea99e648f71],
PUP.Optional.CrossRider.T, C:\Windows\System32\Tasks\c0bc3bff-370e-4b36-b76a-4bd2c9c5e6ec-6, Quarantined, [e1fb18d04d2e81b5d427df183fc354ac],
PUP.Optional.CrossRider.T, C:\Windows\System32\Tasks\c0bc3bff-370e-4b36-b76a-4bd2c9c5e6ec-7, Quarantined, [29b3c8206b10b0862fcc20d7729028d8],
PUP.Optional.CrossRider.T, C:\Windows\System32\Tasks\d4809700-4200-4dc7-964d-8305d49a89fc-1, Quarantined, [9745b23634475bdb12e956a1e919926e],
PUP.Optional.CrossRider.T, C:\Windows\System32\Tasks\d4809700-4200-4dc7-964d-8305d49a89fc-11, Quarantined, [5785499f5f1cc670b843f304ae54847c],
PUP.Optional.CrossRider.T, C:\Windows\System32\Tasks\d4809700-4200-4dc7-964d-8305d49a89fc-2, Quarantined, [fae24e9a85f61a1c40bb10e79e646b95],
PUP.Optional.CrossRider.T, C:\Windows\System32\Tasks\d4809700-4200-4dc7-964d-8305d49a89fc-4, Quarantined, [4e8e24c49ae1c96db14a8b6cfe0419e7],
PUP.Optional.CrossRider.T, C:\Windows\System32\Tasks\d4809700-4200-4dc7-964d-8305d49a89fc-5, Quarantined, [9b418e5acfac2c0ae11af8fff012d030],
PUP.Optional.CrossRider.T, C:\Windows\System32\Tasks\d4809700-4200-4dc7-964d-8305d49a89fc-5_user, Quarantined, [45975296aecdaf87ab50de19f012827e],
PUP.Optional.CrossRider.T, C:\Windows\System32\Tasks\d4809700-4200-4dc7-964d-8305d49a89fc-6, Quarantined, [e5f70cdce6952e08f10a57a062a0de22],
PUP.Optional.CrossRider.T, C:\Windows\System32\Tasks\d4809700-4200-4dc7-964d-8305d49a89fc-7, Quarantined, [5b8123c55f1c320415e6a05751b13dc3],
PUP.Optional.Ciuvo.A, C:\Users\Ahmed\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_api.ciuvo.com_0.localstorage, Delete-on-Reboot, [2daf38b036452c0aeea10af69a69fc04],
PUP.Optional.Ciuvo.A, C:\Users\Ahmed\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_api.ciuvo.com_0.localstorage-journal, Delete-on-Reboot, [5d7f28c0b6c55dd98e01847cbd46e21e],
PUP.Optional.ShoppingGate.A, C:\Users\Ahmed\AppData\Local\Google\Chrome\User Data\Default\Local Storage\https_inst.shoppingate.info_0.localstorage, Delete-on-Reboot, [ffddc91f631835013ff313f47d86c13f],
PUP.Optional.ShoppingGate.A, C:\Users\Ahmed\AppData\Local\Google\Chrome\User Data\Default\Local Storage\https_inst.shoppingate.info_0.localstorage-journal, Delete-on-Reboot, [5e7ec91fb5c6f0467ab8ba4dd82bf30d],
PUP.Optional.Superfish.A, C:\Users\Ahmed\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_www.superfish.com_0.localstorage, Delete-on-Reboot, [5389e3051566ef47e6a3c93e17ec2ed2],
PUP.Optional.Superfish.A, C:\Users\Ahmed\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_www.superfish.com_0.localstorage-journal, Quarantined, [4894ecfc7407bc7a2168a562a85b1fe1],
PUP.Optional.Sense.A, C:\Program Files (x86)\Sense\background.html, Quarantined, [e2fa39aff685f0466fba0e0efb08639d],
PUP.Optional.Sense.A, C:\Program Files (x86)\Sense\c0bc3bff-370e-4b36-b76a-4bd2c9c5e6ec.crx, Quarantined, [e2fa39aff685f0466fba0e0efb08639d],
PUP.Optional.Sense.A, C:\Program Files (x86)\Sense\05b29b00-2a1d-4132-9331-1c62e2ec66b0.crx, Quarantined, [e2fa39aff685f0466fba0e0efb08639d],
PUP.Optional.Sense.A, C:\Program Files (x86)\Sense\1293297481.mxaddon, Quarantined, [e2fa39aff685f0466fba0e0efb08639d],
PUP.Optional.Sense.A, C:\Program Files (x86)\Sense\bgNova.html, Quarantined, [e2fa39aff685f0466fba0e0efb08639d],
PUP.Optional.Sense.A, C:\Program Files (x86)\Sense\c0bc3bff-370e-4b36-b76a-4bd2c9c5e6ec-11.exe, Quarantined, [e2fa39aff685f0466fba0e0efb08639d],
PUP.Optional.Sense.A, C:\Program Files (x86)\Sense\c0bc3bff-370e-4b36-b76a-4bd2c9c5e6ec-3.exe, Quarantined, [e2fa39aff685f0466fba0e0efb08639d],
PUP.Optional.Sense.A, C:\Program Files (x86)\Sense\c0bc3bff-370e-4b36-b76a-4bd2c9c5e6ec-5.exe, Quarantined, [e2fa39aff685f0466fba0e0efb08639d],
PUP.Optional.Sense.A, C:\Program Files (x86)\Sense\c0bc3bff-370e-4b36-b76a-4bd2c9c5e6ec-64.exe, Quarantined, [e2fa39aff685f0466fba0e0efb08639d],
PUP.Optional.Sense.A, C:\Program Files (x86)\Sense\c0bc3bff-370e-4b36-b76a-4bd2c9c5e6ec-7.exe, Quarantined, [e2fa39aff685f0466fba0e0efb08639d],
PUP.Optional.Sense.A, C:\Program Files (x86)\Sense\c0bc3bff-370e-4b36-b76a-4bd2c9c5e6ec.xpi, Quarantined, [e2fa39aff685f0466fba0e0efb08639d],
PUP.Optional.Sense.A, C:\Program Files (x86)\Sense\c0bc3bff-370e-4b36-b76a-4bd2c9c5e6ec_.xpi, Quarantined, [e2fa39aff685f0466fba0e0efb08639d],
PUP.Optional.Sense.A, C:\Program Files (x86)\Sense\ceda7ba7-8761-445a-aecc-28ac6e68466f.crx, Quarantined, [e2fa39aff685f0466fba0e0efb08639d],
PUP.Optional.Sense.A, C:\Program Files (x86)\Sense\ceda7ba7-8761-445a-aecc-28ac6e68466f.dll, Delete-on-Reboot, [e2fa39aff685f0466fba0e0efb08639d],
PUP.Optional.Sense.A, C:\Program Files (x86)\Sense\Sense-bg.exe, Quarantined, [e2fa39aff685f0466fba0e0efb08639d],
PUP.Optional.Sense.A, C:\Program Files (x86)\Sense\Sense-buttonutil.dll, Quarantined, [e2fa39aff685f0466fba0e0efb08639d],
PUP.Optional.Sense.A, C:\Program Files (x86)\Sense\Sense-buttonutil.exe, Quarantined, [e2fa39aff685f0466fba0e0efb08639d],
PUP.Optional.Sense.A, C:\Program Files (x86)\Sense\Sense-buttonutil64.dll, Quarantined, [e2fa39aff685f0466fba0e0efb08639d],
PUP.Optional.Sense.A, C:\Program Files (x86)\Sense\Sense-buttonutil64.exe, Quarantined, [e2fa39aff685f0466fba0e0efb08639d],
PUP.Optional.Sense.A, C:\Program Files (x86)\Sense\Sense.ico, Quarantined, [e2fa39aff685f0466fba0e0efb08639d],
PUP.Optional.Sense.A, C:\Program Files (x86)\Sense\Uninstall.exe, Quarantined, [e2fa39aff685f0466fba0e0efb08639d],
PUP.Optional.Sense.A, C:\Program Files (x86)\Sense\utils.exe, Quarantined, [e2fa39aff685f0466fba0e0efb08639d],
PUP.Optional.NewTab.A, C:\Users\Ahmed\AppData\Local\Google\Chrome\User Data\Default\Extensions\newtab.crx, Quarantined, [ebf15d8b067581b5e16a73a9f60d0ff1],
PUP.Optional.CrossRider.T, C:\Windows\Tasks\c0bc3bff-370e-4b36-b76a-4bd2c9c5e6ec-1.job, Quarantined, [04d8c4247cffbf774f44b3a34eb6c937],
PUP.Optional.CrossRider.T, C:\Windows\Tasks\c0bc3bff-370e-4b36-b76a-4bd2c9c5e6ec-11.job, Quarantined, [419b0fd944375adcff9479dd5ba99c64],
PUP.Optional.CrossRider.T, C:\Windows\Tasks\c0bc3bff-370e-4b36-b76a-4bd2c9c5e6ec-2.job, Quarantined, [b12b7870176441f5118270e67292ef11],
PUP.Optional.CrossRider.T, C:\Windows\Tasks\c0bc3bff-370e-4b36-b76a-4bd2c9c5e6ec-3.job, Quarantined, [904c46a2f9823402f49f4313a75de31d],
PUP.Optional.CrossRider.T, C:\Windows\Tasks\c0bc3bff-370e-4b36-b76a-4bd2c9c5e6ec-4.job, Quarantined, [b02c5c8c295278beff94b3a304003ec2],
PUP.Optional.CrossRider.T, C:\Windows\Tasks\c0bc3bff-370e-4b36-b76a-4bd2c9c5e6ec-5.job, Quarantined, [f5e7df09fe7d92a4662d282ed03414ec],
PUP.Optional.CrossRider.T, C:\Windows\Tasks\c0bc3bff-370e-4b36-b76a-4bd2c9c5e6ec-5_user.job, Quarantined, [29b3a1472e4daa8c9cf78fc735cf1de3],
PUP.Optional.CrossRider.T, C:\Windows\Tasks\c0bc3bff-370e-4b36-b76a-4bd2c9c5e6ec-6.job, Quarantined, [5d7f6187502b6bcb138072e459ab4cb4],
PUP.Optional.CrossRider.T, C:\Windows\Tasks\c0bc3bff-370e-4b36-b76a-4bd2c9c5e6ec-7.job, Quarantined, [499333b593e8c571bfd490c615ef44bc],
PUP.Optional.CrossRider.T, C:\Windows\Tasks\d4809700-4200-4dc7-964d-8305d49a89fc-1.job, Quarantined, [c71536b2b6c5cc6a870c8dc9ab59a25e],
PUP.Optional.CrossRider.T, C:\Windows\Tasks\d4809700-4200-4dc7-964d-8305d49a89fc-11.job, Quarantined, [e9f3994f364504320c8701553cc8de22],
PUP.Optional.CrossRider.T, C:\Windows\Tasks\d4809700-4200-4dc7-964d-8305d49a89fc-2.job, Quarantined, [419b02e63249ff37c4cf80d6e71ddc24],
PUP.Optional.CrossRider.T, C:\Windows\Tasks\d4809700-4200-4dc7-964d-8305d49a89fc-4.job, Quarantined, [f3e92abe0477de58098a8acc768e25db],
PUP.Optional.CrossRider.T, C:\Windows\Tasks\d4809700-4200-4dc7-964d-8305d49a89fc-5.job, Quarantined, [01db21c798e341f5850eb6a051b3c739],
PUP.Optional.CrossRider.T, C:\Windows\Tasks\d4809700-4200-4dc7-964d-8305d49a89fc-5_user.job, Quarantined, [31ab8b5d166592a46a291a3c4bb9f50b],
PUP.Optional.CrossRider.T, C:\Windows\Tasks\d4809700-4200-4dc7-964d-8305d49a89fc-6.job, Quarantined, [b12b3aae80fb9d99078cfe58b3511ce4],
PUP.Optional.CrossRider.T, C:\Windows\Tasks\d4809700-4200-4dc7-964d-8305d49a89fc-7.job, Quarantined, [b02c9751f982e452d1c2a1b5ed174eb2],
PUP.Optional.GlobalUpdate.A, C:\Windows\Tasks\globalUpdateUpdateTaskMachineCore.job, Quarantined, [22baa7415c1f5dd95851ff5733d139c7],
PUP.Optional.GlobalUpdate.A, C:\Windows\System32\Tasks\globalUpdateUpdateTaskMachineCore, Quarantined, [b12bcc1c7704280e7337470ffb09eb15],
PUP.Optional.GlobalUpdate.A, C:\Windows\Tasks\globalUpdateUpdateTaskMachineUA.job, Quarantined, [ba2241a7abd08da9a506421442c2f50b],
PUP.Optional.GlobalUpdate.A, C:\Windows\System32\Tasks\globalUpdateUpdateTaskMachineUA, Quarantined, [f3e908e0adce270fb4f82c2a36ceb050],
PUP.Optional.CrossRider.A, C:\Windows\Tasks\b5f954e2-1d92-461d-97fd-cd8b0ddbf7c3.job, Quarantined, [2dafe00881fad363c8546eeb1ee649b7],
PUP.Optional.CrossRider.A, C:\Windows\System32\Tasks\060184C3-9766-46a0-B258-F4518A0B2633, Quarantined, [7468727690ebf24436e7ea6fd92bf709],
PUP.Optional.CrossRider.A, C:\Windows\System32\Tasks\b5f954e2-1d92-461d-97fd-cd8b0ddbf7c3, Quarantined, [f4e80cdcfe7dc96d3fde1049d62efc04],
PUP.Optional.OpenCandy, C:\Users\Ahmed\AppData\Roaming\OpenCandy\6519755221624733852190E9A68E2680\AVG-PC-TuneUp2014ROW-15-EN-p4v2.exe, Quarantined, [f3e9cc1c4239ca6c7890bb0a6a98659b],
PUP.Optional.OpenCandy, C:\Users\Ahmed\AppData\Roaming\OpenCandy\CA6E4234FDB448899DC3F6273EEBADB9\chrometest3.html, Quarantined, [f3e9cc1c4239ca6c7890bb0a6a98659b],
PUP.Optional.GlobalUpdate.T, C:\Program Files (x86)\globalUpdate\Update\GoogleUpdate.exe, Quarantined, [fbe187614a314aec44d74e916c966997],
PUP.Optional.GlobalUpdate.T, C:\Program Files (x86)\globalUpdate\Update\1.3.25.0\GoogleCrashHandler.exe, Quarantined, [fbe187614a314aec44d74e916c966997],
PUP.Optional.GlobalUpdate.T, C:\Program Files (x86)\globalUpdate\Update\1.3.25.0\GoogleUpdate.exe, Quarantined, [fbe187614a314aec44d74e916c966997],
PUP.Optional.GlobalUpdate.T, C:\Program Files (x86)\globalUpdate\Update\1.3.25.0\GoogleUpdateBroker.exe, Quarantined, [fbe187614a314aec44d74e916c966997],
PUP.Optional.GlobalUpdate.T, C:\Program Files (x86)\globalUpdate\Update\1.3.25.0\GoogleUpdateHelper.msi, Quarantined, [fbe187614a314aec44d74e916c966997],
PUP.Optional.GlobalUpdate.T, C:\Program Files (x86)\globalUpdate\Update\1.3.25.0\GoogleUpdateOnDemand.exe, Quarantined, [fbe187614a314aec44d74e916c966997],
PUP.Optional.GlobalUpdate.T, C:\Program Files (x86)\globalUpdate\Update\1.3.25.0\goopdate.dll, Quarantined, [fbe187614a314aec44d74e916c966997],
PUP.Optional.GlobalUpdate.T, C:\Program Files (x86)\globalUpdate\Update\1.3.25.0\goopdateres_en.dll, Quarantined, [fbe187614a314aec44d74e916c966997],
PUP.Optional.GlobalUpdate.T, C:\Program Files (x86)\globalUpdate\Update\1.3.25.0\npGoogleUpdate4.dll, Quarantined, [fbe187614a314aec44d74e916c966997],
PUP.Optional.GlobalUpdate.T, C:\Program Files (x86)\globalUpdate\Update\1.3.25.0\psmachine.dll, Quarantined, [fbe187614a314aec44d74e916c966997],
PUP.Optional.GlobalUpdate.T, C:\Program Files (x86)\globalUpdate\Update\1.3.25.0\psuser.dll, Quarantined, [fbe187614a314aec44d74e916c966997],
PUP.Optional.GeForce.A, C:\Program Files (x86)\Ge-Force\d4809700-4200-4dc7-964d-8305d49a89fc-64.exe, Quarantined, [77651eca2853c96dbd075b847e84e31d],
PUP.Optional.GeForce.A, C:\Program Files (x86)\Ge-Force\11ad77be-193b-4112-996e-9a01659ee7f7.dll, Delete-on-Reboot, [77651eca2853c96dbd075b847e84e31d],
PUP.Optional.GeForce.A, C:\Program Files (x86)\Ge-Force\1293297481.mxaddon, Quarantined, [77651eca2853c96dbd075b847e84e31d],
PUP.Optional.GeForce.A, C:\Program Files (x86)\Ge-Force\a1dcfe29-6138-40fe-b952-c25fae39e189.dll, Quarantined, [77651eca2853c96dbd075b847e84e31d],
PUP.Optional.GeForce.A, C:\Program Files (x86)\Ge-Force\adc647f2-021d-4667-b53b-24b737e91812.crx, Quarantined, [77651eca2853c96dbd075b847e84e31d],
PUP.Optional.GeForce.A, C:\Program Files (x86)\Ge-Force\background.html, Quarantined, [77651eca2853c96dbd075b847e84e31d],
PUP.Optional.GeForce.A, C:\Program Files (x86)\Ge-Force\bgNova.html, Quarantined, [77651eca2853c96dbd075b847e84e31d],
PUP.Optional.GeForce.A, C:\Program Files (x86)\Ge-Force\d4809700-4200-4dc7-964d-8305d49a89fc-4.exe, Quarantined, [77651eca2853c96dbd075b847e84e31d],
PUP.Optional.GeForce.A, C:\Program Files (x86)\Ge-Force\d4809700-4200-4dc7-964d-8305d49a89fc-5.exe, Quarantined, [77651eca2853c96dbd075b847e84e31d],
PUP.Optional.GeForce.A, C:\Program Files (x86)\Ge-Force\d4809700-4200-4dc7-964d-8305d49a89fc.crx, Quarantined, [77651eca2853c96dbd075b847e84e31d],
PUP.Optional.GeForce.A, C:\Program Files (x86)\Ge-Force\d4809700-4200-4dc7-964d-8305d49a89fc.xpi, Quarantined, [77651eca2853c96dbd075b847e84e31d],
PUP.Optional.GeForce.A, C:\Program Files (x86)\Ge-Force\Ge-Force-bg.exe, Quarantined, [77651eca2853c96dbd075b847e84e31d],
PUP.Optional.GeForce.A, C:\Program Files (x86)\Ge-Force\Ge-Force-buttonutil.dll, Quarantined, [77651eca2853c96dbd075b847e84e31d],
PUP.Optional.GeForce.A, C:\Program Files (x86)\Ge-Force\Ge-Force-buttonutil.exe, Quarantined, [77651eca2853c96dbd075b847e84e31d],
PUP.Optional.GeForce.A, C:\Program Files (x86)\Ge-Force\Ge-Force-buttonutil64.dll, Quarantined, [77651eca2853c96dbd075b847e84e31d],
PUP.Optional.GeForce.A, C:\Program Files (x86)\Ge-Force\Ge-Force-buttonutil64.exe, Quarantined, [77651eca2853c96dbd075b847e84e31d],
PUP.Optional.GeForce.A, C:\Program Files (x86)\Ge-Force\Ge-Force-codedownloader.exe, Quarantined, [77651eca2853c96dbd075b847e84e31d],
PUP.Optional.GeForce.A, C:\Program Files (x86)\Ge-Force\Ge-Force.ico, Quarantined, [77651eca2853c96dbd075b847e84e31d],
PUP.Optional.GeForce.A, C:\Program Files (x86)\Ge-Force\Uninstall.exe, Quarantined, [77651eca2853c96dbd075b847e84e31d],
PUP.Optional.GeForce.A, C:\Program Files (x86)\Ge-Force\utils.exe, Quarantined, [77651eca2853c96dbd075b847e84e31d],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\chrome.manifest, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\install.rdf, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\chrome\content\2d789627ba9359e6a27cf67ef83e3b47.js, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\chrome\content\3a1b148dfebdca3ee82d367505c58316.js, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\chrome\content\45ec68b4c872c336d34e07ce52a114d0.js, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\chrome\content\53e85d76a4943bc7275c234a86711dba.js, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\chrome\content\b34e5e36aa7910ea14c3528fa75f1a02.js, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\chrome\content\background.html, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\chrome\content\browser.xul, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\chrome\content\d8bafda5bb41eee5c1205ae850c4f8a1.js, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\chrome\content\dialog.js, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\chrome\content\ffCoreFilesIndex.txt, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\chrome\content\options.js, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\chrome\content\options.xul, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
PUP.Optional.CrossRider.A,

 

[Ryansee]

LOG 2 CONTINUED

C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\chrome\content\search_dialog.xul, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\chrome\content\core\03184a8283da68e08149c75ed6af174d.js, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\chrome\content\core\0789b0f3196a1924e08cb0d2280fe5cc.js, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\chrome\content\core\07dfc83333096a2001ffd42aaa5f17f0.js, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\chrome\content\core\08dbbef0dfdb0d2f62fdc3ef12fbec9d.js, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\chrome\content\core\08faf3ffa41a38ea797194b8ca8208f9.js, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\chrome\content\core\4f9bc30c4d0b66ed63a110b1c70eebab.js, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\chrome\content\core\5f356756969545fa63e2334837772270.js, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\chrome\content\core\68ca8aef407744a5427e9c763b483fb3.js, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\chrome\content\core\7adb3d1400c090f1328e686f19d2c27f.js, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\chrome\content\core\887360efaf5c53aa6ae3d3ebe9d98d7b.js, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\chrome\content\core\91febed286fd83e530f855be69974009.js, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\chrome\content\core\a60c137fe58018b31ed0bf87afb8264e.js, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\chrome\content\core\b160fbb2c818c396c32baace4f0868ba.js, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\chrome\content\core\b6c3fcfdc065274bc8da8d415029497a.js, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\chrome\content\core\cffca7680e3ad29b2151e25cbc4a4eda.js, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\chrome\content\core\e76af60b324737f08cc4d908cac91d87.js, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\chrome\content\core\eb3bd1314a3e83009f90fadf88814306.js, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\chrome\content\core\installer.js, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\extensionData\manifest.xml, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\extensionData\plugins.json, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\extensionData\plugins\1.js, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\extensionData\plugins\102.js, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\extensionData\plugins\123.js, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\extensionData\plugins\13.js, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\extensionData\plugins\14.js, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\extensionData\plugins\16.js, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\extensionData\plugins\17.js, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\extensionData\plugins\177.js, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\extensionData\plugins\180.js, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\extensionData\plugins\182.js, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\extensionData\plugins\183.js, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\extensionData\plugins\184.js, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\extensionData\plugins\191.js, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\extensionData\plugins\192.js, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\extensionData\plugins\195.js, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\extensionData\plugins\207.js, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\extensionData\plugins\21.js, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\extensionData\plugins\22.js, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\extensionData\plugins\220.js, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\extensionData\plugins\223.js, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\extensionData\plugins\239.js, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\extensionData\plugins\242.js, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\extensionData\plugins\244.js, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\extensionData\plugins\246.js, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\extensionData\plugins\263.js, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\extensionData\plugins\268.js, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\extensionData\plugins\28.js, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\extensionData\plugins\281.js, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\extensionData\plugins\4.js, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\extensionData\plugins\47.js, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\extensionData\plugins\64.js, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\extensionData\plugins\7.js, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\extensionData\plugins\72.js, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\extensionData\plugins\78.js, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\extensionData\plugins\9.js, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\extensionData\plugins\91.js, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\extensionData\plugins\98.js, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\extensionData\userCode\background.js, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\extensionData\userCode\extension.js, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\locale\en-US\translations.dtd, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\chrome.manifest, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\install.rdf, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\chrome\content\37d5393c9a67c17aa8d6eacc07b83535.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\chrome\content\3bb01b58a203c140716795ea708245e3.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\chrome\content\96ee44219a93599692711ae3c26de213.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\chrome\content\background.html, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\chrome\content\bd653fd299b811c31e309c501b63b84f.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\chrome\content\browser.xul, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\chrome\content\dbe58b4125af1f43b0d5d39227f1b23e.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\chrome\content\dialog.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\chrome\content\ffCoreFilesIndex.txt, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\chrome\content\options.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\chrome\content\options.xul, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\chrome\content\search_dialog.xul, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\chrome\content\api\9c1e7a92ea1895f3dea6d647ec834262.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\chrome\content\api\0b5674af2e643600794c0bd4705fdfff.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\chrome\content\api\1b2d70c6f051257cfacbe44f5299606b.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\chrome\content\api\2acd287108053670c8baef201fb2b29e.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\chrome\content\api\35b30f070e6b2a9322d7e1013a15cc7b.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\chrome\content\api\50d864461506f4fa198ac90418792b2c.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\chrome\content\api\59f6218d2a686799b9c7dde9708376e6.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\chrome\content\api\852f3f29b58d2dcdded21979540688b5.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\chrome\content\api\8ee69cfeeb1ad4071c71e14f14dd5078.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\chrome\content\api\d0c437fdff94da0ea6ed2a85de0dc7d4.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\chrome\content\api\d1da4ebcf1647fb8ab54f31cfc649d08.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\chrome\content\api\d4f1b2d09a984b340234b3cf89ce4014.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\chrome\content\api\dc5644feaf56af86314ce5dc1ab07a0f.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\chrome\content\api\de5cb8a5d24bdc269cb8c45998f4e292.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\chrome\content\api\df7a077306f977c21e823c0a0d5a9371.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\chrome\content\api\df91ccbf223651026100646007fe1c61.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\chrome\content\core\1520e4815e65dab7434a2cf930de62f1.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\chrome\content\core\165a9f06b044888556129a78a461f906.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\chrome\content\core\33068727a4225a3a0324608e2c82a5c7.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\chrome\content\core\422641e9d3f84739bf5cdc32ab92e4c4.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\chrome\content\core\4724210a75dfcb79c43f251d67d00723.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\chrome\content\core\56626d55a4bfb8c6a4aad89e81384642.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\chrome\content\core\6c3d77094c1fff3e77acea7424139eab.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\chrome\content\core\7419b2140419266f85052770207f8661.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\chrome\content\core\74c74323c3ec4d203a0fb637e85a4889.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\chrome\content\core\764519850d451d2e6f6009b2256a7175.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\chrome\content\core\a25ae9f185c6e8066b31440cff74f90f.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\chrome\content\core\b1eebba8360d802f7a797feac00dfd95.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\chrome\content\core\b34c47cfe6e867841e9eb6cbfed17c18.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\chrome\content\core\d3b71fea5b323c63c50028883456323a.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\chrome\content\core\d4fdb6ce42de0751ea9fb0534fc464fd.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\chrome\content\core\dbb8eb2977db9544d68c15b82d0fe205.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\chrome\content\core\ebbfdfd0d3f3b60c2d6201caa0105470.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\chrome\content\core\ec492bf677f0bedb77eefc1f3c5a6185.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\chrome\content\core\eed8d3d69474b3b68a89c9c033c2e743.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\chrome\content\core\f4b5dab9f7553a99f6fe2946be1fd110.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\chrome\content\core\installer.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\extensionData\manifest.xml, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\extensionData\plugins.json, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\extensionData\plugins\1.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\extensionData\plugins\102.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\extensionData\plugins\104.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\extensionData\plugins\123.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\extensionData\plugins\13.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\extensionData\plugins\14.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\extensionData\plugins\16.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\extensionData\plugins\17.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\extensionData\plugins\177.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\extensionData\plugins\180.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\extensionData\plugins\182.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\extensionData\plugins\183.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\extensionData\plugins\184.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\extensionData\plugins\191.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\extensionData\plugins\192.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\extensionData\plugins\207.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\extensionData\plugins\21.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\extensionData\plugins\22.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\extensionData\plugins\220.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\extensionData\plugins\221.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\extensionData\plugins\223.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\extensionData\plugins\242.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\extensionData\plugins\244.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\extensionData\plugins\246.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\extensionData\plugins\263.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\extensionData\plugins\268.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\extensionData\plugins\28.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\extensionData\plugins\281.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\extensionData\plugins\286.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\extensionData\plugins\4.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\extensionData\plugins\47.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\extensionData\plugins\64.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\extensionData\plugins\7.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\extensionData\plugins\72.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\extensionData\plugins\78.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\extensionData\plugins\9.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\extensionData\plugins\91.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\extensionData\plugins\93.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\extensionData\plugins\98.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\extensionData\userCode\background.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\extensionData\userCode\extension.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\locale\en-US\translations.dtd, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],

