TechSpot

Nengine.dll is missing "i was told this is a virus"

Inactive-A
By Ryansee
Sep 2, 2014
  1. This all started with me downloading JLAw links which caused me bsod. I removed bit torrent and It let me to scanning with Malwarebyte, MES and then I tried to find help with dealing with a black screen and mouse cursor that appear before window loading.

    I used tdsskiller and it caught something called DS3 service. I used spybot, and free superantispyware. Those antiviruses were me reading about ppl with a problem similiar to mine and I am getting depressed over this and im hoping a proffesional can help me.
     

    Attached Files:

  2. Ryansee

    Ryansee TS Rookie Topic Starter Posts: 19

    Adwcleaner log
     

    Attached Files:

    • lol.txt
      File size:
      10.7 KB
      Views:
      0
  3. Broni

    Broni Malware Annihilator Posts: 47,048   +256

    Welcome aboard [​IMG]

    Please, observe following rules:
    • Read all of my instructions very carefully. Your mistakes during cleaning process may have very serious consequences, like unbootable computer.
    • If you're stuck, or you're not sure about certain step, always ask before doing anything else.
    • Please refrain from running any tools, fixes or applying any changes to your computer other than those I suggest.
    • Never run more than one scan at a time.
    • Keep updating me regarding your computer behavior, good, or bad.
    • The cleaning process, once started, has to be completed. Even if your computer appears to act better, it may still be infected. Once the computer is totally clean, I'll certainly let you know.
    • If you leave the topic without explanation in the middle of a cleaning process, you may not be eligible to receive any more help in malware removal forum.
    • I close my topics if you have not replied in 5 days. If you need more time, simply let me know. If I closed your topic and you need it to be reopened, simply PM me.

    =====================================

    Please observe forum rules.
    All logs have to be pasted not attached.
     
  4. Ryansee

    Ryansee TS Rookie Topic Starter Posts: 19

    Forgive me my bad misunderstood.

    Attach.txt:

    .
    UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
    IF REQUESTED, ZIP IT UP & ATTACH IT
    .
    DDS (Ver_2012-11-20.01)
    .
    Microsoft Windows 7 Home Premium
    Boot Device: \Device\HarddiskVolume1
    Install Date: 6/7/2013 11:35:25 AM
    System Uptime: 9/2/2014 10:01:50 PM (0 hours ago)
    .
    Motherboard: Alienware | | M14xR1
    Processor: Intel(R) Core(TM) i7-2630QM CPU @ 2.00GHz | CPU1 | 880/1600mhz
    .
    ==== Disk Partitions =========================
    .
    C: is FIXED (NTFS) - 699 GiB total, 347.756 GiB free.
    D: is CDROM (CDFS)
    .
    ==== Disabled Device Manager Items =============
    .
    Class GUID: {8ECC055D-047F-11D1-A537-0000F8753ED1}
    Description: LogMeIn Kernel Information Provider
    Device ID: ROOT\LEGACY_LMIINFO\0000
    Manufacturer:
    Name: LogMeIn Kernel Information Provider
    PNP Device ID: ROOT\LEGACY_LMIINFO\0000
    Service: LMIInfo
    .
    Class GUID: {8ECC055D-047F-11D1-A537-0000F8753ED1}
    Description: MpKsl01f98610
    Device ID: ROOT\LEGACY_MPKSL01F98610\0000
    Manufacturer:
    Name: MpKsl01f98610
    PNP Device ID: ROOT\LEGACY_MPKSL01F98610\0000
    Service: MpKsl01f98610
    .
    ==== System Restore Points ===================
    .
    RP215: 8/24/2014 7:04:06 PM - Removed LogMeIn Hamachi
    RP216: 8/25/2014 2:30:59 AM - Installed Daily Alarm Clock
    RP217: 8/25/2014 9:38:01 PM - Installed Naga Firmware Updater 1.13.
    RP218: 8/25/2014 10:09:49 PM - Removed Razer Synapse 2.0.
    RP219: 8/26/2014 4:11:17 PM - Windows Update
    RP220: 8/26/2014 4:44:25 PM - Windows Modules Installer
    RP221: 8/29/2014 3:51:05 AM - Windows Update
    RP222: 9/2/2014 10:48:41 AM - Windows Update
    RP223: 9/2/2014 6:56:14 PM - Installed System Requirements Lab Detection
    .
    ==== Installed Programs ======================
    .
    7-Zip 9.20 (x64 edition)
    AccelerometerP11
    Adobe AIR
    Adobe Digital Editions 2.0
    Adobe Flash Player 14 ActiveX
    Adobe Flash Player 14 Plugin
    Adobe Reader XI (11.0.06)
    Adobe Shockwave Player 12.1
    AlienAutopsy
    Alienware Command Center
    Alienware On-Screen Display
    Amnesia: A Machine for Pigs
    Amnesia: The Dark Descent
    AmrAddonInstall
    Anki
    Anno 2070
    Apple Application Support
    Apple Mobile Device Support
    Apple Software Update
    Ask Mr. Robot
    Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver
    avast! Free Antivirus
    Baidu Antivirus
    Battle.net
    Bloody Trapland
    Bonjour
    Castle Crashers
    CCleaner
    Clownfish for Skype
    Contagion
    Counter-Strike: Source
    Curse
    Curse Client
    Daily Alarm Clock
    DaleSearch Chrome Toolbar
    Damned
    Dawngate
    DayZ
    Debut Video Capture Software
    Defraggler
    Dell System Detect
    Democracy 3
    Diablo III
    DivX Setup
    Dropbox
    Dungeon Crawl Stone Soup
    Dungeon Defenders
    Dungeon Defenders Eternity
    Dungeon Keeper 2
    Elsword
    EMSC
    f.lux
    FileHippo.com Update Checker
    focus booster
    Foxit Cloud
    Foxit Reader
    FTL: Faster Than Light
    Game Fire
    Garry's Mod
    GeForce Experience NvStream Client Components
    GOG.com Dungeon Keeper 2
    Google Chrome
    Google Update Helper
    Guild Wars 2
    Gyazo 2.1
    Hearthstone
    ImgBurn
    InfiniteCrisis_410193F41CAE
    Intel PROSet Wireless
    Intel(R) Management Engine Components
    Intel(R) Processor Graphics
    Intel(R) PROSet/Wireless WiFi Software
    iTunes
    Java 7 Update 67
    Java 7 Update 67 (64-bit)
    Java Auto Updater
    KeePass Password Safe 2.27
    Killing Floor
    Kraven Manor
    Left 4 Dead 2
    LibUSB-Win32-0.1.10.1
    LOLReplay
    lucky leap 1.0.0
    Magic 2014
    Magicka
    Magicka: Wizard Wars
    Malwarebytes Anti-Malware version 2.0.2.1012
    MATLAB R2009b
    MediaInfo 0.7.8
    Microsoft .NET Framework 4.5.1
    Microsoft Office 2003 Web Components
    Microsoft Office 2007 Service Pack 3 (SP3)
    Microsoft Office Access MUI (English) 2007
    Microsoft Office Access Setup Metadata MUI (English) 2007
    Microsoft Office Enterprise 2007
    Microsoft Office Excel MUI (English) 2007
    Microsoft Office Groove MUI (English) 2007
    Microsoft Office Groove Setup Metadata MUI (English) 2007
    Microsoft Office InfoPath MUI (English) 2007
    Microsoft Office Office 64-bit Components 2007
    Microsoft Office OneNote MUI (English) 2007
    Microsoft Office Outlook MUI (English) 2007
    Microsoft Office PowerPoint MUI (English) 2007
    Microsoft Office Proof (English) 2007
    Microsoft Office Proof (French) 2007
    Microsoft Office Proof (Spanish) 2007
    Microsoft Office Proofing (English) 2007
    Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
    Microsoft Office Publisher MUI (English) 2007
    Microsoft Office Shared 64-bit MUI (English) 2007
    Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2007
    Microsoft Office Shared MUI (English) 2007
    Microsoft Office Shared Setup Metadata MUI (English) 2007
    Microsoft Office Word MUI (English) 2007
    Microsoft Security Client
    Microsoft Security Essentials
    Microsoft Silverlight
    Microsoft Visual Basic for Applications 7.1 (x64)
    Microsoft Visual Basic for Applications 7.1 (x64) English
    Microsoft Visual C++ 2005 Redistributable
    Microsoft Visual C++ 2005 Redistributable (x64)
    Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
    Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
    Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219
    Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
    Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.60610
    Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.60610
    Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.60610
    Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.21005
    Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005
    Microsoft Visual C++ 2013 x64 Additional Runtime - 12.0.21005
    Microsoft Visual C++ 2013 x64 Minimum Runtime - 12.0.21005
    Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005
    Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005
    Microsoft Visual Studio 2005 Remote Debugger Light (x64) - ENU
    Microsoft Visual Studio 2005 Tools for Applications - ENU
    Microsoft XNA Framework Redistributable 3.1
    Microsoft XNA Framework Redistributable 4.0 Refresh
    Might & Magic: Heroes VI
    mIRC
    MKV Player 2.1.15
    Mobogenie
    MotioninJoy Gamepad tool 0.7.1001
    Mozilla Firefox 30.0 (x86 en-US)
    Mozilla Maintenance Service
    MSXML 4.0 SP2 (KB954430)
    MSXML 4.0 SP2 (KB973688)
    Mumble 1.2.4
    Naga Firmware Updater 1.13
    NVIDIA 3D Vision Driver 335.23
    NVIDIA Control Panel 335.23
    NVIDIA GeForce Experience 1.8.2.1
    NVIDIA Graphics Driver 335.23
    NVIDIA HD Audio Driver 1.3.30.1
    NVIDIA Install Application
    NVIDIA LED Visualizer 1.0
    NVIDIA Network Service
    NVIDIA Optimus Update 11.10.13
    NVIDIA PhysX
    NVIDIA PhysX System Software 9.13.1220
    NVIDIA ShadowPlay 11.10.13
    NVIDIA Stereoscopic 3D Driver
    NVIDIA Update 11.10.13
    NVIDIA Update Core
    NVIDIA Virtual Audio 1.2.20
    Origin
    Paranormal - CLOSED BETA 7.0
    PCSX2 - Playstation 2 Emulator
    Pharaoh Gold Bundle
    Port Forward Network Utilities 2.0.1
    Portal 2
    Private Internet Access Support Files
    RaidCall
    Razer Core
    Razer Synapse 2.0
    Realtek PCIE Card Reader
    Renesas Electronics USB 3.0 Host Controller Driver
    Rust
    Saints Row IV
    Security Update for CAPICOM (KB931906)
    Security Update for Microsoft .NET Framework 4.5.1 (KB2898869)
    Security Update for Microsoft .NET Framework 4.5.1 (KB2901126)
    Security Update for Microsoft .NET Framework 4.5.1 (KB2931368)
    Security Update for Microsoft Office 2007 suites (KB2596744) 32-Bit Edition
    Security Update for Microsoft Office 2007 suites (KB2596754) 32-Bit Edition
    Security Update for Microsoft Office 2007 suites (KB2596792) 32-Bit Edition
    Security Update for Microsoft Office 2007 suites (KB2596825) 32-Bit Edition
    Security Update for Microsoft Office 2007 suites (KB2596871) 32-Bit Edition
    Security Update for Microsoft Office 2007 suites (KB2597969) 32-Bit Edition
    Security Update for Microsoft Office 2007 suites (KB2597973) 32-Bit Edition
    Security Update for Microsoft Office 2007 suites (KB2687439) 32-Bit Edition
    Security Update for Microsoft Office 2007 suites (KB2760411) 32-Bit Edition
    Security Update for Microsoft Office 2007 suites (KB2760415) 32-Bit Edition
    Security Update for Microsoft Office 2007 suites (KB2760585) 32-Bit Edition
    Security Update for Microsoft Office 2007 suites (KB2760591) 32-Bit Edition
    Security Update for Microsoft Office 2007 suites (KB2817330) 32-Bit Edition
    Security Update for Microsoft Office 2007 suites (KB2827326) 32-Bit Edition
    Security Update for Microsoft Office 2007 suites (KB2850022) 32-Bit Edition
    Security Update for Microsoft Office 2007 suites (KB2878233) 32-Bit Edition
    Security Update for Microsoft Office 2007 suites (KB2880507) 32-Bit Edition
    Security Update for Microsoft Office 2007 suites (KB2880508) 32-Bit Edition
    Security Update for Microsoft Office 2007 suites (KB2880513) 32-Bit Edition
    Security Update for Microsoft Office 2007 suites (KB2881069) 32-Bit Edition
    Security Update for Microsoft Office Excel 2007 (KB2827324) 32-Bit Edition
    Security Update for Microsoft Office InfoPath 2007 (KB2687440) 32-Bit Edition
    Security Update for Microsoft Office OneNote 2007 (KB2596857) 32-Bit Edition
    Security Update for Microsoft Office PowerPoint 2007 (KB2596764) 32-Bit Edition
    Security Update for Microsoft Office PowerPoint 2007 (KB2596912) 32-Bit Edition
    Security Update for Microsoft Office Publisher 2007 (KB2817565) 32-Bit Edition
    Security Update for Microsoft Office Word 2007 (KB2880515) 32-Bit Edition
    SHIELD Streaming
    Sid Meier's Civilization IV
    Sid Meier's Civilization IV: Beyond the Sword
    Sid Meier's Civilization IV: Warlords
    Sid Meier's Civilization V
    SimCity™
    Skype Click to Call
    Skype™ 6.18
    Software Informer 1.3.1107.0
    SolidWorks 2014 x64 Edition SP01
    SolidWorks Composer Player 2014 SP01 x64 Edition
    SolidWorks eDrawings 2014 x64 Edition SP01
    SolidWorks Explorer 2014 SP01 x64 Edition
    SolidWorks Plastics 2014 SP01 x64 Edition
    Sonic & All-Stars Racing Transformed
    SpeedFan (remove only)
    Spybot - Search & Destroy
    Steam
    Strife
    SumatraPDF
    SUPERAntiSpyware
    swMSM
    Synaptics Pointing Device Driver
    System Requirements Lab Detection
    TeamSpeak 3 Client
    TeamViewer 9
    Terraria
    The Wolf Among Us
    TortoiseSVN 1.8.2.24708 (64 bit)
    Tropico 4
    Tropico 5
    Tunngle beta
    Tweaking.com - Windows Repair (All in One)
    Ubisoft Game Launcher
    Unity Web Player
    Unreal Development Kit: 2012-10
    Update for 2007 Microsoft Office System (KB967642)
    Update for Microsoft Office 2007 Help for Common Features (KB963673)
    Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition
    Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition
    Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition
    Update for Microsoft Office Access 2007 Help (KB963663)
    Update for Microsoft Office Excel 2007 Help (KB963678)
    Update for Microsoft Office Infopath 2007 Help (KB963662)
    Update for Microsoft Office OneNote 2007 Help (KB963670)
    Update for Microsoft Office Outlook 2007 (KB2687404) 32-Bit Edition
    Update for Microsoft Office Outlook 2007 (KB2863811) 32-Bit Edition
    Update for Microsoft Office Outlook 2007 Help (KB963677)
    Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2883097) 32-Bit Edition
    Update for Microsoft Office Powerpoint 2007 Help (KB963669)
    Update for Microsoft Office Publisher 2007 Help (KB963667)
    Update for Microsoft Office Script Editor Help (KB963671)
    Update for Microsoft Office Word 2007 Help (KB963665)
    VC80CRTRedist - 8.0.50727.6195
    Ventrilo Client for Windows x64
    Vista Services Optimizer
    Visual Boy Advance Packages
    War of the Roses
    War of the Roses Balance Beta
    War of the Vikings Alpha
    WildStar
    WinRAR 5.00 beta 6 (64-bit)
    Yahoo! Messenger
    Yahoo! Software Update
    Yahoo! Toolbar
    YouTube Accelerator
    .
    ==== Event Viewer Messages From Past Week ========
    .
    9/2/2014 8:57:38 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {9E175B6D-F52A-11D8-B9A5-505054503030}
    9/2/2014 8:48:18 PM, Error: Service Control Manager [7001] - The WinHTTP Web Proxy Auto-Discovery Service service depends on the DHCP Client service which failed to start because of the following error: The dependency service or group failed to start.
    9/2/2014 8:38:03 PM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD aswRdr aswRvrt aswSnx aswSP aswTdi aswVmm Bnbase Bndef DfsC discache MpFilter NetBIOS NetBT nsiproxy Psched rdbss SASDIFSV SASKUTIL spldr tdx vwififlt Wanarpv6 WfpLwf ws2ifsl
    9/2/2014 8:38:01 PM, Error: Service Control Manager [7001] - The SMB MiniRedirector Wrapper and Engine service depends on the Redirected Buffering Sub Sysytem service which failed to start because of the following error: A device attached to the system is not functioning.
    9/2/2014 8:38:01 PM, Error: Service Control Manager [7001] - The SMB 2.0 MiniRedirector service depends on the SMB MiniRedirector Wrapper and Engine service which failed to start because of the following error: The dependency service or group failed to start.
    9/2/2014 8:38:01 PM, Error: Service Control Manager [7001] - The SMB 1.x MiniRedirector service depends on the SMB MiniRedirector Wrapper and Engine service which failed to start because of the following error: The dependency service or group failed to start.
    9/2/2014 8:38:01 PM, Error: Service Control Manager [7001] - The Network Location Awareness service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.
    9/2/2014 8:38:01 PM, Error: Service Control Manager [7001] - The IP Helper service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.
    9/2/2014 8:37:53 PM, Error: Service Control Manager [7001] - The Workstation service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.
    9/2/2014 8:37:53 PM, Error: Service Control Manager [7001] - The TCP/IP NetBIOS Helper service depends on the Ancillary Function Driver for Winsock service which failed to start because of the following error: A device attached to the system is not functioning.
    9/2/2014 8:37:53 PM, Error: Service Control Manager [7001] - The Network Store Interface Service service depends on the NSI proxy service driver. service which failed to start because of the following error: A device attached to the system is not functioning.
    9/2/2014 8:37:53 PM, Error: Service Control Manager [7001] - The DNS Client service depends on the NetIO Legacy TDI Support Driver service which failed to start because of the following error: A device attached to the system is not functioning.
    9/2/2014 8:37:53 PM, Error: Service Control Manager [7001] - The DHCP Client service depends on the Ancillary Function Driver for Winsock service which failed to start because of the following error: A device attached to the system is not functioning.
    9/2/2014 8:33:13 PM, Error: Service Control Manager [7001] - The Network List Service service depends on the Network Location Awareness service which failed to start because of the following error: The dependency service or group failed to start.
    9/2/2014 8:33:12 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}
    9/2/2014 8:33:10 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service netprofm with arguments "" in order to run the server: {A47979D2-C419-11D9-A5B4-001185AD2B89}
    9/2/2014 8:33:10 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service netman with arguments "" in order to run the server: {BA126AD1-2166-11D1-B1D0-00805FC1270E}
    9/2/2014 8:33:08 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
    9/2/2014 8:32:58 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service ShellHWDetection with arguments "" in order to run the server: {DD522ACC-F821-461A-A407-50B198B896DC}
    9/2/2014 6:53:57 PM, Error: Service Control Manager [7030] - The Foxit Cloud Safe Update Service service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.
    9/2/2014 4:34:04 PM, Error: Service Control Manager [7034] - The YouTubeAcceleratorService service terminated unexpectedly. It has done this 1 time(s).
    9/2/2014 3:08:58 PM, Error: Microsoft-Windows-WER-SystemErrorReporting [1001] - The computer has rebooted from a bugcheck. The bugcheck was: 0x000000d1 (0x0000000000000028, 0x0000000000000002, 0x0000000000000000, 0xfffff880015666fd). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 090214-38750-01.
    9/2/2014 10:39:26 AM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the YouTubeAcceleratorService service to connect.
    9/2/2014 10:39:26 AM, Error: Service Control Manager [7000] - The YouTubeAcceleratorService service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
    9/2/2014 10:38:03 AM, Error: Microsoft-Windows-WER-SystemErrorReporting [1001] - The computer has rebooted from a bugcheck. The bugcheck was: 0x000000d1 (0x0000000000000028, 0x0000000000000002, 0x0000000000000000, 0xfffff880015256fd). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 090214-42494-01.
    9/2/2014 10:09:04 PM, Error: Service Control Manager [7022] - The Windows Update service hung on starting.
    9/2/2014 10:04:57 PM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Spybot-S&D 2 Scanner Service service to connect.
    9/2/2014 10:04:57 PM, Error: Service Control Manager [7000] - The Spybot-S&D 2 Scanner Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
    9/2/2014 10:03:13 PM, Error: Service Control Manager [7000] - The LogMeIn Kernel Information Provider service failed to start due to the following error: The system cannot find the path specified.
    9/2/2014 10:03:13 PM, Error: Service Control Manager [7000] - The LibUsb-Win32 - Daemon, Version 0.1.10.1 service failed to start due to the following error: The system cannot find the file specified.
    9/2/2014 10:02:18 PM, Error: Application Popup [1060] - \SystemRoot\SysWow64\drivers\libusb0.sys has been blocked from loading due to incompatibility with this system. Please contact your software vendor for a compatible version of the driver.
    9/1/2014 8:25:47 PM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the SCP DS3 Service service to connect.
    9/1/2014 8:25:47 PM, Error: Service Control Manager [7000] - The SCP DS3 Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
    9/1/2014 10:36:49 AM, Error: Service Control Manager [7022] - The SCP DS3 Service service hung on starting.
    8/31/2014 3:33:25 PM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Steam Client Service service to connect.
    8/31/2014 3:33:25 PM, Error: Service Control Manager [7000] - The Steam Client Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
    8/26/2014 7:33:35 AM, Error: Service Control Manager [7022] - The Windows Modules Installer service hung on starting.
    8/26/2014 7:33:30 AM, Error: Service Control Manager [7022] - The Function Discovery Resource Publication service hung on starting.
    8/26/2014 4:05:51 PM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the Schedule service.
    8/26/2014 1:32:56 AM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the iphlpsvc service.
    .
    ==== End Of File ===========================

     
  5. Ryansee

    Ryansee TS Rookie Topic Starter Posts: 19

    DDS:

    DDS (Ver_2012-11-20.01) - NTFS_AMD64
    Internet Explorer: 11.0.9600.17239 BrowserJavaVersion: 10.67.2
    Run by Ahmed at 22:23:40 on 2014-09-02
    #Option Extended Search is enabled.
    Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.8140.3822 [GMT 3:00]
    .
    AV: Microsoft Security Essentials *Enabled/Updated* {641105E6-77ED-3F35-A304-765193BCB75F}
    AV: avast! Antivirus *Enabled/Outdated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
    AV: Baidu Antivirus *Disabled/Updated* {10616E6C-0E20-8594-D377-A7D03F6128A6}
    SP: avast! Antivirus *Enabled/Outdated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
    SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    SP: Baidu Antivirus *Disabled/Updated* {AB008F88-281A-8A1A-E9C7-9CA244E6621B}
    SP: Spybot - Search and Destroy *Disabled/Updated* {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}
    SP: Microsoft Security Essentials *Enabled/Updated* {DF70E402-51D7-30BB-99B4-4D23E83BFDE2}
    .
    ============== Running Processes ===============
    .
    C:\Windows\system32\lsm.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch
    C:\Windows\system32\nvvsvc.exe
    C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
    C:\Windows\system32\svchost.exe -k RPCSS
    c:\Program Files\Microsoft Security Client\MsMpEng.exe
    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
    C:\Windows\system32\svchost.exe -k netsvcs
    C:\Windows\system32\svchost.exe -k GPSvcGroup
    C:\Windows\system32\svchost.exe -k LocalService
    C:\Windows\system32\svchost.exe -k NetworkService
    C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
    C:\Windows\system32\nvvsvc.exe
    C:\Program Files\AVAST Software\Avast\AvastSvc.exe
    C:\Windows\system32\WLANExt.exe
    C:\Windows\system32\Dwm.exe
    C:\Windows\Explorer.EXE
    C:\Windows\System32\spoolsv.exe
    C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
    C:\Windows\system32\taskeng.exe
    C:\Windows\system32\taskhost.exe
    C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE
    C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe
    C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe
    C:\Program Files\Intel\WiFi\bin\EvtEng.exe
    C:\Program Files (x86)\Foxit Software\Foxit Reader\Foxit Cloud\FCUpdateService.exe
    C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
    C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
    C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
    C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
    C:\Program Files (x86)\Razer\Core\64bit\rzovlmon.exe
    C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
    C:\Program Files\Microsoft Security Client\msseces.exe
    C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe
    C:\Windows\System32\igfxpers.exe
    C:\Windows\System32\igfxtray.exe
    C:\Windows\System32\hkcmd.exe
    C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe
    C:\Windows\system32\taskeng.exe
    C:\Program Files\AskMrRobot\AmrTray.exe
    C:\Program Files\Software Informer\softinfo.exe
    C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
    C:\Program Files (x86)\FileHippo.com\UpdateChecker.exe
    C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
    C:\Program Files (x86)\Skype\Phone\Skype.exe
    C:\Windows\SysWOW64\rundll32.exe
    C:\Program Files\TortoiseSVN\bin\TSVNCache.exe
    C:\Users\Ahmed\AppData\Local\FluxSoftware\Flux\flux.exe
    C:\Program Files\Alienware\Command Center\AWCCServiceController.exe
    C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
    C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
    C:\Program Files (x86)\Alienware On-Screen Display\AlienwareOn-ScreenDisplay.exe
    C:\Program Files\AVAST Software\Avast\AvastUI.exe
    C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
    C:\Windows\system32\svchost.exe -k imgsvc
    C:\Program Files\Alienware\Command Center\AlienwareAlienFXController.exe
    C:\Windows\system32\SearchIndexer.exe
    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
    C:\Windows\system32\wbem\unsecapp.exe
    C:\Windows\system32\wbem\unsecapp.exe
    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    C:\Windows\system32\wbem\wmiprvse.exe
    C:\Windows\system32\wbem\wmiprvse.exe
    c:\Program Files\Microsoft Security Client\NisSrv.exe
    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
    C:\Windows\System32\WUDFHost.exe
    C:\Program Files\Windows Media Player\wmpnetwk.exe
    C:\Windows\System32\svchost.exe -k LocalServicePeerNet
    C:\Windows\System32\rundll32.exe
    C:\Program Files\Alienware\Command Center\AWCCApplicationWatcher32.exe
    C:\Program Files\Alienware\Command Center\AWCCApplicationWatcher64.exe
    C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    C:\Windows\system32\wuauclt.exe
    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe
    C:\Program Files\TortoiseSVN\bin\TSVNCache.exe
    C:\Windows\System32\svchost.exe -k WerSvcGroup
    C:\Windows\System32\cscript.exe
    .
    ============== Pseudo HJT Report ===============
    .
    uSearch Bar = Preserve
    mStart Page = hxxp://www.google.com
    mDefault_Page_URL = hxxp://www.google.com
    mWinlogon: Userinit = userinit.exe,
    BHO: Groove GFS Browser Helper: {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll
    BHO: Java(tm) Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll
    BHO: avast! Online Security: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
    BHO: Skype Click to Call for Internet Explorer: {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
    BHO: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll
    TB: avast! Online Security: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
    uRun: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
    uRun: [FileHippo.com] "C:\Program Files (x86)\FileHippo.com\UpdateChecker.exe" /background
    uRun: [Skype] "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun
    uRun: [NextLive] C:\Windows\SysWOW64\rundll32.exe "C:\Users\Ahmed\AppData\Roaming\newnext.me\nengine.dll",EntryPoint -m l
    uRun: [F.lux] "C:\Users\Ahmed\AppData\Local\FluxSoftware\Flux\flux.exe" /noshow
    mRun: [SDTray] "C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe"
    mRun: [AlienwareOn-ScreenDisplay] C:\Program Files (x86)\Alienware On-Screen Display\AlienwareOn-ScreenDisplay.exe
    mRun: [KeePass 2 PreLoad] "C:\Program Files (x86)\KeePass Password Safe 2\KeePass.exe" --preload
    mRun: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui
    mRun: [NUSB3MON] "C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe"
    dRunOnce: [SPReview] "C:\Windows\System32\SPReview\SPReview.exe" /sp:1 /errorfwlink:"http://go.microsoft.com/fwlink/?LinkID=122915" /build:7601
    uPolicies-Explorer: NoDriveTypeAutoRun = dword:145
    mPolicies-Explorer: NoActiveDesktop = dword:1
    mPolicies-Explorer: NoActiveDesktopChanges = dword:1
    mPolicies-System: ConsentPromptBehaviorUser = dword:3
    mPolicies-System: EnableUIADesktopToggle = dword:0
    IE: E&xport to Microsoft Excel - C:\PROGRA~2\MICROS~3\Office12\EXCEL.EXE/3000
    IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files (x86)\Microsoft Office\Office12\ONBttnIE.dll
    IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
    IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503}
    LSP: C:\Program Files (x86)\YouTube Accelerator\ytalsp.dll
    Trusted Zone: dell.com
    TCP: NameServer = 192.168.1.1 192.168.1.1
    TCP: Interfaces\{388291E2-08A3-4FFB-AA5C-8D2F05E0DECF} : DHCPNameServer = 7.254.254.254
    TCP: Interfaces\{3D7DB392-8310-4C99-9194-FDDF34DFB51D} : DHCPNameServer = 172.20.10.1
    TCP: Interfaces\{893A7A27-7259-4561-BA20-37C578390A09} : DHCPNameServer = 192.168.1.1 192.168.1.1
    TCP: Interfaces\{893A7A27-7259-4561-BA20-37C578390A09}\1426F60214C696 : DHCPNameServer = 192.168.0.1
    TCP: Interfaces\{893A7A27-7259-4561-BA20-37C578390A09}\1486D65646 : DHCPNameServer = 172.20.10.1
    TCP: Interfaces\{893A7A27-7259-4561-BA20-37C578390A09}\1653735613943505 : DHCPNameServer = 192.168.1.1 0.0.0.0
    TCP: Interfaces\{893A7A27-7259-4561-BA20-37C578390A09}\16D627021627166616 : DHCPNameServer = 62.240.110.198 62.240.110.197
    TCP: Interfaces\{893A7A27-7259-4561-BA20-37C578390A09}\3334F6D6 : DHCPNameServer = 192.168.101.1 192.168.101.4
    TCP: Interfaces\{893A7A27-7259-4561-BA20-37C578390A09}\C494E4B44435C4D286F6D656 : DHCPNameServer = 192.168.1.1
    TCP: Interfaces\{9695AEC5-758E-4DB9-811D-6D23A04D41EF} : DHCPNameServer = 209.222.18.222 209.222.18.218
    TCP: Interfaces\{CC4F8F04-1967-40BA-ACB9-D35D82530A16} : NameServer = 41.128.225.225,42.128.225.226
    TCP: Interfaces\{CC4F8F04-1967-40BA-ACB9-D35D82530A16} : DHCPNameServer = 192.168.1.1 192.168.1.1
    Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveSystemServices.dll
    Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll
    Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
    Notify: SDWinLogon - SDWinLogon.dll
    AppInit_DLLs= C:\Windows\SysWOW64\nvinit.dll
    SSODL: WebCheck - <orphaned>
    SEH: Groove GFS Stub Execution Hook - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll
    mASetup: {8A69D345-D564-463c-AFF1-A69D9E530F96} - "C:\Program Files (x86)\Google\Chrome\Application\37.0.2062.102\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --multi-install --chrome
    x64-mStart Page = hxxp://www.google.com
    x64-mDefault_Page_URL = hxxp://www.google.com
    x64-BHO: avast! Online Security: {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll
    x64-BHO: Java(tm) Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll
    x64-BHO: Skype Click to Call for Internet Explorer: {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll
    x64-BHO: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll
    x64-TB: avast! Online Security: {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll
    x64-Run: [SynTPEnh] C:\Program Files (x86)\Synaptics\SynTP\SynTPEnh.exe
    x64-Run: [Command Center Controllers] "C:\Program Files\Alienware\Command Center\AWCCStartupOrchestrator.exe"
    x64-Run: [ShadowPlay] C:\Windows\System32\rundll32.exe C:\Windows\System32\nvspcap64.dll,ShadowPlayOnSystemStart
    x64-Run: [NvBackend] "C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe"
    x64-Run: [MSC] "c:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey
    x64-Run: [IntelWireless] "C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe" /tf Intel Wireless Tray
    x64-Run: [Persistence] "C:\Windows\System32\igfxpers.exe"
    x64-Run: [IgfxTray] "C:\Windows\System32\igfxtray.exe"
    x64-Run: [HotKeysCmds] "C:\Windows\System32\hkcmd.exe"
    x64-Run: [FreeFallProtection] C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe
    x64-Run: [Ask Mr. Robot] C:\Program Files\AskMrRobot\AmrTray.exe
    x64-IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll
    .
    INFO: x64-HKLM has more than 50 listed domains.
    If you wish to scan all of them, select the 'Force scan all domains' option.
    .
    x64-Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - <orphaned>
    x64-Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - <orphaned>
    x64-Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll
    x64-Notify: igfxcui - igfxdev.dll
    x64-SSODL: WebCheck - <orphaned>
    Hosts: 127.0.0.1 www.spywareinfo.com
    .
    ================= FIREFOX ===================
    .
    FF - ProfilePath - C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\
    FF - prefs.js: browser.search.selectedEngine - Bing
    FF - prefs.js: browser.startup.homepage - hxxp://www.msn.com/?pc=UP97&ocid=UP97DHP|http://ar.hao123.com/?tn=pcf_inner_protection_01_hao123_ar
    FF - prefs.js: keyword.URL - hxxp://www.bing.com/search?FORM=UP97DF&PC=UP97&q=
    FF - plugin: C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll
    FF - plugin: C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll
    FF - plugin: C:\Program Files (x86)\globalUpdate\Update\1.3.25.0\npGoogleUpdate4.dll
    FF - plugin: C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll
    FF - plugin: C:\Program Files (x86)\Java\jre7\bin\dtplugin\npdeployJava1.dll
    FF - plugin: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll
    FF - plugin: c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrlui.dll
    FF - plugin: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll
    FF - plugin: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll
    FF - plugin: C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll
    FF - plugin: C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypchub.dll
    FF - plugin: C:\Users\Ahmed\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll
    FF - plugin: C:\Users\Ahmed\AppData\Roaming\raidcall\plugins\nprcplugin.dll
    FF - plugin: C:\Windows\System32\Wat\npWatWeb.dll
    FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_14_0_0_145.dll
    .
    ============= SERVICES / DRIVERS ===============
    .
    R0 aswRvrt;aswRvrt;C:\Windows\System32\drivers\aswRvrt.sys [2013-9-20 65336]
    R0 aswVmm;aswVmm;C:\Windows\System32\drivers\aswVmm.sys [2013-9-20 204880]
    R0 EMSC;COMPAL Embedded System Control;C:\Windows\System32\drivers\EMSC.sys [2009-6-26 16752]
    R0 MpFilter;Microsoft Malware Protection Driver;C:\Windows\System32\drivers\MpFilter.sys [2014-1-25 268512]
    R0 nvpciflt;nvpciflt;C:\Windows\System32\drivers\nvpciflt.sys [2014-4-3 33736]
    R0 stdcfltn;Disk Class Filter Driver for Accelerometer;C:\Windows\System32\drivers\stdcfltn.sys [2013-6-7 21616]
    R1 aswSnx;aswSnx;C:\Windows\System32\drivers\aswSnx.sys [2013-9-20 1030952]
    R1 aswSP;aswSP;C:\Windows\System32\drivers\aswSP.sys [2013-9-20 378944]
    R1 Bfilter;Baidu Antivirus Minifilter Driver;C:\Windows\System32\drivers\Bfilter.sys [2014-7-25 56640]
    R1 Bfmon;Baidu FS Monitor Driver;C:\Windows\System32\drivers\Bfmon.sys [2014-7-25 37696]
    R1 Bnbase;Bnbase;C:\Windows\System32\drivers\bnbasex64.sys [2014-7-25 91616]
    R1 Bndef;Baidu NetDefense;C:\Windows\System32\drivers\bndef64.sys [2014-7-25 70912]
    R1 Bprotect;Baidu Protect;C:\Windows\System32\drivers\Bprotect.sys [2014-7-25 144960]
    R1 nvkflt;nvkflt;C:\Windows\System32\drivers\nvkflt.sys [2014-4-3 300320]
    R1 RzFilter;RzFilter;C:\Windows\System32\drivers\RzFilter.sys [2014-7-26 74432]
    R1 SASDIFSV;SASDIFSV;C:\Program Files\SUPERAntiSpyware\sasdifsv64.sys [2011-7-22 14928]
    R1 SASKUTIL;SASKUTIL;C:\Program Files\SUPERAntiSpyware\saskutil64.sys [2011-7-13 12368]
    R2 !SASCORE;SAS Core Service;C:\Program Files\SUPERAntiSpyware\SASCore64.exe [2014-7-23 172344]
    R2 aswFsBlk;aswFsBlk;C:\Windows\System32\drivers\aswFsBlk.sys [2013-9-20 33400]
    R2 aswMonFlt;aswMonFlt;C:\Windows\System32\drivers\aswMonFlt.sys [2013-9-20 80816]
    R2 avast! Antivirus;avast! Antivirus;C:\Program Files\AVAST Software\Avast\AvastSvc.exe [2013-9-20 46808]
    R2 c2cautoupdatesvc;Skype Click to Call Updater;C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [2014-7-14 1390176]
    R2 c2cpnrsvc;Skype Click to Call PNR Service;C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [2014-7-14 1767520]
    R2 FoxitCloudUpdateService;Foxit Cloud Safe Update Service;C:\Program Files (x86)\Foxit Software\Foxit Reader\Foxit Cloud\FCUpdateService.exe [2014-9-2 242216]
    R2 LMIRfsDriver;LogMeIn Remote File System Driver;C:\Windows\System32\drivers\LMIRfsDriver.sys [2013-9-21 72216]
    R2 NisDrv;Microsoft Network Inspection System;C:\Windows\System32\drivers\NisDrvWFP.sys [2014-3-11 133928]
    R2 NvNetworkService;NVIDIA Network Service;C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [2014-4-4 1593632]
    R2 NvStreamSvc;NVIDIA Streamer Service;C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [2014-4-4 16941856]
    R2 RzOvlMon;Razer Overlay Subsystem Emergency Service;C:\Program Files (x86)\Razer\Core\64bit\RzOvlMon.exe [2014-4-18 32960]
    R2 SDUpdateService;Spybot-S&D 2 Updating Service;C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [2014-9-2 2088408]
    R2 SDWSCService;Spybot-S&D 2 Security Center Service;C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [2014-9-2 171928]
    R2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2014-4-4 411936]
    R2 UNS;Intel(R) Management and Security Application User Notification Service;C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2013-6-7 2656280]
    R3 Acceler;Accelerometer Service;C:\Windows\System32\drivers\Accelern.sys [2013-6-7 27760]
    R3 dcdbas;System Management Driver;C:\Windows\System32\drivers\dcdbas64.sys [2013-6-7 38472]
    R3 IntcDAud;Intel(R) Display Audio;C:\Windows\System32\drivers\IntcDAud.sys [2013-6-7 317440]
    R3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;C:\Windows\System32\drivers\L1C62x64.sys [2013-6-7 76912]
    R3 MBAMSwissArmy;MBAMSwissArmy;C:\Windows\System32\drivers\MBAMSwissArmy.sys [2014-9-2 122584]
    R3 MotioninJoyXFilter;MotioninJoy Virtual Xinput device Filter Driver;C:\Windows\System32\drivers\MijXfilt.sys [2014-6-13 121416]
    R3 NisSrv;Microsoft Network Inspection;C:\Program Files\Microsoft Security Client\NisSrv.exe [2014-3-11 347872]
    R3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;C:\Windows\System32\drivers\nusb3hub.sys [2011-2-1 80384]
    R3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;C:\Windows\System32\drivers\nusb3xhc.sys [2011-2-1 181248]
    R3 nvvad_WaveExtensible;NVIDIA Virtual Audio Device (Wave Extensible) (WDM);C:\Windows\System32\drivers\nvvad64v.sys [2014-4-3 39200]
    R3 RSPCIESTOR;Realtek PCIE CardReader Driver;C:\Windows\System32\drivers\RtsPStor.sys [2013-6-7 333928]
    R3 RzDxgk;RzDxgk;C:\Windows\System32\drivers\RzDxgk.sys [2014-7-26 129472]
    R3 ScpVBus;Scp Virtual Bus Driver;C:\Windows\System32\drivers\ScpVBus.sys [2014-8-11 39168]
    R3 tap0901t;TAP-Win32 Adapter V9 (Tunngle);C:\Windows\System32\drivers\tap0901t.sys [2014-7-27 31232]
    R3 USBAAPL64;Apple Mobile USB Driver;C:\Windows\System32\drivers\usbaapl64.sys [2012-12-13 54784]
    S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2013-9-11 105144]
    S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2013-9-11 124088]
    S2 libusbd;LibUsb-Win32 - Daemon, Version 0.1.10.1;system32\libusbd-nt.exe --> system32\libusbd-nt.exe [?]