Physical Sectors: 0
(No malicious items detected)


(end)

 

[Ryansee]

ADWcleaner log : I ran this software and I might aswell give u the log. I ran it before I saw website.
ADWCLEANER

\\a\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\# AdwCleaner v3.308 - Report created 02/09/2014 at 22:50:42
# Updated 20/08/2014 by Xplode
# Operating System : Windows 7 Home Premium Service Pack 1 (64 bits)
# Username : Ahmed - AHMED-PC
# Running from : C:\Users\Ahmed\Desktop\Week 1\AdwCleaner.exe
# Option : Clean

***** [ Services ] *****


***** [ Files / Folders ] *****

Folder Deleted : C:\ProgramData\baidu
Folder Deleted : C:\ProgramData\NCH Software
Folder Deleted : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\YouTube Accelerator
Folder Deleted : C:\Program Files (x86)\globalUpdate
Folder Deleted : C:\Program Files (x86)\NCH Software
Folder Deleted : C:\Program Files (x86)\YouTube Accelerator
Folder Deleted : C:\Users\Ahmed\AppData\Local\globalUpdate
Folder Deleted : C:\Users\Ahmed\AppData\LocalLow\Goobzo
Folder Deleted : C:\Users\Ahmed\AppData\Roaming\baidu
Folder Deleted : C:\Users\Ahmed\AppData\Roaming\NCH Software
Folder Deleted : C:\Users\Ahmed\Desktop\Save
Folder Deleted : C:\Users\Public\Documents\baidu
Folder Deleted : C:\Users\Public\Documents\Goobzo
Folder Deleted : C:\Users\Ahmed\AppData\Local\Google\Chrome\User Data\Default\Extensions\gkojfkhlekighikafcpjkiklfbnlmeio
File Deleted : C:\Windows\System32\roboot64.exe
File Deleted : C:\Users\Ahmed\daemonprocess.txt
File Deleted : C:\Users\Ahmed\Desktop\YouTube Accelerator.lnk
File Deleted : C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\searchplugins\bingp.xml
File Deleted : C:\Users\Ahmed\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.superfish.com_0.localstorage
File Deleted : C:\Users\Ahmed\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.superfish.com_0.localstorage-journal

***** [ Scheduled Tasks ] *****

Task Deleted : EPUpdater

***** [ Shortcuts ] *****


***** [ Registry ] *****

Value Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Run [NextLive]
Key Deleted : HKLM\SOFTWARE\Classes\*\shell\filescout
Key Deleted : HKLM\SOFTWARE\Classes\d
Key Deleted : HKLM\SOFTWARE\Classes\globalUpdate.OneClickProcessLauncherMachine
Key Deleted : HKLM\SOFTWARE\Classes\globalUpdate.OneClickProcessLauncherMachine.1.0
Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CoCreateAsync
Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CoCreateAsync.1.0
Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CoreClass
Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CoreClass.1
Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CoreMachineClass
Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CoreMachineClass.1
Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CredentialDialogMachine
Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CredentialDialogMachine.1.0
Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.OnDemandCOMClassMachine
Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.OnDemandCOMClassMachine.1.0
Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.OnDemandCOMClassMachineFallback
Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.OnDemandCOMClassMachineFallback.1.0
Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.OnDemandCOMClassSvc
Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.OnDemandCOMClassSvc.1.0
Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.ProcessLauncher
Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.ProcessLauncher.1.0
Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3COMClassService
Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3COMClassService.1.0
Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3WebMachine
Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3WebMachine.1.0
Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3WebMachineFallback
Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3WebMachineFallback.1.0
Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3WebSvc
Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3WebSvc.1.0
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{74F475FA-6C75-43BD-AAB9-ECDA6184F600}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{3278F5CF-48F3-4253-A6BB-004CE84AF492}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{577975B8-C40E-43E6-B0DE-4C6B44088B52}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{7ABBFE1C-E485-44AA-8F36-353751B4124D}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{B15F118E-AF21-45E8-A809-29FDD7362565}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{02A96331-0CA6-40E2-A87D-C224601985EB}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{3278F5CF-48F3-4253-A6BB-004CE84AF492}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{3B5702BA-7F4C-4D1A-B026-1E9A01D43978}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{44B50C01-4993-48E2-ADEE-D812BAE2E9A2}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{577975B8-C40E-43E6-B0DE-4C6B44088B52}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{5E89ACE9-E16B-499A-87B4-0DBF742404C1}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{69F256DF-BA98-45E9-86EA-FC3CFECF9D30}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{6E87FC94-9866-49B9-8E93-5736D6DE3DD7}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{7E49F793-B3CD-4BF7-8419-B34B8BD30E61}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{834469E3-CA2B-4F21-A5CA-4F6F4DBCDE87}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{8529FAA3-5BFD-43C1-AB35-B53C4B96C6E5}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{A3E2F089-DDBB-4CBF-B06C-5D44DA316ED3}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{A5679AB0-C59E-49E7-83C4-5289F844A6E0}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{ADBC39BE-3D20-4333-8D99-E91EB1B62474}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{E06CA7F5-BA34-4FF6-8D24-B1BDC594D91F}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{F6421EE5-A5BE-4D31-81D5-C16B7BF48E4C}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{FD8E81D0-F5FE-4CB1-9AEA-1E163D2BAB78}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{087CDC12-0A11-4D1D-8DCF-44185D7C3496}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{088BF3A9-6AE8-47B9-A3FB-26262F236C79}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{2AC7B9EB-3881-4EB9-8DEE-0A731A309FDE}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{349C0469-ACDD-49DF-9B3E-0D82E7C7DC4D}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{41226591-6F7A-4082-B63A-67FE4A0CF7A6}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{55D69CD1-6715-4C40-BF05-9519AC4DC6E6}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{66C8FD57-54C4-4D4F-BC95-DCCC763B410A}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{717BAE33-7061-4279-8AE5-6C13BC8AF3F9}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{84F06F7A-F811-48D7-8B34-3F4145183D8F}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{88F6D55F-AA3F-4003-BE69-4AC1998D6492}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{8DBCDED5-08AD-41A2-9BBC-235D84F4FE06}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{A0F66203-1A86-4812-9603-A57E09A4D7A3}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{BC39D1B3-4471-41C1-AACA-E097FAF4B7AA}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{DEB85542-1311-4EC6-8A32-5372EB27FC94}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{11D9E165-B8C1-4734-A56C-BC4FCACA966B}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{B15F118E-AF21-45E8-A809-29FDD7362565}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5E89ACE9-E16B-499A-87B4-0DBF742404C1}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9CF034EA-7B46-48D3-8895-8A14B32AE445}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{087CDC12-0A11-4D1D-8DCF-44185D7C3496}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{088BF3A9-6AE8-47B9-A3FB-26262F236C79}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{2AC7B9EB-3881-4EB9-8DEE-0A731A309FDE}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{349C0469-ACDD-49DF-9B3E-0D82E7C7DC4D}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{41226591-6F7A-4082-B63A-67FE4A0CF7A6}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{55D69CD1-6715-4C40-BF05-9519AC4DC6E6}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{66C8FD57-54C4-4D4F-BC95-DCCC763B410A}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{717BAE33-7061-4279-8AE5-6C13BC8AF3F9}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{84F06F7A-F811-48D7-8B34-3F4145183D8F}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{88F6D55F-AA3F-4003-BE69-4AC1998D6492}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{8DBCDED5-08AD-41A2-9BBC-235D84F4FE06}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{A0F66203-1A86-4812-9603-A57E09A4D7A3}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{BC39D1B3-4471-41C1-AACA-E097FAF4B7AA}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{DEB85542-1311-4EC6-8A32-5372EB27FC94}
Key Deleted : HKCU\Software\GlobalUpdate
Key Deleted : HKCU\Software\Goobzo
Key Deleted : HKCU\Software\InstalledBrowserExtensions
Key Deleted : HKCU\Software\AppDataLow\Software\Sense
Key Deleted : HKLM\SOFTWARE\GlobalUpdate
Key Deleted : HKLM\SOFTWARE\Goobzo
Key Deleted : HKLM\SOFTWARE\InstalledBrowserExtensions
Key Deleted : HKLM\SOFTWARE\OpenCandy
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Mobogenie
Key Deleted : [x64] HKLM\SOFTWARE\DivX\Install\Setup\WizardLayout\ConduitToolbar
Key Deleted : [x64] HKLM\SOFTWARE\InstalledBrowserExtensions
Key Deleted : [x64] HKLM\SOFTWARE\Sense
Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\lucky leap

***** [ Browsers ] *****

-\\ Internet Explorer v11.0.9600.17239


-\\ Mozilla Firefox v30.0 (en-US)

[ File : C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\prefs.js ]

Line Deleted : user_pref("browser.startup.homepage", "hxxp://www.msn.com/?pc=UP97&ocid=UP97DHP|hxxp://ar.hao123.com/?tn=pcf_inner_protection_01_hao123_ar");

-\\ Google Chrome v37.0.2062.102

[ File : C:\Users\Ahmed\AppData\Local\Google\Chrome\User Data\Default\preferences ]

Deleted [Homepage] : hxxp://search.softonic.com/INF00234/tb_v1?SearchSource=48&cc=&mi=fe5ade77000000000000a088b455621d&toi=16057
Deleted [Extension] : aidbbndgjnlaclnmhkdimcdjiebjpdel
Deleted [Extension] : bfcpnihmbfoaeoakalclfalkdepgiaje
Deleted [Extension] : cfcbmgbfdbijmjgjihagbomfbjfjmgon
Deleted [Extension] : gkojfkhlekighikafcpjkiklfbnlmeio
Deleted [Extension] : hgojaaaiddhmiiakpejiklijbalpckih
Deleted [Extension] : mocblcnaofikinigmceddfghppkkjbog

*************************

AdwCleaner[R0].txt - [13775 octets] - [21/10/2013 20:11:40]
AdwCleaner[R1].txt - [1812 octets] - [02/09/2014 20:28:15]
AdwCleaner[R2].txt - [10730 octets] - [02/09/2014 22:36:02]
AdwCleaner[S0].txt - [10983 octets] - [21/10/2013 20:12:47]
AdwCleaner[S1].txt - [10682 octets] - [02/09/2014 22:50:42]

########## EOF - C:\AdwCleaner\AdwCleaner[S1].txt - [10743 octets] ##########

 

[Broni]

You're running three AV programs, Avast, MSE and Baidu.
You must uninstall TWO of them.
Only one AV program is allowed to run.

Download RogueKiller from one of the following links and save it to your Desktop:

Link 1
Link 2

• Close all the running programs
• Windows Vista/7/8 users: right click on RogueKiller.exe, click Run as Administrator
• Otherwise just double-click on RogueKiller.exe
• Pre-scan will start. Let it finish.
• Click on SCAN button.
• Wait until the Status box shows Scan Finished
• Click on Delete.
• Wait until the Status box shows Deleting Finished.
• Click on Report and copy/paste the content of the Notepad into your next reply.
• RKreport.txt could also be found on your desktop.
• If more than one log is produced post all logs.
• If RogueKiller has been blocked, do not hesitate to try a few times more. If really won't run, rename it to winlogon.exe (or winlogon.com) and try again

Create new restore point before proceeding with the next step....
How to: http://www.smartestcomputing.us.com/topic/63983-how-to-create-new-restore-point-all-windows/

Download http://www.imgdumper.nl/uploads6/51a5f31352f71/51a5f31352b88-icon_MBAR.png][/url][b][url=https://www.techspot.com/downloads/5603-malwarebytes-anti-rootkit.html][color=#0000FF]Malwarebytes Anti-Rootkit[/color][/url][/b] to your desktop.
[LIST]
[*][b][color=#FF0000]Warning![/color][/b] [I]Malwarebytes Anti-Rootkit needs to be run from an account with administrator rights.[/I]
[*]Double click on downloaded file. OK self extracting prompt.
[*]MBAR will start. Click "[b]Next[/b]" to continue.
[*]Click in the following screen "[b]Update[/b]" to obtain the latest malware definitions.
[*]Once the update is complete select "[b]Next[/b]" and click "[b]Scan[/b]".
[*]When the scan is finished and no malware has been found select "[b]Exit[/b]".
[*]If malware was detected, make sure to check all the items and click "[b]Cleanup[/b]". Reboot your computer.
[*]Open the MBAR folder located on your Desktop and paste the content of the following files in your next reply:
[LIST]
[*][b]"mbar-log-[I]{date} (xx-xx-xx)[/I].txt"[/b]
[*][b]"system-log.txt"[/b]
[/LIST]
[/LIST]

 

[Ryansee]

I dont know how to uninstal baidu

 

[Ryansee]

"registry valye "appinit_dlls" has been found which may be caused by possible rootkit activity."

"do I want to remove this value and restart the tool?"

Idk what to do here??



Roguekiller log:

RogueKiller V9.2.9.0 [Jul 11 2014] by Adlice Software
mail : http://www.adlice.com/contact/
Feedback : http://forum.adlice.com
Website : https://www.adlice.com/softwares/roguekiller/
Blog : http://www.adlice.com

Operating System : Windows 7 (6.1.7601 Service Pack 1) 64 bits version
Started in : Normal mode
User : Ahmed [Admin rights]
Mode : Remove -- Date : 09/03/2014 13:52:09

¤¤¤ Bad processes : 1 ¤¤¤
[Proc.Hidden] -- [x] -> KILLED [TermThr]

¤¤¤ Registry Entries : 22 ¤¤¤
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{388291E2-08A3-4FFB-AA5C-8D2F05E0DECF} | DhcpNameServer : 7.254.254.254 -> NOT SELECTED
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{3D7DB392-8310-4C99-9194-FDDF34DFB51D} | DhcpNameServer : 172.20.10.1 -> NOT SELECTED
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{9695AEC5-758E-4DB9-811D-6D23A04D41EF} | DhcpNameServer : 209.222.18.222 209.222.18.218 -> NOT SELECTED
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{CC4F8F04-1967-40BA-ACB9-D35D82530A16} | NameServer : 41.128.225.225,42.128.225.226 -> NOT SELECTED
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters\Interfaces\{388291E2-08A3-4FFB-AA5C-8D2F05E0DECF} | DhcpNameServer : 7.254.254.254 -> NOT SELECTED
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters\Interfaces\{3D7DB392-8310-4C99-9194-FDDF34DFB51D} | DhcpNameServer : 172.20.10.1 -> NOT SELECTED
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters\Interfaces\{9695AEC5-758E-4DB9-811D-6D23A04D41EF} | DhcpNameServer : 209.222.18.222 209.222.18.218 -> NOT SELECTED
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters\Interfaces\{CC4F8F04-1967-40BA-ACB9-D35D82530A16} | NameServer : 41.128.225.225,42.128.225.226 -> NOT SELECTED
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet002\Services\Tcpip\Parameters\Interfaces\{388291E2-08A3-4FFB-AA5C-8D2F05E0DECF} | DhcpNameServer : 7.254.254.254 -> NOT SELECTED
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet002\Services\Tcpip\Parameters\Interfaces\{3D7DB392-8310-4C99-9194-FDDF34DFB51D} | DhcpNameServer : 172.20.10.1 -> NOT SELECTED
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet002\Services\Tcpip\Parameters\Interfaces\{9695AEC5-758E-4DB9-811D-6D23A04D41EF} | DhcpNameServer : 209.222.18.222 209.222.18.218 -> NOT SELECTED
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet002\Services\Tcpip\Parameters\Interfaces\{CC4F8F04-1967-40BA-ACB9-D35D82530A16} | NameServer : 41.128.225.225,42.128.225.226 -> NOT SELECTED
[PUM.Policies] (X64) HKEY_USERS\S-1-5-21-4037467554-2527304460-3365707105-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System | DisableRegistryTools : 0 -> NOT SELECTED
[PUM.Policies] (X64) HKEY_USERS\S-1-5-21-4037467554-2527304460-3365707105-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System | DisableTaskMgr : 0 -> NOT SELECTED
[PUM.Policies] (X86) HKEY_USERS\S-1-5-21-4037467554-2527304460-3365707105-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System | DisableRegistryTools : 0 -> NOT SELECTED
[PUM.Policies] (X86) HKEY_USERS\S-1-5-21-4037467554-2527304460-3365707105-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System | DisableTaskMgr : 0 -> NOT SELECTED
[PUM.Desktop] (X64) HKEY_USERS\S-1-5-21-4037467554-2527304460-3365707105-1000\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop | NoChangingWallpaper : 0 -> NOT SELECTED
[PUM.Desktop] (X86) HKEY_USERS\S-1-5-21-4037467554-2527304460-3365707105-1000\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop | NoChangingWallpaper : 0 -> NOT SELECTED
[PUM.DesktopIcons] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {20D04FE0-3AEA-1069-A2D8-08002B30309D} : 1 -> NOT SELECTED
[PUM.DesktopIcons] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {59031a47-3f72-44a7-89c5-5595fe6b30ee} : 1 -> NOT SELECTED
[PUM.DesktopIcons] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {20D04FE0-3AEA-1069-A2D8-08002B30309D} : 1 -> NOT SELECTED
[PUM.DesktopIcons] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {59031a47-3f72-44a7-89c5-5595fe6b30ee} : 1 -> NOT SELECTED

¤¤¤ Scheduled tasks : 0 ¤¤¤

¤¤¤ Files : 0 ¤¤¤

¤¤¤ HOSTS File : 0 [Too big!] ¤¤¤

¤¤¤ Antirootkit : 0 (Driver: NOT LOADED [0xc000036b]) ¤¤¤

¤¤¤ Web browsers : 0 ¤¤¤

¤¤¤ MBR Check : ¤¤¤
+++++ PhysicalDrive0: ST9750420AS ATA Device +++++
--- User ---
[MBR] c48bfb66fb3eb5ccb4d27e692be093ae
[BSP] fe2266ba6367db7a0b0c632db4e02d43 : Windows Vista/7/8 MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 2048 | Size: 100 MB
1 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 206848 | Size: 715302 MB
User = LL1 ... OK
User = LL2 ... OK


============================================
RKreport_SCN_09032014_135044.log

 

[Ryansee]

I googled and was told just follow instructions, press no and if it crashed run again and press yes.
System log
---------------------------------------
Malwarebytes Anti-Rootkit BETA 1.07.0.1012

(c) Malwarebytes Corporation 2011-2012

OS version: 6.1.7601 Windows 7 Service Pack 1 x64

Account is Administrative

Internet Explorer version: 11.0.9600.17239

File system is: NTFS
Disk drives: C:\ DRIVE_FIXED
CPU speed: 1.993000 GHz
Memory total: 8535261184, free: 4938641408

Downloaded database version: v2014.09.03.02
Downloaded database version: v2014.08.21.01
=======================================
Initializing...
------------ Kernel report ------------
09/03/2014 14:10:46
------------ Loaded modules -----------
\SystemRoot\system32\ntoskrnl.exe
\SystemRoot\system32\hal.dll
\SystemRoot\system32\kdcom.dll
\SystemRoot\system32\mcupdate_GenuineIntel.dll
\SystemRoot\system32\PSHED.dll
\SystemRoot\system32\CLFS.SYS
\SystemRoot\system32\CI.dll
\SystemRoot\system32\drivers\Wdf01000.sys
\SystemRoot\system32\drivers\WDFLDR.SYS
\SystemRoot\system32\drivers\ACPI.sys
\SystemRoot\system32\drivers\WMILIB.SYS
\SystemRoot\system32\drivers\msisadrv.sys
\SystemRoot\system32\drivers\pci.sys
\SystemRoot\system32\drivers\vdrvroot.sys
\SystemRoot\System32\drivers\partmgr.sys
\SystemRoot\system32\DRIVERS\compbatt.sys
\SystemRoot\system32\DRIVERS\BATTC.SYS
\SystemRoot\system32\drivers\volmgr.sys
\SystemRoot\System32\drivers\volmgrx.sys
\SystemRoot\System32\drivers\mountmgr.sys
\SystemRoot\system32\drivers\atapi.sys
\SystemRoot\system32\drivers\ataport.SYS
\SystemRoot\system32\drivers\msahci.sys
\SystemRoot\system32\drivers\PCIIDEX.SYS
\SystemRoot\system32\drivers\amdxata.sys
\SystemRoot\system32\drivers\fltmgr.sys
\SystemRoot\system32\drivers\fileinfo.sys
\SystemRoot\system32\DRIVERS\MpFilter.sys
\SystemRoot\System32\Drivers\Ntfs.sys
\SystemRoot\System32\Drivers\msrpc.sys
\SystemRoot\System32\Drivers\ksecdd.sys
\SystemRoot\System32\Drivers\cng.sys
\SystemRoot\System32\drivers\pcw.sys
\SystemRoot\System32\Drivers\Fs_Rec.sys
\SystemRoot\system32\drivers\ndis.sys
\SystemRoot\system32\drivers\NETIO.SYS
\SystemRoot\System32\Drivers\ksecpkg.sys
\SystemRoot\System32\drivers\tcpip.sys
\SystemRoot\System32\drivers\fwpkclnt.sys
\SystemRoot\system32\drivers\volsnap.sys
\SystemRoot\system32\DRIVERS\stdcfltn.sys
\SystemRoot\System32\Drivers\spldr.sys
\SystemRoot\SysWOW64\speedfan.sys
\SystemRoot\System32\drivers\rdyboost.sys
\SystemRoot\system32\DRIVERS\nvpciflt.sys
\SystemRoot\System32\Drivers\mup.sys
\SystemRoot\System32\drivers\hwpolicy.sys
\SystemRoot\System32\DRIVERS\fvevol.sys
\SystemRoot\system32\DRIVERS\EMSC.SYS
\SystemRoot\system32\DRIVERS\disk.sys
\SystemRoot\system32\DRIVERS\CLASSPNP.SYS
\SystemRoot\system32\drivers\cdrom.sys
\??\C:\Windows\System32\drivers\Bfilter.sys
\??\C:\Windows\System32\drivers\Bfmon.sys
\SystemRoot\System32\Drivers\Null.SYS
\SystemRoot\System32\Drivers\Beep.SYS
\??\C:\Windows\System32\drivers\Bprotect.sys
\SystemRoot\System32\drivers\vga.sys
\SystemRoot\System32\drivers\VIDEOPRT.SYS
\SystemRoot\System32\drivers\watchdog.sys
\SystemRoot\System32\DRIVERS\RDPCDD.sys
\SystemRoot\system32\drivers\rdpencdd.sys
\SystemRoot\system32\drivers\rdprefmp.sys
\SystemRoot\System32\Drivers\Msfs.SYS
\SystemRoot\System32\Drivers\Npfs.SYS
\SystemRoot\System32\drivers\bnbasex64.sys
\SystemRoot\System32\drivers\TDI.SYS
\SystemRoot\system32\DRIVERS\tdx.sys
\SystemRoot\system32\drivers\afd.sys
\SystemRoot\System32\DRIVERS\netbt.sys
\SystemRoot\system32\drivers\ws2ifsl.sys
\SystemRoot\system32\DRIVERS\wfplwf.sys
\SystemRoot\system32\DRIVERS\pacer.sys
\SystemRoot\system32\DRIVERS\vwififlt.sys
\SystemRoot\system32\DRIVERS\netbios.sys
\SystemRoot\system32\DRIVERS\wanarp.sys
\SystemRoot\system32\drivers\termdd.sys
\??\C:\Program Files\SUPERAntiSpyware\SASKUTIL64.SYS
\??\C:\Program Files\SUPERAntiSpyware\SASDIFSV64.SYS
\??\C:\Windows\system32\drivers\RzFilter.sys
\??\C:\Windows\system32\drivers\HIDPARSE.SYS
\SystemRoot\system32\DRIVERS\rdbss.sys
\SystemRoot\system32\DRIVERS\nvkflt.sys
\SystemRoot\System32\drivers\dxgkrnl.sys
\SystemRoot\System32\drivers\dxgmms1.sys
\SystemRoot\system32\drivers\nsiproxy.sys
\SystemRoot\system32\drivers\mssmbios.sys
\SystemRoot\System32\drivers\discache.sys
\SystemRoot\System32\Drivers\dfsc.sys
\??\C:\Windows\System32\drivers\bndef64.sys
\SystemRoot\system32\DRIVERS\blbdrive.sys
\SystemRoot\system32\DRIVERS\tunnel.sys
\??\C:\Windows\system32\drivers\RzDxgk.sys
\SystemRoot\system32\DRIVERS\nvlddmkm.sys
\SystemRoot\system32\DRIVERS\igdkmd64.sys
\SystemRoot\system32\DRIVERS\HECIx64.sys
\SystemRoot\system32\drivers\HDAudBus.sys
\SystemRoot\system32\DRIVERS\L1C62x64.sys
\SystemRoot\system32\DRIVERS\NETwNs64.sys
\SystemRoot\system32\DRIVERS\vwifibus.sys
\SystemRoot\system32\DRIVERS\RtsPStor.sys
\SystemRoot\system32\drivers\sdbus.sys
\SystemRoot\system32\DRIVERS\nusb3xhc.sys
\SystemRoot\system32\DRIVERS\USBD.SYS
\SystemRoot\system32\drivers\usbehci.sys
\SystemRoot\system32\drivers\USBPORT.SYS
\SystemRoot\system32\DRIVERS\CmBatt.sys
\SystemRoot\system32\drivers\i8042prt.sys
\SystemRoot\system32\DRIVERS\kbdclass.sys
\SystemRoot\system32\DRIVERS\SynTP.sys
\SystemRoot\system32\DRIVERS\mouclass.sys
\SystemRoot\system32\DRIVERS\GEARAspiWDM.sys
\SystemRoot\system32\DRIVERS\Accelern.sys
\SystemRoot\system32\DRIVERS\intelppm.sys
\SystemRoot\system32\drivers\wmiacpi.sys
\SystemRoot\system32\drivers\CompositeBus.sys
\SystemRoot\system32\DRIVERS\lmimirr.sys
\SystemRoot\system32\DRIVERS\AgileVpn.sys
\SystemRoot\system32\DRIVERS\rasl2tp.sys
\SystemRoot\system32\DRIVERS\ndistapi.sys
\SystemRoot\system32\DRIVERS\ndiswan.sys
\SystemRoot\system32\DRIVERS\raspppoe.sys
\SystemRoot\system32\DRIVERS\raspptp.sys
\SystemRoot\system32\DRIVERS\rassstp.sys
\SystemRoot\system32\DRIVERS\tap0901t.sys
\SystemRoot\system32\drivers\swenum.sys
\SystemRoot\system32\drivers\ks.sys
\SystemRoot\system32\DRIVERS\dcdbas64.sys
\SystemRoot\system32\DRIVERS\ScpVBus.sys
\SystemRoot\system32\DRIVERS\umbus.sys
\SystemRoot\system32\drivers\nvvad64v.sys
\SystemRoot\system32\drivers\portcls.sys
\SystemRoot\system32\drivers\drmk.sys
\SystemRoot\system32\drivers\ksthunk.sys
\SystemRoot\system32\DRIVERS\nusb3hub.sys
\SystemRoot\system32\DRIVERS\usbhub.sys
\SystemRoot\System32\Drivers\NDProxy.SYS
\SystemRoot\system32\drivers\HdAudio.sys
\SystemRoot\system32\DRIVERS\IntcDAud.sys
\SystemRoot\system32\DRIVERS\udfs.sys
\SystemRoot\system32\DRIVERS\MijXfilt.sys
\SystemRoot\system32\DRIVERS\cdfs.sys
\SystemRoot\system32\DRIVERS\xusb21.sys
\SystemRoot\system32\DRIVERS\hidusb.sys
\SystemRoot\system32\DRIVERS\HIDCLASS.SYS
\SystemRoot\system32\DRIVERS\mouhid.sys
\SystemRoot\system32\DRIVERS\kbdhid.sys
\SystemRoot\system32\DRIVERS\usbccgp.sys
\SystemRoot\System32\Drivers\usbvideo.sys
\SystemRoot\System32\Drivers\crashdmp.sys
\SystemRoot\System32\Drivers\dump_dumpata.sys
\SystemRoot\System32\Drivers\dump_msahci.sys
\SystemRoot\System32\Drivers\dump_dumpfve.sys
\SystemRoot\System32\win32k.sys
\SystemRoot\System32\drivers\Dxapi.sys
\SystemRoot\system32\DRIVERS\monitor.sys
\SystemRoot\System32\TSDDD.dll
\SystemRoot\System32\cdd.dll
\SystemRoot\System32\ATMFD.DLL
\SystemRoot\system32\drivers\luafv.sys
\SystemRoot\system32\DRIVERS\lltdio.sys
\SystemRoot\system32\DRIVERS\nwifi.sys
\SystemRoot\system32\DRIVERS\ndisuio.sys
\SystemRoot\system32\DRIVERS\rspndr.sys
\SystemRoot\system32\drivers\HTTP.sys
\SystemRoot\system32\DRIVERS\bowser.sys
\SystemRoot\System32\drivers\mpsdrv.sys
\SystemRoot\system32\DRIVERS\mrxsmb.sys
\SystemRoot\system32\DRIVERS\mrxsmb10.sys
\SystemRoot\system32\DRIVERS\mrxsmb20.sys
\??\C:\Windows\system32\drivers\LMIRfsDriver.sys
\SystemRoot\system32\drivers\peauth.sys
\SystemRoot\system32\DRIVERS\vwifimp.sys
\SystemRoot\System32\Drivers\secdrv.SYS
\SystemRoot\System32\DRIVERS\srvnet.sys
\SystemRoot\System32\drivers\tcpipreg.sys
\SystemRoot\System32\DRIVERS\srv2.sys
\SystemRoot\System32\DRIVERS\srv.sys
\SystemRoot\system32\DRIVERS\NisDrvWFP.sys
\SystemRoot\system32\drivers\WudfPf.sys
\SystemRoot\System32\Drivers\usbaapl64.sys
\SystemRoot\system32\DRIVERS\WinUsb.sys
\SystemRoot\system32\DRIVERS\WUDFRd.sys
\??\C:\Windows\system32\drivers\mbamchameleon.sys
\??\C:\Windows\system32\drivers\MBAMSwissArmy.sys
\Windows\System32\ntdll.dll
\Windows\System32\smss.exe
\Windows\System32\apisetschema.dll
----------- End -----------
Done!
<<<1>>>
Upper Device Name: \Device\Harddisk0\DR0
Upper Device Object: 0xfffffa8008365790
Upper Device Driver Name: \Driver\Disk\
Lower Device Name: \Device\Ide\IdeDeviceP0T0L0-0\
Lower Device Object: 0xfffffa8008113060
Lower Device Driver Name: \Driver\atapi\
<<<2>>>
Physical Sector Size: 512
Drive: 0, DevicePointer: 0xfffffa8008365790, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
--------- Disk Stack ------
DevicePointer: 0xfffffa80083652c0, DeviceName: Unknown, DriverName: \Driver\partmgr\
DevicePointer: 0xfffffa8008365790, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
DevicePointer: 0xfffffa8008282bf0, DeviceName: Unknown, DriverName: \Driver\stdcfltn\
DevicePointer: 0xfffffa8008113060, DeviceName: \Device\Ide\IdeDeviceP0T0L0-0\, DriverName: \Driver\atapi\
------------ End ----------
Alternate DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
Upper DeviceData: 0x0, 0x0, 0x0
Lower DeviceData: 0x0, 0x0, 0x0
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
<<<2>>>
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
Scanning drivers directory: C:\WINDOWS\SYSTEM32\drivers...
Done!
Drive 0
This is a System drive
Scanning MBR on drive 0...
Inspecting partition table:
MBR Signature: 55AA
Disk Signature: 44B1E201