    S2 SDScannerService;Spybot-S&D 2 Scanner Service;C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [2014-9-2 1738168]
    S2 SkypeUpdate;Skype Updater;C:\Program Files (x86)\Skype\Updater\Updater.exe [2014-4-3 315008]
    S3 CoordinatorServiceHost;SW Distributed TS Coordinator Service;C:\Program Files\SolidWorks Corp\SolidWorks\swScheduler\DTSCoordinatorService.exe [2013-11-15 76328]
    S3 FLEXnet Licensing Service 64;FLEXnet Licensing Service 64;C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe [2014-1-22 1431888]
    S3 IEEtwCollectorService;Internet Explorer ETW Collector Service;C:\Windows\System32\ieetwcollector.exe [2014-8-13 111616]
    S3 MyWiFiDHCPDNS;Wireless PAN DHCP Server;C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [2010-12-17 340240]
    S3 Netaapl;Apple Mobile Device Ethernet Service;C:\Windows\System32\drivers\netaapl64.sys [2013-7-25 23040]
    S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;C:\Windows\System32\drivers\rdpvideominiport.sys [2014-6-29 19456]
    S3 rzudd;Razer Mouse Driver;C:\Windows\System32\drivers\rzudd.sys [2014-5-19 155816]
    S3 TsUsbFlt;TsUsbFlt;C:\Windows\System32\drivers\TsUsbFlt.sys [2014-6-29 56832]
    S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\System32\Wat\WatAdminSvc.exe [2013-6-8 1255736]
    S3 WDC_SAM;WD SCSI Pass Thru driver;C:\Windows\System32\drivers\wdcsam64.sys [2008-5-6 14464]
    S4 BAVSvc;Baidu Antivirus Service;C:\Program Files (x86)\Baidu Security\Baidu Antivirus\BAVSvc.exe [2014-7-25 2038248]
    S4 BHipsSvc;Baidu Hips Service;C:\Program Files (x86)\Baidu Security\Baidu Antivirus\BHipsSvc.exe [2014-7-25 481432]
    S4 TeamViewer9;TeamViewer 9;C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe [2014-7-4 5037888]
    S4 TunngleService;TunngleService;C:\Program Files (x86)\Tunngle\TnglCtrl.exe [2014-7-27 758224]
    S4 YouTubeAcceleratorService;YouTubeAcceleratorService;C:\PROGRA~2\YOUTUB~1\YouTubeAcceleratorService.exe -start -scm --> C:\PROGRA~2\YOUTUB~1\YouTubeAcceleratorService.exe -start -scm [?]
    .
    =============== Created Last 60 ================
    .
    2014-09-02 19:20:40 -------- d-----w- C:\logs
    2014-09-02 18:31:06 -------- d-----w- C:\TDSSKiller_Quarantine
    2014-09-02 17:04:08 -------- d-----w- C:\Users\Ahmed\AppData\Roaming\KeePass
    2014-09-02 16:25:54 -------- d-----w- C:\ProgramData\Informer Technologies, Inc
    2014-09-02 16:24:27 -------- d-----w- C:\Users\Ahmed\AppData\Roaming\Software Informer
    2014-09-02 16:24:26 -------- d-----w- C:\Program Files\Software Informer
    2014-09-02 16:14:24 -------- d-----w- C:\Program Files (x86)\FileHippo.com
    2014-09-02 16:03:07 -------- d-----w- C:\Program Files (x86)\KeePass Password Safe 2
    2014-09-02 16:00:46 -------- d-----w- C:\Users\Ahmed\AppData\Roaming\Dropbox
    2014-09-02 15:59:50 -------- d-----w- C:\Users\Ahmed\AppData\Roaming\Gyazo
    2014-09-02 15:58:15 -------- d-----w- C:\Program Files (x86)\SystemRequirementsLab
    2014-09-02 15:54:23 -------- d-----w- C:\Users\Ahmed\AppData\Roaming\Foxit Software
    2014-09-02 14:22:45 -------- d-----w- C:\Program Files (x86)\Foxit Software
    2014-09-02 14:01:23 -------- d-----w- C:\Windows\SysWow64\Adobe
    2014-09-02 14:00:34 111016 ----a-w- C:\Windows\System32\WindowsAccessBridge-64.dll
    2014-09-02 13:57:56 98216 ----a-w- C:\Windows\SysWow64\WindowsAccessBridge-32.dll
    2014-09-02 13:46:01 -------- d---a-w- C:\3590F75ABA9E485486C100C1A9D4FF06ZZ.Z..ZZZZZ....Z
    2014-09-02 13:45:50 21040 ----a-w- C:\Windows\System32\sdnclean64.exe
    2014-09-02 13:45:44 -------- d-----w- C:\ProgramData\Spybot - Search & Destroy
    2014-09-02 13:45:15 -------- d-----w- C:\Program Files (x86)\Spybot - Search & Destroy 2
    2014-09-02 13:40:42 -------- d-----w- C:\Program Files\Defraggler
    2014-09-02 12:40:08 -------- d-----w- C:\SUPERDelete
    2014-09-02 12:38:05 -------- d-----w- C:\Users\Ahmed\AppData\Roaming\SUPERAntiSpyware.com
    2014-09-02 12:36:55 -------- d-----w- C:\ProgramData\SUPERAntiSpyware.com
    2014-09-02 12:36:55 -------- d-----w- C:\Program Files\SUPERAntiSpyware
    2014-09-02 12:25:57 1169712 ----a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{748542A2-DAFC-4239-9186-33CE169A7321}\gapaengine.dll
    2014-09-02 12:25:47 11319192 ----a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{6BB67563-7113-4011-AED3-D722B41E2734}\mpengine.dll
    2014-09-02 12:20:54 122584 ----a-w- C:\Windows\System32\drivers\MBAMSwissArmy.sys
    2014-09-02 12:20:19 91352 ----a-w- C:\Windows\System32\drivers\mbamchameleon.sys
    2014-09-02 12:20:18 63704 ----a-w- C:\Windows\System32\drivers\mwac.sys
    2014-09-02 12:20:17 -------- d-----w- C:\Program Files (x86)\Malwarebytes Anti-Malware
    2014-09-02 12:20:03 -------- d-----w- C:\Program Files (x86)\Microsoft Security Client
    2014-09-02 12:19:50 -------- d-----w- C:\Program Files\Microsoft Security Client
    2014-09-02 07:49:50 11319192 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{1939B7FD-1B0E-46DC-9ED2-DAA779942156}\mpengine.dll
    2014-08-31 16:04:06 -------- d-----w- C:\Program Files (x86)\psx emulation cheater
    2014-08-28 16:29:11 3163648 ----a-w- C:\Windows\System32\win32k.sys
    2014-08-28 16:29:10 404480 ----a-w- C:\Windows\System32\gdi32.dll
    2014-08-28 16:29:10 311808 ----a-w- C:\Windows\SysWow64\gdi32.dll
    2014-08-25 18:38:37 300408 ----a-r- C:\Users\Ahmed\AppData\Roaming\Microsoft\Installer\{5A336D74-E680-4986-96F4-E9CEBC784F56}\ARPPRODUCTICON.exe
    2014-08-25 18:38:37 136568 ----a-r- C:\Users\Ahmed\AppData\Roaming\Microsoft\Installer\{5A336D74-E680-4986-96F4-E9CEBC784F56}\ShortcutUpdater_DF0BD54B5FA14948AAC4D5BDB1FBFCF2.exe
    2014-08-24 23:31:57 -------- d-----w- C:\Program Files (x86)\Daily Alarm Clock
    2014-08-18 02:01:14 99480 ----a-w- C:\Windows\SysWow64\infocardapi.dll
    2014-08-18 02:01:14 619672 ----a-w- C:\Windows\SysWow64\icardagt.exe
    2014-08-18 02:01:14 171160 ----a-w- C:\Windows\System32\infocardapi.dll
    2014-08-18 02:01:14 1389208 ----a-w- C:\Windows\System32\icardagt.exe
    2014-08-18 02:01:11 8856 ----a-w- C:\Windows\SysWow64\icardres.dll
    2014-08-18 02:01:11 8856 ----a-w- C:\Windows\System32\icardres.dll
    2014-08-18 02:00:55 35480 ----a-w- C:\Windows\SysWow64\TsWpfWrp.exe
    2014-08-18 02:00:55 35480 ----a-w- C:\Windows\System32\TsWpfWrp.exe
    2014-08-13 20:28:50 7168 ----a-w- C:\Windows\SysWow64\KBDYAK.DLL
    2014-08-13 20:28:49 7168 ----a-w- C:\Windows\System32\KBDYAK.DLL
    2014-08-13 20:28:49 7168 ----a-w- C:\Windows\System32\KBDBASH.DLL
    2014-08-13 20:28:49 6656 ----a-w- C:\Windows\SysWow64\KBDBASH.DLL
    2014-08-13 20:28:01 2048 ----a-w- C:\Windows\SysWow64\tzres.dll
    2014-08-13 20:28:01 2048 ----a-w- C:\Windows\System32\tzres.dll
    2014-08-13 20:24:03 1216000 ----a-w- C:\Windows\System32\rpcrt4.dll
    2014-08-13 20:24:02 664064 ----a-w- C:\Windows\SysWow64\rpcrt4.dll
    2014-08-12 02:28:38 -------- d-----w- C:\Users\Ahmed\AppData\Local\Installer
    2014-08-12 02:20:34 -------- d-sh--w- C:\Users\Ahmed\AppData\Local\EmieUserList
    2014-08-12 02:20:34 -------- d-sh--w- C:\Users\Ahmed\AppData\Local\EmieSiteList
    2014-08-12 02:11:12 -------- d-----w- C:\Program Files (x86)\YouTube Accelerator
    2014-08-12 02:11:03 172032 ----a-w- C:\Windows\SysWow64\AniGIF.ocx
    2014-08-12 02:10:15 -------- d-----w- C:\Program Files (x86)\PCSXR
    2014-08-12 02:10:05 -------- d-----w- C:\Users\Ahmed\AppData\Local\globalUpdate
    2014-08-12 02:10:05 -------- d-----w- C:\Program Files (x86)\globalUpdate
    2014-08-11 18:12:59 39168 ----a-w- C:\Windows\System32\drivers\ScpVBus.sys
    2014-08-11 18:12:59 1002728 ----a-w- C:\Windows\System32\WinUSBCoInstaller2.dll
    2014-08-11 18:11:49 -------- d-----w- C:\Program Files\Scarlet.Crush Productions
    2014-08-10 21:22:21 -------- d-----w- C:\Users\Ahmed\AppData\Roaming\AVG
    2014-08-10 21:22:21 -------- d-----w- C:\Users\Ahmed\AppData\Local\AVG
    2014-08-10 21:20:26 -------- d-----w- C:\ProgramData\AVG
    2014-08-10 21:20:19 -------- d-sh--w- C:\ProgramData\{01BD4FC9-2F86-4706-A62E-774BB7E9D308}
    2014-08-10 21:20:19 -------- d--h--w- C:\ProgramData\Common Files
    2014-08-10 20:56:59 -------- d-----w- C:\Program Files (x86)\PCSX2 1.2.1
    2014-08-09 18:36:14 455328 ----a-w- C:\Windows\SysWow64\msvcp120.dll
    2014-08-09 18:36:08 660128 ----a-w- C:\Windows\System32\msvcp120.dll
    2014-08-09 18:35:16 -------- d-----w- C:\ProgramData\Logs
    2014-08-09 18:35:12 19392 ----a-w- C:\Windows\System32\roboot64.exe
    2014-08-03 20:13:44 -------- d-----w- C:\Program Files\Echobit
    2014-07-31 18:25:53 -------- d-----w- C:\ProgramData\Echobit
    2014-07-31 18:25:52 -------- d-----w- C:\Users\Ahmed\AppData\Local\Echobit
    2014-07-27 20:07:32 -------- d-----w- C:\Users\Ahmed\AppData\Roaming\PortForward.com
    2014-07-27 20:07:30 -------- d-----w- C:\Program Files (x86)\Portforward.com
    2014-07-27 13:38:05 -------- d-----w- C:\Users\Ahmed\AppData\Roaming\Tunngle
    2014-07-27 13:38:05 -------- d-----w- C:\ProgramData\Tunngle
    2014-07-27 13:38:02 31232 ----a-w- C:\Windows\System32\drivers\tap0901t.sys
    2014-07-27 13:38:00 -------- d-----w- C:\Program Files (x86)\Tunngle
    2014-07-27 11:16:12 -------- d-----w- C:\Users\Ahmed\AppData\Local\Razer
    2014-07-26 21:28:24 -------- d-----w- C:\Program Files (x86)\Dungeon Defenders 2
    2014-07-26 16:41:56 74432 ----a-w- C:\Windows\System32\drivers\RzFilter.sys
    2014-07-26 16:41:51 129472 ----a-w- C:\Windows\System32\drivers\RzDxgk.sys
    2014-07-26 16:40:02 -------- d-----w- C:\Windows\Razer Core
    2014-07-25 20:46:51 -------- d-----w- C:\Users\Ahmed\AppData\Local\Razer_Inc
    2014-07-25 16:22:06 91616 ----a-w- C:\Windows\System32\drivers\Bnbasex.sys
    2014-07-25 16:22:06 70912 ----a-w- C:\Windows\System32\drivers\Bndef.sys
    2014-07-25 16:04:08 -------- d-----w- C:\Users\Ahmed\AppData\Roaming\Baidu
    2014-07-25 16:04:07 144960 ----a-w- C:\Windows\System32\drivers\Bprotect.sys
    2014-07-25 16:04:02 37696 ----a-w- C:\Windows\System32\drivers\Bfmon.sys
    2014-07-25 16:03:58 56640 ----a-w- C:\Windows\System32\drivers\Bfilter.sys
    2014-07-25 16:03:55 91616 ----a-w- C:\Windows\System32\drivers\bnbasex64.sys
    2014-07-25 16:03:55 70912 ----a-w- C:\Windows\System32\drivers\bndef64.sys
    2014-07-25 16:03:46 -------- d-----w- C:\ProgramData\baidu
    2014-07-21 03:00:33 294912 ----a-w- C:\Windows\System32\browserchoice.exe
    2014-07-19 18:01:06 -------- d-----w- C:\Users\Ahmed\AppData\Roaming\Titanium
    2014-07-19 17:59:54 31232 ----a-w- C:\Windows\System32\drivers\tap0901.sys
    2014-07-19 17:59:45 -------- d-----w- C:\Program Files\pia_manager
    2014-07-16 15:47:24 -------- d-----w- C:\ProgramData\Riot Games
    2014-07-12 13:40:23 -------- d-----w- C:\Users\Ahmed\AppData\Roaming\UDP Software
    2014-07-11 21:55:34 -------- d-----w- C:\df
    2014-07-09 17:04:14 497152 ----a-w- C:\Windows\System32\drivers\afd.sys
    2014-07-09 17:04:13 1719296 ----a-w- C:\Program Files\Windows Journal\NBDoc.DLL
    2014-07-09 17:04:13 1380864 ----a-w- C:\Program Files\Windows Journal\JNTFiltr.dll
    2014-07-09 17:04:12 936960 ----a-w- C:\Program Files (x86)\Common Files\Microsoft Shared\ink\journal.dll
    2014-07-09 17:04:12 1389568 ----a-w- C:\Program Files\Windows Journal\JNWDRV.dll
    2014-07-09 17:04:12 1354240 ----a-w- C:\Program Files\Common Files\Microsoft Shared\ink\journal.dll
    2014-07-09 17:01:20 1460736 ----a-w- C:\Windows\System32\lsasrv.dll
    2014-07-09 17:01:19 22016 ----a-w- C:\Windows\SysWow64\secur32.dll
    2014-07-09 17:01:18 96768 ----a-w- C:\Windows\SysWow64\sspicli.dll
    2014-07-09 15:27:51 -------- d-----w- C:\PeridexisErrant LNP r65
    .
    ==================== Find6M ====================
    .
    2014-07-25 14:02:12 2724864 ----a-w- C:\Windows\System32\mshtml.tlb
    2014-07-25 14:01:41 4096 ----a-w- C:\Windows\System32\ieetwcollectorres.dll
    2014-07-25 13:30:30 66048 ----a-w- C:\Windows\System32\iesetup.dll
    2014-07-25 13:28:35 48640 ----a-w- C:\Windows\System32\ieetwproxystub.dll
    2014-07-25 13:28:27 548352 ----a-w- C:\Windows\System32\vbscript.dll
    2014-07-25 13:25:45 83968 ----a-w- C:\Windows\System32\MshtmlDac.dll
    2014-07-25 13:04:40 2724864 ----a-w- C:\Windows\SysWow64\mshtml.tlb
    2014-07-25 13:00:51 139264 ----a-w- C:\Windows\System32\ieUnatt.exe
    2014-07-25 13:00:25 111616 ----a-w- C:\Windows\System32\ieetwcollector.exe
    2014-07-25 12:59:28 758272 ----a-w- C:\Windows\System32\jscript9diag.dll
    2014-07-25 12:47:25 940032 ----a-w- C:\Windows\System32\MsSpellCheckingFacility.exe
    2014-07-25 12:34:49 61952 ----a-w- C:\Windows\SysWow64\iesetup.dll
    2014-07-25 12:34:03 455168 ----a-w- C:\Windows\SysWow64\vbscript.dll
    2014-07-25 12:33:08 51200 ----a-w- C:\Windows\SysWow64\ieetwproxystub.dll
    2014-07-25 12:30:32 61952 ----a-w- C:\Windows\SysWow64\MshtmlDac.dll
    2014-07-25 12:28:15 5824512 ----a-w- C:\Windows\System32\jscript9.dll
    2014-07-25 12:28:05 72704 ----a-w- C:\Windows\System32\JavaScriptCollectionAgent.dll
    2014-07-25 12:10:15 112128 ----a-w- C:\Windows\SysWow64\ieUnatt.exe
    2014-07-25 12:08:47 597504 ----a-w- C:\Windows\SysWow64\jscript9diag.dll
    2014-07-25 12:06:47 4204032 ----a-w- C:\Windows\SysWow64\jscript9.dll
    2014-07-25 11:43:16 60416 ----a-w- C:\Windows\SysWow64\JavaScriptCollectionAgent.dll
    2014-07-25 11:39:29 2087936 ----a-w- C:\Windows\System32\inetcpl.cpl
    2014-07-25 11:39:25 1249280 ----a-w- C:\Windows\System32\mshtmlmedia.dll
    2014-07-25 11:07:49 2001920 ----a-w- C:\Windows\SysWow64\inetcpl.cpl
    2014-07-25 11:07:10 1068032 ----a-w- C:\Windows\SysWow64\mshtmlmedia.dll
    2014-07-25 10:52:06 2266624 ----a-w- C:\Windows\System32\wininet.dll
    2014-07-25 10:05:23 1792512 ----a-w- C:\Windows\SysWow64\wininet.dll
    2014-07-09 14:15:35 71344 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
    2014-07-09 14:15:35 699056 ----a-w- C:\Windows\SysWow64\FlashPlayerApp.exe
    2014-06-18 02:18:30 692736 ----a-w- C:\Windows\System32\osk.exe
    2014-06-18 01:51:32 646144 ----a-w- C:\Windows\SysWow64\osk.exe
    2014-06-16 02:10:19 985536 ----a-w- C:\Windows\System32\drivers\dxgkrnl.sys
    2014-06-06 10:10:34 624128 ----a-w- C:\Windows\System32\qedit.dll
    2014-06-06 09:44:17 509440 ----a-w- C:\Windows\SysWow64\qedit.dll
    2014-06-03 10:02:37 112064 ----a-w- C:\Windows\System32\consent.exe
    2014-06-03 10:02:21 504320 ----a-w- C:\Windows\System32\msihnd.dll
    2014-06-03 10:02:21 3241984 ----a-w- C:\Windows\System32\msi.dll
    2014-06-03 10:02:12 1941504 ----a-w- C:\Windows\System32\authui.dll
    2014-06-03 09:29:50 337408 ----a-w- C:\Windows\SysWow64\msihnd.dll
    2014-06-03 09:29:50 2363392 ----a-w- C:\Windows\SysWow64\msi.dll
    2014-06-03 09:29:40 1805824 ----a-w- C:\Windows\SysWow64\authui.dll
    2014-05-30 08:08:52 210944 ----a-w- C:\Windows\System32\wdigest.dll
    2014-05-30 08:08:49 86528 ----a-w- C:\Windows\System32\TSpkg.dll
    2014-05-30 08:08:47 340992 ----a-w- C:\Windows\System32\schannel.dll
    2014-05-30 08:08:41 314880 ----a-w- C:\Windows\System32\msv1_0.dll
    2014-05-30 08:08:41 307200 ----a-w- C:\Windows\System32\ncrypt.dll
    2014-05-30 08:08:36 728064 ----a-w- C:\Windows\System32\kerberos.dll
    2014-05-30 08:08:31 22016 ----a-w- C:\Windows\System32\credssp.dll
    2014-05-30 07:52:51 172032 ----a-w- C:\Windows\SysWow64\wdigest.dll
    2014-05-30 07:52:49 65536 ----a-w- C:\Windows\SysWow64\TSpkg.dll
    2014-05-30 07:52:45 247808 ----a-w- C:\Windows\SysWow64\schannel.dll
    2014-05-30 07:52:41 220160 ----a-w- C:\Windows\SysWow64\ncrypt.dll
    2014-05-30 07:52:40 259584 ----a-w- C:\Windows\SysWow64\msv1_0.dll
    2014-05-30 07:52:36 550912 ----a-w- C:\Windows\SysWow64\kerberos.dll
    2014-05-30 07:52:30 17408 ----a-w- C:\Windows\SysWow64\credssp.dll
    2014-05-29 05:32:14 80384 ----a-w- C:\Windows\System32\RazerCoinstaller.dll
    2014-05-19 06:47:28 155816 ----a-w- C:\Windows\System32\drivers\rzudd.sys
    2014-05-19 06:26:50 89088 ----a-w- C:\Windows\SysWow64\rzdevinfo.dll
    2014-05-14 16:21:04 2620928 ----a-w- C:\Windows\System32\wucltux.dll
    2014-05-14 16:20:45 97792 ----a-w- C:\Windows\System32\wudriver.dll
    2014-05-14 16:17:10 92672 ----a-w- C:\Windows\SysWow64\wudriver.dll
    2014-05-14 07:23:04 198600 ----a-w- C:\Windows\System32\wuwebv.dll
    2014-05-14 07:23:04 179656 ----a-w- C:\Windows\SysWow64\wuwebv.dll
    2014-05-14 07:20:46 36864 ----a-w- C:\Windows\System32\wuapp.exe
    2014-05-14 07:17:14 33792 ----a-w- C:\Windows\SysWow64\wuapp.exe
    2014-05-12 04:25:56 25816 ----a-w- C:\Windows\System32\drivers\mbam.sys
    2014-05-09 06:14:03 477184 ----a-w- C:\Windows\System32\aepdu.dll
    2014-05-09 06:11:23 424448 ----a-w- C:\Windows\System32\aeinv.dll
    2014-05-08 09:32:11 3178496 ----a-w- C:\Windows\System32\rdpcorets.dll
    2014-05-08 09:32:11 16384 ----a-w- C:\Windows\System32\RdpGroupPolicyExtension.dll
    2014-04-25 02:34:59 801280 ----a-w- C:\Windows\System32\usp10.dll
    2014-04-25 02:06:17 626688 ----a-w- C:\Windows\SysWow64\usp10.dll
    2014-04-12 02:22:05 95680 ----a-w- C:\Windows\System32\drivers\ksecdd.sys
    2014-04-12 02:22:05 155072 ----a-w- C:\Windows\System32\drivers\ksecpkg.sys
    2014-04-12 02:19:38 29184 ----a-w- C:\Windows\System32\sspisrv.dll
    2014-04-12 02:19:38 136192 ----a-w- C:\Windows\System32\sspicli.dll
    2014-04-12 02:19:37 28160 ----a-w- C:\Windows\System32\secur32.dll
    2014-04-12 02:19:05 31232 ----a-w- C:\Windows\System32\lsass.exe
    2014-04-05 02:47:20 1903552 ----a-w- C:\Windows\System32\drivers\tcpip.sys
    2014-04-05 02:47:09 288192 ----a-w- C:\Windows\System32\drivers\FWPKCLNT.SYS
    2014-03-31 20:46:48 130712 ----a-w- C:\Windows\SysWow64\MSSTDFMT.DLL
    2014-03-26 14:44:48 2002432 ----a-w- C:\Windows\System32\msxml6.dll
    2014-03-26 14:44:48 1882112 ----a-w- C:\Windows\System32\msxml3.dll
    2014-03-26 14:41:39 2048 ----a-w- C:\Windows\System32\msxml6r.dll
    2014-03-26 14:41:39 2048 ----a-w- C:\Windows\System32\msxml3r.dll
    2014-03-26 14:27:50 1389056 ----a-w- C:\Windows\SysWow64\msxml6.dll
    2014-03-26 14:27:50 1237504 ----a-w- C:\Windows\SysWow64\msxml3.dll
    2014-03-26 14:25:14 2048 ----a-w- C:\Windows\SysWow64\msxml6r.dll
    2014-03-26 14:25:14 2048 ----a-w- C:\Windows\SysWow64\msxml3r.dll
    2014-03-11 06:52:30 133928 ----a-w- C:\Windows\System32\drivers\NisDrvWFP.sys
    .
    ============= FINISH: 22:25:09.55 ===============
     
  6. Ryansee

    Ryansee TS Rookie Topic Starter Posts: 19

    Malwarebyte log 1:

    Malwarebytes Anti-Malware
    www.malwarebytes.org

    Scan Date: 9/2/2014
    Scan Time: 8:57:37 PM
    Logfile: Log 1.txt
    Administrator: Yes

    Version: 2.00.2.1012
    Malware Database: v2014.09.02.04
    Rootkit Database: v2014.08.21.01
    License: Free
    Malware Protection: Disabled
    Malicious Website Protection: Disabled
    Self-protection: Disabled

    OS: Windows 7 Service Pack 1
    CPU: x64
    File System: NTFS
    User: Ahmed

    Scan Type: Threat Scan
    Result: Completed
    Objects Scanned: 367099
    Time Elapsed: 16 min, 14 sec

    Memory: Enabled
    Startup: Enabled
    Filesystem: Enabled
    Archives: Enabled
    Rootkits: Enabled
    Heuristics: Enabled
    PUP: Warn
    PUM: Enabled

    Processes: 0
    (No malicious items detected)

    Modules: 0
    (No malicious items detected)

    Registry Keys: 0
    (No malicious items detected)

    Registry Values: 0
    (No malicious items detected)

    Registry Data: 0
    (No malicious items detected)

    Folders: 0
    (No malicious items detected)

    Files: 5
    PUP.Optional.OutBrowse, C:\Users\Ahmed\Desktop\Week 1\setup (1).exe, Quarantined, [efaaf9d0aecd2214d210c7e41ae759a7],
    PUP.Optional.OutBrowse, C:\Users\Ahmed\Desktop\Week 1\setup.exe, Quarantined, [2d6ca9206e0d58de0dd59d0e1ce5d42c],
    PUP.Optional.OpenCandy, C:\Users\Ahmed\Desktop\Week 1\SetupImgBurn_2.5.8.0.exe, Quarantined, [1b7ea920f883ce684c152ae4bb4aa25e],
    PUP.Optional.Superfish.A, C:\Users\Ahmed\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_www.superfish.com_0.localstorage, Quarantined, [8c0db415d5a64fe75336cb3c73900af6],
    PUP.Optional.Superfish.A, C:\Users\Ahmed\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_www.superfish.com_0.localstorage-journal, Quarantined, [0099f0d9304b0432345557b032d1619f],

    Physical Sectors: 0
    (No malicious items detected)


    (end)
     
  7. Ryansee

    Ryansee TS Rookie Topic Starter Posts: 19

    MBAM log 2:

    Malwarebytes Anti-Malware
    www.malwarebytes.org

    Scan Date: 9/2/2014
    Scan Time: 3:22:42 PM
    Logfile: log 2.txt
    Administrator: Yes

    Version: 2.00.2.1012
    Malware Database: v2014.09.02.04
    Rootkit Database: v2014.08.21.01
    License: Free
    Malware Protection: Disabled
    Malicious Website Protection: Disabled
    Self-protection: Disabled

    OS: Windows 7 Service Pack 1
    CPU: x64
    File System: NTFS
    User: Ahmed

    Scan Type: Threat Scan
    Result: Completed
    Objects Scanned: 366273
    Time Elapsed: 50 min, 38 sec

    Memory: Enabled
    Startup: Enabled
    Filesystem: Enabled
    Archives: Enabled
    Rootkits: Disabled
    Heuristics: Enabled
    PUP: Warn
    PUM: Enabled

    Processes: 2
    PUP.Optional.GeForce.A, C:\Program Files (x86)\Ge-Force\d4809700-4200-4dc7-964d-8305d49a89fc-6.exe, 2344, Delete-on-Reboot, [c814b731a4d7ef475fff158c778a7f81]
    PUP.Optional.Sense.A, C:\Program Files (x86)\Sense\c0bc3bff-370e-4b36-b76a-4bd2c9c5e6ec-6.exe, 2640, Delete-on-Reboot, [00dceafeec8fca6c54334e0abe437f81]

    Modules: 2
    PUP.Optional.Sense.A, C:\Program Files (x86)\Sense\ceda7ba7-8761-445a-aecc-28ac6e68466f.dll, Delete-on-Reboot, [e2fa39aff685f0466fba0e0efb08639d],
    PUP.Optional.GeForce.A, C:\Program Files (x86)\Ge-Force\11ad77be-193b-4112-996e-9a01659ee7f7.dll, Delete-on-Reboot, [77651eca2853c96dbd075b847e84e31d],

    Registry Keys: 110
    PUP.Optional.Sense.A, HKLM\SOFTWARE\CLASSES\CLSID\{11111111-1111-1111-1111-110611191115}, Quarantined, [bc209c4c413a90a65532aaae3bc6a35d],
    PUP.Optional.Sense.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{11111111-1111-1111-1111-110611191115}, Quarantined, [bc209c4c413a90a65532aaae3bc6a35d],
    PUP.Optional.Sense.A, HKLM\SOFTWARE\CLASSES\TYPELIB\{44444444-4444-4444-4444-440644194415}, Quarantined, [bc209c4c413a90a65532aaae3bc6a35d],
    PUP.Optional.Sense.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{55555555-5555-5555-5555-550655195515}, Quarantined, [bc209c4c413a90a65532aaae3bc6a35d],
    PUP.Optional.Sense.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{66666666-6666-6666-6666-660666196615}, Quarantined, [bc209c4c413a90a65532aaae3bc6a35d],
    PUP.Optional.Sense.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{55555555-5555-5555-5555-550655195515}, Quarantined, [bc209c4c413a90a65532aaae3bc6a35d],
    PUP.Optional.Sense.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{66666666-6666-6666-6666-660666196615}, Quarantined, [bc209c4c413a90a65532aaae3bc6a35d],
    PUP.Optional.Sense.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\TYPELIB\{44444444-4444-4444-4444-440644194415}, Quarantined, [bc209c4c413a90a65532aaae3bc6a35d],
    PUP.Optional.Sense.A, HKLM\SOFTWARE\CLASSES\CrossriderApp0061915.BHO.1, Quarantined, [bc209c4c413a90a65532aaae3bc6a35d],
    PUP.Optional.Sense.A, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{11111111-1111-1111-1111-110611191115}, Quarantined, [bc209c4c413a90a65532aaae3bc6a35d],
    PUP.Optional.Sense.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{11111111-1111-1111-1111-110611191115}, Quarantined, [bc209c4c413a90a65532aaae3bc6a35d],
    PUP.Optional.Sense.A, HKLM\SOFTWARE\CLASSES\CrossriderApp0061915.BHO, Quarantined, [bc209c4c413a90a65532aaae3bc6a35d],
    PUP.Optional.Sense.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CrossriderApp0061915.BHO, Quarantined, [bc209c4c413a90a65532aaae3bc6a35d],
    PUP.Optional.Sense.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CrossriderApp0061915.BHO.1, Quarantined, [bc209c4c413a90a65532aaae3bc6a35d],
    PUP.Optional.Sense.A, HKU\S-1-5-21-4037467554-2527304460-3365707105-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{11111111-1111-1111-1111-110611191115}, Quarantined, [bc209c4c413a90a65532aaae3bc6a35d],
    PUP.Optional.Sense.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{22222222-2222-2222-2222-220622192215}, Quarantined, [bc209c4c413a90a65532aaae3bc6a35d],
    PUP.Optional.Sense.A, HKLM\SOFTWARE\CLASSES\CrossriderApp0061915.Sandbox.1, Quarantined, [bc209c4c413a90a65532aaae3bc6a35d],
    PUP.Optional.Sense.A, HKLM\SOFTWARE\CLASSES\CrossriderApp0061915.Sandbox, Quarantined, [bc209c4c413a90a65532aaae3bc6a35d],
    PUP.Optional.Sense.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CrossriderApp0061915.Sandbox, Quarantined, [bc209c4c413a90a65532aaae3bc6a35d],
    PUP.Optional.Sense.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CrossriderApp0061915.Sandbox.1, Quarantined, [bc209c4c413a90a65532aaae3bc6a35d],
    PUP.Optional.Sense.A, HKLM\SOFTWARE\CLASSES\CLSID\{22222222-2222-2222-2222-220622192215}, Quarantined, [bc209c4c413a90a65532aaae3bc6a35d],
    PUP.Optional.Sense.A, HKLM\SOFTWARE\CLASSES\CLSID\{11111111-1111-1111-1111-110611191115}\INPROCSERVER32, Quarantined, [bc209c4c413a90a65532aaae3bc6a35d],
    PUP.Optional.GeForce.A, HKLM\SOFTWARE\CLASSES\CLSID\{11111111-1111-1111-1111-110611191111}, Quarantined, [53890bdd463500368bd3544d8f727e82],
    PUP.Optional.GeForce.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{11111111-1111-1111-1111-110611191111}, Quarantined, [53890bdd463500368bd3544d8f727e82],
    PUP.Optional.GeForce.A, HKLM\SOFTWARE\CLASSES\TYPELIB\{44444444-4444-4444-4444-440644194411}, Quarantined, [53890bdd463500368bd3544d8f727e82],
    PUP.Optional.GeForce.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{55555555-5555-5555-5555-550655195511}, Quarantined, [53890bdd463500368bd3544d8f727e82],
    PUP.Optional.GeForce.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{66666666-6666-6666-6666-660666196611}, Quarantined, [53890bdd463500368bd3544d8f727e82],
    PUP.Optional.GeForce.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{55555555-5555-5555-5555-550655195511}, Quarantined, [53890bdd463500368bd3544d8f727e82],
    PUP.Optional.GeForce.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{66666666-6666-6666-6666-660666196611}, Quarantined, [53890bdd463500368bd3544d8f727e82],
    PUP.Optional.GeForce.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\TYPELIB\{44444444-4444-4444-4444-440644194411}, Quarantined, [53890bdd463500368bd3544d8f727e82],
    PUP.Optional.GeForce.A, HKLM\SOFTWARE\CLASSES\CrossriderApp0061911.BHO.1, Quarantined, [53890bdd463500368bd3544d8f727e82],
    PUP.Optional.GeForce.A, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{11111111-1111-1111-1111-110611191111}, Quarantined, [53890bdd463500368bd3544d8f727e82],
    PUP.Optional.GeForce.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{11111111-1111-1111-1111-110611191111}, Quarantined, [53890bdd463500368bd3544d8f727e82],
    PUP.Optional.GeForce.A, HKLM\SOFTWARE\CLASSES\CrossriderApp0061911.BHO, Quarantined, [53890bdd463500368bd3544d8f727e82],
    PUP.Optional.GeForce.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CrossriderApp0061911.BHO, Quarantined, [53890bdd463500368bd3544d8f727e82],
    PUP.Optional.GeForce.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CrossriderApp0061911.BHO.1, Quarantined, [53890bdd463500368bd3544d8f727e82],
    PUP.Optional.GeForce.A, HKU\S-1-5-21-4037467554-2527304460-3365707105-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{11111111-1111-1111-1111-110611191111}, Quarantined, [53890bdd463500368bd3544d8f727e82],
    PUP.Optional.GeForce.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{22222222-2222-2222-2222-220622192211}, Quarantined, [53890bdd463500368bd3544d8f727e82],
    PUP.Optional.GeForce.A, HKLM\SOFTWARE\CLASSES\CrossriderApp0061911.Sandbox.1, Quarantined, [53890bdd463500368bd3544d8f727e82],
    PUP.Optional.GeForce.A, HKLM\SOFTWARE\CLASSES\CrossriderApp0061911.Sandbox, Quarantined, [53890bdd463500368bd3544d8f727e82],
    PUP.Optional.GeForce.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CrossriderApp0061911.Sandbox, Quarantined, [53890bdd463500368bd3544d8f727e82],
    PUP.Optional.GeForce.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CrossriderApp0061911.Sandbox.1, Quarantined, [53890bdd463500368bd3544d8f727e82],
    PUP.Optional.GeForce.A, HKLM\SOFTWARE\CLASSES\CLSID\{22222222-2222-2222-2222-220622192211}, Quarantined, [53890bdd463500368bd3544d8f727e82],
    PUP.Optional.GeForce.A, HKLM\SOFTWARE\CLASSES\CLSID\{11111111-1111-1111-1111-110611191111}\INPROCSERVER32, Quarantined, [53890bdd463500368bd3544d8f727e82],
    PUP.Optional.BrowseFox.A, HKLM\SOFTWARE\CLASSES\CLSID\{4AA46D49-459F-4358-B4D1-169048547C23}, Quarantined, [3e9e8662631840f6d3fa2e8334cebd43],
    PUP.Optional.Softonic.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{5018CFD2-804D-4C99-9F81-25EAEA2769DE}, Quarantined, [ebf107e1ec8fbf7797c37506887af60a],
    PUP.Optional.Softonic.A, HKU\S-1-5-21-4037467554-2527304460-3365707105-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{5018CFD2-804D-4C99-9F81-25EAEA2769DE}, Quarantined, [ebf107e1ec8fbf7797c37506887af60a],
    PUP.Optional.Softonic.A, HKU\S-1-5-21-4037467554-2527304460-3365707105-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{5018CFD2-804D-4C99-9F81-25EAEA2769DE}, Quarantined, [ebf107e1ec8fbf7797c37506887af60a],
    PUP.Optional.Outbrowse, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{6D4506CE-F855-4657-AA38-DB6B1F733982}, Quarantined, [24b8c3251e5d2c0a78b17b3a70928f71],
    PUP.Optional.Outbrowse, HKLM\SOFTWARE\CLASSES\TYPELIB\{03771AEF-400D-4A13-B712-25878EC4A3F5}, Quarantined, [24b8c3251e5d2c0a78b17b3a70928f71],
    PUP.Optional.Outbrowse, HKLM\SOFTWARE\CLASSES\INTERFACE\{3408AC0D-510E-4808-8F7B-6B70B1F88534}, Quarantined, [24b8c3251e5d2c0a78b17b3a70928f71],
    PUP.Optional.Outbrowse, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{3408AC0D-510E-4808-8F7B-6B70B1F88534}, Quarantined, [24b8c3251e5d2c0a78b17b3a70928f71],
    PUP.Optional.Outbrowse, HKLM\SOFTWARE\WOW6432NODE\CLASSES\TYPELIB\{03771AEF-400D-4A13-B712-25878EC4A3F5}, Quarantined, [24b8c3251e5d2c0a78b17b3a70928f71],
    PUP.Optional.Softonic.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{E87806B5-E908-45FD-AF5E-957D83E58E68}, Quarantined, [7468ac3ce29976c0e576afcc09f947b9],
    PUP.Optional.Softonic.A, HKU\S-1-5-21-4037467554-2527304460-3365707105-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{E87806B5-E908-45FD-AF5E-957D83E58E68}, Quarantined, [7468ac3ce29976c0e576afcc09f947b9],
    PUP.Optional.Softonic.A, HKU\S-1-5-21-4037467554-2527304460-3365707105-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{E87806B5-E908-45FD-AF5E-957D83E58E68}, Quarantined, [7468ac3ce29976c0e576afcc09f947b9],
    PUP.Optional.Multiplug, HKLM\SOFTWARE\CLASSES\TYPELIB\{157B1AA6-3E5C-404A-9118-C1D91F537040}, Quarantined, [657706e27ffcac8a2cf2e7904db513ed],
    PUP.Optional.Multiplug, HKLM\SOFTWARE\CLASSES\INTERFACE\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}, Quarantined, [657706e27ffcac8a2cf2e7904db513ed],
    PUP.Optional.Multiplug, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}, Quarantined, [657706e27ffcac8a2cf2e7904db513ed],
    PUP.Optional.Multiplug, HKLM\SOFTWARE\WOW6432NODE\CLASSES\TYPELIB\{157B1AA6-3E5C-404A-9118-C1D91F537040}, Quarantined, [657706e27ffcac8a2cf2e7904db513ed],
    PUP.Optional.Babylon.A, HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}, Quarantined, [d309e206ceadbc7a4fecbdbbae5451af],
    PUP.Optional.DaleSearch.A, HKLM\SOFTWARE\CLASSES\dalesearch.dalesearchdskBnd, Quarantined, [27b55593eb90979f74aa9023b44ee020],
    PUP.Optional.DaleSearch.A, HKLM\SOFTWARE\CLASSES\dalesearch.dalesearchdskBnd.1, Quarantined, [b329a048601bbe788b93e5ce47bb4bb5],
    PUP.Optional.DaleSearch.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\dalesearch.dalesearchdskBnd, Quarantined, [b329a048601bbe788b93e5ce47bb4bb5],
    PUP.Optional.DaleSearch.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\dalesearch.dalesearchdskBnd.1, Quarantined, [b329a048601bbe788b93e5ce47bb4bb5],
    PUP.Optional.DaleSearch.A, HKLM\SOFTWARE\CLASSES\dalesearch.dalesearchHlpr, Quarantined, [ab31e8003b406cca5ac5a60d15edb44c],
    PUP.Optional.DaleSearch.A, HKLM\SOFTWARE\CLASSES\dalesearch.dalesearchHlpr.1, Quarantined, [924ac22628536dc956c98e25da28ae52],
    PUP.Optional.DaleSearch.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\dalesearch.dalesearchHlpr, Quarantined, [924ac22628536dc956c98e25da28ae52],
    PUP.Optional.DaleSearch.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\dalesearch.dalesearchHlpr.1, Quarantined, [924ac22628536dc956c98e25da28ae52],
    PUP.Optional.Sense.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\Sense, Quarantined, [e2fa39aff685f0466fba0e0efb08639d],
    PUP.Optional.GeForce.A, HKLM\SOFTWARE\Ge-Force, Quarantined, [76664b9d6f0c01357a7d5bfb966e9f61],
    PUP.Optional.CrossRider.A, HKLM\SOFTWARE\INSTALLEDBROWSEREXTENSIONS\20891, Quarantined, [79639355e89370c6ce5ddc3710f3d030],
    PUP.Optional.CrossRider.A, HKLM\SOFTWARE\INSTALLEDBROWSEREXTENSIONS\21836, Quarantined, [93493dab23589d99e942de35649f6b95],
    PUP.Optional.GeForce.A, HKLM\SOFTWARE\WOW6432NODE\Ge-Force, Quarantined, [f5e738b0f982e056a453aaac659f55ab],
    PUP.Optional.GlobalUpdate.T, HKLM\SOFTWARE\WOW6432NODE\GLOBALUPDATE\UPDATE, Quarantined, [805ce305bbc0e551c8388b6dcb37b050],
    PUP.Optional.Spigot.A, HKLM\SOFTWARE\WOW6432NODE\GOOGLE\CHROME\EXTENSIONS\cflheckfmhopnialghigdlggahiomebp, Quarantined, [0cd06583f8834aec81539b6129d91fe1],
    PUP.Optional.LuckyLeap.A, HKLM\SOFTWARE\WOW6432NODE\GOOGLE\CHROME\EXTENSIONS\eiimolhnbbbdagljikeckdkldgemmmlj, Quarantined, [98440edad0abd3634fd6bb4042c0b749],
    PUP.Optional.Softonic.A, HKLM\SOFTWARE\WOW6432NODE\GOOGLE\CHROME\EXTENSIONS\elchiiiejkobdbblfejjkbphbddgmljf, Quarantined, [8e4ecb1d9fdc072f426c5cb5ba498b75],
    PUP.Optional.CrossRider.A, HKLM\SOFTWARE\WOW6432NODE\INSTALLEDBROWSEREXTENSIONS\20891, Quarantined, [30ac6d7b95e6b284210a7b98946f5aa6],
    PUP.Optional.CrossRider.A, HKLM\SOFTWARE\WOW6432NODE\INSTALLEDBROWSEREXTENSIONS\21836, Quarantined, [518b07e1a4d7eb4b8c9fbb5838cb22de],
    PUP.Optional.GlobalUpdate.A, HKLM\SOFTWARE\WOW6432NODE\MOZILLAPLUGINS\@staging.google.com/globalUpdate Update;version=10, Quarantined, [7e5e6d7b7efdfc3a79a51a3f36ce8c74],
    PUP.Optional.GlobalUpdate.A, HKLM\SOFTWARE\WOW6432NODE\MOZILLAPLUGINS\@staging.google.com/globalUpdate Update;version=4, Quarantined, [02dad018611a5fd71906fd5c8381d42c],
    PUP.Optional.Sense.A, HKLM\SOFTWARE\WOW6432NODE\SENSE\IE, Quarantined, [e0fc6f79463592a459d2ff1d867dac54],
    PUP.Optional.CrossRider.A, HKLM\SOFTWARE\WOW6432NODE\SENSE, Quarantined, [03d93cacfe7d2a0cdd595faa50b3ac54],
    PUP.Optional.ObjectBrowser.A, HKLM\SOFTWARE\WOW6432NODE\SENSE\INSTALLER, Quarantined, [29b3f0f80b7068ce52c639db9c6750b0],
    PUP.Optional.CrossRider.A, HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\Crossrider, Quarantined, [4c901ccc0774b581b671103a9a6a629e],
    PUP.Optional.GeForce.A, HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\Ge-Force, Quarantined, [9c405692d7a488ae17e2e0760103718f],
    PUP.Optional.CrossRider.A, HKU\S-1-5-21-4037467554-2527304460-3365707105-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\Crossrider, Quarantined, [9f3d16d2136855e19295ea601be9f907],
    PUP.Optional.GeForce.A, HKU\S-1-5-21-4037467554-2527304460-3365707105-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\Ge-Force, Quarantined, [a537e20696e541f5ce2b183e5aaa9c64],
    PUP.Optional.CrossRider.A, HKU\S-1-5-21-4037467554-2527304460-3365707105-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\INSTALLEDBROWSEREXTENSIONS\20891, Quarantined, [0ad2d513de9dda5cd75118daf111f60a],
    PUP.Optional.CrossRider.A, HKU\S-1-5-21-4037467554-2527304460-3365707105-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\INSTALLEDBROWSEREXTENSIONS\21836, Quarantined, [3f9d9355c8b3989e40e8a9495ba7d62a],
    PUP.Optional.iWebar.A, HKU\S-1-5-21-4037467554-2527304460-3365707105-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\INSTALLEDBROWSEREXTENSIONS\iWebar, Quarantined, [cc1055931d5e8da988d459c36a9927d9],
    PUP.Optional.CrossRider.A, HKU\S-1-5-21-4037467554-2527304460-3365707105-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\INSTALLEDBROWSEREXTENSIONS\Object Browser, Quarantined, [b626b7317a01d46220e7a2a9ef157e82],
    PUP.Optional.GlobalUpdate.T, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\globalUpdate, Quarantined, [fbe187614a314aec44d74e916c966997],
    PUP.Optional.GlobalUpdate.T, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\globalUpdatem, Quarantined, [fbe187614a314aec44d74e916c966997],
    PUP.Optional.GlobalUpdate.T, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\GOOGLEUPDATE.EXE, Quarantined, [fbe187614a314aec44d74e916c966997],
    PUP.Optional.GlobalUpdate.T, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\GOOGLEUPDATE.EXE, Quarantined, [fbe187614a314aec44d74e916c966997],
    PUP.Optional.GlobalUpdate.T, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{5645E0E7-FC12-43BF-A6E4-F9751942B298}, Quarantined, [fbe187614a314aec44d74e916c966997],
    PUP.Optional.GlobalUpdate.T, HKLM\SOFTWARE\CLASSES\globalUpdate.OneClickCtrl.10, Quarantined, [fbe187614a314aec44d74e916c966997],
    PUP.Optional.GlobalUpdate.T, HKLM\SOFTWARE\WOW6432NODE\CLASSES\globalUpdate.OneClickCtrl.10, Quarantined, [fbe187614a314aec44d74e916c966997],
    PUP.Optional.GlobalUpdate.T, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{5645E0E7-FC12-43BF-A6E4-F9751942B298}, Quarantined, [fbe187614a314aec44d74e916c966997],
    PUP.Optional.GlobalUpdate.T, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\PREAPPROVED\{5645E0E7-FC12-43BF-A6E4-F9751942B298}, Quarantined, [fbe187614a314aec44d74e916c966997],
    PUP.Optional.GlobalUpdate.T, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{C7BF8F4B-7BC7-4F42-B944-3D28A3A86D8A}, Quarantined, [fbe187614a314aec44d74e916c966997],
    PUP.Optional.GlobalUpdate.T, HKLM\SOFTWARE\CLASSES\globalUpdate.Update3WebControl.4, Quarantined, [fbe187614a314aec44d74e916c966997],
    PUP.Optional.GlobalUpdate.T, HKLM\SOFTWARE\WOW6432NODE\CLASSES\globalUpdate.Update3WebControl.4, Quarantined, [fbe187614a314aec44d74e916c966997],
    PUP.Optional.GlobalUpdate.T, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{C7BF8F4B-7BC7-4F42-B944-3D28A3A86D8A}, Quarantined, [fbe187614a314aec44d74e916c966997],
    PUP.Optional.GlobalUpdate.T, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\PREAPPROVED\{C7BF8F4B-7BC7-4F42-B944-3D28A3A86D8A}, Quarantined, [fbe187614a314aec44d74e916c966997],
    PUP.Optional.GlobalUpdate.T, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{CFC47BB5-5FB5-4AD0-8427-6AA04334A3FC}, Quarantined, [fbe187614a314aec44d74e916c966997],
    PUP.Optional.GlobalUpdate.T, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{E0ADB535-D7B5-4D8B-B15D-578BDD20D76A}, Quarantined, [fbe187614a314aec44d74e916c966997],
    PUP.Optional.GeForce.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\Ge-Force, Quarantined, [77651eca2853c96dbd075b847e84e31d],