Partition information:

Partition 0 type is Primary (0x7)
Partition is ACTIVE.
Partition starts at LBA: 2048 Numsec = 204800
Partition file system is NTFS
Partition is bootable

Partition 1 type is Primary (0x7)
Partition is NOT ACTIVE.
Partition starts at LBA: 206848 Numsec = 1464938496

Partition 2 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0

Partition 3 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0

Disk Size: 750156374016 bytes
Sector size: 512 bytes

Scanning physical sectors of unpartitioned space on drive 0 (1-2047-1465129168-1465149168)...
Done!
Scan finished
=======================================


Removal queue found; removal started
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR-0-I.mbam...
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\VBR-0-0-2048-I.mbam...
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR-0-r.mbam...
Removal finished

log scan

Malwarebytes Anti-Rootkit BETA 1.07.0.1012
www.malwarebytes.org

Database version: v2014.09.03.02

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 11.0.9600.17239
Ahmed :: AHMED-PC [administrator]

9/3/2014 2:10:59 PM
mbar-log-2014-09-03 (14-10-59).txt

Scan type: Quick scan
Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken
Scan options disabled:
Objects scanned: 370190
Time elapsed: 15 minute(s), 19 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

Physical Sectors Detected: 0
(No malicious items detected)

(end)

 

[Ryansee]

Should I worry??? I feel pretty depressed atm.

 

[Ryansee]

Update : Internet is working but browsers don't. Requires a restart to get then to work agsin

 

[Broni]

I dont know how to uninstal baidu

Start>Control Panel>Programs & Features.

Please download ComboFix from Here, Here or Here to your Desktop.

**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**

• Never rename Combofix unless instructed.
• Close any open browsers.
• Very Important! Temporarily disable your anti-virus and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
• Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
• Close any open browsers.
• WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
• Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
• If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
  If the connection is not there use restore point you created prior to running Combofix.
• Double click on combofix.exe & follow the prompts.

• 
  NOTE1. If Combofix asks you to install Recovery Console, please allow it.
  NOTE 2. If Combofix asks you to update the program, always do so.

• When finished, it will produce a report for you.
• Please post the "C:\ComboFix.txt"

**Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall
**Note 2 for AVG and CA Internet Security (Total Defense Internet Security) users: ComboFix will not run until AVG/CA Internet Security is uninstalled as a protective measure against the anti-virus. This is because AVG/CA Internet Security "falsely" detects ComboFix (or its embedded files) as a threat and may remove them resulting in the tool not working correctly which in turn can cause "unpredictable results". Since AVG/CA Internet Security cannot be effectively disabled before running ComboFix, the author recommends you to uninstall AVG/CA Internet Security first.
Use AppRemover to uninstall it: https://www.techspot.com/downloads/5514-appremover.html
We can reinstall it when we're done with CF.
**Note 3: If you receive an error Illegal operation attempted on a registery key that has been marked for deletion, restart computer to fix the issue.
**Note 4: Some infections may take some significant time to be cured. As long as your computer clock is running Combofix is still working. Be patient.


Make sure, you re-enable your security programs, when you're done with Combofix.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

NOTE.
If, for some reason, Combofix refuses to run, try the following...

Delete Combofix file, download fresh one, but rename combofix.exe to your_name.exe BEFORE saving it to your desktop.
Do NOT run it yet.
Download Rkill (courtesy of BleepingComputer.com) to your desktop.
There are 2 different versions. If one of them won't run then download and try to run the other one.
You only need to get one of these to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.

rKill.exe: http://www.bleepingcomputer.com/download/rkill/dl/10/
iExplore.exe (renamed rKill.exe): http://www.bleepingcomputer.com/download/rkill/dl/11/

Restart computer in safe mode

• Double-click on the Rkill desktop icon to run the tool.
• If using Vista or Windows 7 right-click on it and choose Run As Administrator.
• A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
• If not, delete the file, then download and use the one provided in Link 2.
• Do not reboot until instructed.
• If the tool does not run from any of the links provided, please let me know.

When the scan is done Notepad will open with rKill.txt log.
NOTE. rKill.txt log will also be present on your desktop.

Once you've gotten one of them to run, immediately run your_name.exe by double clicking on it.

IF you had to run rKill post BOTH logs, rKill.txt and Combofix.txt.

 

[Ryansee]

ComboFix 14-08-31.01 - Ahmed 09/04/2014 13:18:04.1.8 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.8140.6056 [GMT 3:00]
Running from: c:\users\Ahmed\Desktop\ComboFix.exe
AV: Microsoft Security Essentials *Disabled/Updated* {641105E6-77ED-3F35-A304-765193BCB75F}
SP: Microsoft Security Essentials *Disabled/Updated* {DF70E402-51D7-30BB-99B4-4D23E83BFDE2}
SP: Spybot - Search and Destroy *Disabled/Updated* {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\PCDr\6426\AddOnDownloaded\7c5b1d75-4145-4f69-b184-a8fb559fd417.dll
c:\programdata\PCDr\6426\AddOnDownloaded\a05de01f-6d84-4008-82c8-44786a5ba980.dll
c:\programdata\PCDr\6426\AddOnDownloaded\d25002f9-4300-486b-80e9-bcb6abe38487.dll
c:\programdata\PCDr\6426\AddOnDownloaded\fbd50850-4122-4fe3-a72e-fcbe58a0f196.dll
c:\programdata\Roaming
c:\users\Ahmed\AppData\Local\datos.txt
c:\users\Ahmed\AppData\Roaming\mIRC\logs\status.log
c:\users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\search-metadata.json
c:\windows\SysWow64\Config.ini
.
.
((((((((((((((((((((((((( Files Created from 2014-08-04 to 2014-09-04 )))))))))))))))))))))))))))))))
.
.
2014-09-04 10:27 . 2014-09-04 10:27 -------- d-----w- c:\users\UpdatusUser\AppData\Local\temp
2014-09-04 10:27 . 2014-09-04 10:27 -------- d-----w- c:\users\Default\AppData\Local\temp
2014-09-03 13:31 . 2014-08-20 17:43 11319192 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{A6B6F880-9509-41D1-9A63-3FD313AAF5F8}\mpengine.dll
2014-09-03 12:55 . 2014-09-03 12:55 20672 ----a-w- c:\windows\system32\drivers\GUBootStartup.sys
2014-09-03 12:55 . 2014-09-03 12:55 -------- d-----w- c:\users\Ahmed\AppData\Roaming\GlarySoft
2014-09-03 12:55 . 2014-09-03 12:55 -------- d-----w- c:\users\Ahmed\AppData\Roaming\DiskDefrag
2014-09-03 12:55 . 2014-09-04 08:55 -------- d-----w- c:\program files (x86)\Glary Utilities 5
2014-09-03 11:10 . 2014-09-03 11:26 -------- d-----w- c:\programdata\Malwarebytes' Anti-Malware (portable)
2014-09-03 10:43 . 2014-09-03 10:45 33512 ----a-w- c:\windows\SysWow64\drivers\TrueSight.sys
2014-09-03 10:43 . 2014-09-03 10:43 -------- d-----w- c:\programdata\RogueKiller
2014-09-03 10:38 . 2014-09-03 10:38 -------- d-----w- c:\users\Ahmed\AppData\Roaming\Baidu
2014-09-03 10:33 . 2014-09-03 10:33 -------- d-----w- c:\users\Ahmed\AppData\Local\CrashDumps
2014-09-02 19:38 . 2010-08-30 05:34 536576 ----a-w- c:\windows\SysWow64\sqlite3.dll
2014-09-02 19:20 . 2014-09-02 19:20 -------- d-----w- C:\logs
2014-09-02 18:31 . 2014-09-02 18:31 -------- d-----w- C:\TDSSKiller_Quarantine
2014-09-02 17:04 . 2014-09-02 17:04 -------- d-----w- c:\users\Ahmed\AppData\Roaming\KeePass
2014-09-02 16:25 . 2014-09-02 16:25 -------- d-----w- c:\programdata\Informer Technologies, Inc
2014-09-02 16:24 . 2014-09-02 16:39 -------- d-----w- c:\users\Ahmed\AppData\Roaming\Software Informer
2014-09-02 16:24 . 2014-09-02 16:24 -------- d-----w- c:\program files\Software Informer
2014-09-02 16:14 . 2014-09-02 16:14 -------- d-----w- c:\program files (x86)\FileHippo.com
2014-09-02 16:03 . 2014-09-02 16:03 -------- d-----w- c:\program files (x86)\KeePass Password Safe 2
2014-09-02 16:00 . 2014-09-02 16:02 -------- d-----w- c:\users\Ahmed\AppData\Roaming\Dropbox
2014-09-02 15:59 . 2014-09-02 15:59 -------- d-----w- c:\users\Ahmed\AppData\Roaming\Gyazo
2014-09-02 15:58 . 2014-09-02 15:58 -------- d-----w- c:\program files (x86)\SystemRequirementsLab
2014-09-02 15:54 . 2014-09-02 15:54 -------- d-----w- c:\users\Ahmed\AppData\Roaming\Foxit Software
2014-09-02 15:54 . 2014-09-02 15:54 -------- d-----w- c:\users\Public\Foxit Software
2014-09-02 14:22 . 2014-09-02 14:22 -------- d-----w- c:\program files (x86)\Foxit Software
2014-09-02 14:02 . 2014-09-02 14:02 -------- d-----w- c:\program files\7-Zip
2014-09-02 14:01 . 2014-09-02 14:01 -------- d-----w- c:\windows\SysWow64\Adobe
2014-09-02 14:00 . 2014-09-02 14:00 319912 ----a-w- c:\windows\system32\javaws.exe
2014-09-02 14:00 . 2014-09-02 14:00 111016 ----a-w- c:\windows\system32\WindowsAccessBridge-64.dll
2014-09-02 14:00 . 2014-09-02 14:00 189352 ----a-w- c:\windows\system32\javaw.exe
2014-09-02 14:00 . 2014-09-02 14:00 189352 ----a-w- c:\windows\system32\java.exe
2014-09-02 14:00 . 2014-09-02 14:00 -------- d-----w- c:\program files\Java
2014-09-02 13:58 . 2014-09-02 13:58 -------- d-----w- c:\program files (x86)\Common Files\Java
2014-09-02 13:57 . 2014-09-02 13:57 98216 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll
2014-09-02 13:46 . 2014-09-02 16:39 -------- d---a-w- C:\3590F75ABA9E485486C100C1A9D4FF06ZZ.Z..ZZZZZ....Z
2014-09-02 13:45 . 2013-09-20 07:49 21040 ----a-w- c:\windows\system32\sdnclean64.exe
2014-09-02 13:45 . 2014-09-02 13:50 -------- d-----w- c:\programdata\Spybot - Search & Destroy
2014-09-02 13:45 . 2014-09-02 13:52 -------- d-----w- c:\program files (x86)\Spybot - Search & Destroy 2
2014-09-02 13:40 . 2014-09-02 13:41 -------- d-----w- c:\program files\Defraggler
2014-09-02 12:40 . 2014-09-02 12:40 -------- d-----w- C:\SUPERDelete
2014-09-02 12:38 . 2014-09-02 12:38 -------- d-----w- c:\users\Ahmed\AppData\Roaming\SUPERAntiSpyware.com
2014-09-02 12:36 . 2014-09-03 22:34 -------- d-----w- c:\program files\SUPERAntiSpyware
2014-09-02 12:36 . 2014-09-02 12:36 -------- d-----w- c:\programdata\SUPERAntiSpyware.com
2014-09-02 12:25 . 2014-09-02 12:25 1169712 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{748542A2-DAFC-4239-9186-33CE169A7321}\gapaengine.dll
2014-09-02 12:25 . 2014-08-20 17:43 11319192 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2014-09-02 12:20 . 2014-09-04 10:12 122584 ----a-w- c:\windows\system32\drivers\MBAMSwissArmy.sys
2014-09-02 12:20 . 2014-09-03 11:08 92888 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys
2014-09-02 12:20 . 2014-05-12 04:26 63704 ----a-w- c:\windows\system32\drivers\mwac.sys
2014-09-02 12:20 . 2014-09-02 12:20 -------- d-----w- c:\program files (x86)\Malwarebytes Anti-Malware
2014-09-02 12:20 . 2014-09-02 12:20 -------- d-----w- c:\program files (x86)\Microsoft Security Client
2014-09-02 12:19 . 2014-09-02 12:20 -------- d-----w- c:\program files\Microsoft Security Client
2014-09-02 07:49 . 2014-08-21 03:43 11319192 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{1939B7FD-1B0E-46DC-9ED2-DAA779942156}\mpengine.dll
2014-08-31 16:04 . 2014-08-31 16:04 -------- d-----w- c:\program files (x86)\psx emulation cheater
2014-08-28 16:29 . 2014-08-23 00:59 3163648 ----a-w- c:\windows\system32\win32k.sys
2014-08-28 16:29 . 2014-08-23 02:07 404480 ----a-w- c:\windows\system32\gdi32.dll
2014-08-28 16:29 . 2014-08-23 01:45 311808 ----a-w- c:\windows\SysWow64\gdi32.dll
2014-08-25 18:38 . 2014-08-25 18:38 136568 ----a-r- c:\users\Ahmed\AppData\Roaming\Microsoft\Installer\{5A336D74-E680-4986-96F4-E9CEBC784F56}\ShortcutUpdater_DF0BD54B5FA14948AAC4D5BDB1FBFCF2.exe
2014-08-25 18:38 . 2014-08-25 18:38 300408 ----a-r- c:\users\Ahmed\AppData\Roaming\Microsoft\Installer\{5A336D74-E680-4986-96F4-E9CEBC784F56}\ARPPRODUCTICON.exe
2014-08-24 23:31 . 2014-08-24 23:34 -------- d-----w- c:\program files (x86)\Daily Alarm Clock
2014-08-18 02:01 . 2014-03-09 21:48 171160 ----a-w- c:\windows\system32\infocardapi.dll
2014-08-18 02:01 . 2014-03-09 21:48 1389208 ----a-w- c:\windows\system32\icardagt.exe
2014-08-18 02:01 . 2014-03-09 21:47 99480 ----a-w- c:\windows\SysWow64\infocardapi.dll
2014-08-18 02:01 . 2014-03-09 21:47 619672 ----a-w- c:\windows\SysWow64\icardagt.exe
2014-08-18 02:01 . 2014-06-30 22:24 8856 ----a-w- c:\windows\system32\icardres.dll
2014-08-18 02:01 . 2014-06-30 22:14 8856 ----a-w- c:\windows\SysWow64\icardres.dll
2014-08-18 02:00 . 2014-06-06 06:16 35480 ----a-w- c:\windows\SysWow64\TsWpfWrp.exe
2014-08-18 02:00 . 2014-06-06 06:12 35480 ----a-w- c:\windows\system32\TsWpfWrp.exe
2014-08-13 20:28 . 2014-07-09 02:03 7168 ----a-w- c:\windows\system32\KBDTAT.DLL
2014-08-13 20:28 . 2014-07-09 01:31 7168 ----a-w- c:\windows\SysWow64\KBDYAK.DLL
2014-08-13 20:28 . 2014-07-09 02:03 7168 ----a-w- c:\windows\system32\KBDYAK.DLL
2014-08-13 20:28 . 2014-07-09 02:03 7168 ----a-w- c:\windows\system32\KBDRU1.DLL
2014-08-13 20:28 . 2014-07-09 02:03 6656 ----a-w- c:\windows\system32\KBDRU.DLL
2014-08-13 20:28 . 2014-07-09 02:03 7168 ----a-w- c:\windows\system32\KBDBASH.DLL
2014-08-13 20:28 . 2014-07-09 01:31 6656 ----a-w- c:\windows\SysWow64\KBDBASH.DLL
2014-08-13 20:28 . 2014-07-16 03:23 2048 ----a-w- c:\windows\system32\tzres.dll
2014-08-13 20:28 . 2014-07-16 02:46 2048 ----a-w- c:\windows\SysWow64\tzres.dll
2014-08-13 20:26 . 2014-07-25 13:00 139264 ----a-w- c:\windows\system32\ieUnatt.exe
2014-08-13 20:24 . 2014-07-14 02:02 1216000 ----a-w- c:\windows\system32\rpcrt4.dll
2014-08-13 20:24 . 2014-07-14 01:40 664064 ----a-w- c:\windows\SysWow64\rpcrt4.dll
2014-08-12 02:28 . 2014-08-12 02:28 -------- d-----w- c:\users\Ahmed\AppData\Local\Installer
2014-08-12 02:20 . 2014-08-12 02:20 -------- d-sh--w- c:\users\Ahmed\AppData\Local\EmieUserList
2014-08-12 02:20 . 2014-08-12 02:20 -------- d-sh--w- c:\users\Ahmed\AppData\Local\EmieSiteList
2014-08-12 02:20 . 2014-08-12 02:20 14304 ----a-w- c:\programdata\Duplicaterecord.js
2014-08-12 02:11 . 2014-08-12 02:11 172032 ----a-w- c:\windows\SysWow64\AniGIF.ocx
2014-08-12 02:10 . 2014-08-12 02:10 -------- d-----w- c:\program files (x86)\PCSXR
2014-08-11 18:12 . 2013-05-19 07:02 39168 ----a-w- c:\windows\system32\drivers\ScpVBus.sys
2014-08-11 18:12 . 2013-01-07 14:56 1002728 ----a-w- c:\windows\system32\WinUSBCoInstaller2.dll
2014-08-11 18:11 . 2014-09-02 18:38 -------- d-----w- c:\program files\Scarlet.Crush Productions
2014-08-10 21:29 . 2014-08-10 21:29 -------- d-----w- c:\users\Ahmed\AppData\Roaming\ImgBurn
2014-08-10 21:22 . 2014-08-10 21:22 -------- d-----w- c:\users\Ahmed\AppData\Roaming\AVG
2014-08-10 21:22 . 2014-08-10 21:22 -------- d-----w- c:\users\Ahmed\AppData\Local\AVG
2014-08-10 21:20 . 2014-08-10 22:30 -------- d-----w- c:\programdata\AVG
2014-08-10 21:20 . 2014-08-10 21:20 -------- d-sh--w- c:\programdata\{01BD4FC9-2F86-4706-A62E-774BB7E9D308}
2014-08-10 21:20 . 2014-08-10 21:20 -------- d--h--w- c:\programdata\Common Files
2014-08-10 21:18 . 2014-08-10 21:18 -------- d-----w- c:\program files (x86)\ImgBurn
2014-08-10 20:56 . 2014-08-10 20:59 -------- d-----w- c:\program files (x86)\PCSX2 1.2.1
2014-08-09 18:36 . 2014-08-09 18:36 455328 ----a-w- c:\windows\SysWow64\msvcp120.dll
2014-08-09 18:36 . 2014-08-09 18:36 660128 ----a-w- c:\windows\system32\msvcp120.dll
2014-08-09 18:35 . 2014-08-09 18:35 -------- d-----w- c:\programdata\Logs
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-08-14 03:07 . 2013-06-07 14:23 99218768 ----a-w- c:\windows\system32\MRT.exe
2014-07-19 17:59 . 2014-07-19 17:59 31232 ----a-w- c:\windows\system32\drivers\tap0901.sys
2014-07-09 14:15 . 2013-10-15 01:03 71344 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2014-07-09 14:15 . 2013-10-15 01:03 699056 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2014-06-18 02:18 . 2014-07-09 17:03 692736 ----a-w- c:\windows\system32\osk.exe
2014-06-18 01:51 . 2014-07-09 17:03 646144 ----a-w- c:\windows\SysWow64\osk.exe
2014-06-13 02:11 . 2014-07-25 16:22 70912 ----a-w- c:\windows\system32\drivers\Bndef.sys
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt1"]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2014-08-18 17:22 131480 ----a-w- c:\users\Ahmed\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt2"]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2014-08-18 17:22 131480 ----a-w- c:\users\Ahmed\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt3"]
@="{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}]
2014-08-18 17:22 131480 ----a-w- c:\users\Ahmed\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt4"]
@="{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}]
2014-08-18 17:22 131480 ----a-w- c:\users\Ahmed\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt5"]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2014-08-18 17:22 131480 ----a-w- c:\users\Ahmed\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt6"]
@="{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}]
2014-08-18 17:22 131480 ----a-w- c:\users\Ahmed\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt7"]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2014-08-18 17:22 131480 ----a-w- c:\users\Ahmed\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt8"]
@="{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}]
2014-08-18 17:22 131480 ----a-w- c:\users\Ahmed\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\1TortoiseNormal]
@="{C5994560-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994560-53D9-4125-87C9-F193FC689CB2}]
2011-06-13 08:20 64792 ----a-w- c:\program files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\2TortoiseModified]
@="{C5994561-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994561-53D9-4125-87C9-F193FC689CB2}]
2011-06-13 08:20 64792 ----a-w- c:\program files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\3TortoiseConflict]
@="{C5994562-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994562-53D9-4125-87C9-F193FC689CB2}]
2011-06-13 08:20 64792 ----a-w- c:\program files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\4TortoiseLocked]
@="{C5994563-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994563-53D9-4125-87C9-F193FC689CB2}]
2011-06-13 08:20 64792 ----a-w- c:\program files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\5TortoiseReadOnly]
@="{C5994564-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994564-53D9-4125-87C9-F193FC689CB2}]
2011-06-13 08:20 64792 ----a-w- c:\program files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\6TortoiseDeleted]
@="{C5994565-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994565-53D9-4125-87C9-F193FC689CB2}]
2011-06-13 08:20 64792 ----a-w- c:\program files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\7TortoiseAdded]
@="{C5994566-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994566-53D9-4125-87C9-F193FC689CB2}]
2011-06-13 08:20 64792 ----a-w- c:\program files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\8TortoiseIgnored]
@="{C5994567-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994567-53D9-4125-87C9-F193FC689CB2}]
2011-06-13 08:20 64792 ----a-w- c:\program files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\9TortoiseUnversioned]
@="{C5994568-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994568-53D9-4125-87C9-F193FC689CB2}]
2011-06-13 08:20 64792 ----a-w- c:\program files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2014-08-14 7762712]
"F.lux"="c:\users\Ahmed\AppData\Local\FluxSoftware\Flux\flux.exe" [2013-10-15 1016712]
"GUDelayStartup"="c:\program files (x86)\Glary Utilities 5\StartupManager.exe" [2014-09-01 37152]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"SDTray"="c:\program files (x86)\Spybot - Search & Destroy 2\SDTray.exe" [2014-06-24 4101576]
"AlienwareOn-ScreenDisplay"="c:\program files (x86)\Alienware On-Screen Display\AlienwareOn-ScreenDisplay.exe" [2011-01-10 1545584]
"KeePass 2 PreLoad"="c:\program files (x86)\KeePass Password Safe 2\KeePass.exe" [2014-07-06 2117632]
"NUSB3MON"="c:\program files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe" [2011-02-01 113288]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
"AppInit_DLLs"=c:\windows\SysWOW64\nvinit.dll
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AutoUpdateDisableNotify"=dword:00000001
.
R1 Bfilter;Baidu Antivirus Minifilter Driver;c:\windows\System32\drivers\Bfilter.sys;c:\windows\SYSNATIVE\drivers\Bfilter.sys [x]
R1 Bfmon;Baidu FS Monitor Driver;c:\windows\System32\drivers\Bfmon.sys;c:\windows\SYSNATIVE\drivers\Bfmon.sys [x]
R1 Bnbase;Bnbase;c:\windows\system32\drivers\bnbasex64.sys;c:\windows\SYSNATIVE\drivers\bnbasex64.sys [x]
R1 Bndef;Baidu NetDefense;c:\windows\System32\drivers\bndef64.sys;c:\windows\SYSNATIVE\drivers\bndef64.sys [x]
R1 Bprotect;Baidu Protect;c:\windows\System32\drivers\Bprotect.sys;c:\windows\SYSNATIVE\drivers\Bprotect.sys [x]
R1 MpKsl01f98610;MpKsl01f98610;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{6BB67563-7113-4011-AED3-D722B41E2734}\MpKsl01f98610.sys;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{6BB67563-7113-4011-AED3-D722B41E2734}\MpKsl01f98610.sys [x]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 libusbd;LibUsb-Win32 - Daemon, Version 0.1.10.1;c:\windows\system32\libusbd-nt.exe;c:\windows\SYSNATIVE\libusbd-nt.exe [x]
R2 LMIInfo;LogMeIn Kernel Information Provider;c:\program files (x86)\LogMeIn\x64\RaInfo.sys;c:\program files (x86)\LogMeIn\x64\RaInfo.sys [x]
R2 SDScannerService;Spybot-S&D 2 Scanner Service;c:\program files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe;c:\program files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R3 BprotectEx;Baidu ProtectEx;c:\windows\System32\drivers\BprotectEx.sys;c:\windows\SYSNATIVE\drivers\BprotectEx.sys [x]
R3 CoordinatorServiceHost;SW Distributed TS Coordinator Service;c:\program files\SolidWorks Corp\SolidWorks\swScheduler\DTSCoordinatorService.exe;c:\program files\SolidWorks Corp\SolidWorks\swScheduler\DTSCoordinatorService.exe [x]
R3 FLEXnet Licensing Service 64;FLEXnet Licensing Service 64;c:\program files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe;c:\program files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 libusb0;LibUsb-Win32 - Kernel Driver, Version 0.1.10.1;c:\windows\system32\drivers\libusb0.sys;c:\windows\SYSNATIVE\drivers\libusb0.sys [x]
R3 MyWiFiDHCPDNS;Wireless PAN DHCP Server;c:\program files\Intel\WiFi\bin\PanDhcpDns.exe;c:\program files\Intel\WiFi\bin\PanDhcpDns.exe [x]
R3 Netaapl;Apple Mobile Device Ethernet Service;c:\windows\system32\DRIVERS\netaapl64.sys;c:\windows\SYSNATIVE\DRIVERS\netaapl64.sys [x]
R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys;c:\windows\SYSNATIVE\DRIVERS\NisDrvWFP.sys [x]
R3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\NisSrv.exe;c:\program files\Microsoft Security Client\NisSrv.exe [x]
R3 PCFApiUtil;PCFApiUtil;c:\program files (x86)\Baidu Security\PC Faster\4.0.0.0\PCFApiUtil64.sys;c:\program files (x86)\Baidu Security\PC Faster\4.0.0.0\PCFApiUtil64.sys [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]
R3 rzudd;Razer Mouse Driver;c:\windows\system32\DRIVERS\rzudd.sys;c:\windows\SYSNATIVE\DRIVERS\rzudd.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
R3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\DRIVERS\wdcsam64.sys;c:\windows\SYSNATIVE\DRIVERS\wdcsam64.sys [x]
R4 TeamViewer9;TeamViewer 9;c:\program files (x86)\TeamViewer\Version9\TeamViewer_Service.exe;c:\program files (x86)\TeamViewer\Version9\TeamViewer_Service.exe [x]
R4 TunngleService;TunngleService;c:\program files (x86)\Tunngle\TnglCtrl.exe;c:\program files (x86)\Tunngle\TnglCtrl.exe [x]
R4 YouTubeAcceleratorService;YouTubeAcceleratorService;c:\progra~2\YOUTUB~1\YouTubeAcceleratorService.exe;c:\progra~2\YOUTUB~1\YouTubeAcceleratorService.exe [x]
S0 EMSC;COMPAL Embedded System Control;c:\windows\system32\DRIVERS\EMSC.SYS;c:\windows\SYSNATIVE\DRIVERS\EMSC.SYS [x]
S0 nvpciflt;nvpciflt;c:\windows\system32\DRIVERS\nvpciflt.sys;c:\windows\SYSNATIVE\DRIVERS\nvpciflt.sys [x]
S0 stdcfltn;Disk Class Filter Driver for Accelerometer;c:\windows\system32\DRIVERS\stdcfltn.sys;c:\windows\SYSNATIVE\DRIVERS\stdcfltn.sys [x]
S1 GUBootStartup;GUBootStartup;c:\windows\System32\drivers\GUBootStartup.sys;c:\windows\SYSNATIVE\drivers\GUBootStartup.sys [x]
S1 nvkflt;nvkflt;c:\windows\system32\DRIVERS\nvkflt.sys;c:\windows\SYSNATIVE\DRIVERS\nvkflt.sys [x]
S1 RzFilter;RzFilter;c:\windows\system32\drivers\RzFilter.sys;c:\windows\SYSNATIVE\drivers\RzFilter.sys [x]
S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV64.SYS;c:\program files\SUPERAntiSpyware\SASDIFSV64.SYS [x]
S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL64.SYS;c:\program files\SUPERAntiSpyware\SASKUTIL64.SYS [x]
S2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCORE64.EXE;c:\program files\SUPERAntiSpyware\SASCORE64.EXE [x]
S2 c2cautoupdatesvc;Skype Click to Call Updater;c:\program files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe;c:\program files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [x]
S2 c2cpnrsvc;Skype Click to Call PNR Service;c:\program files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe;c:\program files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [x]
S2 FoxitCloudUpdateService;Foxit Cloud Safe Update Service;c:\program files (x86)\Foxit Software\Foxit Reader\Foxit Cloud\FCUpdateService.exe;c:\program files (x86)\Foxit Software\Foxit Reader\Foxit Cloud\FCUpdateService.exe [x]
S2 NvNetworkService;NVIDIA Network Service;c:\program files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe;c:\program files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [x]
S2 NvStreamSvc;NVIDIA Streamer Service;c:\program files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe;c:\program files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [x]
S2 RzOvlMon;Razer Overlay Subsystem Emergency Service;c:\program files (x86)\Razer\Core\64bit\rzovlmon.exe;c:\program files (x86)\Razer\Core\64bit\rzovlmon.exe [x]
S2 SDUpdateService;Spybot-S&D 2 Updating Service;c:\program files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe;c:\program files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [x]
S2 SDWSCService;Spybot-S&D 2 Security Center Service;c:\program files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe;c:\program files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [x]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [x]
S2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [x]
S3 Acceler;Accelerometer Service;c:\windows\system32\DRIVERS\Accelern.sys;c:\windows\SYSNATIVE\DRIVERS\Accelern.sys [x]
S3 dcdbas;System Management Driver;c:\windows\system32\DRIVERS\dcdbas64.sys;c:\windows\SYSNATIVE\DRIVERS\dcdbas64.sys [x]
S3 IntcDAud;Intel(R) Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys;c:\windows\SYSNATIVE\DRIVERS\IntcDAud.sys [x]
S3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\L1C62x64.sys;c:\windows\SYSNATIVE\DRIVERS\L1C62x64.sys [x]
S3 MotioninJoyXFilter;MotioninJoy Virtual Xinput device Filter Driver;c:\windows\system32\DRIVERS\MijXfilt.sys;c:\windows\SYSNATIVE\DRIVERS\MijXfilt.sys [x]
S3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\nusb3hub.sys;c:\windows\SYSNATIVE\DRIVERS\nusb3hub.sys [x]
S3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;c:\windows\system32\DRIVERS\nusb3xhc.sys;c:\windows\SYSNATIVE\DRIVERS\nusb3xhc.sys [x]
S3 nvvad_WaveExtensible;NVIDIA Virtual Audio Device (Wave Extensible) (WDM);c:\windows\system32\drivers\nvvad64v.sys;c:\windows\SYSNATIVE\drivers\nvvad64v.sys [x]
S3 RSPCIESTOR;Realtek PCIE CardReader Driver;c:\windows\system32\DRIVERS\RtsPStor.sys;c:\windows\SYSNATIVE\DRIVERS\RtsPStor.sys [x]
S3 RzDxgk;RzDxgk;c:\windows\system32\drivers\RzDxgk.sys;c:\windows\SYSNATIVE\drivers\RzDxgk.sys [x]
S3 ScpVBus;Scp Virtual Bus Driver;c:\windows\system32\DRIVERS\ScpVBus.sys;c:\windows\SYSNATIVE\DRIVERS\ScpVBus.sys [x]
S3 tap0901t;TAP-Win32 Adapter V9 (Tunngle);c:\windows\system32\DRIVERS\tap0901t.sys;c:\windows\SYSNATIVE\DRIVERS\tap0901t.sys [x]
S3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys;c:\windows\SYSNATIVE\Drivers\usbaapl64.sys [x]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2014-09-03 10:05 1096520 ----a-w- c:\program files (x86)\Google\Chrome\Application\37.0.2062.103\Installer\chrmstp.exe
.
Contents of the 'Scheduled Tasks' folder
.
2014-09-04 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-10-15 14:15]
.
2014-09-04 c:\windows\Tasks\GlaryInitialize 5.job
- c:\program files (x86)\Glary Utilities 5\Initialize.exe [2014-09-01 06:13]
.
2014-09-04 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-06-07 10:32]
.
2014-09-04 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-06-07 10:32]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt1"]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2014-08-18 17:22 164760 ----a-w- c:\users\Ahmed\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt2"]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2014-08-18 17:22 164760 ----a-w- c:\users\Ahmed\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt3"]
@="{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}]
2014-08-18 17:22 164760 ----a-w- c:\users\Ahmed\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt4"]
@="{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}]
2014-08-18 17:22 164760 ----a-w- c:\users\Ahmed\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt5"]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2014-08-18 17:22 164760 ----a-w- c:\users\Ahmed\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt6"]
@="{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}]
2014-08-18 17:22 164760 ----a-w- c:\users\Ahmed\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt7"]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2014-08-18 17:22 164760 ----a-w- c:\users\Ahmed\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt8"]
@="{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}]
2014-08-18 17:22 164760 ----a-w- c:\users\Ahmed\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\1TortoiseNormal]
@="{C5994560-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994560-53D9-4125-87C9-F193FC689CB2}]
2011-06-13 08:20 75544 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\2TortoiseModified]
@="{C5994561-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994561-53D9-4125-87C9-F193FC689CB2}]
2011-06-13 08:20 75544 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\3TortoiseConflict]
@="{C5994562-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994562-53D9-4125-87C9-F193FC689CB2}]
2011-06-13 08:20 75544 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\4TortoiseLocked]
@="{C5994563-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994563-53D9-4125-87C9-F193FC689CB2}]
2011-06-13 08:20 75544 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\5TortoiseReadOnly]
@="{C5994564-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994564-53D9-4125-87C9-F193FC689CB2}]
2011-06-13 08:20 75544 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\6TortoiseDeleted]
@="{C5994565-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994565-53D9-4125-87C9-F193FC689CB2}]
2011-06-13 08:20 75544 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\7TortoiseAdded]
@="{C5994566-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994566-53D9-4125-87C9-F193FC689CB2}]
2011-06-13 08:20 75544 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\8TortoiseIgnored]
@="{C5994567-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994567-53D9-4125-87C9-F193FC689CB2}]
2011-06-13 08:20 75544 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\9TortoiseUnversioned]
@="{C5994568-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994568-53D9-4125-87C9-F193FC689CB2}]
2011-06-13 08:20 75544 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Command Center Controllers"="c:\program files\Alienware\Command Center\AWCCStartupOrchestrator.exe" [2012-06-15 12656]
"ShadowPlay"="c:\windows\system32\nvspcap64.dll" [2014-02-05 1179576]
"NvBackend"="c:\program files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe" [2014-02-05 2234144]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2014-03-11 1271072]
"IntelWireless"="c:\program files\Common Files\Intel\WirelessCommon\iFrmewrk.exe" [2010-12-17 1933584]
"Persistence"="c:\windows\system32\igfxpers.exe" [2013-11-06 442328]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2013-11-06 171992]
"FreeFallProtection"="c:\program files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe" [2010-12-17 703088]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2013-11-06 399832]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=c:\windows\System32\nvinitx.dll
.
------- Supplementary Scan -------
.
uLocal Page = c:\windows\system32\blank.htm
mDefault_Page_URL = hxxp://www.google.com
mStart Page = hxxp://www.google.com
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~3\Office12\EXCEL.EXE/3000
Trusted Zone: dell.com
TCP: DhcpNameServer = 192.168.1.1 192.168.1.1
TCP: Interfaces\{CC4F8F04-1967-40BA-ACB9-D35D82530A16}: NameServer = 41.128.225.225,42.128.225.226
FF - ProfilePath - c:\users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\
FF - prefs.js: browser.search.selectedEngine - Bing
FF - prefs.js: keyword.URL - hxxp://www.bing.com/search?FORM=UP97DF&PC=UP97&q=
.
- - - - ORPHANS REMOVED - - - -
.
Wow6432Node-HKLM-Run-<NO NAME> - (no file)
Wow6432Node-HKU-Default-RunOnce-SPReview - c:\windows\System32\SPReview\SPReview.exe
Notify-SDWinLogon - SDWinLogon.dll
SafeBoot-58754566.sys
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
ShellIconOverlayIdentifiers-{472083B0-C522-11CF-8763-00608CC02F24} - (no file)
HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe
AddRemove-Clownfish - c:\program files (x86)\Clownfish\uninstall.exe
AddRemove-DaleSearch Chrome Toolbar - c:\users\Ahmed\AppData\Roaming\BabSolution\Shared\GUninstaller.exe
AddRemove-Debut - c:\program files (x86)\NCH Software\Debut\debut.exe
AddRemove-YouTube Accelerator - c:\program files (x86)\YouTube Accelerator\YTAUninstall.exe
.
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_14_0_0_145_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_14_0_0_145_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_14_0_0_145_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_14_0_0_145_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_14_0_0_145.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.14"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_14_0_0_145.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_14_0_0_145.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_14_0_0_145.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
Completion time: 2014-09-04 13:30:14
ComboFix-quarantined-files.txt 2014-09-04 10:30
.
Pre-Run: 372,635,512,832 bytes free
Post-Run: 372,298,461,184 bytes free
.
- - End Of File - - 19CFFAADC5F431906B71481646A0460A
A36C5E4F47E84449FF07ED3517B43A31

 

[Broni]

Please download AdwCleaner by Xplode onto your desktop.

• Close all open programs and internet browsers.
• Double click on adwcleaner.exe to run the tool.
• Click on Scan button.
• When the scan has finished click on Clean button.
• Your computer will be rebooted automatically. A text file will open after the restart.
• Please post the contents of that logfile with your next reply.
• You can find the logfile at C:\AdwCleaner[S1].txt as well.

Please download Junkware Removal Tool to your desktop.

• Shut down your protection software now to avoid potential conflicts.
• Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
• The tool will open and start scanning your system.
• Please be patient as this can take a while to complete depending on your system's specifications.
• On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
• Post the contents of JRT.txt into your next message.

Please download Farbar Recovery Scan Tool and save it to your Desktop.

Note: You need to run the version compatibale with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

• Double-click to run it. When the tool opens click Yes to disclaimer.
• Press Scan button.
• It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
• The first time the tool is run, it makes also another log (Addition.txt). Please copy and paste it to your reply.

 

[Ryansee]

update: During the cursor and black screen problem I saw a cmd screen running stuff from system32?? I couldnt read it fast enough.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.4 (04.06.2014:1)
OS: Windows 7 Home Premium x64
Ran by Ahmed on Fri 09/05/2014 at 13:16:24.00
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\baidu
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\AskMrRobot-Setup_RASAPI32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\AskMrRobot-Setup_RASMANCS
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\AskMrRobot-Setup_RASAPI32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\AskMrRobot-Setup_RASMANCS



~~~ Files