    Registry Values: 4
    PUP.Optional.GlobalUpdate.T, HKLM\SOFTWARE\WOW6432NODE\GLOBALUPDATE\UPDATE|path, C:\Program Files (x86)\globalUpdate\Update\GoogleUpdate.exe, Quarantined, [805ce305bbc0e551c8388b6dcb37b050]
    PUP.Optional.CrossRider.A, HKLM\SOFTWARE\WOW6432NODE\SENSE|ActiveAppId, 61915, Quarantined, [03d93cacfe7d2a0cdd595faa50b3ac54]
    PUP.Optional.ObjectBrowser.A, HKLM\SOFTWARE\WOW6432NODE\SENSE\INSTALLER|BundledIe, 1, Quarantined, [29b3f0f80b7068ce52c639db9c6750b0]
    PUP.Optional.ConduitSearchProtect, HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|SearchProtect, \SearchProtect\bin\cltmng.exe, Quarantined, [f9e3c127ceadd95ddeff43ef0301d927]

    Registry Data: 1
    PUP.Optional.Qone8, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES|DefaultScope, {33BB0A4E-99AF-4226-BDF6-49120163DE86}, Good: ({0633EE93-D776-472f-A0FF-E1416B8B2E3A}), Bad: ({33BB0A4E-99AF-4226-BDF6-49120163DE86}),Replaced,[3aa21dcb5f1c81b59f79e504af55c838]

    Folders: 34
    PUP.Optional.Sense.A, C:\Program Files (x86)\Sense, Delete-on-Reboot, [e2fa39aff685f0466fba0e0efb08639d],
    PUP.Optional.OpenCandy, C:\Users\Ahmed\AppData\Roaming\OpenCandy, Quarantined, [f3e9cc1c4239ca6c7890bb0a6a98659b],
    PUP.Optional.OpenCandy, C:\Users\Ahmed\AppData\Roaming\OpenCandy\6519755221624733852190E9A68E2680, Quarantined, [f3e9cc1c4239ca6c7890bb0a6a98659b],
    PUP.Optional.OpenCandy, C:\Users\Ahmed\AppData\Roaming\OpenCandy\CA6E4234FDB448899DC3F6273EEBADB9, Quarantined, [f3e9cc1c4239ca6c7890bb0a6a98659b],
    PUP.Optional.GlobalUpdate.T, C:\Program Files (x86)\globalUpdate\Update, Quarantined, [fbe187614a314aec44d74e916c966997],
    PUP.Optional.GlobalUpdate.T, C:\Program Files (x86)\globalUpdate\Update\1.3.25.0, Quarantined, [fbe187614a314aec44d74e916c966997],
    PUP.Optional.GlobalUpdate.T, C:\Program Files (x86)\globalUpdate\Update\Download, Quarantined, [fbe187614a314aec44d74e916c966997],
    PUP.Optional.GlobalUpdate.T, C:\Program Files (x86)\globalUpdate\Update\Install, Quarantined, [fbe187614a314aec44d74e916c966997],
    PUP.Optional.GlobalUpdate.T, C:\Program Files (x86)\globalUpdate\Update\Offline, Quarantined, [fbe187614a314aec44d74e916c966997],
    PUP.Optional.GlobalUpdate.T, C:\Program Files (x86)\globalUpdate\Update\Offline\{C5F72330-F5A3-42EC-814C-52CC8D2C581C}, Quarantined, [fbe187614a314aec44d74e916c966997],
    PUP.Optional.GeForce.A, C:\Program Files (x86)\Ge-Force, Delete-on-Reboot, [77651eca2853c96dbd075b847e84e31d],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\chrome, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\chrome\content, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\chrome\content\core, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\defaults, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\defaults\preferences, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\extensionData, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\extensionData\plugins, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\extensionData\userCode, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\locale, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\locale\en-US, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\chrome, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\chrome\content, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\chrome\content\api, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\chrome\content\core, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\defaults, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\defaults\preferences, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\extensionData, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\extensionData\plugins, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\extensionData\userCode, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\locale, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\locale\en-US, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],