~~~ Folders

Successfully deleted: [Folder] "C:\Users\Ahmed\AppData\Roaming\software informer"
Successfully deleted: [Folder] "C:\Windows\syswow64\ai_recyclebin"



~~~ FireFox

Emptied folder: C:\Users\Ahmed\AppData\Roaming\mozilla\firefox\profiles\8trc4n2o.default\minidumps [2 files]



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on Fri 09/05/2014 at 13:23:13.28
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
# AdwCleaner v3.309 - Report created 05/09/2014 at 13:05:32
# Updated 02/09/2014 by Xplode
# Operating System : Windows 7 Home Premium Service Pack 1 (64 bits)
# Username : Ahmed - AHMED-PC
# Running from : C:\Users\Ahmed\Desktop\Week 1\adwcleaner_3.309.exe
# Option : Clean

***** [ Services ] *****


***** [ Files / Folders ] *****

Folder Deleted : C:\Users\Ahmed\AppData\Roaming\baidu
Folder Deleted : C:\Users\Public\Documents\baidu
Folder Deleted : C:\Users\Ahmed\AppData\Local\Google\Chrome\User Data\Default\Extensions\gkojfkhlekighikafcpjkiklfbnlmeio
File Deleted : C:\Users\Ahmed\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.superfish.com_0.localstorage
File Deleted : C:\Users\Ahmed\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.superfish.com_0.localstorage-journal

***** [ Scheduled Tasks ] *****

Task Deleted : YTAUpdate_logon

***** [ Shortcuts ] *****


***** [ Registry ] *****


***** [ Browsers ] *****

-\\ Internet Explorer v11.0.9600.17239


-\\ Mozilla Firefox v30.0 (en-US)

[ File : C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\prefs.js ]


-\\ Google Chrome v37.0.2062.103

[ File : C:\Users\Ahmed\AppData\Local\Google\Chrome\User Data\Default\preferences ]

Deleted [Search Provider] : hxxp://search.softonic.com/INF00234/tb_v1?q={searchTerms}&SearchSource=49&cc=&mi=fe5ade77000000000000a088b455621d&toi=16057
Deleted [Search Provider] : hxxp://search.aol.com/aol/search?q={searchTerms}
Deleted [Search Provider] : hxxp://www.ask.com/web?q={searchTerms}
Deleted [Homepage] : hxxp://search.softonic.com/INF00234/tb_v1?SearchSource=48&cc=&mi=fe5ade77000000000000a088b455621d&toi=16057
Deleted [Extension] : gkojfkhlekighikafcpjkiklfbnlmeio

*************************

AdwCleaner[R0].txt - [13775 octets] - [21/10/2013 20:11:40]
AdwCleaner[R1].txt - [1812 octets] - [02/09/2014 20:28:15]
AdwCleaner[R2].txt - [10730 octets] - [02/09/2014 22:36:02]
AdwCleaner[R3].txt - [1948 octets] - [05/09/2014 13:02:11]
AdwCleaner[S0].txt - [10983 octets] - [21/10/2013 20:12:47]
AdwCleaner[S1].txt - [10896 octets] - [02/09/2014 22:50:42]
AdwCleaner[S2].txt - [2184 octets] - [05/09/2014 13:05:32]

########## EOF - C:\AdwCleaner\AdwCleaner[S2].txt - [2244 octets] ##########

 

[Ryansee]

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 03-09-2014 02
Ran by Ahmed (administrator) on AHMED-PC on 05-09-2014 13:26:01
Running from C:\Users\Ahmed\Desktop\Week 1
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: English (United States)
Internet Explorer Version 11
Boot Mode: Normal

The only official download link for FRST:
Download link for 32-Bit version: https://www.techspot.com/downloads/6731-farbar-recovery-scan-tool.html
Download link for 64-Bit Version: https://www.techspot.com/downloads/6731-farbar-recovery-scan-tool.html
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST:

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(SUPERAntiSpyware.com) C:\Program Files\SUPERAntiSpyware\SASCore64.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Foxit Corporation) C:\Program Files (x86)\Foxit Software\Foxit Reader\Foxit Cloud\FCUpdateService.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(Razer, Inc.) C:\Program Files (x86)\Razer\Core\64bit\RzOvlMon.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
() C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(SUPERAntiSpyware) C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
(Flux Software LLC) C:\Users\Ahmed\AppData\Local\FluxSoftware\Flux\flux.exe
(http://tortoisesvn.net) C:\Program Files\TortoiseSVN\bin\TSVNCache.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Alienware) C:\Program Files\Alienware\Command Center\AWCCServiceController.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
() C:\Program Files (x86)\Alienware On-Screen Display\AlienwareOn-ScreenDisplay.exe
(Renesas Electronics Corporation) C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
(Alienware) C:\Program Files\Alienware\Command Center\AlienwareAlienFXController.exe
(Glarysoft Ltd) C:\Program Files (x86)\Glary Utilities 5\Integrator.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(PC-Doctor, Inc.) C:\Program Files\AlienAutopsy\uaclauncher.exe
(Microsoft Corporation) C:\Windows\System32\msconfig.exe
(http://tortoisesvn.net) C:\Program Files\TortoiseSVN\bin\TSVNCache.exe
(Microsoft Corporation) C:\Windows\System32\SndVol.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2392872 2011-02-22] (Synaptics Incorporated)
HKLM\...\Run: [Command Center Controllers] => C:\Program Files\Alienware\Command Center\AWCCStartupOrchestrator.exe [12656 2012-06-15] (Alienware)
HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2234144 2014-02-05] (NVIDIA Corporation)
HKLM\...\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [1271072 2014-03-11] (Microsoft Corporation)
HKLM\...\Run: [IntelWireless] => C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe [1933584 2010-12-17] (Intel(R) Corporation)
HKLM\...\Run: [FreeFallProtection] => C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe [703088 2010-12-17] ()
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [4101576 2014-06-24] (Safer-Networking Ltd.)
HKLM-x32\...\Run: [AlienwareOn-ScreenDisplay] => C:\Program Files (x86)\Alienware On-Screen Display\AlienwareOn-ScreenDisplay.exe [1545584 2011-01-10] ()
HKLM-x32\...\Run: [KeePass 2 PreLoad] => C:\Program Files (x86)\KeePass Password Safe 2\KeePass.exe [2117632 2014-07-06] (Dominik Reichl)
HKLM-x32\...\Run: [NUSB3MON] => C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [113288 2011-02-01] (Renesas Electronics Corporation)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
HKU\S-1-5-21-4037467554-2527304460-3365707105-1000\...\Run: [SUPERAntiSpyware] => C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe [7762712 2014-08-14] (SUPERAntiSpyware)
HKU\S-1-5-21-4037467554-2527304460-3365707105-1000\...\Run: [F.lux] => C:\Users\Ahmed\AppData\Local\FluxSoftware\Flux\flux.exe [1016712 2013-10-16] (Flux Software LLC)
HKU\S-1-5-21-4037467554-2527304460-3365707105-1000\...\Run: [GUDelayStartup] => C:\Program Files (x86)\Glary Utilities 5\StartupManager.exe [37152 2014-09-01] (Glarysoft Ltd)
HKU\S-1-5-21-4037467554-2527304460-3365707105-1000\...\Policies\Explorer: [NoLowDiskSpaceChecks] 1
AppInit_DLLs: C:\Windows\System32\nvinitx.dll => C:\Windows\System32\nvinitx.dll [174296 2014-03-04] (NVIDIA Corporation)
AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll => C:\Windows\SysWOW64\nvinit.dll [148016 2014-03-04] (NVIDIA Corporation)
ShellIconOverlayIdentifiers: 00avast -> {472083B0-C522-11CF-8763-00608CC02F24} => No File
ShellIconOverlayIdentifiers: 1TortoiseNormal -> {C5994560-53D9-4125-87C9-F193FC689CB2} => C:\Program Files\Common Files\TortoiseOverlays\TortoiseOverlays.dll (http://tortoisesvn.net)
ShellIconOverlayIdentifiers: 2TortoiseModified -> {C5994561-53D9-4125-87C9-F193FC689CB2} => C:\Program Files\Common Files\TortoiseOverlays\TortoiseOverlays.dll (http://tortoisesvn.net)
ShellIconOverlayIdentifiers: 3TortoiseConflict -> {C5994562-53D9-4125-87C9-F193FC689CB2} => C:\Program Files\Common Files\TortoiseOverlays\TortoiseOverlays.dll (http://tortoisesvn.net)
ShellIconOverlayIdentifiers: 4TortoiseLocked -> {C5994563-53D9-4125-87C9-F193FC689CB2} => C:\Program Files\Common Files\TortoiseOverlays\TortoiseOverlays.dll (http://tortoisesvn.net)
ShellIconOverlayIdentifiers: 5TortoiseReadOnly -> {C5994564-53D9-4125-87C9-F193FC689CB2} => C:\Program Files\Common Files\TortoiseOverlays\TortoiseOverlays.dll (http://tortoisesvn.net)
ShellIconOverlayIdentifiers: 6TortoiseDeleted -> {C5994565-53D9-4125-87C9-F193FC689CB2} => C:\Program Files\Common Files\TortoiseOverlays\TortoiseOverlays.dll (http://tortoisesvn.net)
ShellIconOverlayIdentifiers: 7TortoiseAdded -> {C5994566-53D9-4125-87C9-F193FC689CB2} => C:\Program Files\Common Files\TortoiseOverlays\TortoiseOverlays.dll (http://tortoisesvn.net)
ShellIconOverlayIdentifiers: 8TortoiseIgnored -> {C5994567-53D9-4125-87C9-F193FC689CB2} => C:\Program Files\Common Files\TortoiseOverlays\TortoiseOverlays.dll (http://tortoisesvn.net)
ShellIconOverlayIdentifiers: 9TortoiseUnversioned -> {C5994568-53D9-4125-87C9-F193FC689CB2} => C:\Program Files\Common Files\TortoiseOverlays\TortoiseOverlays.dll (http://tortoisesvn.net)
ShellIconOverlayIdentifiers-x32: 1TortoiseNormal -> {C5994560-53D9-4125-87C9-F193FC689CB2} => C:\Program Files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll (http://tortoisesvn.net)
ShellIconOverlayIdentifiers-x32: 2TortoiseModified -> {C5994561-53D9-4125-87C9-F193FC689CB2} => C:\Program Files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll (http://tortoisesvn.net)
ShellIconOverlayIdentifiers-x32: 3TortoiseConflict -> {C5994562-53D9-4125-87C9-F193FC689CB2} => C:\Program Files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll (http://tortoisesvn.net)
ShellIconOverlayIdentifiers-x32: 4TortoiseLocked -> {C5994563-53D9-4125-87C9-F193FC689CB2} => C:\Program Files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll (http://tortoisesvn.net)
ShellIconOverlayIdentifiers-x32: 5TortoiseReadOnly -> {C5994564-53D9-4125-87C9-F193FC689CB2} => C:\Program Files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll (http://tortoisesvn.net)
ShellIconOverlayIdentifiers-x32: 6TortoiseDeleted -> {C5994565-53D9-4125-87C9-F193FC689CB2} => C:\Program Files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll (http://tortoisesvn.net)
ShellIconOverlayIdentifiers-x32: 7TortoiseAdded -> {C5994566-53D9-4125-87C9-F193FC689CB2} => C:\Program Files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll (http://tortoisesvn.net)
ShellIconOverlayIdentifiers-x32: 8TortoiseIgnored -> {C5994567-53D9-4125-87C9-F193FC689CB2} => C:\Program Files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll (http://tortoisesvn.net)
ShellIconOverlayIdentifiers-x32: 9TortoiseUnversioned -> {C5994568-53D9-4125-87C9-F193FC689CB2} => C:\Program Files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll (http://tortoisesvn.net)
BootExecute: autocheck autochk *

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-US
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com/?pc=UP97&ocid=UP97DHP
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x0E18639C83EFCE01
HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = http://g.msn.com/1ewenusDefaultPack/UP97_FRPage
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Handler-x32: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 192.168.1.1
Tcpip\..\Interfaces\{CC4F8F04-1967-40BA-ACB9-D35D82530A16}: [NameServer] 41.128.225.225,42.128.225.226

FireFox:
========
FF ProfilePath: C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default
FF DefaultSearchEngine: Bing
FF SearchEngineOrder.3: Bing
FF SelectedSearchEngine: Bing
FF Keyword.URL: hxxp://www.bing.com/search?FORM=UP97DF&PC=UP97&q=
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_14_0_0_145.dll ()
FF Plugin: @java.com/DTPlugin,version=10.67.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.67.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE -> C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_14_0_0_145.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\SysWOW64\Adobe\Director\np32dsw_1213153.dll (Adobe Systems, Inc.)
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 -> C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin-x32: @divx.com/DivX Web Player Plug-In,version=1.0.0 -> C:\Program Files (x86)\DivX\DivX Web Player\npdivx32.dll (DivX, LLC)
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf -> C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll (Foxit Corporation)
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.fdf -> C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll (Foxit Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.6 -> C:\Program Files (x86)\Yahoo!\Shared\npYState.dll (Yahoo! Inc.)
FF Plugin-x32: @microsoft.com/GENUINE -> C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @raidcall.en/RCplugin -> C:\Users\Ahmed\AppData\Roaming\raidcall\plugins\nprcplugin.dll (Raidcall)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\Ahmed\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF Plugin HKCU: ubisoft.com/uplaypc -> C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll ()
FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi [2014-07-14]

Chrome:
=======
CHR HomePage: Default -> hxxp://search.softonic.com/INF00234/tb_v1?SearchSource=48&cc=&mi=fe5ade77000000000000a088b455621d&toi=16057
CHR StartupUrls: Default -> "hxxp://www.google.com/", "https://workflowy.com/", "hxxp://www.msn.com/?pc=UP97&ocid=UP97DHP"
CHR DefaultSearchKeyword: Default -> 32B50213958ADF4D541A0FE15A960D8D6F8C2675D5A348F1A275D9BFFBF93FF8
CHR DefaultSearchURL: Default -> 2502C45294EF9D0DD0B9F0FF0C27ADCDD2C71B1CA59CAE3E431910BADF2E0BCA
CHR Profile: C:\Users\Ahmed\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Drive) - C:\Users\Ahmed\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-09-21]
CHR Extension: (CIRC) - C:\Users\Ahmed\AppData\Local\Google\Chrome\User Data\Default\Extensions\bebigdkelppomhhjaaianniiifjbgocn [2014-01-07]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Ahmed\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-05-23]
CHR Extension: (WOT) - C:\Users\Ahmed\AppData\Local\Google\Chrome\User Data\Default\Extensions\bhmmomiinigofkjcapegjjndpbikblnp [2014-09-02]
CHR Extension: (Nanny for Google Chrome (TM)) - C:\Users\Ahmed\AppData\Local\Google\Chrome\User Data\Default\Extensions\cljcgchbnolheggdgaeclffeagnnmhno [2013-12-21]
CHR Extension: (Tampermonkey) - C:\Users\Ahmed\AppData\Local\Google\Chrome\User Data\Default\Extensions\dhdgffkkebhmkfjojejmpbldmpobfkfo [2014-01-25]
CHR Extension: (AdBlock) - C:\Users\Ahmed\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2013-12-28]
CHR Extension: (Hola Better Internet) - C:\Users\Ahmed\AppData\Local\Google\Chrome\User Data\Default\Extensions\gkojfkhlekighikafcpjkiklfbnlmeio [2014-09-05]
CHR Extension: (avast! Online Security) - C:\Users\Ahmed\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2013-09-20]
CHR Extension: (Hearthstone Linkifier) - C:\Users\Ahmed\AppData\Local\Google\Chrome\User Data\Default\Extensions\hgfciolhdhbagnccplcficnahgleflam [2013-12-19]
CHR Extension: (Reddit Enhancement Suite) - C:\Users\Ahmed\AppData\Local\Google\Chrome\User Data\Default\Extensions\kbmfpngjjgdllneeigpgjifpgocmfgmb [2013-12-28]
CHR Extension: (StayFocusd) - C:\Users\Ahmed\AppData\Local\Google\Chrome\User Data\Default\Extensions\laankejkbhbdhmipfmgcngdelahlfoji [2013-12-21]
CHR Extension: (Skype Click to Call) - C:\Users\Ahmed\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl [2014-07-21]
CHR Extension: (Sense) - C:\Users\Ahmed\AppData\Local\Google\Chrome\User Data\Default\Extensions\mihcahmgecmbnbcchbopgniflfhgnkff [2014-08-15]
CHR Extension: (Google Wallet) - C:\Users\Ahmed\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-23]
CHR Extension: (League Streams: Stream Browser) - C:\Users\Ahmed\AppData\Local\Google\Chrome\User Data\Default\Extensions\plbfmpfcbppeepkmbgphjpgldpgglbob [2013-12-03]
CHR HKCU\...\Chrome\Extension: [cflheckfmhopnialghigdlggahiomebp] - C:\Users\Ahmed\AppData\Local\CRE\cflheckfmhopnialghigdlggahiomebp.crx []
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\ChromeExtension\skype_chrome_extension.crx [2014-07-14]
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 !SASCORE; C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE [172344 2014-07-23] (SUPERAntiSpyware.com)
R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1390176 2014-07-14] (Microsoft Corporation)
R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1767520 2014-07-14] (Microsoft Corporation)
R2 FoxitCloudUpdateService; C:\Program Files (x86)\Foxit Software\Foxit Reader\Foxit Cloud\FCUpdateService.exe [242216 2014-06-17] (Foxit Corporation)
S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe [73728 2004-10-22] (Macrovision Corporation) [File not signed]
S2 libusbd; C:\Windows\SysWOW64\libusbd-nt.exe [18944 2005-03-09] (http://libusb-win32.sourceforge.net) [File not signed]
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [23808 2014-03-11] (Microsoft Corporation)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [340240 2010-12-17] ()
S3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [347872 2014-03-11] (Microsoft Corporation)
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1593632 2014-02-05] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [16941856 2014-02-05] (NVIDIA Corporation)
R2 RzOvlMon; C:\Program Files (x86)\Razer\Core\64bit\rzovlmon.exe [32960 2014-04-18] (Razer, Inc.)
R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1738168 2014-06-24] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [2088408 2014-06-27] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2014-04-25] (Safer-Networking Ltd.)
S4 SolidWorks Licensing Service; C:\Program Files (x86)\Common Files\SolidWorks Shared\Service\SolidWorksLicensing.exe [79360 2014-01-22] (SolidWorks) [File not signed]
S4 TunngleService; C:\Program Files (x86)\Tunngle\TnglCtrl.exe [758224 2013-11-06] (Tunngle.net GmbH)
S4 YouTubeAcceleratorService; C:\PROGRA~2\YOUTUB~1\YouTubeAcceleratorService.exe -start -scm [X]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
R3 dcdbas; C:\Windows\System32\DRIVERS\dcdbas64.sys [38472 2011-02-02] (Dell Inc.)
R1 GUBootStartup; C:\Windows\System32\drivers\GUBootStartup.sys [20672 2014-09-03] (Glarysoft Ltd)
S3 libusb0; C:\Windows\SysWOW64\drivers\libusb0.sys [33792 2005-03-09] () [File not signed]
S4 LMIRfsClientNP; No ImagePath
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [268512 2014-01-25] (Microsoft Corporation)
S3 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [133928 2014-03-11] (Microsoft Corporation)
R1 nvkflt; C:\Windows\System32\DRIVERS\nvkflt.sys [300320 2014-03-04] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [39200 2013-12-27] (NVIDIA Corporation)
R3 RzDxgk; C:\Windows\system32\drivers\RzDxgk.sys [129472 2014-04-18] (Razer, Inc.)
R1 RzFilter; C:\Windows\system32\drivers\RzFilter.sys [74432 2014-04-18] (Razer, Inc.)
R1 SASDIFSV; C:\Program Files\SUPERAntiSpyware\SASDIFSV64.SYS [14928 2011-07-22] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
R1 SASKUTIL; C:\Program Files\SUPERAntiSpyware\SASKUTIL64.SYS [12368 2011-07-13] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
R3 ScpVBus; C:\Windows\System32\DRIVERS\ScpVBus.sys [39168 2013-05-19] (Scarlet.Crush Productions)
R3 tap0901t; C:\Windows\System32\DRIVERS\tap0901t.sys [31232 2009-09-16] (Tunngle.net)
U3 TrueSight; C:\Windows\SysWOW64\drivers\TrueSight.sys [33512 2014-09-03] ()
S1 BAPIDRV; system32\DRIVERS\BAPIDRV64.sys [X]
S1 Bfilter; \??\C:\Windows\System32\drivers\Bfilter.sys [X]
S1 Bfmon; \??\C:\Windows\System32\drivers\Bfmon.sys [X]
S1 Bnbase; System32\drivers\bnbasex64.sys [X]
S1 Bndef; \??\C:\Windows\System32\drivers\bndef64.sys [X]
S1 Bprotect; \??\C:\Windows\System32\drivers\Bprotect.sys [X]
S3 BprotectEx; \??\C:\Windows\System32\drivers\BprotectEx.sys [X]
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 IntcAzAudAddService; system32\drivers\RTKVHD64.sys [X]
S2 LMIInfo; \??\C:\Program Files (x86)\LogMeIn\x64\RaInfo.sys [X]
S3 PCFApiUtil; \??\C:\Program Files (x86)\Baidu Security\PC Faster\4.0.0.0\PCFApiUtil64.sys [X]

 

[Ryansee]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-09-05 13:25 - 2014-09-05 13:26 - 00000000 ____D () C:\FRST
2014-09-05 13:23 - 2014-09-05 13:23 - 00001455 _____ () C:\Users\Ahmed\Desktop\JRT.txt
2014-09-05 13:07 - 2014-09-05 13:07 - 00002324 _____ () C:\Users\Ahmed\Desktop\AdwCleaner[S2].txt
2014-09-04 15:41 - 2014-09-04 15:41 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MotioninJoy
2014-09-04 15:41 - 2011-12-07 19:42 - 00328712 _____ (Logitech Inc.) C:\Windows\system32\MijFrc.dll
2014-09-04 15:28 - 2014-09-04 15:28 - 04117346 _____ () C:\Users\Ahmed\Documents\motioninjoy-0-7-1001-en-win.zip
2014-09-04 15:00 - 2014-09-04 15:00 - 00000000 ____D () C:\Users\Ahmed\Desktop\New folder (4)
2014-09-04 15:00 - 2014-09-04 15:00 - 00000000 ____D () C:\Users\Ahmed\Desktop\breath of fire
2014-09-04 14:47 - 2014-08-21 16:22 - 00023752 _____ (360安全中心) C:\Windows\SysWOW64\Drivers\efimon.sys
2014-09-04 14:43 - 2014-09-04 14:43 - 162499401 _____ () C:\Users\Ahmed\Desktop\Breath of Fire IV.7z
2014-09-04 14:36 - 2014-09-05 12:57 - 00000000 ____D () C:\Program Files (x86)\360
2014-09-04 13:30 - 2014-09-04 13:30 - 00042534 _____ () C:\ComboFix.txt
2014-09-04 13:16 - 2014-09-04 13:30 - 00000000 ____D () C:\Qoobox
2014-09-04 13:16 - 2011-06-26 09:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-09-04 13:16 - 2010-11-07 20:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-09-04 13:16 - 2009-04-20 07:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-09-04 13:16 - 2000-08-31 03:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-09-04 13:16 - 2000-08-31 03:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-09-04 13:16 - 2000-08-31 03:00 - 00098816 _____ () C:\Windows\sed.exe
2014-09-04 13:16 - 2000-08-31 03:00 - 00080412 _____ () C:\Windows\grep.exe
2014-09-04 13:16 - 2000-08-31 03:00 - 00068096 _____ () C:\Windows\zip.exe
2014-09-04 13:15 - 2014-09-04 13:28 - 00000000 ____D () C:\Windows\erdnt
2014-09-04 12:59 - 2014-09-04 13:00 - 05576326 ____R (Swearware) C:\Users\Ahmed\Desktop\ComboFix.exe
2014-09-03 15:55 - 2014-09-05 13:07 - 00000332 _____ () C:\Windows\Tasks\GlaryInitialize 5.job
2014-09-03 15:55 - 2014-09-05 13:07 - 00000000 ____D () C:\Program Files (x86)\Glary Utilities 5
2014-09-03 15:55 - 2014-09-03 15:55 - 00020672 _____ (Glarysoft Ltd) C:\Windows\system32\Drivers\GUBootStartup.sys
2014-09-03 15:55 - 2014-09-03 15:55 - 00002972 _____ () C:\Windows\System32\Tasks\GU5SkipUAC
2014-09-03 15:55 - 2014-09-03 15:55 - 00002628 _____ () C:\Windows\System32\Tasks\GlaryInitialize 5
2014-09-03 15:55 - 2014-09-03 15:55 - 00001096 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Glary Utilities 5.lnk
2014-09-03 15:55 - 2014-09-03 15:55 - 00001084 _____ () C:\Users\Public\Desktop\Glary Utilities 5.lnk
2014-09-03 15:55 - 2014-09-03 15:55 - 00000000 ____D () C:\Users\Ahmed\AppData\Roaming\GlarySoft
2014-09-03 15:55 - 2014-09-03 15:55 - 00000000 ____D () C:\Users\Ahmed\AppData\Roaming\DiskDefrag
2014-09-03 15:55 - 2014-09-03 15:55 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Glary Utilities 5
2014-09-03 14:10 - 2014-09-03 14:26 - 00000000 ____D () C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2014-09-03 14:00 - 2014-09-03 14:26 - 00000000 ____D () C:\Users\Ahmed\Desktop\mbar
2014-09-03 13:59 - 2014-09-03 13:59 - 14349744 _____ (Malwarebytes Corp.) C:\Users\Ahmed\Desktop\mbar-1.07.0.1012.exe
2014-09-03 13:53 - 2014-09-03 13:54 - 00005349 _____ () C:\Users\Ahmed\Desktop\RKreport_DEL_09032014_135209.log
2014-09-03 13:43 - 2014-09-03 13:45 - 00033512 _____ () C:\Windows\SysWOW64\Drivers\TrueSight.sys
2014-09-03 13:43 - 2014-09-03 13:43 - 00000000 ____D () C:\ProgramData\RogueKiller
2014-09-03 13:41 - 2014-09-03 13:41 - 04857944 _____ () C:\Users\Ahmed\Desktop\RogueKiller.exe
2014-09-03 13:33 - 2014-09-05 12:58 - 00000000 ____D () C:\Users\Ahmed\AppData\Local\CrashDumps
2014-09-02 22:38 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\Windows\SysWOW64\sqlite3.dll
2014-09-02 22:25 - 2014-09-02 22:25 - 00039025 _____ () C:\Users\Ahmed\Desktop\dds.txt
2014-09-02 22:25 - 2014-09-02 22:25 - 00020697 _____ () C:\Users\Ahmed\Desktop\attach.txt
2014-09-02 21:31 - 2014-09-02 21:31 - 00000000 ____D () C:\TDSSKiller_Quarantine
2014-09-02 20:04 - 2014-09-02 20:04 - 00000000 ____D () C:\Users\Ahmed\AppData\Roaming\KeePass
2014-09-02 19:42 - 2014-09-05 13:07 - 00002632 _____ () C:\Windows\setupact.log
2014-09-02 19:42 - 2014-09-02 19:42 - 00000000 _____ () C:\Windows\setuperr.log
2014-09-02 19:41 - 2014-09-05 13:06 - 00128960 _____ () C:\Windows\PFRO.log
2014-09-02 19:25 - 2014-09-02 19:25 - 00000000 ____D () C:\ProgramData\Informer Technologies, Inc
2014-09-02 19:24 - 2014-09-02 19:24 - 00003306 _____ () C:\Windows\System32\Tasks\SoftwareInformerService
2014-09-02 19:24 - 2014-09-02 19:24 - 00000875 _____ () C:\Users\Public\Desktop\Software Informer.lnk
2014-09-02 19:24 - 2014-09-02 19:24 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Software Informer
2014-09-02 19:24 - 2014-09-02 19:24 - 00000000 ____D () C:\Program Files\Software Informer
2014-09-02 19:14 - 2014-09-02 19:14 - 00002003 _____ () C:\Users\Ahmed\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Update Checker.lnk
2014-09-02 19:14 - 2014-09-02 19:14 - 00001973 _____ () C:\Users\Ahmed\Desktop\Update Checker.lnk
2014-09-02 19:14 - 2014-09-02 19:14 - 00000000 ____D () C:\Program Files (x86)\FileHippo.com
2014-09-02 19:03 - 2014-09-02 19:03 - 00001121 _____ () C:\Users\Public\Desktop\KeePass 2.lnk
2014-09-02 19:03 - 2014-09-02 19:03 - 00001121 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\KeePass 2.lnk
2014-09-02 19:03 - 2014-09-02 19:03 - 00000000 ____D () C:\Program Files (x86)\KeePass Password Safe 2
2014-09-02 19:03 - 2014-09-02 19:02 - 00001009 _____ () C:\Users\Ahmed\Desktop\Dropbox.lnk
2014-09-02 19:02 - 2014-09-02 19:02 - 00000000 ____D () C:\Users\Ahmed\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2014-09-02 19:00 - 2014-09-02 19:02 - 00000000 ____D () C:\Users\Ahmed\AppData\Roaming\Dropbox
2014-09-02 18:59 - 2014-09-02 18:59 - 00000000 ____D () C:\Users\Ahmed\AppData\Roaming\Gyazo
2014-09-02 18:58 - 2014-09-02 18:58 - 00000000 ____D () C:\Program Files (x86)\SystemRequirementsLab
2014-09-02 18:54 - 2014-09-02 18:54 - 00000000 ____D () C:\Users\Public\Foxit Software
2014-09-02 18:54 - 2014-09-02 18:54 - 00000000 ____D () C:\Users\Ahmed\AppData\Roaming\Foxit Software
2014-09-02 18:53 - 2014-09-02 18:53 - 00001362 _____ () C:\Users\Public\Desktop\Foxit Reader.lnk
2014-09-02 18:53 - 2014-09-02 18:53 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Foxit Reader
2014-09-02 17:22 - 2014-09-02 17:22 - 00000000 ____D () C:\Program Files (x86)\Foxit Software
2014-09-02 17:07 - 2013-11-03 23:15 - 00000855 _____ () C:\Windows\system32\Drivers\etc\hosts.20140902-170736.backup
2014-09-02 17:02 - 2014-09-02 17:02 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip
2014-09-02 17:02 - 2014-09-02 17:02 - 00000000 ____D () C:\Program Files\7-Zip
2014-09-02 17:01 - 2014-09-02 17:01 - 00000000 ____D () C:\Windows\SysWOW64\Adobe
2014-09-02 17:01 - 2014-09-02 17:01 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Everything
2014-09-02 17:00 - 2014-09-02 17:00 - 00319912 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2014-09-02 17:00 - 2014-09-02 17:00 - 00189352 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2014-09-02 17:00 - 2014-09-02 17:00 - 00189352 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2014-09-02 17:00 - 2014-09-02 17:00 - 00111016 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge-64.dll
2014-09-02 17:00 - 2014-09-02 17:00 - 00000000 ____D () C:\Program Files\Java
2014-09-02 16:58 - 2014-09-02 16:58 - 00001011 _____ () C:\Users\Ahmed\Desktop\SpeedFan.lnk
2014-09-02 16:58 - 2014-09-02 16:57 - 00272808 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2014-09-02 16:57 - 2014-09-02 16:57 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2014-09-02 16:57 - 2014-09-02 16:57 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2014-09-02 16:57 - 2014-09-02 16:57 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2014-09-02 16:54 - 2014-09-03 13:10 - 00002183 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-09-02 16:46 - 2014-09-02 19:39 - 00000000 ____D () C:\3590F75ABA9E485486C100C1A9D4FF06ZZ.Z..ZZZZZ....Z
2014-09-02 16:46 - 2014-09-02 16:46 - 00001395 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot-S&D Start Center.lnk
2014-09-02 16:46 - 2014-09-02 16:46 - 00001383 _____ () C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
2014-09-02 16:46 - 2014-09-02 16:46 - 00000000 ____D () C:\Windows\System32\Tasks\Safer-Networking
2014-09-02 16:46 - 2014-09-02 16:46 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy 2
2014-09-02 16:45 - 2014-09-02 16:52 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2
2014-09-02 16:45 - 2014-09-02 16:50 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
2014-09-02 16:45 - 2013-09-20 10:49 - 00021040 _____ (Safer Networking Limited) C:\Windows\system32\sdnclean64.exe
2014-09-02 16:40 - 2014-09-02 16:41 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Defraggler
2014-09-02 16:40 - 2014-09-02 16:41 - 00000000 ____D () C:\Program Files\Defraggler
2014-09-02 16:40 - 2014-09-02 16:40 - 00001724 _____ () C:\Users\Public\Desktop\Defraggler.lnk
2014-09-02 15:40 - 2014-09-02 15:40 - 00000000 ____D () C:\SUPERDelete
2014-09-02 15:38 - 2014-09-02 15:38 - 00000000 ____D () C:\Users\Ahmed\AppData\Roaming\SUPERAntiSpyware.com
2014-09-02 15:37 - 2014-09-02 15:37 - 00001808 _____ () C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk
2014-09-02 15:37 - 2014-09-02 15:37 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SUPERAntiSpyware
2014-09-02 15:36 - 2014-09-05 12:58 - 00000000 ____D () C:\Program Files\SUPERAntiSpyware
2014-09-02 15:36 - 2014-09-02 15:36 - 00000000 ____D () C:\ProgramData\SUPERAntiSpyware.com
2014-09-02 15:20 - 2014-09-04 15:43 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-09-02 15:20 - 2014-09-03 14:08 - 00092888 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-09-02 15:20 - 2014-09-02 15:20 - 00002117 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Security Essentials.lnk
2014-09-02 15:20 - 2014-09-02 15:20 - 00001945 _____ () C:\Windows\epplauncher.mif
2014-09-02 15:20 - 2014-09-02 15:20 - 00001106 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-09-02 15:20 - 2014-09-02 15:20 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-09-02 15:20 - 2014-09-02 15:20 - 00000000 ____D () C:\Program Files (x86)\Microsoft Security Client
2014-09-02 15:20 - 2014-09-02 15:20 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-09-02 15:20 - 2014-05-12 07:26 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-09-02 15:19 - 2014-09-02 15:20 - 00000000 ____D () C:\Program Files\Microsoft Security Client
2014-08-31 19:04 - 2014-08-31 19:04 - 00001965 _____ () C:\Users\Ahmed\Desktop\psx emulation cheater.lnk
2014-08-31 19:04 - 2014-08-31 19:04 - 00000000 ____D () C:\Users\Ahmed\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\psx emulation cheater
2014-08-31 19:04 - 2014-08-31 19:04 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\psx emulation cheater
2014-08-31 19:04 - 2014-08-31 19:04 - 00000000 ____D () C:\Program Files (x86)\psx emulation cheater
2014-08-31 18:33 - 2003-09-06 07:23 - 00000080 _____ () C:\Users\Ahmed\Desktop\GameShark v5.cue
2014-08-31 18:33 - 2003-09-06 07:19 - 14667072 _____ () C:\Users\Ahmed\Desktop\GameShark v5.img
2014-08-31 18:33 - 2003-09-06 07:19 - 00598656 _____ () C:\Users\Ahmed\Desktop\GameShark v5.sub
2014-08-31 18:33 - 2003-09-06 07:19 - 00000770 _____ () C:\Users\Ahmed\Desktop\GameShark v5.ccd
2014-08-28 19:29 - 2014-08-23 05:07 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2014-08-28 19:29 - 2014-08-23 04:45 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2014-08-28 19:29 - 2014-08-23 03:59 - 03163648 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-08-25 22:05 - 2014-08-25 22:05 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_WinUsb_01005.Wdf
2014-08-25 21:38 - 2014-08-25 21:38 - 00000000 ____D () C:\Users\Ahmed\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Razer
2014-08-25 02:36 - 2014-08-25 02:36 - 00003608 _____ () C:\Windows\System32\Tasks\Alarm
2014-08-25 02:31 - 2014-08-25 02:34 - 00000000 ____D () C:\Program Files (x86)\Daily Alarm Clock
2014-08-25 02:31 - 2014-08-25 02:31 - 00002633 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Daily Alarm Clock.lnk
2014-08-18 05:01 - 2014-07-01 01:24 - 00008856 _____ (Microsoft Corporation) C:\Windows\system32\icardres.dll
2014-08-18 05:01 - 2014-07-01 01:14 - 00008856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardres.dll
2014-08-18 05:01 - 2014-03-10 00:48 - 01389208 _____ (Microsoft Corporation) C:\Windows\system32\icardagt.exe
2014-08-18 05:01 - 2014-03-10 00:48 - 00171160 _____ (Microsoft Corporation) C:\Windows\system32\infocardapi.dll
2014-08-18 05:01 - 2014-03-10 00:47 - 00619672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardagt.exe
2014-08-18 05:01 - 2014-03-10 00:47 - 00099480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\infocardapi.dll
2014-08-18 05:00 - 2014-06-06 09:16 - 00035480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TsWpfWrp.exe
2014-08-18 05:00 - 2014-06-06 09:12 - 00035480 _____ (Microsoft Corporation) C:\Windows\system32\TsWpfWrp.exe
2014-08-15 02:38 - 2014-08-15 02:49 - 00000290 _____ () C:\Users\Ahmed\Desktop\lol.txt
2014-08-13 23:28 - 2014-07-16 06:23 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2014-08-13 23:28 - 2014-07-16 05:46 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2014-08-13 23:28 - 2014-07-09 05:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDYAK.DLL
2014-08-13 23:28 - 2014-07-09 05:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDTAT.DLL
2014-08-13 23:28 - 2014-07-09 05:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDRU1.DLL
2014-08-13 23:28 - 2014-07-09 05:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDBASH.DLL
2014-08-13 23:28 - 2014-07-09 05:03 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\KBDRU.DLL
2014-08-13 23:28 - 2014-07-09 04:31 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDYAK.DLL
2014-08-13 23:28 - 2014-07-09 04:31 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDTAT.DLL
2014-08-13 23:28 - 2014-07-09 04:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDRU1.DLL
2014-08-13 23:28 - 2014-07-09 04:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDRU.DLL
2014-08-13 23:28 - 2014-07-09 04:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDBASH.DLL
2014-08-13 23:28 - 2014-07-09 01:38 - 00419992 _____ () C:\Windows\system32\locale.nls
2014-08-13 23:28 - 2014-07-09 01:30 - 00419992 _____ () C:\Windows\SysWOW64\locale.nls
2014-08-13 23:27 - 2014-08-01 02:41 - 00348856 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-08-13 23:27 - 2014-08-01 02:16 - 00307384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-08-13 23:27 - 2014-07-25 17:02 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-08-13 23:27 - 2014-07-25 17:01 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-08-13 23:27 - 2014-07-25 16:51 - 17524224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-08-13 23:27 - 2014-07-25 16:30 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-08-13 23:27 - 2014-07-25 16:28 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-08-13 23:27 - 2014-07-25 16:25 - 02774528 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-08-13 23:27 - 2014-07-25 16:11 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-08-13 23:27 - 2014-07-25 16:10 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-08-13 23:27 - 2014-07-25 16:04 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-08-13 23:27 - 2014-07-25 16:03 - 00598016 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-08-13 23:27 - 2014-07-25 16:00 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-08-13 23:27 - 2014-07-25 15:40 - 00452096 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-08-13 23:27 - 2014-07-25 15:34 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-08-13 23:27 - 2014-07-25 15:34 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-08-13 23:27 - 2014-07-25 15:33 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-08-13 23:27 - 2014-07-25 15:30 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-08-13 23:27 - 2014-07-25 15:28 - 00072704 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-08-13 23:27 - 2014-07-25 15:21 - 02184704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-08-13 23:27 - 2014-07-25 15:18 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-08-13 23:27 - 2014-07-25 15:17 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-08-13 23:27 - 2014-07-25 15:12 - 00438784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-08-13 23:27 - 2014-07-25 15:10 - 00292864 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-08-13 23:27 - 2014-07-25 15:10 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-08-13 23:27 - 2014-07-25 15:08 - 00597504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-08-13 23:27 - 2014-07-25 15:06 - 04204032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-08-13 23:27 - 2014-07-25 14:52 - 00367104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-08-13 23:27 - 2014-07-25 14:47 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-08-13 23:27 - 2014-07-25 14:43 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-08-13 23:27 - 2014-07-25 14:42 - 00692736 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-08-13 23:27 - 2014-07-25 14:39 - 02087936 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-08-13 23:27 - 2014-07-25 14:36 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-08-13 23:27 - 2014-07-25 14:34 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-08-13 23:27 - 2014-07-25 14:29 - 00239616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-08-13 23:27 - 2014-07-25 14:23 - 13547008 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-08-13 23:27 - 2014-07-25 14:13 - 00526336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-08-13 23:27 - 2014-07-25 14:07 - 02001920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-08-13 23:27 - 2014-07-25 14:07 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-08-13 23:27 - 2014-07-25 14:03 - 11772928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-08-13 23:27 - 2014-07-25 13:26 - 01431040 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-08-13 23:27 - 2014-07-25 13:09 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-08-13 23:27 - 2014-07-25 13:05 - 01792512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-08-13 23:27 - 2014-07-25 13:00 - 01169920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-08-13 23:27 - 2014-06-25 05:05 - 14175744 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2014-08-13 23:27 - 2014-06-25 04:41 - 12874240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2014-08-13 23:27 - 2014-06-16 05:10 - 00985536 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2014-08-13 23:27 - 2014-06-03 13:02 - 03241984 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2014-08-13 23:27 - 2014-06-03 13:02 - 01941504 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2014-08-13 23:27 - 2014-06-03 13:02 - 00504320 _____ (Microsoft Corporation) C:\Windows\system32\msihnd.dll
2014-08-13 23:27 - 2014-06-03 13:02 - 00112064 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe
2014-08-13 23:27 - 2014-06-03 12:29 - 02363392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2014-08-13 23:27 - 2014-06-03 12:29 - 01805824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2014-08-13 23:27 - 2014-06-03 12:29 - 00337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msihnd.dll
2014-08-13 23:26 - 2014-07-25 17:52 - 23645696 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-08-13 23:26 - 2014-07-25 16:28 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-08-13 23:26 - 2014-07-25 16:25 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-08-13 23:26 - 2014-07-25 16:00 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-08-13 23:26 - 2014-07-25 15:59 - 00758272 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-08-13 23:26 - 2014-07-25 15:47 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-08-13 23:26 - 2014-07-25 15:28 - 05824512 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-08-13 23:26 - 2014-07-25 15:19 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-08-13 23:26 - 2014-07-25 15:17 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-08-13 23:26 - 2014-07-25 14:39 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-08-13 23:26 - 2014-07-25 13:52 - 02266624 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-08-13 23:26 - 2014-07-25 13:17 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-08-13 23:24 - 2014-07-14 05:02 - 01216000 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2014-08-13 23:24 - 2014-07-14 04:40 - 00664064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2014-08-13 17:19 - 2014-08-13 17:19 - 00000701 _____ () C:\Users\Ahmed\Desktop\ePSXe - Shortcut.lnk
2014-08-12 05:42 - 2006-03-12 01:29 - 00000000 ____D () C:\Users\Ahmed\Desktop\Digimon World 2 [SLUS-01193]
2014-08-12 05:20 - 2014-08-12 05:20 - 00014304 _____ () C:\ProgramData\Duplicaterecord.js
2014-08-12 05:20 - 2014-08-12 05:20 - 00000000 __SHD () C:\Users\Ahmed\AppData\Local\EmieUserList
2014-08-12 05:20 - 2014-08-12 05:20 - 00000000 __SHD () C:\Users\Ahmed\AppData\Local\EmieSiteList
2014-08-12 05:11 - 2014-08-12 05:11 - 00172032 _____ (Jin Hui E-mail: jinhui@jcomsoft.com Web: http://www.jcomsoft.com) C:\Windows\SysWOW64\AniGIF.ocx
2014-08-12 05:11 - 2014-08-12 05:11 - 00003446 _____ () C:\Windows\System32\Tasks\YTAUpdate
2014-08-12 05:10 - 2014-08-12 05:10 - 00000000 ____D () C:\Program Files (x86)\PCSXR
2014-08-12 05:09 - 2014-08-12 05:09 - 00001796 _____ () C:\Users\Ahmed\Desktop\Continue PCSX-Reloaded.lnk
2014-08-11 22:25 - 2014-08-11 22:25 - 00013500 _____ () C:\Users\Ahmed\Desktop\final_fantasy_x_eu_h.max
2014-08-11 22:09 - 2014-08-11 22:16 - 00000000 ___DC () C:\Users\Ahmed\Desktop\pls
2014-08-11 22:05 - 2007-05-13 17:29 - 00000000 ____D () C:\Users\Ahmed\Desktop\state5
2014-08-11 22:00 - 2014-08-11 22:00 - 00010851 _____ () C:\Users\Ahmed\Desktop\final_fantasy_x_g.cbs
2014-08-11 21:34 - 2014-08-11 21:35 - 00000258 __RSH () C:\ProgramData\ntuser.pol
2014-08-11 21:14 - 2014-08-11 21:14 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_WinUsb_01009.Wdf
2014-08-11 21:12 - 2013-05-19 10:02 - 00039168 _____ (Scarlet.Crush Productions) C:\Windows\system32\Drivers\ScpVBus.sys
2014-08-11 21:12 - 2013-01-07 17:56 - 01002728 _____ (Microsoft Corporation) C:\Windows\system32\WinUSBCoInstaller2.dll
2014-08-11 21:11 - 2014-09-02 21:38 - 00000000 ____D () C:\Program Files\Scarlet.Crush Productions
2014-08-11 21:10 - 2014-03-11 08:18 - 00000000 ____D () C:\Users\Ahmed\Desktop\ScpServer
2014-08-11 20:56 - 2014-08-11 20:56 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_xusb21_01009.Wdf
2014-08-11 20:56 - 2014-08-11 20:56 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_MijXfilt_01009.Wdf
2014-08-11 20:53 - 2014-08-11 20:52 - 04117346 _____ () C:\Users\Ahmed\Desktop\motioninjoy-0-7-1001-en-win.zip
2014-08-11 20:53 - 2012-05-12 07:33 - 04199240 _____ (www.motioninjoy.com ) C:\Users\Ahmed\Desktop\MotioninJoy_071001_signed.exe
2014-08-11 00:29 - 2014-08-11 00:29 - 00000000 ____D () C:\Users\Ahmed\AppData\Roaming\ImgBurn
2014-08-11 00:22 - 2014-08-11 00:22 - 00000000 ____D () C:\Users\Ahmed\AppData\Roaming\AVG
2014-08-11 00:22 - 2014-08-11 00:22 - 00000000 ____D () C:\Users\Ahmed\AppData\Local\AVG
2014-08-11 00:20 - 2014-08-11 01:30 - 00000000 ____D () C:\ProgramData\AVG
2014-08-11 00:20 - 2014-08-11 00:20 - 00000000 __SHD () C:\ProgramData\{01BD4FC9-2F86-4706-A62E-774BB7E9D308}
2014-08-11 00:19 - 2014-08-11 00:29 - 303202304 _____ () C:\Users\Ahmed\Documents\FINAL_FANTASY_X.ISO
2014-08-11 00:18 - 2014-08-11 00:18 - 00001881 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ImgBurn.lnk
2014-08-11 00:18 - 2014-08-11 00:18 - 00001869 _____ () C:\Users\Public\Desktop\ImgBurn.lnk
2014-08-11 00:18 - 2014-08-11 00:18 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ImgBurn
2014-08-11 00:18 - 2014-08-11 00:18 - 00000000 ____D () C:\Program Files (x86)\ImgBurn
2014-08-11 00:07 - 2014-08-12 02:48 - 303202304 _____ () C:\Users\Ahmed\Downloads\FINAL_FANTASY_X.iso
2014-08-11 00:04 - 2014-08-11 00:04 - 00000000 ____D () C:\Users\Ahmed\Desktop\bios
2014-08-10 23:57 - 2014-08-10 23:57 - 00001989 _____ () C:\Users\Public\Desktop\PCSX2 1.2.1 (r5875).lnk
2014-08-10 23:56 - 2014-08-10 23:59 - 00000000 ____D () C:\Program Files (x86)\PCSX2 1.2.1
2014-08-09 21:36 - 2014-08-09 21:36 - 00660128 _____ (Microsoft Corporation) C:\Windows\system32\msvcp120.dll
2014-08-09 21:36 - 2014-08-09 21:36 - 00455328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msvcp120.dll
2014-08-09 21:02 - 2014-08-09 21:02 - 00000000 ____D () C:\Users\Ahmed\Desktop\ppsspp_win

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-09-05 13:26 - 2014-09-05 13:25 - 00000000 ____D () C:\FRST
2014-09-05 13:26 - 2014-08-03 16:02 - 00000000 ____D () C:\Users\Ahmed\Desktop\Week 1
2014-09-05 13:23 - 2014-09-05 13:23 - 00001455 _____ () C:\Users\Ahmed\Desktop\JRT.txt
2014-09-05 13:16 - 2013-09-26 19:49 - 00000000 ____D () C:\Windows\pss
2014-09-05 13:15 - 2014-06-10 18:44 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-09-05 13:13 - 2013-06-07 13:04 - 01568674 _____ () C:\Windows\WindowsUpdate.log
2014-09-05 13:13 - 2009-07-14 07:45 - 00014240 _____ () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-09-05 13:13 - 2009-07-14 07:45 - 00014240 _____ () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-09-05 13:07 - 2014-09-05 13:07 - 00002324 _____ () C:\Users\Ahmed\Desktop\AdwCleaner[S2].txt
2014-09-05 13:07 - 2014-09-03 15:55 - 00000332 _____ () C:\Windows\Tasks\GlaryInitialize 5.job
2014-09-05 13:07 - 2014-09-03 15:55 - 00000000 ____D () C:\Program Files (x86)\Glary Utilities 5
2014-09-05 13:07 - 2014-09-02 19:42 - 00002632 _____ () C:\Windows\setupact.log
2014-09-05 13:07 - 2013-06-07 13:32 - 00000892 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-09-05 13:06 - 2014-09-02 19:41 - 00128960 _____ () C:\Windows\PFRO.log
2014-09-05 13:06 - 2013-06-07 11:56 - 00000000 ____D () C:\ProgramData\NVIDIA
2014-09-05 13:06 - 2009-07-14 08:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-09-05 13:05 - 2013-10-21 20:11 - 00000000 ____D () C:\AdwCleaner
2014-09-05 13:02 - 2013-06-07 16:58 - 00000000 ____D () C:\Users\Ahmed\AppData\Roaming\Skype
2014-09-05 13:02 - 2013-06-07 13:32 - 00000896 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-09-05 12:58 - 2014-09-03 13:33 - 00000000 ____D () C:\Users\Ahmed\AppData\Local\CrashDumps
2014-09-05 12:58 - 2014-09-02 15:36 - 00000000 ____D () C:\Program Files\SUPERAntiSpyware
2014-09-05 12:57 - 2014-09-04 14:36 - 00000000 ____D () C:\Program Files (x86)\360
2014-09-05 12:57 - 2013-10-01 01:41 - 00000000 ____D () C:\Users\Ahmed\AppData\Local\TSVNCache
2014-09-04 15:49 - 2014-06-13 11:43 - 00000000 ____D () C:\Users\Ahmed\AppData\Local\BetterDS3
2014-09-04 15:43 - 2014-09-02 15:20 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-09-04 15:41 - 2014-09-04 15:41 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MotioninJoy
2014-09-04 15:28 - 2014-09-04 15:28 - 04117346 _____ () C:\Users\Ahmed\Documents\motioninjoy-0-7-1001-en-win.zip
2014-09-04 15:00 - 2014-09-04 15:00 - 00000000 ____D () C:\Users\Ahmed\Desktop\New folder (4)
2014-09-04 15:00 - 2014-09-04 15:00 - 00000000 ____D () C:\Users\Ahmed\Desktop\breath of fire
2014-09-04 14:46 - 2013-06-07 12:31 - 00000000 ____D () C:\Users\Ahmed\AppData\Local\Apps\2.0
2014-09-04 14:43 - 2014-09-04 14:43 - 162499401 _____ () C:\Users\Ahmed\Desktop\Breath of Fire IV.7z
2014-09-04 13:30 - 2014-09-04 13:30 - 00042534 _____ () C:\ComboFix.txt
2014-09-04 13:30 - 2014-09-04 13:16 - 00000000 ____D () C:\Qoobox
2014-09-04 13:30 - 2009-07-14 06:20 - 00000000 ___RD () C:\Users\Default
2014-09-04 13:28 - 2014-09-04 13:15 - 00000000 ____D () C:\Windows\erdnt
2014-09-04 13:27 - 2009-07-14 05:34 - 00000215 _____ () C:\Windows\system.ini
2014-09-04 13:24 - 2013-09-10 20:51 - 00000000 ____D () C:\ProgramData\TEMP
2014-09-04 13:00 - 2014-09-04 12:59 - 05576326 ____R (Swearware) C:\Users\Ahmed\Desktop\ComboFix.exe
2014-09-04 12:33 - 2009-07-14 06:20 - 00000000 ____D () C:\Windows\system32\NDF
2014-09-04 02:06 - 2013-12-06 13:55 - 00000000 ____D () C:\Users\Ahmed\AppData\Local\Battle.net
2014-09-03 17:25 - 2013-07-05 03:25 - 00007604 _____ () C:\Users\Ahmed\AppData\Local\Resmon.ResmonCfg
2014-09-03 15:57 - 2014-07-19 21:00 - 00003160 _____ () C:\Windows\System32\Tasks\Private Internet Access Startup
2014-09-03 15:57 - 2013-09-20 13:56 - 00004184 _____ () C:\Windows\System32\Tasks\avast! Emergency Update
2014-09-03 15:57 - 2013-06-10 17:41 - 00004008 _____ () C:\Windows\System32\Tasks\PCDoctorBackgroundMonitorTask
2014-09-03 15:57 - 2013-06-10 17:41 - 00003462 _____ () C:\Windows\System32\Tasks\PCDEventLauncherTask
2014-09-03 15:55 - 2014-09-03 15:55 - 00020672 _____ (Glarysoft Ltd) C:\Windows\system32\Drivers\GUBootStartup.sys
2014-09-03 15:55 - 2014-09-03 15:55 - 00002972 _____ () C:\Windows\System32\Tasks\GU5SkipUAC
2014-09-03 15:55 - 2014-09-03 15:55 - 00002628 _____ () C:\Windows\System32\Tasks\GlaryInitialize 5
2014-09-03 15:55 - 2014-09-03 15:55 - 00001096 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Glary Utilities 5.lnk
2014-09-03 15:55 - 2014-09-03 15:55 - 00001084 _____ () C:\Users\Public\Desktop\Glary Utilities 5.lnk
2014-09-03 15:55 - 2014-09-03 15:55 - 00000000 ____D () C:\Users\Ahmed\AppData\Roaming\GlarySoft
2014-09-03 15:55 - 2014-09-03 15:55 - 00000000 ____D () C:\Users\Ahmed\AppData\Roaming\DiskDefrag
2014-09-03 15:55 - 2014-09-03 15:55 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Glary Utilities 5
2014-09-03 14:26 - 2014-09-03 14:10 - 00000000 ____D () C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2014-09-03 14:26 - 2014-09-03 14:00 - 00000000 ____D () C:\Users\Ahmed\Desktop\mbar
2014-09-03 14:08 - 2014-09-02 15:20 - 00092888 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-09-03 13:59 - 2014-09-03 13:59 - 14349744 _____ (Malwarebytes Corp.) C:\Users\Ahmed\Desktop\mbar-1.07.0.1012.exe
2014-09-03 13:54 - 2014-09-03 13:53 - 00005349 _____ () C:\Users\Ahmed\Desktop\RKreport_DEL_09032014_135209.log
2014-09-03 13:45 - 2014-09-03 13:43 - 00033512 _____ () C:\Windows\SysWOW64\Drivers\TrueSight.sys
2014-09-03 13:43 - 2014-09-03 13:43 - 00000000 ____D () C:\ProgramData\RogueKiller
2014-09-03 13:41 - 2014-09-03 13:41 - 04857944 _____ () C:\Users\Ahmed\Desktop\RogueKiller.exe
2014-09-03 13:38 - 2013-09-10 20:43 - 00000000 ____D () C:\ProgramData\Baidu Security
2014-09-03 13:28 - 2013-09-20 13:56 - 00000000 ____D () C:\Program Files\AVAST Software
2014-09-03 13:28 - 2013-09-20 13:56 - 00000000 _____ () C:\Windows\SysWOW64\config.nt
2014-09-03 13:10 - 2014-09-02 16:54 - 00002183 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-09-02 23:18 - 2014-04-03 21:40 - 00000000 ____D () C:\Program Files (x86)\SpeedFan
2014-09-02 22:51 - 2013-06-07 11:35 - 00000000 ____D () C:\Users\Ahmed
2014-09-02 22:25 - 2014-09-02 22:25 - 00039025 _____ () C:\Users\Ahmed\Desktop\dds.txt
2014-09-02 22:25 - 2014-09-02 22:25 - 00020697 _____ () C:\Users\Ahmed\Desktop\attach.txt
2014-09-02 21:38 - 2014-08-11 21:11 - 00000000 ____D () C:\Program Files\Scarlet.Crush Productions
2014-09-02 21:31 - 2014-09-02 21:31 - 00000000 ____D () C:\TDSSKiller_Quarantine
2014-09-02 21:14 - 2013-09-26 19:43 - 00000000 ____D () C:\Windows\Minidump
2014-09-02 20:04 - 2014-09-02 20:04 - 00000000 ____D () C:\Users\Ahmed\AppData\Roaming\KeePass
2014-09-02 19:42 - 2014-09-02 19:42 - 00000000 _____ () C:\Windows\setuperr.log
2014-09-02 19:39 - 2014-09-02 16:46 - 00000000 ____D () C:\3590F75ABA9E485486C100C1A9D4FF06ZZ.Z..ZZZZZ....Z
2014-09-02 19:25 - 2014-09-02 19:25 - 00000000 ____D () C:\ProgramData\Informer Technologies, Inc
2014-09-02 19:24 - 2014-09-02 19:24 - 00003306 _____ () C:\Windows\System32\Tasks\SoftwareInformerService
2014-09-02 19:24 - 2014-09-02 19:24 - 00000875 _____ () C:\Users\Public\Desktop\Software Informer.lnk
2014-09-02 19:24 - 2014-09-02 19:24 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Software Informer
2014-09-02 19:24 - 2014-09-02 19:24 - 00000000 ____D () C:\Program Files\Software Informer
2014-09-02 19:14 - 2014-09-02 19:14 - 00002003 _____ () C:\Users\Ahmed\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Update Checker.lnk
2014-09-02 19:14 - 2014-09-02 19:14 - 00001973 _____ () C:\Users\Ahmed\Desktop\Update Checker.lnk
2014-09-02 19:14 - 2014-09-02 19:14 - 00000000 ____D () C:\Program Files (x86)\FileHippo.com
2014-09-02 19:03 - 2014-09-02 19:03 - 00001121 _____ () C:\Users\Public\Desktop\KeePass 2.lnk
2014-09-02 19:03 - 2014-09-02 19:03 - 00001121 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\KeePass 2.lnk
2014-09-02 19:03 - 2014-09-02 19:03 - 00000000 ____D () C:\Program Files (x86)\KeePass Password Safe 2
2014-09-02 19:02 - 2014-09-02 19:03 - 00001009 _____ () C:\Users\Ahmed\Desktop\Dropbox.lnk
2014-09-02 19:02 - 2014-09-02 19:02 - 00000000 ____D () C:\Users\Ahmed\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2014-09-02 19:02 - 2014-09-02 19:00 - 00000000 ____D () C:\Users\Ahmed\AppData\Roaming\Dropbox
2014-09-02 18:59 - 2014-09-02 18:59 - 00000000 ____D () C:\Users\Ahmed\AppData\Roaming\Gyazo
2014-09-02 18:58 - 2014-09-02 18:58 - 00000000 ____D () C:\Program Files (x86)\SystemRequirementsLab
2014-09-02 18:54 - 2014-09-02 18:54 - 00000000 ____D () C:\Users\Public\Foxit Software
2014-09-02 18:54 - 2014-09-02 18:54 - 00000000 ____D () C:\Users\Ahmed\AppData\Roaming\Foxit Software
2014-09-02 18:54 - 2013-06-07 12:31 - 00000000 ____D () C:\Users\Ahmed\AppData\Local\Deployment
2014-09-02 18:53 - 2014-09-02 18:53 - 00001362 _____ () C:\Users\Public\Desktop\Foxit Reader.lnk
2014-09-02 18:53 - 2014-09-02 18:53 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Foxit Reader
2014-09-02 17:22 - 2014-09-02 17:22 - 00000000 ____D () C:\Program Files (x86)\Foxit Software
2014-09-02 17:02 - 2014-09-02 17:02 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip
2014-09-02 17:02 - 2014-09-02 17:02 - 00000000 ____D () C:\Program Files\7-Zip
2014-09-02 17:01 - 2014-09-02 17:01 - 00000000 ____D () C:\Windows\SysWOW64\Adobe
2014-09-02 17:01 - 2014-09-02 17:01 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Everything