    Files: 293
    PUP.Optional.GeForce.A, C:\Program Files (x86)\Ge-Force\d4809700-4200-4dc7-964d-8305d49a89fc-6.exe, Delete-on-Reboot, [c814b731a4d7ef475fff158c778a7f81],
    PUP.Optional.Sense.A, C:\Program Files (x86)\Sense\c0bc3bff-370e-4b36-b76a-4bd2c9c5e6ec-6.exe, Delete-on-Reboot, [00dceafeec8fca6c54334e0abe437f81],
    PUP.Optional.Sense.A, C:\Program Files (x86)\Sense\Sense-bho64.dll, Quarantined, [bc209c4c413a90a65532aaae3bc6a35d],
    PUP.Optional.Sense.A, C:\Program Files (x86)\Sense\Sense-bho.dll, Quarantined, [bc209c4c413a90a65532aaae3bc6a35d],
    PUP.Optional.GeForce.A, C:\Program Files (x86)\Ge-Force\Ge-Force-bho64.dll, Quarantined, [53890bdd463500368bd3544d8f727e82],
    PUP.Optional.GeForce.A, C:\Program Files (x86)\Ge-Force\Ge-Force-bho.dll, Quarantined, [53890bdd463500368bd3544d8f727e82],
    PUP.Optional.Multiplug, C:\Users\Ahmed\Desktop\Week 1\Downloader_for_GameShark Version 5.0.exe, Quarantined, [657706e27ffcac8a2cf2e7904db513ed],
    PUP.Optional.InstallCore.A, C:\Users\Ahmed\Downloads\VisualBoyAdvance_Setup.exe, Quarantined, [e5f7cf1986f5f343365e9519ba4a55ab],
    PUP.Optional.CodecPerformer.A, C:\Users\Ahmed\Downloads\CodecPerformerSetup.exe, Quarantined, [4f8d8860205b6cca22ca641614ed8a76],
    PUP.Optional.InstallCore, C:\Users\Ahmed\Downloads\CR_Downloader_voor_pokemon-firered.exe, Quarantined, [0fcdf6f21c5f2214d2e6bfeece36c33d],
    PUP.Optional.InstallCore, C:\Users\Ahmed\Downloads\CR_Downloader_voor_pokemon-gold.exe, Quarantined, [4399fbed423951e560585c5127ddf907],
    PUP.Optional.InstallCore, C:\Users\Ahmed\Downloads\CR_Downloader_voor_pokemon-yellow.exe, Quarantined, [706c895fd4a7f4424177129b05ff59a7],
    PUP.Optional.Softonic.A, C:\Users\Ahmed\Downloads\SoftonicDownloader_for_mkv-player.exe, Quarantined, [dffd697f6714b086662bbe6fd03144bc],
    PUP.Optional.WorldSetup, C:\Users\Ahmed\Downloads\CR_Downloader_voor_tgb-dual (1).exe, Quarantined, [637924c498e39c9a761130812dd73dc3],
    PUP.Optional.OpenCandy, C:\Users\Ahmed\Downloads\MediaInfo_GUI_0.7.8_Windows_i386.exe, Quarantined, [be1e6088592281b56ef3e32b1fe6bd43],
    PUP.Optional.Amonetize, C:\Users\Ahmed\Downloads\TVapp__8821_i846768588_il485160.exe, Quarantined, [30acc91faecd0135ae7b2e7d26dbd729],
    PUP.Optional.OutBrowse, C:\Users\Ahmed\Downloads\install-flashplayer (1).exe, Quarantined, [9e3ee30569122b0b4f09a2fb9071c739],
    PUP.Optional.OutBrowse, C:\Users\Ahmed\Downloads\install-flashplayer.exe, Quarantined, [03d97b6d740763d3f167a0fd08f942be],
    PUP.Optional.WorldSetup, C:\Users\Ahmed\Downloads\CR_Downloader_voor_tgb-dual.exe, Quarantined, [677524c42c4f49ed5037bcf51aeaa25e],
    PUP.Optional.InstallCore, C:\Users\Ahmed\Downloads\FirefoxSetup.exe, Quarantined, [cd0f86626813bc7ac4e1923618ec4eb2],
    PUP.Optional.CrossRider.T, C:\Windows\System32\Tasks\c0bc3bff-370e-4b36-b76a-4bd2c9c5e6ec-1, Quarantined, [4e8edb0d304bd165fdfef5026a98c63a],
    PUP.Optional.CrossRider.T, C:\Windows\System32\Tasks\c0bc3bff-370e-4b36-b76a-4bd2c9c5e6ec-11, Quarantined, [21bbe4042f4cc96dc8336592cc36fa06],
    PUP.Optional.CrossRider.T, C:\Windows\System32\Tasks\c0bc3bff-370e-4b36-b76a-4bd2c9c5e6ec-2, Quarantined, [99430ade8af135013cbf35c258aaff01],
    PUP.Optional.CrossRider.T, C:\Windows\System32\Tasks\c0bc3bff-370e-4b36-b76a-4bd2c9c5e6ec-3, Quarantined, [6676e107235812243bc08c6b62a0a25e],
    PUP.Optional.CrossRider.T, C:\Windows\System32\Tasks\c0bc3bff-370e-4b36-b76a-4bd2c9c5e6ec-4, Quarantined, [aa3276726417cf67659622d51de5916f],
    PUP.Optional.CrossRider.T, C:\Windows\System32\Tasks\c0bc3bff-370e-4b36-b76a-4bd2c9c5e6ec-5, Quarantined, [ddfff7f1b8c376c088737285d032ee12],
    PUP.Optional.CrossRider.T, C:\Windows\System32\Tasks\c0bc3bff-370e-4b36-b76a-4bd2c9c5e6ec-5_user, Quarantined, [09d305e389f23cfa9a614ea99e648f71],
    PUP.Optional.CrossRider.T, C:\Windows\System32\Tasks\c0bc3bff-370e-4b36-b76a-4bd2c9c5e6ec-6, Quarantined, [e1fb18d04d2e81b5d427df183fc354ac],
    PUP.Optional.CrossRider.T, C:\Windows\System32\Tasks\c0bc3bff-370e-4b36-b76a-4bd2c9c5e6ec-7, Quarantined, [29b3c8206b10b0862fcc20d7729028d8],
    PUP.Optional.CrossRider.T, C:\Windows\System32\Tasks\d4809700-4200-4dc7-964d-8305d49a89fc-1, Quarantined, [9745b23634475bdb12e956a1e919926e],
    PUP.Optional.CrossRider.T, C:\Windows\System32\Tasks\d4809700-4200-4dc7-964d-8305d49a89fc-11, Quarantined, [5785499f5f1cc670b843f304ae54847c],
    PUP.Optional.CrossRider.T, C:\Windows\System32\Tasks\d4809700-4200-4dc7-964d-8305d49a89fc-2, Quarantined, [fae24e9a85f61a1c40bb10e79e646b95],
    PUP.Optional.CrossRider.T, C:\Windows\System32\Tasks\d4809700-4200-4dc7-964d-8305d49a89fc-4, Quarantined, [4e8e24c49ae1c96db14a8b6cfe0419e7],
    PUP.Optional.CrossRider.T, C:\Windows\System32\Tasks\d4809700-4200-4dc7-964d-8305d49a89fc-5, Quarantined, [9b418e5acfac2c0ae11af8fff012d030],
    PUP.Optional.CrossRider.T, C:\Windows\System32\Tasks\d4809700-4200-4dc7-964d-8305d49a89fc-5_user, Quarantined, [45975296aecdaf87ab50de19f012827e],
    PUP.Optional.CrossRider.T, C:\Windows\System32\Tasks\d4809700-4200-4dc7-964d-8305d49a89fc-6, Quarantined, [e5f70cdce6952e08f10a57a062a0de22],
    PUP.Optional.CrossRider.T, C:\Windows\System32\Tasks\d4809700-4200-4dc7-964d-8305d49a89fc-7, Quarantined, [5b8123c55f1c320415e6a05751b13dc3],
    PUP.Optional.Ciuvo.A, C:\Users\Ahmed\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_api.ciuvo.com_0.localstorage, Delete-on-Reboot, [2daf38b036452c0aeea10af69a69fc04],
    PUP.Optional.Ciuvo.A, C:\Users\Ahmed\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_api.ciuvo.com_0.localstorage-journal, Delete-on-Reboot, [5d7f28c0b6c55dd98e01847cbd46e21e],
    PUP.Optional.ShoppingGate.A, C:\Users\Ahmed\AppData\Local\Google\Chrome\User Data\Default\Local Storage\https_inst.shoppingate.info_0.localstorage, Delete-on-Reboot, [ffddc91f631835013ff313f47d86c13f],
    PUP.Optional.ShoppingGate.A, C:\Users\Ahmed\AppData\Local\Google\Chrome\User Data\Default\Local Storage\https_inst.shoppingate.info_0.localstorage-journal, Delete-on-Reboot, [5e7ec91fb5c6f0467ab8ba4dd82bf30d],
    PUP.Optional.Superfish.A, C:\Users\Ahmed\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_www.superfish.com_0.localstorage, Delete-on-Reboot, [5389e3051566ef47e6a3c93e17ec2ed2],
    PUP.Optional.Superfish.A, C:\Users\Ahmed\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_www.superfish.com_0.localstorage-journal, Quarantined, [4894ecfc7407bc7a2168a562a85b1fe1],
    PUP.Optional.Sense.A, C:\Program Files (x86)\Sense\background.html, Quarantined, [e2fa39aff685f0466fba0e0efb08639d],
    PUP.Optional.Sense.A, C:\Program Files (x86)\Sense\c0bc3bff-370e-4b36-b76a-4bd2c9c5e6ec.crx, Quarantined, [e2fa39aff685f0466fba0e0efb08639d],
    PUP.Optional.Sense.A, C:\Program Files (x86)\Sense\05b29b00-2a1d-4132-9331-1c62e2ec66b0.crx, Quarantined, [e2fa39aff685f0466fba0e0efb08639d],
    PUP.Optional.Sense.A, C:\Program Files (x86)\Sense\1293297481.mxaddon, Quarantined, [e2fa39aff685f0466fba0e0efb08639d],
    PUP.Optional.Sense.A, C:\Program Files (x86)\Sense\bgNova.html, Quarantined, [e2fa39aff685f0466fba0e0efb08639d],
    PUP.Optional.Sense.A, C:\Program Files (x86)\Sense\c0bc3bff-370e-4b36-b76a-4bd2c9c5e6ec-11.exe, Quarantined, [e2fa39aff685f0466fba0e0efb08639d],
    PUP.Optional.Sense.A, C:\Program Files (x86)\Sense\c0bc3bff-370e-4b36-b76a-4bd2c9c5e6ec-3.exe, Quarantined, [e2fa39aff685f0466fba0e0efb08639d],
    PUP.Optional.Sense.A, C:\Program Files (x86)\Sense\c0bc3bff-370e-4b36-b76a-4bd2c9c5e6ec-5.exe, Quarantined, [e2fa39aff685f0466fba0e0efb08639d],
    PUP.Optional.Sense.A, C:\Program Files (x86)\Sense\c0bc3bff-370e-4b36-b76a-4bd2c9c5e6ec-64.exe, Quarantined, [e2fa39aff685f0466fba0e0efb08639d],
    PUP.Optional.Sense.A, C:\Program Files (x86)\Sense\c0bc3bff-370e-4b36-b76a-4bd2c9c5e6ec-7.exe, Quarantined, [e2fa39aff685f0466fba0e0efb08639d],
    PUP.Optional.Sense.A, C:\Program Files (x86)\Sense\c0bc3bff-370e-4b36-b76a-4bd2c9c5e6ec.xpi, Quarantined, [e2fa39aff685f0466fba0e0efb08639d],
    PUP.Optional.Sense.A, C:\Program Files (x86)\Sense\c0bc3bff-370e-4b36-b76a-4bd2c9c5e6ec_.xpi, Quarantined, [e2fa39aff685f0466fba0e0efb08639d],
    PUP.Optional.Sense.A, C:\Program Files (x86)\Sense\ceda7ba7-8761-445a-aecc-28ac6e68466f.crx, Quarantined, [e2fa39aff685f0466fba0e0efb08639d],
    PUP.Optional.Sense.A, C:\Program Files (x86)\Sense\ceda7ba7-8761-445a-aecc-28ac6e68466f.dll, Delete-on-Reboot, [e2fa39aff685f0466fba0e0efb08639d],
    PUP.Optional.Sense.A, C:\Program Files (x86)\Sense\Sense-bg.exe, Quarantined, [e2fa39aff685f0466fba0e0efb08639d],
    PUP.Optional.Sense.A, C:\Program Files (x86)\Sense\Sense-buttonutil.dll, Quarantined, [e2fa39aff685f0466fba0e0efb08639d],
    PUP.Optional.Sense.A, C:\Program Files (x86)\Sense\Sense-buttonutil.exe, Quarantined, [e2fa39aff685f0466fba0e0efb08639d],
    PUP.Optional.Sense.A, C:\Program Files (x86)\Sense\Sense-buttonutil64.dll, Quarantined, [e2fa39aff685f0466fba0e0efb08639d],
    PUP.Optional.Sense.A, C:\Program Files (x86)\Sense\Sense-buttonutil64.exe, Quarantined, [e2fa39aff685f0466fba0e0efb08639d],
    PUP.Optional.Sense.A, C:\Program Files (x86)\Sense\Sense.ico, Quarantined, [e2fa39aff685f0466fba0e0efb08639d],
    PUP.Optional.Sense.A, C:\Program Files (x86)\Sense\Uninstall.exe, Quarantined, [e2fa39aff685f0466fba0e0efb08639d],
    PUP.Optional.Sense.A, C:\Program Files (x86)\Sense\utils.exe, Quarantined, [e2fa39aff685f0466fba0e0efb08639d],
    PUP.Optional.NewTab.A, C:\Users\Ahmed\AppData\Local\Google\Chrome\User Data\Default\Extensions\newtab.crx, Quarantined, [ebf15d8b067581b5e16a73a9f60d0ff1],
    PUP.Optional.CrossRider.T, C:\Windows\Tasks\c0bc3bff-370e-4b36-b76a-4bd2c9c5e6ec-1.job, Quarantined, [04d8c4247cffbf774f44b3a34eb6c937],
    PUP.Optional.CrossRider.T, C:\Windows\Tasks\c0bc3bff-370e-4b36-b76a-4bd2c9c5e6ec-11.job, Quarantined, [419b0fd944375adcff9479dd5ba99c64],
    PUP.Optional.CrossRider.T, C:\Windows\Tasks\c0bc3bff-370e-4b36-b76a-4bd2c9c5e6ec-2.job, Quarantined, [b12b7870176441f5118270e67292ef11],
    PUP.Optional.CrossRider.T, C:\Windows\Tasks\c0bc3bff-370e-4b36-b76a-4bd2c9c5e6ec-3.job, Quarantined, [904c46a2f9823402f49f4313a75de31d],
    PUP.Optional.CrossRider.T, C:\Windows\Tasks\c0bc3bff-370e-4b36-b76a-4bd2c9c5e6ec-4.job, Quarantined, [b02c5c8c295278beff94b3a304003ec2],
    PUP.Optional.CrossRider.T, C:\Windows\Tasks\c0bc3bff-370e-4b36-b76a-4bd2c9c5e6ec-5.job, Quarantined, [f5e7df09fe7d92a4662d282ed03414ec],
    PUP.Optional.CrossRider.T, C:\Windows\Tasks\c0bc3bff-370e-4b36-b76a-4bd2c9c5e6ec-5_user.job, Quarantined, [29b3a1472e4daa8c9cf78fc735cf1de3],
    PUP.Optional.CrossRider.T, C:\Windows\Tasks\c0bc3bff-370e-4b36-b76a-4bd2c9c5e6ec-6.job, Quarantined, [5d7f6187502b6bcb138072e459ab4cb4],
    PUP.Optional.CrossRider.T, C:\Windows\Tasks\c0bc3bff-370e-4b36-b76a-4bd2c9c5e6ec-7.job, Quarantined, [499333b593e8c571bfd490c615ef44bc],
    PUP.Optional.CrossRider.T, C:\Windows\Tasks\d4809700-4200-4dc7-964d-8305d49a89fc-1.job, Quarantined, [c71536b2b6c5cc6a870c8dc9ab59a25e],
    PUP.Optional.CrossRider.T, C:\Windows\Tasks\d4809700-4200-4dc7-964d-8305d49a89fc-11.job, Quarantined, [e9f3994f364504320c8701553cc8de22],
    PUP.Optional.CrossRider.T, C:\Windows\Tasks\d4809700-4200-4dc7-964d-8305d49a89fc-2.job, Quarantined, [419b02e63249ff37c4cf80d6e71ddc24],
    PUP.Optional.CrossRider.T, C:\Windows\Tasks\d4809700-4200-4dc7-964d-8305d49a89fc-4.job, Quarantined, [f3e92abe0477de58098a8acc768e25db],
    PUP.Optional.CrossRider.T, C:\Windows\Tasks\d4809700-4200-4dc7-964d-8305d49a89fc-5.job, Quarantined, [01db21c798e341f5850eb6a051b3c739],
    PUP.Optional.CrossRider.T, C:\Windows\Tasks\d4809700-4200-4dc7-964d-8305d49a89fc-5_user.job, Quarantined, [31ab8b5d166592a46a291a3c4bb9f50b],
    PUP.Optional.CrossRider.T, C:\Windows\Tasks\d4809700-4200-4dc7-964d-8305d49a89fc-6.job, Quarantined, [b12b3aae80fb9d99078cfe58b3511ce4],
    PUP.Optional.CrossRider.T, C:\Windows\Tasks\d4809700-4200-4dc7-964d-8305d49a89fc-7.job, Quarantined, [b02c9751f982e452d1c2a1b5ed174eb2],
    PUP.Optional.GlobalUpdate.A, C:\Windows\Tasks\globalUpdateUpdateTaskMachineCore.job, Quarantined, [22baa7415c1f5dd95851ff5733d139c7],
    PUP.Optional.GlobalUpdate.A, C:\Windows\System32\Tasks\globalUpdateUpdateTaskMachineCore, Quarantined, [b12bcc1c7704280e7337470ffb09eb15],
    PUP.Optional.GlobalUpdate.A, C:\Windows\Tasks\globalUpdateUpdateTaskMachineUA.job, Quarantined, [ba2241a7abd08da9a506421442c2f50b],
    PUP.Optional.GlobalUpdate.A, C:\Windows\System32\Tasks\globalUpdateUpdateTaskMachineUA, Quarantined, [f3e908e0adce270fb4f82c2a36ceb050],
    PUP.Optional.CrossRider.A, C:\Windows\Tasks\b5f954e2-1d92-461d-97fd-cd8b0ddbf7c3.job, Quarantined, [2dafe00881fad363c8546eeb1ee649b7],
    PUP.Optional.CrossRider.A, C:\Windows\System32\Tasks\060184C3-9766-46a0-B258-F4518A0B2633, Quarantined, [7468727690ebf24436e7ea6fd92bf709],
    PUP.Optional.CrossRider.A, C:\Windows\System32\Tasks\b5f954e2-1d92-461d-97fd-cd8b0ddbf7c3, Quarantined, [f4e80cdcfe7dc96d3fde1049d62efc04],
    PUP.Optional.OpenCandy, C:\Users\Ahmed\AppData\Roaming\OpenCandy\6519755221624733852190E9A68E2680\AVG-PC-TuneUp2014ROW-15-EN-p4v2.exe, Quarantined, [f3e9cc1c4239ca6c7890bb0a6a98659b],
    PUP.Optional.OpenCandy, C:\Users\Ahmed\AppData\Roaming\OpenCandy\CA6E4234FDB448899DC3F6273EEBADB9\chrometest3.html, Quarantined, [f3e9cc1c4239ca6c7890bb0a6a98659b],
    PUP.Optional.GlobalUpdate.T, C:\Program Files (x86)\globalUpdate\Update\GoogleUpdate.exe, Quarantined, [fbe187614a314aec44d74e916c966997],
    PUP.Optional.GlobalUpdate.T, C:\Program Files (x86)\globalUpdate\Update\1.3.25.0\GoogleCrashHandler.exe, Quarantined, [fbe187614a314aec44d74e916c966997],
    PUP.Optional.GlobalUpdate.T, C:\Program Files (x86)\globalUpdate\Update\1.3.25.0\GoogleUpdate.exe, Quarantined, [fbe187614a314aec44d74e916c966997],
    PUP.Optional.GlobalUpdate.T, C:\Program Files (x86)\globalUpdate\Update\1.3.25.0\GoogleUpdateBroker.exe, Quarantined, [fbe187614a314aec44d74e916c966997],
    PUP.Optional.GlobalUpdate.T, C:\Program Files (x86)\globalUpdate\Update\1.3.25.0\GoogleUpdateHelper.msi, Quarantined, [fbe187614a314aec44d74e916c966997],
    PUP.Optional.GlobalUpdate.T, C:\Program Files (x86)\globalUpdate\Update\1.3.25.0\GoogleUpdateOnDemand.exe, Quarantined, [fbe187614a314aec44d74e916c966997],
    PUP.Optional.GlobalUpdate.T, C:\Program Files (x86)\globalUpdate\Update\1.3.25.0\goopdate.dll, Quarantined, [fbe187614a314aec44d74e916c966997],
    PUP.Optional.GlobalUpdate.T, C:\Program Files (x86)\globalUpdate\Update\1.3.25.0\goopdateres_en.dll, Quarantined, [fbe187614a314aec44d74e916c966997],
    PUP.Optional.GlobalUpdate.T, C:\Program Files (x86)\globalUpdate\Update\1.3.25.0\npGoogleUpdate4.dll, Quarantined, [fbe187614a314aec44d74e916c966997],
    PUP.Optional.GlobalUpdate.T, C:\Program Files (x86)\globalUpdate\Update\1.3.25.0\psmachine.dll, Quarantined, [fbe187614a314aec44d74e916c966997],
    PUP.Optional.GlobalUpdate.T, C:\Program Files (x86)\globalUpdate\Update\1.3.25.0\psuser.dll, Quarantined, [fbe187614a314aec44d74e916c966997],
    PUP.Optional.GeForce.A, C:\Program Files (x86)\Ge-Force\d4809700-4200-4dc7-964d-8305d49a89fc-64.exe, Quarantined, [77651eca2853c96dbd075b847e84e31d],
    PUP.Optional.GeForce.A, C:\Program Files (x86)\Ge-Force\11ad77be-193b-4112-996e-9a01659ee7f7.dll, Delete-on-Reboot, [77651eca2853c96dbd075b847e84e31d],
    PUP.Optional.GeForce.A, C:\Program Files (x86)\Ge-Force\1293297481.mxaddon, Quarantined, [77651eca2853c96dbd075b847e84e31d],
    PUP.Optional.GeForce.A, C:\Program Files (x86)\Ge-Force\a1dcfe29-6138-40fe-b952-c25fae39e189.dll, Quarantined, [77651eca2853c96dbd075b847e84e31d],
    PUP.Optional.GeForce.A, C:\Program Files (x86)\Ge-Force\adc647f2-021d-4667-b53b-24b737e91812.crx, Quarantined, [77651eca2853c96dbd075b847e84e31d],
    PUP.Optional.GeForce.A, C:\Program Files (x86)\Ge-Force\background.html, Quarantined, [77651eca2853c96dbd075b847e84e31d],
    PUP.Optional.GeForce.A, C:\Program Files (x86)\Ge-Force\bgNova.html, Quarantined, [77651eca2853c96dbd075b847e84e31d],
    PUP.Optional.GeForce.A, C:\Program Files (x86)\Ge-Force\d4809700-4200-4dc7-964d-8305d49a89fc-4.exe, Quarantined, [77651eca2853c96dbd075b847e84e31d],
    PUP.Optional.GeForce.A, C:\Program Files (x86)\Ge-Force\d4809700-4200-4dc7-964d-8305d49a89fc-5.exe, Quarantined, [77651eca2853c96dbd075b847e84e31d],
    PUP.Optional.GeForce.A, C:\Program Files (x86)\Ge-Force\d4809700-4200-4dc7-964d-8305d49a89fc.crx, Quarantined, [77651eca2853c96dbd075b847e84e31d],
    PUP.Optional.GeForce.A, C:\Program Files (x86)\Ge-Force\d4809700-4200-4dc7-964d-8305d49a89fc.xpi, Quarantined, [77651eca2853c96dbd075b847e84e31d],
    PUP.Optional.GeForce.A, C:\Program Files (x86)\Ge-Force\Ge-Force-bg.exe, Quarantined, [77651eca2853c96dbd075b847e84e31d],
    PUP.Optional.GeForce.A, C:\Program Files (x86)\Ge-Force\Ge-Force-buttonutil.dll, Quarantined, [77651eca2853c96dbd075b847e84e31d],
    PUP.Optional.GeForce.A, C:\Program Files (x86)\Ge-Force\Ge-Force-buttonutil.exe, Quarantined, [77651eca2853c96dbd075b847e84e31d],
    PUP.Optional.GeForce.A, C:\Program Files (x86)\Ge-Force\Ge-Force-buttonutil64.dll, Quarantined, [77651eca2853c96dbd075b847e84e31d],
    PUP.Optional.GeForce.A, C:\Program Files (x86)\Ge-Force\Ge-Force-buttonutil64.exe, Quarantined, [77651eca2853c96dbd075b847e84e31d],
    PUP.Optional.GeForce.A, C:\Program Files (x86)\Ge-Force\Ge-Force-codedownloader.exe, Quarantined, [77651eca2853c96dbd075b847e84e31d],
    PUP.Optional.GeForce.A, C:\Program Files (x86)\Ge-Force\Ge-Force.ico, Quarantined, [77651eca2853c96dbd075b847e84e31d],
    PUP.Optional.GeForce.A, C:\Program Files (x86)\Ge-Force\Uninstall.exe, Quarantined, [77651eca2853c96dbd075b847e84e31d],
    PUP.Optional.GeForce.A, C:\Program Files (x86)\Ge-Force\utils.exe, Quarantined, [77651eca2853c96dbd075b847e84e31d],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\chrome.manifest, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\install.rdf, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\chrome\content\2d789627ba9359e6a27cf67ef83e3b47.js, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\chrome\content\3a1b148dfebdca3ee82d367505c58316.js, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\chrome\content\45ec68b4c872c336d34e07ce52a114d0.js, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\chrome\content\53e85d76a4943bc7275c234a86711dba.js, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\chrome\content\b34e5e36aa7910ea14c3528fa75f1a02.js, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\chrome\content\background.html, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\chrome\content\browser.xul, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\chrome\content\d8bafda5bb41eee5c1205ae850c4f8a1.js, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\chrome\content\dialog.js, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\chrome\content\ffCoreFilesIndex.txt, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\chrome\content\options.js, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\chrome\content\options.xul, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
    PUP.Optional.CrossRider.A,
     
  8. Ryansee

    Ryansee TS Rookie Topic Starter Posts: 19

    LOG 2 CONTINUED

    C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\chrome\content\search_dialog.xul, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\chrome\content\core\03184a8283da68e08149c75ed6af174d.js, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\chrome\content\core\0789b0f3196a1924e08cb0d2280fe5cc.js, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\chrome\content\core\07dfc83333096a2001ffd42aaa5f17f0.js, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\chrome\content\core\08dbbef0dfdb0d2f62fdc3ef12fbec9d.js, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\chrome\content\core\08faf3ffa41a38ea797194b8ca8208f9.js, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\chrome\content\core\4f9bc30c4d0b66ed63a110b1c70eebab.js, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\chrome\content\core\5f356756969545fa63e2334837772270.js, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\chrome\content\core\68ca8aef407744a5427e9c763b483fb3.js, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\chrome\content\core\7adb3d1400c090f1328e686f19d2c27f.js, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\chrome\content\core\887360efaf5c53aa6ae3d3ebe9d98d7b.js, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\chrome\content\core\91febed286fd83e530f855be69974009.js, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\chrome\content\core\a60c137fe58018b31ed0bf87afb8264e.js, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\chrome\content\core\b160fbb2c818c396c32baace4f0868ba.js, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\chrome\content\core\b6c3fcfdc065274bc8da8d415029497a.js, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\chrome\content\core\cffca7680e3ad29b2151e25cbc4a4eda.js, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\chrome\content\core\e76af60b324737f08cc4d908cac91d87.js, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\chrome\content\core\eb3bd1314a3e83009f90fadf88814306.js, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\chrome\content\core\installer.js, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\extensionData\manifest.xml, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\extensionData\plugins.json, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\extensionData\plugins\1.js, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\extensionData\plugins\102.js, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\extensionData\plugins\123.js, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\extensionData\plugins\13.js, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\extensionData\plugins\14.js, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\extensionData\plugins\16.js, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\extensionData\plugins\17.js, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\extensionData\plugins\177.js, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\extensionData\plugins\180.js, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\extensionData\plugins\182.js, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\extensionData\plugins\183.js, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\extensionData\plugins\184.js, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\extensionData\plugins\191.js, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\extensionData\plugins\192.js, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\extensionData\plugins\195.js, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\extensionData\plugins\207.js, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\extensionData\plugins\21.js, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\extensionData\plugins\22.js, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\extensionData\plugins\220.js, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\extensionData\plugins\223.js, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\extensionData\plugins\239.js, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\extensionData\plugins\242.js, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\extensionData\plugins\244.js, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\extensionData\plugins\246.js, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\extensionData\plugins\263.js, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\extensionData\plugins\268.js, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\extensionData\plugins\28.js, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\extensionData\plugins\281.js, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\extensionData\plugins\4.js, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\extensionData\plugins\47.js, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\extensionData\plugins\64.js, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\extensionData\plugins\7.js, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\extensionData\plugins\72.js, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\extensionData\plugins\78.js, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\extensionData\plugins\9.js, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\extensionData\plugins\91.js, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\extensionData\plugins\98.js, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\extensionData\userCode\background.js, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\extensionData\userCode\extension.js, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\warnerroberts@hotmail.com\locale\en-US\translations.dtd, Quarantined, [78649b4d8bf0053114fee60056ac56aa],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\chrome.manifest, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\install.rdf, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\chrome\content\37d5393c9a67c17aa8d6eacc07b83535.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\chrome\content\3bb01b58a203c140716795ea708245e3.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\chrome\content\96ee44219a93599692711ae3c26de213.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\chrome\content\background.html, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\chrome\content\bd653fd299b811c31e309c501b63b84f.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\chrome\content\browser.xul, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\chrome\content\dbe58b4125af1f43b0d5d39227f1b23e.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\chrome\content\dialog.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\chrome\content\ffCoreFilesIndex.txt, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\chrome\content\options.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\chrome\content\options.xul, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\chrome\content\search_dialog.xul, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\chrome\content\api\9c1e7a92ea1895f3dea6d647ec834262.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\chrome\content\api\0b5674af2e643600794c0bd4705fdfff.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\chrome\content\api\1b2d70c6f051257cfacbe44f5299606b.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\chrome\content\api\2acd287108053670c8baef201fb2b29e.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\chrome\content\api\35b30f070e6b2a9322d7e1013a15cc7b.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\chrome\content\api\50d864461506f4fa198ac90418792b2c.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\chrome\content\api\59f6218d2a686799b9c7dde9708376e6.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\chrome\content\api\852f3f29b58d2dcdded21979540688b5.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\chrome\content\api\8ee69cfeeb1ad4071c71e14f14dd5078.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\chrome\content\api\d0c437fdff94da0ea6ed2a85de0dc7d4.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\chrome\content\api\d1da4ebcf1647fb8ab54f31cfc649d08.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\chrome\content\api\d4f1b2d09a984b340234b3cf89ce4014.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\chrome\content\api\dc5644feaf56af86314ce5dc1ab07a0f.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\chrome\content\api\de5cb8a5d24bdc269cb8c45998f4e292.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\chrome\content\api\df7a077306f977c21e823c0a0d5a9371.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\chrome\content\api\df91ccbf223651026100646007fe1c61.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\chrome\content\core\1520e4815e65dab7434a2cf930de62f1.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\chrome\content\core\165a9f06b044888556129a78a461f906.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\chrome\content\core\33068727a4225a3a0324608e2c82a5c7.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\chrome\content\core\422641e9d3f84739bf5cdc32ab92e4c4.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\chrome\content\core\4724210a75dfcb79c43f251d67d00723.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\chrome\content\core\56626d55a4bfb8c6a4aad89e81384642.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\chrome\content\core\6c3d77094c1fff3e77acea7424139eab.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\chrome\content\core\7419b2140419266f85052770207f8661.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\chrome\content\core\74c74323c3ec4d203a0fb637e85a4889.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\chrome\content\core\764519850d451d2e6f6009b2256a7175.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\chrome\content\core\a25ae9f185c6e8066b31440cff74f90f.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\chrome\content\core\b1eebba8360d802f7a797feac00dfd95.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\chrome\content\core\b34c47cfe6e867841e9eb6cbfed17c18.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\chrome\content\core\d3b71fea5b323c63c50028883456323a.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\chrome\content\core\d4fdb6ce42de0751ea9fb0534fc464fd.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\chrome\content\core\dbb8eb2977db9544d68c15b82d0fe205.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\chrome\content\core\ebbfdfd0d3f3b60c2d6201caa0105470.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\chrome\content\core\ec492bf677f0bedb77eefc1f3c5a6185.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\chrome\content\core\eed8d3d69474b3b68a89c9c033c2e743.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\chrome\content\core\f4b5dab9f7553a99f6fe2946be1fd110.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\chrome\content\core\installer.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\extensionData\manifest.xml, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\extensionData\plugins.json, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\extensionData\plugins\1.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\extensionData\plugins\102.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\extensionData\plugins\104.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\extensionData\plugins\123.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\extensionData\plugins\13.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\extensionData\plugins\14.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\extensionData\plugins\16.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\extensionData\plugins\17.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\extensionData\plugins\177.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\extensionData\plugins\180.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\extensionData\plugins\182.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\extensionData\plugins\183.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\extensionData\plugins\184.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\extensionData\plugins\191.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\extensionData\plugins\192.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\extensionData\plugins\207.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\extensionData\plugins\21.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\extensionData\plugins\22.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\extensionData\plugins\220.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\extensionData\plugins\221.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\extensionData\plugins\223.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\extensionData\plugins\242.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\extensionData\plugins\244.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\extensionData\plugins\246.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\extensionData\plugins\263.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\extensionData\plugins\268.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\extensionData\plugins\28.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\extensionData\plugins\281.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\extensionData\plugins\286.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\extensionData\plugins\4.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\extensionData\plugins\47.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\extensionData\plugins\64.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\extensionData\plugins\7.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\extensionData\plugins\72.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\extensionData\plugins\78.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\extensionData\plugins\9.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\extensionData\plugins\91.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\extensionData\plugins\93.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\extensionData\plugins\98.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\extensionData\userCode\background.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\extensionData\userCode\extension.js, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],
    PUP.Optional.CrossRider.A, C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\extensions\45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com\locale\en-US\translations.dtd, Quarantined, [7f5d90589fdc3cfa769d7175f60c916f],