2014-09-02 17:00 - 2014-09-02 17:00 - 00319912 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2014-09-02 17:00 - 2014-09-02 17:00 - 00189352 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2014-09-02 17:00 - 2014-09-02 17:00 - 00189352 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2014-09-02 17:00 - 2014-09-02 17:00 - 00111016 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge-64.dll
2014-09-02 17:00 - 2014-09-02 17:00 - 00000000 ____D () C:\Program Files\Java
2014-09-02 16:58 - 2014-09-02 16:58 - 00001011 _____ () C:\Users\Ahmed\Desktop\SpeedFan.lnk
2014-09-02 16:58 - 2014-04-03 21:40 - 00000045 _____ () C:\Windows\SysWOW64\initdebug.nfo
2014-09-02 16:57 - 2014-09-02 16:58 - 00272808 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2014-09-02 16:57 - 2014-09-02 16:57 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2014-09-02 16:57 - 2014-09-02 16:57 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2014-09-02 16:57 - 2014-09-02 16:57 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2014-09-02 16:52 - 2014-09-02 16:45 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2
2014-09-02 16:50 - 2014-09-02 16:45 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
2014-09-02 16:46 - 2014-09-02 16:46 - 00001395 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot-S&D Start Center.lnk
2014-09-02 16:46 - 2014-09-02 16:46 - 00001383 _____ () C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
2014-09-02 16:46 - 2014-09-02 16:46 - 00000000 ____D () C:\Windows\System32\Tasks\Safer-Networking
2014-09-02 16:46 - 2014-09-02 16:46 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy 2
2014-09-02 16:45 - 2013-06-28 23:42 - 00000000 ____D () C:\Program Files (x86)\Steam
2014-09-02 16:41 - 2014-09-02 16:40 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Defraggler
2014-09-02 16:41 - 2014-09-02 16:40 - 00000000 ____D () C:\Program Files\Defraggler
2014-09-02 16:40 - 2014-09-02 16:40 - 00001724 _____ () C:\Users\Public\Desktop\Defraggler.lnk
2014-09-02 15:40 - 2014-09-02 15:40 - 00000000 ____D () C:\SUPERDelete
2014-09-02 15:38 - 2014-09-02 15:38 - 00000000 ____D () C:\Users\Ahmed\AppData\Roaming\SUPERAntiSpyware.com
2014-09-02 15:37 - 2014-09-02 15:37 - 00001808 _____ () C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk
2014-09-02 15:37 - 2014-09-02 15:37 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SUPERAntiSpyware
2014-09-02 15:36 - 2014-09-02 15:36 - 00000000 ____D () C:\ProgramData\SUPERAntiSpyware.com
2014-09-02 15:20 - 2014-09-02 15:20 - 00002117 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Security Essentials.lnk
2014-09-02 15:20 - 2014-09-02 15:20 - 00001945 _____ () C:\Windows\epplauncher.mif
2014-09-02 15:20 - 2014-09-02 15:20 - 00001106 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-09-02 15:20 - 2014-09-02 15:20 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-09-02 15:20 - 2014-09-02 15:20 - 00000000 ____D () C:\Program Files (x86)\Microsoft Security Client
2014-09-02 15:20 - 2014-09-02 15:20 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-09-02 15:20 - 2014-09-02 15:19 - 00000000 ____D () C:\Program Files\Microsoft Security Client
2014-09-02 15:20 - 2013-11-03 22:29 - 00000000 ____D () C:\Users\Ahmed\AppData\Roaming\Malwarebytes
2014-09-02 15:20 - 2013-11-03 22:29 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-08-31 19:04 - 2014-08-31 19:04 - 00001965 _____ () C:\Users\Ahmed\Desktop\psx emulation cheater.lnk
2014-08-31 19:04 - 2014-08-31 19:04 - 00000000 ____D () C:\Users\Ahmed\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\psx emulation cheater
2014-08-31 19:04 - 2014-08-31 19:04 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\psx emulation cheater
2014-08-31 19:04 - 2014-08-31 19:04 - 00000000 ____D () C:\Program Files (x86)\psx emulation cheater
2014-08-29 13:29 - 2009-07-14 07:45 - 00450936 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-08-27 15:06 - 2013-06-07 16:56 - 00000000 ____D () C:\Program Files (x86)\World of Warcraft
2014-08-26 01:32 - 2014-07-27 14:16 - 00000000 ____D () C:\Users\Ahmed\AppData\Local\Razer
2014-08-25 22:05 - 2014-08-25 22:05 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_WinUsb_01005.Wdf
2014-08-25 21:51 - 2013-06-07 12:31 - 00125072 _____ () C:\Users\Ahmed\AppData\Local\GDIPFONTCACHEV1.DAT
2014-08-25 21:38 - 2014-08-25 21:38 - 00000000 ____D () C:\Users\Ahmed\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Razer
2014-08-25 21:38 - 2014-06-29 17:59 - 00000000 ____D () C:\Program Files (x86)\Razer
2014-08-25 02:36 - 2014-08-25 02:36 - 00003608 _____ () C:\Windows\System32\Tasks\Alarm
2014-08-25 02:34 - 2014-08-25 02:31 - 00000000 ____D () C:\Program Files (x86)\Daily Alarm Clock
2014-08-25 02:31 - 2014-08-25 02:31 - 00002633 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Daily Alarm Clock.lnk
2014-08-23 19:06 - 2013-12-06 13:55 - 00000000 ____D () C:\Program Files (x86)\Battle.net
2014-08-23 19:02 - 2013-12-06 14:57 - 00000000 ____D () C:\Program Files (x86)\Hearthstone
2014-08-23 05:07 - 2014-08-28 19:29 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2014-08-23 04:45 - 2014-08-28 19:29 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2014-08-23 03:59 - 2014-08-28 19:29 - 03163648 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-08-21 16:22 - 2014-09-04 14:47 - 00023752 _____ (360安全中心) C:\Windows\SysWOW64\Drivers\efimon.sys
2014-08-17 20:35 - 2009-07-14 08:13 - 00782662 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-08-15 02:49 - 2014-08-15 02:38 - 00000290 _____ () C:\Users\Ahmed\Desktop\lol.txt
2014-08-14 10:40 - 2009-07-14 06:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
2014-08-14 10:04 - 2013-06-10 17:33 - 00000000 ____D () C:\Users\Ahmed\AppData\Roaming\PCDr
2014-08-14 06:23 - 2013-11-30 16:14 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-08-14 06:12 - 2013-07-23 04:04 - 00000000 ____D () C:\Windows\system32\MRT
2014-08-14 06:07 - 2013-06-07 17:23 - 99218768 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-08-13 17:19 - 2014-08-13 17:19 - 00000701 _____ () C:\Users\Ahmed\Desktop\ePSXe - Shortcut.lnk
2014-08-12 17:01 - 2013-06-07 16:57 - 00000000 ____D () C:\ProgramData\Skype
2014-08-12 05:25 - 2014-04-09 23:06 - 00000000 ____D () C:\Users\Ahmed\Documents\Pamela
2014-08-12 05:25 - 2014-04-09 23:06 - 00000000 ____D () C:\Users\Ahmed\AppData\Roaming\Pamela
2014-08-12 05:20 - 2014-08-12 05:20 - 00014304 _____ () C:\ProgramData\Duplicaterecord.js
2014-08-12 05:20 - 2014-08-12 05:20 - 00000000 __SHD () C:\Users\Ahmed\AppData\Local\EmieUserList
2014-08-12 05:20 - 2014-08-12 05:20 - 00000000 __SHD () C:\Users\Ahmed\AppData\Local\EmieSiteList
2014-08-12 05:20 - 2013-09-10 20:45 - 00000000 ____D () C:\Users\Ahmed\AppData\Roaming\Baidu Security
2014-08-12 05:20 - 2013-09-10 20:43 - 00000000 ____D () C:\Users\Public\Documents\Baidu Security
2014-08-12 05:11 - 2014-08-12 05:11 - 00172032 _____ (Jin Hui E-mail: jinhui@jcomsoft.com Web: http://www.jcomsoft.com) C:\Windows\SysWOW64\AniGIF.ocx
2014-08-12 05:11 - 2014-08-12 05:11 - 00003446 _____ () C:\Windows\System32\Tasks\YTAUpdate
2014-08-12 05:10 - 2014-08-12 05:10 - 00000000 ____D () C:\Program Files (x86)\PCSXR
2014-08-12 05:09 - 2014-08-12 05:09 - 00001796 _____ () C:\Users\Ahmed\Desktop\Continue PCSX-Reloaded.lnk
2014-08-12 02:48 - 2014-08-11 00:07 - 303202304 _____ () C:\Users\Ahmed\Downloads\FINAL_FANTASY_X.iso
2014-08-11 22:25 - 2014-08-11 22:25 - 00013500 _____ () C:\Users\Ahmed\Desktop\final_fantasy_x_eu_h.max
2014-08-11 22:16 - 2014-08-11 22:09 - 00000000 ___DC () C:\Users\Ahmed\Desktop\pls
2014-08-11 22:00 - 2014-08-11 22:00 - 00010851 _____ () C:\Users\Ahmed\Desktop\final_fantasy_x_g.cbs
2014-08-11 21:35 - 2014-08-11 21:34 - 00000258 __RSH () C:\ProgramData\ntuser.pol
2014-08-11 21:34 - 2009-07-14 06:20 - 00000000 ___HD () C:\Windows\system32\GroupPolicy
2014-08-11 21:14 - 2014-08-11 21:14 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_WinUsb_01009.Wdf
2014-08-11 20:56 - 2014-08-11 20:56 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_xusb21_01009.Wdf
2014-08-11 20:56 - 2014-08-11 20:56 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_MijXfilt_01009.Wdf
2014-08-11 20:52 - 2014-08-11 20:53 - 04117346 _____ () C:\Users\Ahmed\Desktop\motioninjoy-0-7-1001-en-win.zip
2014-08-11 01:30 - 2014-08-11 00:20 - 00000000 ____D () C:\ProgramData\AVG
2014-08-11 00:29 - 2014-08-11 00:29 - 00000000 ____D () C:\Users\Ahmed\AppData\Roaming\ImgBurn
2014-08-11 00:29 - 2014-08-11 00:19 - 303202304 _____ () C:\Users\Ahmed\Documents\FINAL_FANTASY_X.ISO
2014-08-11 00:22 - 2014-08-11 00:22 - 00000000 ____D () C:\Users\Ahmed\AppData\Roaming\AVG
2014-08-11 00:22 - 2014-08-11 00:22 - 00000000 ____D () C:\Users\Ahmed\AppData\Local\AVG
2014-08-11 00:20 - 2014-08-11 00:20 - 00000000 __SHD () C:\ProgramData\{01BD4FC9-2F86-4706-A62E-774BB7E9D308}
2014-08-11 00:18 - 2014-08-11 00:18 - 00001881 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ImgBurn.lnk
2014-08-11 00:18 - 2014-08-11 00:18 - 00001869 _____ () C:\Users\Public\Desktop\ImgBurn.lnk
2014-08-11 00:18 - 2014-08-11 00:18 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ImgBurn
2014-08-11 00:18 - 2014-08-11 00:18 - 00000000 ____D () C:\Program Files (x86)\ImgBurn
2014-08-11 00:04 - 2014-08-11 00:04 - 00000000 ____D () C:\Users\Ahmed\Desktop\bios
2014-08-10 23:59 - 2014-08-10 23:56 - 00000000 ____D () C:\Program Files (x86)\PCSX2 1.2.1
2014-08-10 23:59 - 2014-06-06 14:04 - 00000000 ____D () C:\Users\Ahmed\Documents\PCSX2
2014-08-10 23:58 - 2013-06-07 13:44 - 00000000 ____D () C:\Windows\SysWOW64\directx
2014-08-10 23:58 - 2013-06-07 13:44 - 00000000 ____D () C:\Windows\msdownld.tmp
2014-08-10 23:57 - 2014-08-10 23:57 - 00001989 _____ () C:\Users\Public\Desktop\PCSX2 1.2.1 (r5875).lnk
2014-08-10 23:57 - 2014-06-06 14:03 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PCSX2
2014-08-10 23:57 - 2013-07-10 23:34 - 00000000 ____D () C:\ProgramData\Package Cache
2014-08-09 21:36 - 2014-08-09 21:36 - 00660128 _____ (Microsoft Corporation) C:\Windows\system32\msvcp120.dll
2014-08-09 21:36 - 2014-08-09 21:36 - 00455328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msvcp120.dll
2014-08-09 21:02 - 2014-08-09 21:02 - 00000000 ____D () C:\Users\Ahmed\Desktop\ppsspp_win
2014-08-07 17:09 - 2013-07-01 01:49 - 00000000 ____D () C:\Program Files (x86)\Diablo III

Files to move or delete:
====================
C:\ProgramData\Duplicaterecord.js


Some content of TEMP:
====================
C:\Users\Ahmed\AppData\Local\Temp\Quarantine.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-08-27 18:02

==================== End Of Log ============================

 

[Ryansee]

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 03-09-2014 02
Ran by Ahmed at 2014-09-05 13:27:42
Running from C:\Users\Ahmed\Desktop\Week 1
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Microsoft Security Essentials (Disabled - Up to date) {641105E6-77ED-3F35-A304-765193BCB75F}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Spybot - Search and Destroy (Enabled - Up to date) {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}
AS: Microsoft Security Essentials (Disabled - Up to date) {DF70E402-51D7-30BB-99B4-4D23E83BFDE2}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

7-Zip 9.20 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov)
AccelerometerP11 (HKLM-x32\...\{87434D51-51DB-4109-B68F-A829ECDCF380}) (Version: 2.00.11.22 - STMicroelectronics)
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 14.0.0.178 - Adobe Systems Incorporated)
Adobe AIR (x32 Version: 14.0.0.178 - Adobe Systems Incorporated) Hidden
Adobe Digital Editions 2.0 (HKLM-x32\...\Adobe Digital Editions 2.0) (Version: 2.0.1 - Adobe Systems Incorporated)
Adobe Flash Player 14 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 14.0.0.145 - Adobe Systems Incorporated)
Adobe Flash Player 14 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 14.0.0.145 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.06) (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AB0000000001}) (Version: 11.0.06 - Adobe Systems Incorporated)
Adobe Shockwave Player 12.1 (HKLM-x32\...\Adobe Shockwave Player) (Version: 12.1.3.153 - Adobe Systems, Inc.)
AlienAutopsy (HKLM\...\PC-Doctor for Windows) (Version: 3.5.6426.22 - PC-Doctor, Inc.)
Alienware Command Center (HKLM-x32\...\InstallShield_{FD1AE10F-163C-4D4B-9FCE-AC667AF1DC6E}) (Version: 2.8.8.0 - Alienware Corp.)
Alienware Command Center (Version: 2.8.8.0 - Alienware Corp.) Hidden
Alienware On-Screen Display (HKLM-x32\...\InstallShield_{0D69462F-99CC-4F8D-942E-666E21CE59F8}) (Version: 0.31.1.8C - )
Alienware On-Screen Display (x32 Version: 0.31.1.8C - ) Hidden
Amnesia: A Machine for Pigs (HKLM-x32\...\Steam App 239200) (Version: - The Chinese Room)
Amnesia: The Dark Descent (HKLM-x32\...\Steam App 57300) (Version: - Frictional Games)
AmrAddonInstall (Version: 1.0.9.0 - Microsoft) Hidden
Anki (HKLM-x32\...\Anki) (Version: - )
Anno 2070 (HKLM-x32\...\Steam App 48240) (Version: - BlueByte)
Apple Application Support (HKLM-x32\...\{46F044A5-CE8B-4196-984E-5BD6525E361D}) (Version: 2.3.6 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{2EF5D87E-B7BD-458F-8428-E4D0B8B4E65C}) (Version: 7.0.0.117 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Ask Mr. Robot (HKLM-x32\...\{02465e28-384a-49d0-a3ef-a1986d3f02d0}) (Version: 1.3.5.0 - Ask Mr. Robot)
Ask Mr. Robot (Version: 1.3.5.0 - Ask Mr. Robot) Hidden
Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver (HKLM-x32\...\{3108C217-BE83-42E4-AE9E-A56A2A92E549}) (Version: 1.0.0.36 - Atheros Communications Inc.)
Battle.net (HKLM-x32\...\Battle.net) (Version: - Blizzard Entertainment)
Bloody Trapland (HKLM-x32\...\Steam App 257750) (Version: - )
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
Castle Crashers (HKLM-x32\...\Steam App 204360) (Version: - The Behemoth)
CCleaner (HKLM\...\CCleaner) (Version: 4.12 - Piriform)
Clownfish for Skype (HKLM-x32\...\Clownfish) (Version: - )
Contagion (HKLM-x32\...\Steam App 238430) (Version: - Monochrome LLC)
Counter-Strike: Source (HKLM-x32\...\Steam App 240) (Version: - Valve)
Curse (HKLM-x32\...\{DEE70742-F4E9-44CA-B2B9-EE95DCF37295}) (Version: 6.0.0.0 - Curse)
Curse Client (HKCU\...\101a9f93b8f0bb6f) (Version: 5.1.1.810 - Curse)
Daily Alarm Clock (HKLM-x32\...\{38FA7EE0-0222-4F98-9464-A084C15744B0}) (Version: 2.0.0 - Sean Regan)
DaleSearch Chrome Toolbar (HKLM-x32\...\DaleSearch Chrome Toolbar) (Version: - DaleSearch) <==== ATTENTION
Damned (HKLM-x32\...\Steam App 251170) (Version: - )
Dawngate (HKLM-x32\...\{25FAB7E0-526C-437F-8D55-7F00436B873D}) (Version: 180.16.77.0 - Electronic Arts, Inc.)
DayZ (HKLM-x32\...\Steam App 221100) (Version: - Bohemia Interactive)
Debut Video Capture Software (HKLM-x32\...\Debut) (Version: 2.00 - NCH Software)
Defraggler (HKLM\...\Defraggler) (Version: 2.18 - Piriform)
Dell System Detect (HKCU\...\9204f5692a8faf3b) (Version: 5.9.0.5 - Dell)
Democracy 3 (HKLM-x32\...\Steam App 245470) (Version: - Positech Games)
Diablo III (HKLM-x32\...\Diablo III) (Version: - Blizzard Entertainment)
DivX Setup (HKLM-x32\...\DivX Setup) (Version: 2.6.1.87 - DivX, LLC)
Dropbox (HKCU\...\Dropbox) (Version: 2.10.29 - Dropbox, Inc.)
Dungeon Crawl Stone Soup (HKLM-x32\...\Crawl) (Version: 0.14.0 - )
Dungeon Defenders (HKLM-x32\...\Steam App 65800) (Version: - Trendy Entertainment)
Dungeon Defenders Eternity (HKLM-x32\...\Steam App 302270) (Version: - Nom Nom Games)
Dungeon Keeper 2 (HKLM-x32\...\GOGPACKDUNGEONKEEPER2_is1) (Version: 2.0.0.32 - GOG.com)
Elsword (HKLM-x32\...\Steam App 237310) (Version: - KOG)
EMSC (x32 Version: 0.0.0.22C - Compal Electronics, Inc.) Hidden
f.lux (HKCU\...\Flux) (Version: - )
FileHippo.com Update Checker (HKLM-x32\...\FileHippo.com) (Version: - )
focus booster (HKLM-x32\...\com.focusboosterapp.focusbooster.air) (Version: 1.3.1 - UNKNOWN)
focus booster (x32 Version: 1.3.1 - UNKNOWN) Hidden
Foxit Cloud (HKLM-x32\...\{41914D8B-9D6E-4764-A1F9-BC43FB6782C1}_is1) (Version: 1.5.129.617 - Foxit Corporation)
Foxit Reader (HKLM-x32\...\Foxit Reader_is1) (Version: 6.2.3.815 - Foxit Corporation)
FTL: Faster Than Light (HKLM-x32\...\Steam App 212680) (Version: - Subset Games)
Game Fire (HKLM-x32\...\{B72510EE-A13E-4844-90AB-3ABBFB4B06F3}) (Version: 3.1.200 - Smart PC Utilities)
Garry's Mod (HKLM-x32\...\Steam App 4000) (Version: - Facepunch Studios)
GeForce Experience NvStream Client Components (Version: 1.6.28 - NVIDIA Corporation) Hidden
Glary Utilities 5.7 (HKLM-x32\...\Glary Utilities 5) (Version: 5.7.0.14 - Glarysoft Ltd)
GOG.com Dungeon Keeper 2 (HKLM\...\{b6462b67-caf5-4a74-99df-cc2811bd1957}.sdb) (Version: - )
Google Chrome (HKLM-x32\...\{5E326DEC-2D1F-30C1-AAC0-9716A5DA7707}) (Version: 66.3.32870 - Google, Inc.)
Google Update Helper (x32 Version: 1.3.24.15 - Google Inc.) Hidden
Guild Wars 2 (HKLM-x32\...\Guild Wars 2) (Version: - NCsoft Corporation, Ltd.)
Gyazo 2.1 (HKLM-x32\...\{6DB8C365-E719-4BA5-9594-10DFC244D3FD}_is1) (Version: - Nota Inc.)
Hearthstone (HKLM-x32\...\Hearthstone) (Version: - Blizzard Entertainment)
ImgBurn (HKLM-x32\...\ImgBurn) (Version: 2.5.8.0 - LIGHTNING UK!)
InfiniteCrisis_410193F41CAE (HKLM-x32\...\InfiniteCrisis_410193F41CAE) (Version: - Turbine, Inc)
Intel PROSet Wireless (Version: - ) Hidden
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 7.0.0.1144 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 9.17.10.3347 - Intel Corporation)
Intel(R) PROSet/Wireless WiFi Software (HKLM\...\{290D4DB2-F1B4-4B8E-918D-D71EF29A001B}) (Version: 14.00.1000 - Intel Corporation)
iTunes (HKLM\...\{A535111D-95C8-487F-869E-CE4C239972D2}) (Version: 11.1.1.11 - Apple Inc.)
Java 7 Update 67 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F06417067FF}) (Version: 7.0.670 - Oracle)
Java 7 Update 67 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F03217067FF}) (Version: 7.0.670 - Oracle)
Java Auto Updater (x32 Version: 2.1.67.1 - Oracle, Inc.) Hidden
KeePass Password Safe 2.27 (HKLM-x32\...\KeePassPasswordSafe2_is1) (Version: 2.27 - Dominik Reichl)
Killing Floor (HKLM-x32\...\Steam App 1250) (Version: - Tripwire Interactive)
Kraven Manor (HKCU\...\Kraven Manor) (Version: 1.0.0 - The Guildhall at SMU)
Left 4 Dead 2 (HKLM-x32\...\Steam App 550) (Version: - Valve)
LibUSB-Win32-0.1.10.1 (HKLM-x32\...\LibUSB-Win32_is1) (Version: 0.1.10.1 - LibUSB-Win32)
LOLReplay (HKLM-x32\...\LOLReplay) (Version: 0.8.5.1 - www.leaguereplays.com)
Magic 2014 (HKLM-x32\...\Steam App 213850) (Version: - Stainless Games)
Magicka (HKLM-x32\...\Steam App 42910) (Version: - Arrowhead Game Studios)
Magicka: Wizard Wars (HKLM-x32\...\Steam App 202090) (Version: - Paradox North)
Malwarebytes Anti-Malware version 2.0.2.1012 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.2.1012 - Malwarebytes Corporation)
MATLAB R2009b (HKLM\...\MatlabR2009b) (Version: 7.9 - The MathWorks, Inc.)
MediaInfo 0.7.8 (HKLM-x32\...\MediaInfo) (Version: 0.7.8 - )
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Office 2003 Web Components (HKLM-x32\...\{90120000-00A4-0409-0000-0000000FF1CE}) (Version: 12.0.6213.1000 - Microsoft Corporation)
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version: - Microsoft)
Microsoft Office 2007 Service Pack 3 (SP3) (x32 Version: - Microsoft) Hidden
Microsoft Office Access MUI (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Access Setup Metadata MUI (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Enterprise 2007 (HKLM-x32\...\ENTERPRISE) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Enterprise 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Excel MUI (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Groove MUI (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Groove Setup Metadata MUI (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office InfoPath MUI (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Office 64-bit Components 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office OneNote MUI (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Outlook MUI (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Spanish) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (English) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) (x32 Version: - Microsoft) Hidden
Microsoft Office Publisher MUI (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared 64-bit MUI (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared Setup Metadata MUI (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Security Client (Version: 4.5.0216.0 - Microsoft Corporation) Hidden
Microsoft Security Essentials (HKLM\...\Microsoft Security Client) (Version: 4.5.216.0 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft Visual Basic for Applications 7.1 (x64) (Version: 7.1.00.00 - Microsoft Corporation) Hidden
Microsoft Visual Basic for Applications 7.1 (x64) English (Version: 7.1.0.0 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.60610 (HKLM-x32\...\{95716cce-fc71-413f-8ad5-56c2892d4b3a}) (Version: 11.0.60610.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.60610 (x32 Version: 11.0.60610 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.60610 (x32 Version: 11.0.60610 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.21005 (HKLM-x32\...\{7f51bdb9-ee21-49ee-94d6-90afc321780e}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\...\{ce085a78-074e-4823-8dc1-8a721b94b76d}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft Visual C++ 2013 x64 Additional Runtime - 12.0.21005 (Version: 12.0.21005 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2013 x64 Minimum Runtime - 12.0.21005 (Version: 12.0.21005 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005 (x32 Version: 12.0.21005 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 (x32 Version: 12.0.21005 - Microsoft Corporation) Hidden
Microsoft Visual Studio 2005 Remote Debugger Light (x64) - ENU (HKLM\...\Microsoft Visual Studio 2005 Remote Debugger Light (x64) - ENU) (Version: - Microsoft Corporation)
Microsoft Visual Studio 2005 Remote Debugger Light (x64) - ENU (Version: 8.0.52572 - Microsoft Corporation) Hidden
Microsoft Visual Studio 2005 Tools for Applications - ENU (HKLM-x32\...\Microsoft Visual Studio 2005 Tools for Applications - ENU) (Version: - Microsoft Corporation)
Microsoft Visual Studio 2005 Tools for Applications - ENU (x32 Version: 8.0.50727.146 - Microsoft Corporation) Hidden
Microsoft XNA Framework Redistributable 3.1 (HKLM-x32\...\{19BFDA5D-1FE2-4F25-97F9-1A79DD04EE20}) (Version: 3.1.10527.0 - Microsoft Corporation)
Microsoft XNA Framework Redistributable 4.0 Refresh (HKLM-x32\...\{D69C8EDE-BBC5-436B-8E0E-C5A6D311CF4F}) (Version: 4.0.30901.0 - Microsoft Corporation)
Might & Magic: Heroes VI (HKLM-x32\...\Steam App 48220) (Version: - Blackhole)
mIRC (HKLM-x32\...\mIRC) (Version: 7.32 - mIRC Co. Ltd.)
MKV Player 2.1.15 (HKLM-x32\...\MKV Player_is1) (Version: - )
MotioninJoy Gamepad tool 0.7.1001 (HKLM\...\{330DAC67-5B62-452A-A0E4-6B4A5923940F}_is1) (Version: 0.7.1001 - www.motioninjoy.com)
Mozilla Firefox 30.0 (x86 en-US) (HKLM-x32\...\Mozilla Firefox 30.0 (x86 en-US)) (Version: 30.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 28.0 - Mozilla)
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
Mumble 1.2.4 (HKLM-x32\...\{E0955568-4353-4C85-8988-285A8C0F5E87}) (Version: 1.2.4 - Thorvald Natvig)
Naga Firmware Updater 1.13 (HKLM-x32\...\{5A336D74-E680-4986-96F4-E9CEBC784F56}) (Version: 1.13.01 - Razer)
NVIDIA 3D Vision Driver 335.23 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 335.23 - NVIDIA Corporation)
NVIDIA Control Panel 335.23 (Version: 335.23 - NVIDIA Corporation) Hidden
NVIDIA GeForce Experience 1.8.2.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 1.8.2.1 - NVIDIA Corporation)
NVIDIA Graphics Driver 335.23 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 335.23 - NVIDIA Corporation)
NVIDIA HD Audio Driver 1.3.30.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.30.1 - NVIDIA Corporation)
NVIDIA Install Application (Version: 2.1002.147.1067 - NVIDIA Corporation) Hidden
NVIDIA LED Visualizer 1.0 (Version: 1.0 - NVIDIA Corporation) Hidden
NVIDIA Network Service (Version: 1.0 - NVIDIA Corporation) Hidden
NVIDIA Optimus Update 11.10.13 (Version: 11.10.13 - NVIDIA Corporation) Hidden
NVIDIA PhysX (x32 Version: 9.13.1220 - NVIDIA Corporation) Hidden
NVIDIA PhysX System Software 9.13.1220 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.13.1220 - NVIDIA Corporation)
NVIDIA ShadowPlay 11.10.13 (Version: 11.10.13 - NVIDIA Corporation) Hidden
NVIDIA Stereoscopic 3D Driver (x32 Version: 7.17.13.3523 - NVIDIA Corporation) Hidden
NVIDIA Update 11.10.13 (Version: 11.10.13 - NVIDIA Corporation) Hidden
NVIDIA Update Core (Version: 11.10.13 - NVIDIA Corporation) Hidden
NVIDIA Virtual Audio 1.2.20 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_VirtualAudio.Driver) (Version: 1.2.20 - NVIDIA Corporation)
Origin (HKLM-x32\...\Origin) (Version: 9.3.10.4710 - Electronic Arts, Inc.)
Paranormal - CLOSED BETA 7.0 (HKLM\...\UDK-6d458bda-690f-49df-bca0-91726e75d79c) (Version: - Epic Games, Inc.)
PCSX2 - Playstation 2 Emulator (HKLM-x32\...\pcsx2-r5875) (Version: - )
Pharaoh Gold Bundle (HKLM-x32\...\Pharaoh Gold Bundle_is1) (Version: - GOG.com)
Port Forward Network Utilities 2.0.1 (HKLM-x32\...\Port Forward Network Utilities) (Version: 2.0.1 - Portforward.com)
Portal 2 (HKLM-x32\...\Steam App 620) (Version: - Valve)
Private Internet Access Support Files (HKLM-x32\...\{7D72DAFF-DCB2-437B-BC22-4B2ABF21462B}) (Version: 1.0.0.0 - Private Internet Access)
RaidCall (HKLM-x32\...\RaidCall) (Version: 7.3.0-1.0.10926.49 - raidcall.com)
Razer Core (HKLM-x32\...\Razer Core) (Version: 1.0.1.66 - Razer Inc)
Razer Synapse 2.0 (HKLM-x32\...\{0D78BEE2-F8FF-4498-AF1A-3FF81CED8AC6}) (Version: 1.18.15.20888 - Razer Inc.)
Realtek PCIE Card Reader (HKLM-x32\...\{C1594429-8296-4652-BF54-9DBE4932A44C}) (Version: 6.1.7600.75 - Realtek Semiconductor Corp.)
Renesas Electronics USB 3.0 Host Controller Driver (HKLM-x32\...\InstallShield_{5442DAB8-7177-49E1-8B22-09A049EA5996}) (Version: 2.0.32.0 - Renesas Electronics Corporation)
Renesas Electronics USB 3.0 Host Controller Driver (x32 Version: 2.0.32.0 - Renesas Electronics Corporation) Hidden
Rust (HKLM-x32\...\Steam App 252490) (Version: - Facepunch Studios)
Saints Row IV (HKLM-x32\...\Steam App 206420) (Version: - Deep Silver Volition)
SHIELD Streaming (Version: 1.7.321 - NVIDIA Corporation) Hidden
Sid Meier's Civilization IV (HKLM-x32\...\Steam App 3900) (Version: - Firaxis Games)
Sid Meier's Civilization IV: Beyond the Sword (HKLM-x32\...\Steam App 8800) (Version: - Firaxis Games)
Sid Meier's Civilization IV: Warlords (HKLM-x32\...\Steam App 3990) (Version: - Firaxis Games)
Sid Meier's Civilization V (HKLM-x32\...\Steam App 8930) (Version: - 2K Games, Inc.)
SimCity™ (HKLM-x32\...\{F70FDE4B-8F86-4eb6-8C8E-636EC89F6419}) (Version: 1.0.0.0 - Electronic Arts)
Skype Click to Call (HKLM-x32\...\{6D1221A9-17BF-4EC0-81F2-27D30EC30701}) (Version: 7.3.16540.9015 - Microsoft Corporation)
Skype™ 6.18 (HKLM-x32\...\{7A3C7E05-EE37-47D6-99E1-2EB05A3DA3F7}) (Version: 6.18.106 - Skype Technologies S.A.)
Software Informer 1.3.1107.0 (HKLM\...\Software Informer_is1) (Version: - Informer Technologies, Inc.)
SolidWorks 2014 x64 Edition SP01 (HKLM-x32\...\SolidWorks Installation Manager 20140-40100-1100-100) (Version: 22.1.0.44 - SolidWorks Corporation)
SolidWorks 2014 x64 Edition SP01 (Version: 22.110.44 - SolidWorks) Hidden
SolidWorks Composer Player 2014 SP01 x64 Edition (Version: 22.10.44 - Dassault Systemes SolidWorks) Hidden
SolidWorks eDrawings 2014 x64 Edition SP01 (Version: 14.1.116 - Dassault Systèmes SolidWorks Corp) Hidden
SolidWorks Explorer 2014 SP01 x64 Edition (Version: 22.10.44 - SolidWorks Corporation) Hidden
SolidWorks Plastics 2014 SP01 x64 Edition (Version: 22.10.44 - SolidWorks Corporation) Hidden
Sonic & All-Stars Racing Transformed (HKLM-x32\...\Steam App 212480) (Version: - Sumo Digital)
SpeedFan (remove only) (HKLM-x32\...\SpeedFan) (Version: - )
Spybot - Search & Destroy (HKLM-x32\...\{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1) (Version: 2.4.40 - Safer-Networking Ltd.)
Steam (HKLM-x32\...\{048298C9-A4D3-490B-9FF9-AB023A9238F3}) (Version: 1.0.0.0 - Valve Corporation)
Strife (HKLM-x32\...\strife) (Version: 0.0.1 - S2 Games)
SumatraPDF (HKLM-x32\...\SumatraPDF) (Version: 2.4 - Krzysztof Kowalczyk)
SUPERAntiSpyware (HKLM\...\{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}) (Version: 6.0.1130 - SUPERAntiSpyware.com)
swMSM (x32 Version: 12.0.0.1 - Adobe Systems, Inc) Hidden
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 15.1.19.0 - Synaptics Incorporated)
System Requirements Lab Detection (HKLM-x32\...\{39D29B93-6553-4786-818D-1CBC5F4BE0DF}) (Version: 2.0.0.0 - Husdawg, LLC)
TeamSpeak 3 Client (HKLM\...\TeamSpeak 3 Client) (Version: 3.0.11.1 - TeamSpeak Systems GmbH)
TeamViewer 9 (HKLM-x32\...\TeamViewer 9) (Version: 9.0.29947 - TeamViewer)
Terraria (HKLM-x32\...\Steam App 105600) (Version: - Re-Logic)
The Wolf Among Us (HKLM-x32\...\Steam App 250320) (Version: - )
TortoiseSVN 1.8.2.24708 (64 bit) (HKLM\...\{D0DC3918-460D-4229-811E-41F22D0CD7E9}) (Version: 1.8.24708 - TortoiseSVN)
Tropico 4 (HKLM-x32\...\Steam App 57690) (Version: - Haemimont Games)
Tropico 5 (HKLM-x32\...\Steam App 245620) (Version: - Haemimont Games)
Tunngle beta (HKLM-x32\...\Tunngle beta_is1) (Version: - Tunngle.net GmbH)
Tweaking.com - Windows Repair (All in One) (HKLM-x32\...\Tweaking.com - Windows Repair (All in One)) (Version: 2.0.1 - Tweaking.com)
Ubisoft Game Launcher (HKLM-x32\...\{888F1505-C2B3-4FDE-835D-36353EBD4754}) (Version: 1.0.0.0 - UBISOFT)
Unity Web Player (HKCU\...\UnityWebPlayer) (Version: - Unity Technologies ApS)
Unreal Development Kit: 2012-10 (HKLM\...\UDK-4a414f0a-1816-459c-bad0-7e7647dd18c2) (Version: - Epic Games, Inc.)
Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version: - Microsoft)
Update for Microsoft Office 2007 Help for Common Features (KB963673) (HKLM-x32\...\{90120000-006E-0409-0000-0000000FF1CE}_ENTERPRISE_{AB365889-0395-4FAD-B702-CA5985D53D42}) (Version: - Microsoft)
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{A024FC7B-77DE-45DE-A058-1C049A17BFB3}) (Version: - Microsoft)
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (HKLM-x32\...\{90120000-002A-0000-1000-0000000FF1CE}_ENTERPRISE_{CB68A5B0-3508-4193-AEB9-AF636DAECE0F}) (Version: - Microsoft)
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{CB68A5B0-3508-4193-AEB9-AF636DAECE0F}) (Version: - Microsoft)
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{E9A82945-BA29-4EE8-8F2A-2F49545E9CF2}) (Version: - Microsoft)
Update for Microsoft Office Access 2007 Help (KB963663) (HKLM-x32\...\{90120000-0015-0409-0000-0000000FF1CE}_ENTERPRISE_{6B76A18A-AA1E-42AB-A7AD-6C84BBB43987}) (Version: - Microsoft)
Update for Microsoft Office Excel 2007 Help (KB963678) (HKLM-x32\...\{90120000-0016-0409-0000-0000000FF1CE}_ENTERPRISE_{199DF7B6-169C-448C-B511-1054101BE9C9}) (Version: - Microsoft)
Update for Microsoft Office Infopath 2007 Help (KB963662) (HKLM-x32\...\{90120000-0044-0409-0000-0000000FF1CE}_ENTERPRISE_{716B81B8-B13C-41DF-8EAC-7A2F656CAB63}) (Version: - Microsoft)
Update for Microsoft Office OneNote 2007 Help (KB963670) (HKLM-x32\...\{90120000-00A1-0409-0000-0000000FF1CE}_ENTERPRISE_{2744EF05-38E1-4D5D-B333-E021EDAEA245}) (Version: - Microsoft)
Update for Microsoft Office Outlook 2007 (KB2687404) 32-Bit Edition (HKLM-x32\...\{90120000-001A-0409-0000-0000000FF1CE}_ENTERPRISE_{ED38F8A3-4F61-494E-8BCA-E3AC7760C924}) (Version: - Microsoft)
Update for Microsoft Office Outlook 2007 (KB2863811) 32-Bit Edition (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{53DEC068-4690-4F6B-9946-7D21EF02236B}) (Version: - Microsoft)
Update for Microsoft Office Outlook 2007 Help (KB963677) (HKLM-x32\...\{90120000-001A-0409-0000-0000000FF1CE}_ENTERPRISE_{0451F231-E3E3-4943-AB9F-58EB96171784}) (Version: - Microsoft)
Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2883097) 32-Bit Edition (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{B2260BC9-D561-46EE-B33D-739CF760A2A9}) (Version: - Microsoft)
Update for Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM-x32\...\{90120000-0018-0409-0000-0000000FF1CE}_ENTERPRISE_{397B1D4F-ED7B-4ACA-A637-43B670843876}) (Version: - Microsoft)
Update for Microsoft Office Publisher 2007 Help (KB963667) (HKLM-x32\...\{90120000-0019-0409-0000-0000000FF1CE}_ENTERPRISE_{2E40DE55-B289-4C8B-8901-5D369B16814F}) (Version: - Microsoft)
Update for Microsoft Office Script Editor Help (KB963671) (HKLM-x32\...\{90120000-006E-0409-0000-0000000FF1CE}_ENTERPRISE_{CD11C6A2-FFC6-4271-8EAB-79C3582F505C}) (Version: - Microsoft)
Update for Microsoft Office Word 2007 Help (KB963665) (HKLM-x32\...\{90120000-001B-0409-0000-0000000FF1CE}_ENTERPRISE_{80E762AA-C921-4839-9D7D-DB62A72C0726}) (Version: - Microsoft)
VC80CRTRedist - 8.0.50727.6195 (x32 Version: 1.2.0 - DivX, Inc) Hidden
Ventrilo Client for Windows x64 (HKLM\...\{EEB3F6BB-318D-4CE5-989F-8191FCBFB578}) (Version: 3.0.8.0 - Flagship Industries, Inc.)
Vista Services Optimizer (HKLM-x32\...\{C165D09F-FBC4-48C7-B951-CCD5177803F4}) (Version: 2.1.300 - Smart PC Utilities)
Visual Boy Advance Packages (HKCU\...\Visual Boy Advance Packages) (Version: - ) <==== ATTENTION
War of the Roses (HKLM-x32\...\Steam App 42160) (Version: - Fatshark)
War of the Roses Balance Beta (HKLM-x32\...\Steam App 206980) (Version: - )
War of the Vikings Alpha (HKLM-x32\...\Steam App 246190) (Version: - )
WildStar (HKLM-x32\...\WildStar) (Version: - NCSOFT)
WinRAR 5.00 beta 6 (64-bit) (HKLM\...\WinRAR archiver) (Version: 5.00.6 - win.rar GmbH)
Yahoo! Messenger (HKLM-x32\...\Yahoo! Messenger) (Version: - Yahoo! Inc.)
Yahoo! Software Update (HKLM-x32\...\Yahoo! Software Update) (Version: - )
Yahoo! Toolbar (HKLM-x32\...\Yahoo! Companion) (Version: - Yahoo! Inc.)
YouTube Accelerator (HKLM-x32\...\YouTube Accelerator) (Version: 3394(build_96) - Goobzo Ltd.)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-4037467554-2527304460-3365707105-1000_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\Ahmed\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-4037467554-2527304460-3365707105-1000_Classes\CLSID\{92c58f58-7e24-4a80-b590-142b6da8fec2}\InprocServer32 -> C:\Windows\system32\dfshim.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-4037467554-2527304460-3365707105-1000_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Ahmed\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-4037467554-2527304460-3365707105-1000_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Ahmed\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-4037467554-2527304460-3365707105-1000_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Ahmed\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-4037467554-2527304460-3365707105-1000_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Ahmed\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-4037467554-2527304460-3365707105-1000_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Ahmed\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-4037467554-2527304460-3365707105-1000_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Ahmed\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-4037467554-2527304460-3365707105-1000_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Ahmed\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-4037467554-2527304460-3365707105-1000_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Ahmed\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)

==================== Restore Points =========================

24-08-2014 23:30:59 Installed Daily Alarm Clock
25-08-2014 18:38:01 Installed Naga Firmware Updater 1.13.
25-08-2014 19:09:49 Removed Razer Synapse 2.0.
26-08-2014 13:11:17 Windows Update
26-08-2014 13:44:25 Windows Modules Installer
29-08-2014 00:51:05 Windows Update
02-09-2014 07:48:41 Windows Update
02-09-2014 15:56:14 Installed System Requirements Lab Detection
03-09-2014 10:56:06 Before antirootkit

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 05:34 - 2014-09-04 13:27 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 localhost

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {04BFF931-040D-44DB-9978-3135F2208EA7} - System32\Tasks\GU5SkipUAC => C:\Program Files (x86)\Glary Utilities 5\Integrator.exe [2014-09-01] (Glarysoft Ltd)
Task: {0ABEDAA1-D3EC-4288-8F77-03667F1CB0AB} - System32\Tasks\SystemToolsDailyTest => uaclauncher.exe
Task: {12FFA309-F827-4353-8176-9A61C2694D1B} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-07-09] (Adobe Systems Incorporated)
Task: {2A712EC4-0D4A-4C23-8C00-602C0607AB99} - System32\Tasks\Private Internet Access Startup => C:\Program Files\pia_manager\pia_manager.exe [2014-07-19] ()
Task: {329F7992-DB2D-4936-907B-0418CFF3F05D} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-06-07] (Google Inc.)
Task: {33B4BB5A-EF42-4C95-B309-FF5378264020} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe
Task: {36CA1824-B99F-4691-B2C8-2B77387C6288} - System32\Tasks\PCDoctorBackgroundMonitorTask => C:\Program Files\AlienAutopsy\uaclauncher.exe [2014-01-31] (PC-Doctor, Inc.)
Task: {38E14CD4-0AE0-4CFF-9742-521D665D5438} - System32\Tasks\SidebarExecute => C:\Program Files (x86)\Windows Sidebar\sidebar.exe [2010-11-20] (Microsoft Corporation)
Task: {4479AA1E-96CC-4269-A61C-FCAA8FD2AC5B} - System32\Tasks\Alarm => C:\Users\Ahmed\Desktop\Desktop\『Popipopoison』 Popipo League of Legends Parody - Copy.mp3 [2013-11-28] ()
Task: {5B3993D5-2F24-47C1-BCCF-FE073EA1E8AC} - System32\Tasks\YTAUpdate => C:\PROGRA~2\YOUTUB~1\Updater.exe <==== ATTENTION
Task: {6C648445-18C2-4DEE-A8CE-9B14815E3C6D} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Scan the system => C:\Program Files (x86)\Spybot - Search &amp; Destroy 2\SDScan.exe
Task: {80D3B691-7F42-4D23-8651-E2E059381646} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-06-07] (Google Inc.)
Task: {90F5A1D0-588E-4462-B847-E0D878D2AD6E} - System32\Tasks\Wake up => C:\Users\Ahmed\Desktop\Desktop\『Popipopoison』 Popipo League of Legends Parody - Copy.mp3 [2013-11-28] ()
Task: {9CEDBD86-3ED1-4480-A94A-3E1C0844410F} - System32\Tasks\GlaryInitialize 5 => C:\Program Files (x86)\Glary Utilities 5\Initialize.exe [2014-09-01] (Glarysoft Ltd)
Task: {A241A0CA-E007-46B4-9A1F-BE5CA0F49774} - System32\Tasks\Upload the friggin document ya ahbal
Task: {A2506356-AC99-4B04-8394-2E1B9F3004F3} - System32\Tasks\SoftwareInformerService => C:\Program Files\Software Informer\softinfo.exe [2014-07-23] (Informer Technologies, Inc.)
Task: {CB77D201-7295-4D4E-BD86-D5FFA82A3D22} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Check for updates => C:\Program Files (x86)\Spybot - Search &amp; Destroy 2\SDUpdate.exe
Task: {D3371FD4-5E74-4258-A8E5-6EC3C2BD891D} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {DF214550-B0CB-417E-AC88-F1CC448D9A4F} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2014-03-18] (Piriform Ltd)
Task: {E1AC9C6B-3D06-43A9-B90D-B8A4DD5C6256} - System32\Tasks\GyazoUpdateTaskMachine => C:\Program Files (x86)\Gyazo\GyazoUpdate.exe [2014-05-08] ()
Task: {E87B1D26-1F44-4BE0-8D9E-030943D1F444} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization => C:\Program Files (x86)\Spybot - Search &amp; Destroy 2\SDImmunize.exe
Task: {EDC520D2-2AEB-44F1-B3F7-130CFA764372} - System32\Tasks\PCDEventLauncherTask => C:\Program Files\AlienAutopsy\sessionchecker.exe [2014-01-31] (PC-Doctor, Inc.)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GlaryInitialize 5.job => C:\Program Files (x86)\Glary Utilities 5\Initialize.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2010-12-17 13:53 - 2010-12-17 13:53 - 01501696 _____ () C:\Program Files\Common Files\Intel\WirelessCommon\Libeay32.dll
2014-04-04 00:02 - 2014-03-04 16:05 - 00116056 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2010-12-17 13:53 - 2010-12-17 13:53 - 01501696 _____ () C:\Program Files\Common Files\Intel\WirelessCommon\LIBEAY32.dll
2013-06-07 11:50 - 2011-03-14 10:43 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2013-06-07 12:02 - 2010-12-17 10:27 - 00703088 _____ () C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe
2013-08-27 23:59 - 2013-08-27 23:59 - 00088304 _____ () C:\Program Files\TortoiseSVN\bin\libsasl.dll
2011-01-10 16:16 - 2011-01-10 16:16 - 01545584 _____ () C:\Program Files (x86)\Alienware On-Screen Display\AlienwareOn-ScreenDisplay.exe
2013-08-28 00:00 - 2013-08-28 00:00 - 00075504 _____ () C:\Program Files\TortoiseSVN\bin\TortoiseStub.dll
2014-04-03 23:46 - 2014-03-04 17:35 - 00014280 _____ () C:\Program Files (x86)\NVIDIA Corporation\CoProcManager\detoured.dll
2014-09-02 16:45 - 2014-05-13 12:04 - 00109400 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlThirdParty150.bpl
2014-09-02 16:45 - 2014-05-13 12:04 - 00416600 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\DEC150.bpl
2014-09-02 16:45 - 2014-05-13 12:04 - 00167768 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlFileFormats150.bpl
2009-12-18 11:07 - 2009-12-18 11:07 - 00577536 _____ () C:\Program Files (x86)\Alienware On-Screen Display\EMSC.dll
2014-09-01 09:14 - 2014-09-01 09:14 - 00080160 _____ () C:\Program Files (x86)\Glary Utilities 5\zlib1.dll
2013-08-27 23:05 - 2013-08-27 23:05 - 00065264 _____ () C:\Program Files\TortoiseSVN\bin\TortoiseStub32.dll
2013-08-27 23:04 - 2013-08-27 23:04 - 00070896 _____ () C:\Program Files\TortoiseSVN\bin\libsasl32.dll
2014-09-02 16:45 - 2012-08-23 10:38 - 00574840 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\sqlite3.dll
2014-09-02 16:45 - 2012-04-03 17:06 - 00565640 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\av\BDSmartDB.dll
2014-09-03 13:10 - 2014-08-30 05:49 - 01098056 _____ () C:\Program Files (x86)\Google\Chrome\Application\37.0.2062.103\libglesv2.dll
2014-09-03 13:10 - 2014-08-30 05:49 - 00174408 _____ () C:\Program Files (x86)\Google\Chrome\Application\37.0.2062.103\libegl.dll
2014-09-03 13:10 - 2014-08-30 05:49 - 08577864 _____ () C:\Program Files (x86)\Google\Chrome\Application\37.0.2062.103\pdf.dll
2014-09-03 13:10 - 2014-08-30 05:49 - 00331592 _____ () C:\Program Files (x86)\Google\Chrome\Application\37.0.2062.103\ppGoogleNaClPluginChrome.dll
2014-09-03 13:10 - 2014-08-30 05:49 - 01660232 _____ () C:\Program Files (x86)\Google\Chrome\Application\37.0.2062.103\ffmpegsumo.dll
2014-09-03 13:10 - 2014-08-30 05:49 - 14669128 _____ () C:\Program Files (x86)\Google\Chrome\Application\37.0.2062.103\PepperFlash\pepflashplayer.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

AlternateDataStreams: C:\ProgramData\TEMP:373E1720
AlternateDataStreams: C:\ProgramData\TEMP:56E2E879

==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)

MSCONFIG\Services: Apple Mobile Device => 2
MSCONFIG\Services: BAVSvc => 2
MSCONFIG\Services: BHipsSvc => 2
MSCONFIG\Services: Bonjour Service => 2
MSCONFIG\Services: iPod Service => 3
MSCONFIG\Services: MozillaMaintenance => 3
MSCONFIG\Services: PCAppStoreSvc_{PCAppStore_4.0.6.5038} => 2
MSCONFIG\Services: SolidWorks Licensing Service => 3
MSCONFIG\Services: TeamViewer9 => 2
MSCONFIG\Services: TunngleService => 3
MSCONFIG\Services: YahooAUService => 2
MSCONFIG\Services: YouTubeAcceleratorService => 2
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^LOLRecorder.lnk => C:\Windows\pss\LOLRecorder.lnk.CommonStartup
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^SolidWorks 2014 Fast Start.lnk => C:\Windows\pss\SolidWorks 2014 Fast Start.lnk.CommonStartup
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^SolidWorks Background Downloader.lnk => C:\Windows\pss\SolidWorks Background Downloader.lnk.CommonStartup
MSCONFIG\startupfolder: C:^Users^Ahmed^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Curse.lnk => C:\Windows\pss\Curse.lnk.Startup
MSCONFIG\startupfolder: C:^Users^Ahmed^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^CurseClientStartup.ccip => C:\Windows\pss\CurseClientStartup.ccip.Startup
MSCONFIG\startupfolder: C:^Users^Ahmed^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^MyPC Backup.lnk => C:\Windows\pss\MyPC Backup.lnk.Startup
MSCONFIG\startupreg: APSDaemon => "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
MSCONFIG\startupreg: Clownfish => "C:\Program Files (x86)\Clownfish\Clownfish.exe"
MSCONFIG\startupreg: DivXMediaServer => C:\Program Files (x86)\DivX\DivX Media Server\DivXMediaServer.exe
MSCONFIG\startupreg: DivXUpdate => "C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
MSCONFIG\startupreg: EADM => "C:\Program Files (x86)\Origin\Origin.exe" -AutoStart
MSCONFIG\startupreg: Game Fire => C:\Program Files (x86)\Smart PC Utilities\Game Fire\GFTray.exe /START
MSCONFIG\startupreg: GoobzoYouTubeAccelerator => "C:\Program Files (x86)\YouTube Accelerator\YouTubeAccelerator.exe" /startup
MSCONFIG\startupreg: Gyazo => C:\Program Files (x86)\Gyazo\GyStation.exe
MSCONFIG\startupreg: iTunesHelper => "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
MSCONFIG\startupreg: LogMeIn GUI => "C:\Program Files (x86)\LogMeIn\x64\LogMeInSystray.exe"
MSCONFIG\startupreg: LogMeIn Hamachi Ui => "C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe" --auto-start
MSCONFIG\startupreg: Messenger (Yahoo!) => "C:\PROGRA~2\Yahoo!\Messenger\YahooMessenger.exe" -quiet
MSCONFIG\startupreg: Optimizer Pro => C:\Program Files (x86)\Optimizer Pro\OptProLauncher.exe
MSCONFIG\startupreg: Razer Synapse => "C:\Program Files (x86)\Razer\Synapse\RzSynapse.exe"
MSCONFIG\startupreg: SearchProtectAll => C:\Program Files (x86)\SearchProtect\bin\cltmng.exe
MSCONFIG\startupreg: uTorrent => "C:\Users\Ahmed\AppData\Roaming\uTorrent\uTorrent.exe" /MINIMIZED

==================== Faulty Device Manager Devices =============

Name: Bnbase
Description: Bnbase
Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Manufacturer:
Service: Bnbase
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.

Name: Baidu NetDefense
Description: Baidu NetDefense
Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Manufacturer:
Service: Bndef
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.

Name: LogMeIn Kernel Information Provider
Description: LogMeIn Kernel Information Provider
Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Manufacturer:
Service: LMIInfo
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.

Name: Baidu Protect
Description: Baidu Protect
Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Manufacturer:
Service: Bprotect
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.

Name: BAPIDRV
Description: BAPIDRV
Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Manufacturer:
Service: BAPIDRV
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.

Name: TAP-Win32 Adapter V9
Description: TAP-Win32 Adapter V9
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: TAP-Win32 Provider V9
Service: tap0901
Problem: : Windows cannot start this hardware device because its configuration information (in the registry) is incomplete or damaged. (Code 19)
Resolution: A registry problem was detected.
This can occur when more than one service is defined for a device, if there is a failure opening the service subkey, or if the driver name cannot be obtained from the service subkey. Try these options:
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.
Click "Uninstall", and then click "Scan for hardware changes" to load a usable driver.


==================== Event log errors: =========================

Application errors:
==================

System errors:
=============

Microsoft Office Sessions:
=========================

CodeIntegrity Errors:
===================================
Date: 2014-09-04 13:26:52.992
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2014-09-04 13:26:52.882
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.


==================== Memory info ===========================

Processor: Intel(R) Core(TM) i7-2630QM CPU @ 2.00GHz
Percentage of memory in use: 41%
Total physical RAM: 8139.86 MB
Available physical RAM: 4789.78 MB
Total Pagefile: 16277.9 MB
Available Pagefile: 12586.68 MB
Total Virtual: 8192 MB
Available Virtual: 8191.83 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:698.54 GB) (Free:345.67 GB) NTFS
Drive d: (FINAL_FANTASY_X) (CDROM) (Total:4.28 GB) (Free:0 GB) CDFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 698.6 GB) (Disk ID: 44B1E201)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=698.5 GB) - (Type=07 NTFS)

==================== End Of Log ============================

 

[Broni]

Uninstall:
- DaleSearch Chrome Toolbar
- Visual Boy Advance Packages

Download attached fixlist.txt file and save it to the Desktop.
NOTE. It's important that both files, FRST and fixlist.txt are in the same location or the fix will not work.

NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

Run FRST(FRST64) and press the Fix button just once and wait.
The tool will make a log on the Desktop (Fixlog.txt). Please post it to your reply.

 

[Ryansee]

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 03-09-2014 02
Ran by Ahmed at 2014-09-06 15:41:59 Run:1
Running from C:\Users\Ahmed\Desktop\Week 1
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
HKLM-x32\...\Run: [] => [X]
ShellIconOverlayIdentifiers: 00avast -> {472083B0-C522-11CF-8763-00608CC02F24} => No File
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
S4 YouTubeAcceleratorService; C:\PROGRA~2\YOUTUB~1\YouTubeAcceleratorService.exe -start -scm [X]
S4 LMIRfsClientNP; No ImagePath
S1 BAPIDRV; system32\DRIVERS\BAPIDRV64.sys [X]
S1 Bfilter; \??\C:\Windows\System32\drivers\Bfilter.sys [X]
S1 Bfmon; \??\C:\Windows\System32\drivers\Bfmon.sys [X]
S1 Bnbase; System32\drivers\bnbasex64.sys [X]
S1 Bndef; \??\C:\Windows\System32\drivers\bndef64.sys [X]
S1 Bprotect; \??\C:\Windows\System32\drivers\Bprotect.sys [X]
S3 BprotectEx; \??\C:\Windows\System32\drivers\BprotectEx.sys [X]
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 IntcAzAudAddService; system32\drivers\RTKVHD64.sys [X]
S2 LMIInfo; \??\C:\Program Files (x86)\LogMeIn\x64\RaInfo.sys [X]
S3 PCFApiUtil; \??\C:\Program Files (x86)\Baidu Security\PC Faster\4.0.0.0\PCFApiUtil64.sys [X]
2014-09-02 16:46 - 2014-09-02 19:39 - 00000000 ____D () C:\3590F75ABA9E485486C100C1A9D4FF06ZZ.Z..ZZZZZ....Z
C:\ProgramData\Duplicaterecord.js
C:\Users\Ahmed\AppData\Local\Temp\Quarantine.exe
Task: {5B3993D5-2F24-47C1-BCCF-FE073EA1E8AC} - System32\Tasks\YTAUpdate => C:\PROGRA~2\YOUTUB~1\Updater.exe <==== ATTENTION
AlternateDataStreams: C:\ProgramData\TEMP:373E1720
AlternateDataStreams: C:\ProgramData\TEMP:56E2E879

*****************

HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\ => value deleted successfully.
"HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\00avast" => Key deleted successfully.
"HKCR\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}" => Key not found.
"HKLM\SOFTWARE\Policies\Google" => Key deleted successfully.
YouTubeAcceleratorService => Service deleted successfully.
LMIRfsClientNP => Service deleted successfully.
BAPIDRV => Service deleted successfully.
Bfilter => Service deleted successfully.
Bfmon => Service deleted successfully.
Bnbase => Service deleted successfully.
Bndef => Service deleted successfully.
Bprotect => Service deleted successfully.
BprotectEx => Service deleted successfully.
catchme => Service deleted successfully.
IntcAzAudAddService => Service deleted successfully.
LMIInfo => Service deleted successfully.
PCFApiUtil => Service deleted successfully.
C:\3590F75ABA9E485486C100C1A9D4FF06ZZ.Z..ZZZZZ....Z => Moved successfully.
C:\ProgramData\Duplicaterecord.js => Moved successfully.
C:\Users\Ahmed\AppData\Local\Temp\Quarantine.exe => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{5B3993D5-2F24-47C1-BCCF-FE073EA1E8AC}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{5B3993D5-2F24-47C1-BCCF-FE073EA1E8AC}" => Key deleted successfully.
C:\Windows\System32\Tasks\YTAUpdate => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\YTAUpdate" => Key deleted successfully.
C:\ProgramData\TEMP => ":373E1720" ADS removed successfully.
C:\ProgramData\TEMP => ":56E2E879" ADS removed successfully.

==== End of Fixlog ====

 

[Broni]

How is computer doing?

Last scans...

Download Security Check from here or here and save it to your Desktop.

• Double-click SecurityCheck.exe
• Follow the onscreen instructions inside of the black box.
• A Notepad document should open automatically called checkup.txt; please post the contents of that document.

NOTE 1. If one of your security applications (e.g., third-party firewall) requests permission to allow DIG.EXE access the Internet, allow it to do so.
NOTE 2 SecurityCheck may produce some false warning(s), so leave the results reading to me.
NOTE 3. If you receive UNSUPPORTED OPERATING SYSTEM! ABORTED! message restart computer and Security Check should run

Please download Farbar Service Scanner (FSS) and run it on the computer with the issue.

• Make sure the following options are checked:
  • Internet Services
  • Windows Firewall
  • System Restore
  • Security Center
  • Windows Update
  • Windows Defender
  • Other Services
• Press "Scan".
• It will create a log (FSS.txt) in the same directory the tool is run.
• Please copy and paste the log to your reply.

Download Temp File Cleaner (TFC)
Alternate download: http://www.itxassociates.com/OT-Tools/TFC.exe

• Double click on TFC.exe to run the program.
• Click on Start button to begin cleaning process.
• TFC will close all running programs, and it may ask you to restart computer.

Please run a free online scan with the ESET Online Scanner

• Disable your antivirus program
• Internet Explorer users - Click on this link to open ESET OnlineScan.
• For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
  • Click on ESET Smart Installer to download the ESET Smart Installer. Save it to your desktop.
  • Double click on the http://www.bleepstatic.com/fhost/uploads/0/esetsmartinstaller_enu.png][/url] icon on your desktop.
    [/LIST]
    [*]Check [I]"YES, I accept the Terms of Use."[/I]
    [*]Click the [b]Start[/b] button.
    [*]Accept any security warnings from your browser.[/*]
    [*]Check [I]"Enable detection of potentially unwanted applications"[/I].
    [*]Click [I]Advanced settings[/I] and make sure all 4 boxes are checkmarked (two of them are already checkmarked by default).
    Do NOT checkmark [I]"Use custom proxy settings"[/I]
    [*]Click the [b]Start[/b] button.
    [*]ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
    [*]When the scan completes, click [b]List Threats[/b][/*]
    [*]Click [b]Export[/b], and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
    [*]Click the [b]Back[/b] button.
    [*]Click the [b]Finish[/b] button.
    [/LIST]