    Physical Sectors: 0
    (No malicious items detected)


    (end)
     
  9. Ryansee

    Ryansee TS Rookie Topic Starter Posts: 19

    ADWcleaner log : I ran this software and I might aswell give u the log. I ran it before I saw website.
    ADWCLEANER

    \\a\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\# AdwCleaner v3.308 - Report created 02/09/2014 at 22:50:42
    # Updated 20/08/2014 by Xplode
    # Operating System : Windows 7 Home Premium Service Pack 1 (64 bits)
    # Username : Ahmed - AHMED-PC
    # Running from : C:\Users\Ahmed\Desktop\Week 1\AdwCleaner.exe
    # Option : Clean

    ***** [ Services ] *****


    ***** [ Files / Folders ] *****

    Folder Deleted : C:\ProgramData\baidu
    Folder Deleted : C:\ProgramData\NCH Software
    Folder Deleted : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\YouTube Accelerator
    Folder Deleted : C:\Program Files (x86)\globalUpdate
    Folder Deleted : C:\Program Files (x86)\NCH Software
    Folder Deleted : C:\Program Files (x86)\YouTube Accelerator
    Folder Deleted : C:\Users\Ahmed\AppData\Local\globalUpdate
    Folder Deleted : C:\Users\Ahmed\AppData\LocalLow\Goobzo
    Folder Deleted : C:\Users\Ahmed\AppData\Roaming\baidu
    Folder Deleted : C:\Users\Ahmed\AppData\Roaming\NCH Software
    Folder Deleted : C:\Users\Ahmed\Desktop\Save
    Folder Deleted : C:\Users\Public\Documents\baidu
    Folder Deleted : C:\Users\Public\Documents\Goobzo
    Folder Deleted : C:\Users\Ahmed\AppData\Local\Google\Chrome\User Data\Default\Extensions\gkojfkhlekighikafcpjkiklfbnlmeio
    File Deleted : C:\Windows\System32\roboot64.exe
    File Deleted : C:\Users\Ahmed\daemonprocess.txt
    File Deleted : C:\Users\Ahmed\Desktop\YouTube Accelerator.lnk
    File Deleted : C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\searchplugins\bingp.xml
    File Deleted : C:\Users\Ahmed\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.superfish.com_0.localstorage
    File Deleted : C:\Users\Ahmed\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.superfish.com_0.localstorage-journal

    ***** [ Scheduled Tasks ] *****

    Task Deleted : EPUpdater

    ***** [ Shortcuts ] *****


    ***** [ Registry ] *****

    Value Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Run [NextLive]
    Key Deleted : HKLM\SOFTWARE\Classes\*\shell\filescout
    Key Deleted : HKLM\SOFTWARE\Classes\d
    Key Deleted : HKLM\SOFTWARE\Classes\globalUpdate.OneClickProcessLauncherMachine
    Key Deleted : HKLM\SOFTWARE\Classes\globalUpdate.OneClickProcessLauncherMachine.1.0
    Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CoCreateAsync
    Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CoCreateAsync.1.0
    Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CoreClass
    Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CoreClass.1
    Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CoreMachineClass
    Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CoreMachineClass.1
    Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CredentialDialogMachine
    Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CredentialDialogMachine.1.0
    Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.OnDemandCOMClassMachine
    Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.OnDemandCOMClassMachine.1.0
    Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.OnDemandCOMClassMachineFallback
    Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.OnDemandCOMClassMachineFallback.1.0
    Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.OnDemandCOMClassSvc
    Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.OnDemandCOMClassSvc.1.0
    Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.ProcessLauncher
    Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.ProcessLauncher.1.0
    Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3COMClassService
    Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3COMClassService.1.0
    Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3WebMachine
    Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3WebMachine.1.0
    Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3WebMachineFallback
    Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3WebMachineFallback.1.0
    Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3WebSvc
    Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3WebSvc.1.0
    Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{74F475FA-6C75-43BD-AAB9-ECDA6184F600}
    Key Deleted : HKLM\SOFTWARE\Classes\AppID\{3278F5CF-48F3-4253-A6BB-004CE84AF492}
    Key Deleted : HKLM\SOFTWARE\Classes\AppID\{577975B8-C40E-43E6-B0DE-4C6B44088B52}
    Key Deleted : HKLM\SOFTWARE\Classes\AppID\{7ABBFE1C-E485-44AA-8F36-353751B4124D}
    Key Deleted : HKLM\SOFTWARE\Classes\AppID\{B15F118E-AF21-45E8-A809-29FDD7362565}
    Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{02A96331-0CA6-40E2-A87D-C224601985EB}
    Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{3278F5CF-48F3-4253-A6BB-004CE84AF492}
    Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{3B5702BA-7F4C-4D1A-B026-1E9A01D43978}
    Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{44B50C01-4993-48E2-ADEE-D812BAE2E9A2}
    Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{577975B8-C40E-43E6-B0DE-4C6B44088B52}
    Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{5E89ACE9-E16B-499A-87B4-0DBF742404C1}
    Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{69F256DF-BA98-45E9-86EA-FC3CFECF9D30}
    Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{6E87FC94-9866-49B9-8E93-5736D6DE3DD7}
    Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{7E49F793-B3CD-4BF7-8419-B34B8BD30E61}
    Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{834469E3-CA2B-4F21-A5CA-4F6F4DBCDE87}
    Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{8529FAA3-5BFD-43C1-AB35-B53C4B96C6E5}
    Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{A3E2F089-DDBB-4CBF-B06C-5D44DA316ED3}
    Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{A5679AB0-C59E-49E7-83C4-5289F844A6E0}
    Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{ADBC39BE-3D20-4333-8D99-E91EB1B62474}
    Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{E06CA7F5-BA34-4FF6-8D24-B1BDC594D91F}
    Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{F6421EE5-A5BE-4D31-81D5-C16B7BF48E4C}
    Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{FD8E81D0-F5FE-4CB1-9AEA-1E163D2BAB78}
    Key Deleted : HKLM\SOFTWARE\Classes\Interface\{087CDC12-0A11-4D1D-8DCF-44185D7C3496}
    Key Deleted : HKLM\SOFTWARE\Classes\Interface\{088BF3A9-6AE8-47B9-A3FB-26262F236C79}
    Key Deleted : HKLM\SOFTWARE\Classes\Interface\{2AC7B9EB-3881-4EB9-8DEE-0A731A309FDE}
    Key Deleted : HKLM\SOFTWARE\Classes\Interface\{349C0469-ACDD-49DF-9B3E-0D82E7C7DC4D}
    Key Deleted : HKLM\SOFTWARE\Classes\Interface\{41226591-6F7A-4082-B63A-67FE4A0CF7A6}
    Key Deleted : HKLM\SOFTWARE\Classes\Interface\{55D69CD1-6715-4C40-BF05-9519AC4DC6E6}
    Key Deleted : HKLM\SOFTWARE\Classes\Interface\{66C8FD57-54C4-4D4F-BC95-DCCC763B410A}
    Key Deleted : HKLM\SOFTWARE\Classes\Interface\{717BAE33-7061-4279-8AE5-6C13BC8AF3F9}
    Key Deleted : HKLM\SOFTWARE\Classes\Interface\{84F06F7A-F811-48D7-8B34-3F4145183D8F}
    Key Deleted : HKLM\SOFTWARE\Classes\Interface\{88F6D55F-AA3F-4003-BE69-4AC1998D6492}
    Key Deleted : HKLM\SOFTWARE\Classes\Interface\{8DBCDED5-08AD-41A2-9BBC-235D84F4FE06}
    Key Deleted : HKLM\SOFTWARE\Classes\Interface\{A0F66203-1A86-4812-9603-A57E09A4D7A3}
    Key Deleted : HKLM\SOFTWARE\Classes\Interface\{BC39D1B3-4471-41C1-AACA-E097FAF4B7AA}
    Key Deleted : HKLM\SOFTWARE\Classes\Interface\{DEB85542-1311-4EC6-8A32-5372EB27FC94}
    Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{11D9E165-B8C1-4734-A56C-BC4FCACA966B}
    Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{B15F118E-AF21-45E8-A809-29FDD7362565}
    Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5E89ACE9-E16B-499A-87B4-0DBF742404C1}
    Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9CF034EA-7B46-48D3-8895-8A14B32AE445}
    Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{087CDC12-0A11-4D1D-8DCF-44185D7C3496}
    Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{088BF3A9-6AE8-47B9-A3FB-26262F236C79}
    Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{2AC7B9EB-3881-4EB9-8DEE-0A731A309FDE}
    Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{349C0469-ACDD-49DF-9B3E-0D82E7C7DC4D}
    Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{41226591-6F7A-4082-B63A-67FE4A0CF7A6}
    Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{55D69CD1-6715-4C40-BF05-9519AC4DC6E6}
    Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{66C8FD57-54C4-4D4F-BC95-DCCC763B410A}
    Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{717BAE33-7061-4279-8AE5-6C13BC8AF3F9}
    Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{84F06F7A-F811-48D7-8B34-3F4145183D8F}
    Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{88F6D55F-AA3F-4003-BE69-4AC1998D6492}
    Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{8DBCDED5-08AD-41A2-9BBC-235D84F4FE06}
    Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{A0F66203-1A86-4812-9603-A57E09A4D7A3}
    Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{BC39D1B3-4471-41C1-AACA-E097FAF4B7AA}
    Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{DEB85542-1311-4EC6-8A32-5372EB27FC94}
    Key Deleted : HKCU\Software\GlobalUpdate
    Key Deleted : HKCU\Software\Goobzo
    Key Deleted : HKCU\Software\InstalledBrowserExtensions
    Key Deleted : HKCU\Software\AppDataLow\Software\Sense
    Key Deleted : HKLM\SOFTWARE\GlobalUpdate
    Key Deleted : HKLM\SOFTWARE\Goobzo
    Key Deleted : HKLM\SOFTWARE\InstalledBrowserExtensions
    Key Deleted : HKLM\SOFTWARE\OpenCandy
    Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Mobogenie
    Key Deleted : [x64] HKLM\SOFTWARE\DivX\Install\Setup\WizardLayout\ConduitToolbar
    Key Deleted : [x64] HKLM\SOFTWARE\InstalledBrowserExtensions
    Key Deleted : [x64] HKLM\SOFTWARE\Sense
    Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\lucky leap

    ***** [ Browsers ] *****

    -\\ Internet Explorer v11.0.9600.17239


    -\\ Mozilla Firefox v30.0 (en-US)

    [ File : C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\prefs.js ]

    Line Deleted : user_pref("browser.startup.homepage", "hxxp://www.msn.com/?pc=UP97&ocid=UP97DHP|hxxp://ar.hao123.com/?tn=pcf_inner_protection_01_hao123_ar");

    -\\ Google Chrome v37.0.2062.102

    [ File : C:\Users\Ahmed\AppData\Local\Google\Chrome\User Data\Default\preferences ]

    Deleted [Homepage] : hxxp://search.softonic.com/INF00234/tb_v1?SearchSource=48&cc=&mi=fe5ade77000000000000a088b455621d&toi=16057
    Deleted [Extension] : aidbbndgjnlaclnmhkdimcdjiebjpdel
    Deleted [Extension] : bfcpnihmbfoaeoakalclfalkdepgiaje
    Deleted [Extension] : cfcbmgbfdbijmjgjihagbomfbjfjmgon
    Deleted [Extension] : gkojfkhlekighikafcpjkiklfbnlmeio
    Deleted [Extension] : hgojaaaiddhmiiakpejiklijbalpckih
    Deleted [Extension] : mocblcnaofikinigmceddfghppkkjbog

    *************************

    AdwCleaner[R0].txt - [13775 octets] - [21/10/2013 20:11:40]
    AdwCleaner[R1].txt - [1812 octets] - [02/09/2014 20:28:15]
    AdwCleaner[R2].txt - [10730 octets] - [02/09/2014 22:36:02]
    AdwCleaner[S0].txt - [10983 octets] - [21/10/2013 20:12:47]
    AdwCleaner[S1].txt - [10682 octets] - [02/09/2014 22:50:42]

    ########## EOF - C:\AdwCleaner\AdwCleaner[S1].txt - [10743 octets] ##########
     
  10. Broni

    Broni Malware Annihilator Posts: 47,048   +256

    [​IMG] You're running three AV programs, Avast, MSE and Baidu.
    You must uninstall TWO of them.
    Only one AV program is allowed to run.

    [​IMG] Download RogueKiller from one of the following links and save it to your Desktop:

    Link 1
    Link 2

    • Close all the running programs
    • Windows Vista/7/8 users: right click on RogueKiller.exe, click Run as Administrator
    • Otherwise just double-click on RogueKiller.exe
    • Pre-scan will start. Let it finish.
    • Click on SCAN button.
    • Wait until the Status box shows Scan Finished
    • Click on Delete.
    • Wait until the Status box shows Deleting Finished.
    • Click on Report and copy/paste the content of the Notepad into your next reply.
    • RKreport.txt could also be found on your desktop.
    • If more than one log is produced post all logs.
    • If RogueKiller has been blocked, do not hesitate to try a few times more. If really won't run, rename it to winlogon.exe (or winlogon.com) and try again

    [​IMG] Create new restore point before proceeding with the next step....
    How to: http://www.smartestcomputing.us.com/topic/63983-how-to-create-new-restore-point-all-windows/

    Download [img=[url]http://www.imgdumper.nl/uploads6/51a5f31352f71/51a5f31352b88-icon_MBAR.png][/url]Malwarebytes Anti-Rootkit to your desktop.
    • Warning! Malwarebytes Anti-Rootkit needs to be run from an account with administrator rights.
    • Double click on downloaded file. OK self extracting prompt.
    • MBAR will start. Click "Next" to continue.
    • Click in the following screen "Update" to obtain the latest malware definitions.
    • Once the update is complete select "Next" and click "Scan".
    • When the scan is finished and no malware has been found select "Exit".
    • If malware was detected, make sure to check all the items and click "Cleanup". Reboot your computer.
    • Open the MBAR folder located on your Desktop and paste the content of the following files in your next reply:
      • "mbar-log-{date} (xx-xx-xx).txt"
      • "system-log.txt"
     
  11. Ryansee

    Ryansee TS Rookie Topic Starter Posts: 19

    I dont know how to uninstal baidu
     
     
  12. Ryansee

    Ryansee TS Rookie Topic Starter Posts: 19

    "registry valye "appinit_dlls" has been found which may be caused by possible rootkit activity."

    "do I want to remove this value and restart the tool?"

    Idk what to do here??



    Roguekiller log:

    RogueKiller V9.2.9.0 [Jul 11 2014] by Adlice Software
    mail : http://www.adlice.com/contact/
    Feedback : http://forum.adlice.com
    Website : https://www.adlice.com/softwares/roguekiller/
    Blog : http://www.adlice.com

    Operating System : Windows 7 (6.1.7601 Service Pack 1) 64 bits version
    Started in : Normal mode
    User : Ahmed [Admin rights]
    Mode : Remove -- Date : 09/03/2014 13:52:09

    ¤¤¤ Bad processes : 1 ¤¤¤
    [Proc.Hidden] -- [x] -> KILLED [TermThr]

    ¤¤¤ Registry Entries : 22 ¤¤¤
    [PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{388291E2-08A3-4FFB-AA5C-8D2F05E0DECF} | DhcpNameServer : 7.254.254.254 -> NOT SELECTED
    [PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{3D7DB392-8310-4C99-9194-FDDF34DFB51D} | DhcpNameServer : 172.20.10.1 -> NOT SELECTED
    [PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{9695AEC5-758E-4DB9-811D-6D23A04D41EF} | DhcpNameServer : 209.222.18.222 209.222.18.218 -> NOT SELECTED
    [PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{CC4F8F04-1967-40BA-ACB9-D35D82530A16} | NameServer : 41.128.225.225,42.128.225.226 -> NOT SELECTED
    [PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters\Interfaces\{388291E2-08A3-4FFB-AA5C-8D2F05E0DECF} | DhcpNameServer : 7.254.254.254 -> NOT SELECTED
    [PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters\Interfaces\{3D7DB392-8310-4C99-9194-FDDF34DFB51D} | DhcpNameServer : 172.20.10.1 -> NOT SELECTED
    [PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters\Interfaces\{9695AEC5-758E-4DB9-811D-6D23A04D41EF} | DhcpNameServer : 209.222.18.222 209.222.18.218 -> NOT SELECTED
    [PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters\Interfaces\{CC4F8F04-1967-40BA-ACB9-D35D82530A16} | NameServer : 41.128.225.225,42.128.225.226 -> NOT SELECTED
    [PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet002\Services\Tcpip\Parameters\Interfaces\{388291E2-08A3-4FFB-AA5C-8D2F05E0DECF} | DhcpNameServer : 7.254.254.254 -> NOT SELECTED
    [PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet002\Services\Tcpip\Parameters\Interfaces\{3D7DB392-8310-4C99-9194-FDDF34DFB51D} | DhcpNameServer : 172.20.10.1 -> NOT SELECTED
    [PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet002\Services\Tcpip\Parameters\Interfaces\{9695AEC5-758E-4DB9-811D-6D23A04D41EF} | DhcpNameServer : 209.222.18.222 209.222.18.218 -> NOT SELECTED
    [PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet002\Services\Tcpip\Parameters\Interfaces\{CC4F8F04-1967-40BA-ACB9-D35D82530A16} | NameServer : 41.128.225.225,42.128.225.226 -> NOT SELECTED
    [PUM.Policies] (X64) HKEY_USERS\S-1-5-21-4037467554-2527304460-3365707105-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System | DisableRegistryTools : 0 -> NOT SELECTED
    [PUM.Policies] (X64) HKEY_USERS\S-1-5-21-4037467554-2527304460-3365707105-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System | DisableTaskMgr : 0 -> NOT SELECTED
    [PUM.Policies] (X86) HKEY_USERS\S-1-5-21-4037467554-2527304460-3365707105-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System | DisableRegistryTools : 0 -> NOT SELECTED
    [PUM.Policies] (X86) HKEY_USERS\S-1-5-21-4037467554-2527304460-3365707105-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System | DisableTaskMgr : 0 -> NOT SELECTED
    [PUM.Desktop] (X64) HKEY_USERS\S-1-5-21-4037467554-2527304460-3365707105-1000\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop | NoChangingWallpaper : 0 -> NOT SELECTED
    [PUM.Desktop] (X86) HKEY_USERS\S-1-5-21-4037467554-2527304460-3365707105-1000\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop | NoChangingWallpaper : 0 -> NOT SELECTED
    [PUM.DesktopIcons] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {20D04FE0-3AEA-1069-A2D8-08002B30309D} : 1 -> NOT SELECTED
    [PUM.DesktopIcons] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {59031a47-3f72-44a7-89c5-5595fe6b30ee} : 1 -> NOT SELECTED
    [PUM.DesktopIcons] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {20D04FE0-3AEA-1069-A2D8-08002B30309D} : 1 -> NOT SELECTED
    [PUM.DesktopIcons] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {59031a47-3f72-44a7-89c5-5595fe6b30ee} : 1 -> NOT SELECTED

    ¤¤¤ Scheduled tasks : 0 ¤¤¤

    ¤¤¤ Files : 0 ¤¤¤

    ¤¤¤ HOSTS File : 0 [Too big!] ¤¤¤

    ¤¤¤ Antirootkit : 0 (Driver: NOT LOADED [0xc000036b]) ¤¤¤

    ¤¤¤ Web browsers : 0 ¤¤¤

    ¤¤¤ MBR Check : ¤¤¤
    +++++ PhysicalDrive0: ST9750420AS ATA Device +++++
    --- User ---
    [MBR] c48bfb66fb3eb5ccb4d27e692be093ae
    [BSP] fe2266ba6367db7a0b0c632db4e02d43 : Windows Vista/7/8 MBR Code
    Partition table:
    0 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 2048 | Size: 100 MB
    1 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 206848 | Size: 715302 MB
    User = LL1 ... OK
    User = LL2 ... OK


    ============================================
    RKreport_SCN_09032014_135044.log
     
  13. Ryansee

    Ryansee TS Rookie Topic Starter Posts: 19

    I googled and was told just follow instructions, press no and if it crashed run again and press yes.
    System log
    ---------------------------------------
    Malwarebytes Anti-Rootkit BETA 1.07.0.1012

    (c) Malwarebytes Corporation 2011-2012

    OS version: 6.1.7601 Windows 7 Service Pack 1 x64

    Account is Administrative

    Internet Explorer version: 11.0.9600.17239

    File system is: NTFS
    Disk drives: C:\ DRIVE_FIXED
    CPU speed: 1.993000 GHz
    Memory total: 8535261184, free: 4938641408

    Downloaded database version: v2014.09.03.02
    Downloaded database version: v2014.08.21.01
    =======================================
    Initializing...
    ------------ Kernel report ------------
    09/03/2014 14:10:46
    ------------ Loaded modules -----------
    \SystemRoot\system32\ntoskrnl.exe
    \SystemRoot\system32\hal.dll
    \SystemRoot\system32\kdcom.dll
    \SystemRoot\system32\mcupdate_GenuineIntel.dll
    \SystemRoot\system32\PSHED.dll
    \SystemRoot\system32\CLFS.SYS
    \SystemRoot\system32\CI.dll
    \SystemRoot\system32\drivers\Wdf01000.sys
    \SystemRoot\system32\drivers\WDFLDR.SYS
    \SystemRoot\system32\drivers\ACPI.sys
    \SystemRoot\system32\drivers\WMILIB.SYS
    \SystemRoot\system32\drivers\msisadrv.sys
    \SystemRoot\system32\drivers\pci.sys
    \SystemRoot\system32\drivers\vdrvroot.sys
    \SystemRoot\System32\drivers\partmgr.sys
    \SystemRoot\system32\DRIVERS\compbatt.sys
    \SystemRoot\system32\DRIVERS\BATTC.SYS
    \SystemRoot\system32\drivers\volmgr.sys
    \SystemRoot\System32\drivers\volmgrx.sys
    \SystemRoot\System32\drivers\mountmgr.sys
    \SystemRoot\system32\drivers\atapi.sys
    \SystemRoot\system32\drivers\ataport.SYS
    \SystemRoot\system32\drivers\msahci.sys
    \SystemRoot\system32\drivers\PCIIDEX.SYS
    \SystemRoot\system32\drivers\amdxata.sys
    \SystemRoot\system32\drivers\fltmgr.sys
    \SystemRoot\system32\drivers\fileinfo.sys
    \SystemRoot\system32\DRIVERS\MpFilter.sys
    \SystemRoot\System32\Drivers\Ntfs.sys
    \SystemRoot\System32\Drivers\msrpc.sys
    \SystemRoot\System32\Drivers\ksecdd.sys
    \SystemRoot\System32\Drivers\cng.sys
    \SystemRoot\System32\drivers\pcw.sys
    \SystemRoot\System32\Drivers\Fs_Rec.sys
    \SystemRoot\system32\drivers\ndis.sys
    \SystemRoot\system32\drivers\NETIO.SYS
    \SystemRoot\System32\Drivers\ksecpkg.sys
    \SystemRoot\System32\drivers\tcpip.sys
    \SystemRoot\System32\drivers\fwpkclnt.sys
    \SystemRoot\system32\drivers\volsnap.sys
    \SystemRoot\system32\DRIVERS\stdcfltn.sys
    \SystemRoot\System32\Drivers\spldr.sys
    \SystemRoot\SysWOW64\speedfan.sys
    \SystemRoot\System32\drivers\rdyboost.sys
    \SystemRoot\system32\DRIVERS\nvpciflt.sys
    \SystemRoot\System32\Drivers\mup.sys
    \SystemRoot\System32\drivers\hwpolicy.sys
    \SystemRoot\System32\DRIVERS\fvevol.sys
    \SystemRoot\system32\DRIVERS\EMSC.SYS
    \SystemRoot\system32\DRIVERS\disk.sys
    \SystemRoot\system32\DRIVERS\CLASSPNP.SYS
    \SystemRoot\system32\drivers\cdrom.sys
    \??\C:\Windows\System32\drivers\Bfilter.sys
    \??\C:\Windows\System32\drivers\Bfmon.sys
    \SystemRoot\System32\Drivers\Null.SYS
    \SystemRoot\System32\Drivers\Beep.SYS
    \??\C:\Windows\System32\drivers\Bprotect.sys
    \SystemRoot\System32\drivers\vga.sys
    \SystemRoot\System32\drivers\VIDEOPRT.SYS
    \SystemRoot\System32\drivers\watchdog.sys
    \SystemRoot\System32\DRIVERS\RDPCDD.sys
    \SystemRoot\system32\drivers\rdpencdd.sys
    \SystemRoot\system32\drivers\rdprefmp.sys
    \SystemRoot\System32\Drivers\Msfs.SYS
    \SystemRoot\System32\Drivers\Npfs.SYS
    \SystemRoot\System32\drivers\bnbasex64.sys
    \SystemRoot\System32\drivers\TDI.SYS
    \SystemRoot\system32\DRIVERS\tdx.sys
    \SystemRoot\system32\drivers\afd.sys
    \SystemRoot\System32\DRIVERS\netbt.sys
    \SystemRoot\system32\drivers\ws2ifsl.sys
    \SystemRoot\system32\DRIVERS\wfplwf.sys
    \SystemRoot\system32\DRIVERS\pacer.sys
    \SystemRoot\system32\DRIVERS\vwififlt.sys
    \SystemRoot\system32\DRIVERS\netbios.sys
    \SystemRoot\system32\DRIVERS\wanarp.sys
    \SystemRoot\system32\drivers\termdd.sys
    \??\C:\Program Files\SUPERAntiSpyware\SASKUTIL64.SYS
    \??\C:\Program Files\SUPERAntiSpyware\SASDIFSV64.SYS
    \??\C:\Windows\system32\drivers\RzFilter.sys
    \??\C:\Windows\system32\drivers\HIDPARSE.SYS
    \SystemRoot\system32\DRIVERS\rdbss.sys
    \SystemRoot\system32\DRIVERS\nvkflt.sys
    \SystemRoot\System32\drivers\dxgkrnl.sys
    \SystemRoot\System32\drivers\dxgmms1.sys
    \SystemRoot\system32\drivers\nsiproxy.sys
    \SystemRoot\system32\drivers\mssmbios.sys
    \SystemRoot\System32\drivers\discache.sys
    \SystemRoot\System32\Drivers\dfsc.sys
    \??\C:\Windows\System32\drivers\bndef64.sys
    \SystemRoot\system32\DRIVERS\blbdrive.sys
    \SystemRoot\system32\DRIVERS\tunnel.sys
    \??\C:\Windows\system32\drivers\RzDxgk.sys
    \SystemRoot\system32\DRIVERS\nvlddmkm.sys
    \SystemRoot\system32\DRIVERS\igdkmd64.sys
    \SystemRoot\system32\DRIVERS\HECIx64.sys
    \SystemRoot\system32\drivers\HDAudBus.sys
    \SystemRoot\system32\DRIVERS\L1C62x64.sys
    \SystemRoot\system32\DRIVERS\NETwNs64.sys
    \SystemRoot\system32\DRIVERS\vwifibus.sys
    \SystemRoot\system32\DRIVERS\RtsPStor.sys
    \SystemRoot\system32\drivers\sdbus.sys
    \SystemRoot\system32\DRIVERS\nusb3xhc.sys
    \SystemRoot\system32\DRIVERS\USBD.SYS
    \SystemRoot\system32\drivers\usbehci.sys
    \SystemRoot\system32\drivers\USBPORT.SYS
    \SystemRoot\system32\DRIVERS\CmBatt.sys
    \SystemRoot\system32\drivers\i8042prt.sys
    \SystemRoot\system32\DRIVERS\kbdclass.sys
    \SystemRoot\system32\DRIVERS\SynTP.sys
    \SystemRoot\system32\DRIVERS\mouclass.sys
    \SystemRoot\system32\DRIVERS\GEARAspiWDM.sys
    \SystemRoot\system32\DRIVERS\Accelern.sys
    \SystemRoot\system32\DRIVERS\intelppm.sys
    \SystemRoot\system32\drivers\wmiacpi.sys
    \SystemRoot\system32\drivers\CompositeBus.sys
    \SystemRoot\system32\DRIVERS\lmimirr.sys
    \SystemRoot\system32\DRIVERS\AgileVpn.sys
    \SystemRoot\system32\DRIVERS\rasl2tp.sys
    \SystemRoot\system32\DRIVERS\ndistapi.sys
    \SystemRoot\system32\DRIVERS\ndiswan.sys
    \SystemRoot\system32\DRIVERS\raspppoe.sys
    \SystemRoot\system32\DRIVERS\raspptp.sys
    \SystemRoot\system32\DRIVERS\rassstp.sys
    \SystemRoot\system32\DRIVERS\tap0901t.sys
    \SystemRoot\system32\drivers\swenum.sys
    \SystemRoot\system32\drivers\ks.sys
    \SystemRoot\system32\DRIVERS\dcdbas64.sys
    \SystemRoot\system32\DRIVERS\ScpVBus.sys
    \SystemRoot\system32\DRIVERS\umbus.sys
    \SystemRoot\system32\drivers\nvvad64v.sys
    \SystemRoot\system32\drivers\portcls.sys
    \SystemRoot\system32\drivers\drmk.sys
    \SystemRoot\system32\drivers\ksthunk.sys
    \SystemRoot\system32\DRIVERS\nusb3hub.sys
    \SystemRoot\system32\DRIVERS\usbhub.sys
    \SystemRoot\System32\Drivers\NDProxy.SYS
    \SystemRoot\system32\drivers\HdAudio.sys
    \SystemRoot\system32\DRIVERS\IntcDAud.sys
    \SystemRoot\system32\DRIVERS\udfs.sys
    \SystemRoot\system32\DRIVERS\MijXfilt.sys
    \SystemRoot\system32\DRIVERS\cdfs.sys
    \SystemRoot\system32\DRIVERS\xusb21.sys
    \SystemRoot\system32\DRIVERS\hidusb.sys
    \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
    \SystemRoot\system32\DRIVERS\mouhid.sys
    \SystemRoot\system32\DRIVERS\kbdhid.sys
    \SystemRoot\system32\DRIVERS\usbccgp.sys
    \SystemRoot\System32\Drivers\usbvideo.sys
    \SystemRoot\System32\Drivers\crashdmp.sys
    \SystemRoot\System32\Drivers\dump_dumpata.sys
    \SystemRoot\System32\Drivers\dump_msahci.sys
    \SystemRoot\System32\Drivers\dump_dumpfve.sys
    \SystemRoot\System32\win32k.sys
    \SystemRoot\System32\drivers\Dxapi.sys
    \SystemRoot\system32\DRIVERS\monitor.sys
    \SystemRoot\System32\TSDDD.dll
    \SystemRoot\System32\cdd.dll
    \SystemRoot\System32\ATMFD.DLL
    \SystemRoot\system32\drivers\luafv.sys
    \SystemRoot\system32\DRIVERS\lltdio.sys
    \SystemRoot\system32\DRIVERS\nwifi.sys
    \SystemRoot\system32\DRIVERS\ndisuio.sys
    \SystemRoot\system32\DRIVERS\rspndr.sys
    \SystemRoot\system32\drivers\HTTP.sys
    \SystemRoot\system32\DRIVERS\bowser.sys
    \SystemRoot\System32\drivers\mpsdrv.sys
    \SystemRoot\system32\DRIVERS\mrxsmb.sys
    \SystemRoot\system32\DRIVERS\mrxsmb10.sys
    \SystemRoot\system32\DRIVERS\mrxsmb20.sys
    \??\C:\Windows\system32\drivers\LMIRfsDriver.sys
    \SystemRoot\system32\drivers\peauth.sys
    \SystemRoot\system32\DRIVERS\vwifimp.sys
    \SystemRoot\System32\Drivers\secdrv.SYS
    \SystemRoot\System32\DRIVERS\srvnet.sys
    \SystemRoot\System32\drivers\tcpipreg.sys
    \SystemRoot\System32\DRIVERS\srv2.sys
    \SystemRoot\System32\DRIVERS\srv.sys
    \SystemRoot\system32\DRIVERS\NisDrvWFP.sys
    \SystemRoot\system32\drivers\WudfPf.sys
    \SystemRoot\System32\Drivers\usbaapl64.sys
    \SystemRoot\system32\DRIVERS\WinUsb.sys
    \SystemRoot\system32\DRIVERS\WUDFRd.sys
    \??\C:\Windows\system32\drivers\mbamchameleon.sys
    \??\C:\Windows\system32\drivers\MBAMSwissArmy.sys
    \Windows\System32\ntdll.dll
    \Windows\System32\smss.exe
    \Windows\System32\apisetschema.dll
    ----------- End -----------
    Done!
    <<<1>>>
    Upper Device Name: \Device\Harddisk0\DR0
    Upper Device Object: 0xfffffa8008365790
    Upper Device Driver Name: \Driver\Disk\
    Lower Device Name: \Device\Ide\IdeDeviceP0T0L0-0\
    Lower Device Object: 0xfffffa8008113060
    Lower Device Driver Name: \Driver\atapi\
    <<<2>>>
    Physical Sector Size: 512
    Drive: 0, DevicePointer: 0xfffffa8008365790, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
    --------- Disk Stack ------
    DevicePointer: 0xfffffa80083652c0, DeviceName: Unknown, DriverName: \Driver\partmgr\
    DevicePointer: 0xfffffa8008365790, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
    DevicePointer: 0xfffffa8008282bf0, DeviceName: Unknown, DriverName: \Driver\stdcfltn\
    DevicePointer: 0xfffffa8008113060, DeviceName: \Device\Ide\IdeDeviceP0T0L0-0\, DriverName: \Driver\atapi\
    ------------ End ----------
    Alternate DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
    Upper DeviceData: 0x0, 0x0, 0x0
    Lower DeviceData: 0x0, 0x0, 0x0
    <<<3>>>
    Volume: C:
    File system type: NTFS
    SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
    <<<2>>>
    <<<3>>>
    Volume: C:
    File system type: NTFS
    SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
    Scanning drivers directory: C:\WINDOWS\SYSTEM32\drivers...
    Done!
    Drive 0
    This is a System drive
    Scanning MBR on drive 0...
    Inspecting partition table:
    MBR Signature: 55AA
    Disk Signature: 44B1E201

    Partition information:

    Partition 0 type is Primary (0x7)
    Partition is ACTIVE.
    Partition starts at LBA: 2048 Numsec = 204800
    Partition file system is NTFS
    Partition is bootable

    Partition 1 type is Primary (0x7)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 206848 Numsec = 1464938496

    Partition 2 type is Empty (0x0)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 0 Numsec = 0

    Partition 3 type is Empty (0x0)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 0 Numsec = 0

    Disk Size: 750156374016 bytes
    Sector size: 512 bytes

    Scanning physical sectors of unpartitioned space on drive 0 (1-2047-1465129168-1465149168)...
    Done!
    Scan finished
    =======================================


    Removal queue found; removal started
    Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR-0-I.mbam...
    Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\VBR-0-0-2048-I.mbam...
    Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR-0-r.mbam...
    Removal finished

    log scan

    Malwarebytes Anti-Rootkit BETA 1.07.0.1012
    www.malwarebytes.org

    Database version: v2014.09.03.02

    Windows 7 Service Pack 1 x64 NTFS
    Internet Explorer 11.0.9600.17239
    Ahmed :: AHMED-PC [administrator]

    9/3/2014 2:10:59 PM
    mbar-log-2014-09-03 (14-10-59).txt

    Scan type: Quick scan
    Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken
    Scan options disabled:
    Objects scanned: 370190
    Time elapsed: 15 minute(s), 19 second(s)

    Memory Processes Detected: 0
    (No malicious items detected)

    Memory Modules Detected: 0
    (No malicious items detected)

    Registry Keys Detected: 0
    (No malicious items detected)

    Registry Values Detected: 0
    (No malicious items detected)

    Registry Data Items Detected: 0
    (No malicious items detected)

    Folders Detected: 0
    (No malicious items detected)

    Files Detected: 0
    (No malicious items detected)

    Physical Sectors Detected: 0
    (No malicious items detected)

    (end)
     
  14. Ryansee

    Ryansee TS Rookie Topic Starter Posts: 19

    Should I worry??? I feel pretty depressed atm.
     
  15. Ryansee

    Ryansee TS Rookie Topic Starter Posts: 19

    Update : Internet is working but browsers don't. Requires a restart to get then to work agsin
     
  16. Broni

    Broni Malware Annihilator Posts: 47,048   +256

    Start>Control Panel>Programs & Features.

    Please download ComboFix from Here, Here or Here to your Desktop.

    **Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**
    • Never rename Combofix unless instructed.
    • Close any open browsers.
    • Very Important! Temporarily disable your anti-virus and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
    • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
    • Close any open browsers.
    • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
    • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
    • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
      If the connection is not there use restore point you created prior to running Combofix.
    • Double click on combofix.exe & follow the prompts.

    • NOTE1. If Combofix asks you to install Recovery Console, please allow it.
      NOTE 2. If Combofix asks you to update the program, always do so.
    • When finished, it will produce a report for you.
    • Please post the "C:\ComboFix.txt"
    **Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall
    **Note 2 for AVG and CA Internet Security (Total Defense Internet Security) users: ComboFix will not run until AVG/CA Internet Security is uninstalled as a protective measure against the anti-virus. This is because AVG/CA Internet Security "falsely" detects ComboFix (or its embedded files) as a threat and may remove them resulting in the tool not working correctly which in turn can cause "unpredictable results". Since AVG/CA Internet Security cannot be effectively disabled before running ComboFix, the author recommends you to uninstall AVG/CA Internet Security first.
    Use AppRemover to uninstall it: http://www.appremover.com/
    We can reinstall it when we're done with CF.
    **Note 3: If you receive an error Illegal operation attempted on a registery key that has been marked for deletion, restart computer to fix the issue.
    **Note 4: Some infections may take some significant time to be cured. As long as your computer clock is running Combofix is still working. Be patient.


    Make sure, you re-enable your security programs, when you're done with Combofix.

    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    NOTE.
    If, for some reason, Combofix refuses to run, try the following...

    Delete Combofix file, download fresh one, but rename combofix.exe to your_name.exe BEFORE saving it to your desktop.
    Do NOT run it yet.
    Download Rkill (courtesy of BleepingComputer.com) to your desktop.
    There are 2 different versions. If one of them won't run then download and try to run the other one.
    You only need to get one of these to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.

    rKill.exe: http://www.bleepingcomputer.com/download/rkill/dl/10/
    iExplore.exe (renamed rKill.exe): http://www.bleepingcomputer.com/download/rkill/dl/11/

    Restart computer in safe mode

    • Double-click on the Rkill desktop icon to run the tool.
    • If using Vista or Windows 7 right-click on it and choose Run As Administrator.
    • A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
    • If not, delete the file, then download and use the one provided in Link 2.
    • Do not reboot until instructed.
    • If the tool does not run from any of the links provided, please let me know.

    When the scan is done Notepad will open with rKill.txt log.
    NOTE. rKill.txt log will also be present on your desktop.

    Once you've gotten one of them to run, immediately run your_name.exe by double clicking on it.

    IF you had to run rKill post BOTH logs, rKill.txt and Combofix.txt.
     
  17. Ryansee

    Ryansee TS Rookie Topic Starter Posts: 19

    ComboFix 14-08-31.01 - Ahmed 09/04/2014 13:18:04.1.8 - x64
    Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.8140.6056 [GMT 3:00]
    Running from: c:\users\Ahmed\Desktop\ComboFix.exe
    AV: Microsoft Security Essentials *Disabled/Updated* {641105E6-77ED-3F35-A304-765193BCB75F}
    SP: Microsoft Security Essentials *Disabled/Updated* {DF70E402-51D7-30BB-99B4-4D23E83BFDE2}
    SP: Spybot - Search and Destroy *Disabled/Updated* {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}
    SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    .
    .
    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    c:\programdata\PCDr\6426\AddOnDownloaded\7c5b1d75-4145-4f69-b184-a8fb559fd417.dll
    c:\programdata\PCDr\6426\AddOnDownloaded\a05de01f-6d84-4008-82c8-44786a5ba980.dll
    c:\programdata\PCDr\6426\AddOnDownloaded\d25002f9-4300-486b-80e9-bcb6abe38487.dll
    c:\programdata\PCDr\6426\AddOnDownloaded\fbd50850-4122-4fe3-a72e-fcbe58a0f196.dll
    c:\programdata\Roaming
    c:\users\Ahmed\AppData\Local\datos.txt
    c:\users\Ahmed\AppData\Roaming\mIRC\logs\status.log
    c:\users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\search-metadata.json
    c:\windows\SysWow64\Config.ini
    .
    .
    ((((((((((((((((((((((((( Files Created from 2014-08-04 to 2014-09-04 )))))))))))))))))))))))))))))))
    .
    .
    2014-09-04 10:27 . 2014-09-04 10:27 -------- d-----w- c:\users\UpdatusUser\AppData\Local\temp
    2014-09-04 10:27 . 2014-09-04 10:27 -------- d-----w- c:\users\Default\AppData\Local\temp
    2014-09-03 13:31 . 2014-08-20 17:43 11319192 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{A6B6F880-9509-41D1-9A63-3FD313AAF5F8}\mpengine.dll
    2014-09-03 12:55 . 2014-09-03 12:55 20672 ----a-w- c:\windows\system32\drivers\GUBootStartup.sys
    2014-09-03 12:55 . 2014-09-03 12:55 -------- d-----w- c:\users\Ahmed\AppData\Roaming\GlarySoft
    2014-09-03 12:55 . 2014-09-03 12:55 -------- d-----w- c:\users\Ahmed\AppData\Roaming\DiskDefrag
    2014-09-03 12:55 . 2014-09-04 08:55 -------- d-----w- c:\program files (x86)\Glary Utilities 5
    2014-09-03 11:10 . 2014-09-03 11:26 -------- d-----w- c:\programdata\Malwarebytes' Anti-Malware (portable)
    2014-09-03 10:43 . 2014-09-03 10:45 33512 ----a-w- c:\windows\SysWow64\drivers\TrueSight.sys
    2014-09-03 10:43 . 2014-09-03 10:43 -------- d-----w- c:\programdata\RogueKiller
    2014-09-03 10:38 . 2014-09-03 10:38 -------- d-----w- c:\users\Ahmed\AppData\Roaming\Baidu
    2014-09-03 10:33 . 2014-09-03 10:33 -------- d-----w- c:\users\Ahmed\AppData\Local\CrashDumps
    2014-09-02 19:38 . 2010-08-30 05:34 536576 ----a-w- c:\windows\SysWow64\sqlite3.dll
    2014-09-02 19:20 . 2014-09-02 19:20 -------- d-----w- C:\logs
    2014-09-02 18:31 . 2014-09-02 18:31 -------- d-----w- C:\TDSSKiller_Quarantine
    2014-09-02 17:04 . 2014-09-02 17:04 -------- d-----w- c:\users\Ahmed\AppData\Roaming\KeePass
    2014-09-02 16:25 . 2014-09-02 16:25 -------- d-----w- c:\programdata\Informer Technologies, Inc
    2014-09-02 16:24 . 2014-09-02 16:39 -------- d-----w- c:\users\Ahmed\AppData\Roaming\Software Informer
    2014-09-02 16:24 . 2014-09-02 16:24 -------- d-----w- c:\program files\Software Informer
    2014-09-02 16:14 . 2014-09-02 16:14 -------- d-----w- c:\program files (x86)\FileHippo.com
    2014-09-02 16:03 . 2014-09-02 16:03 -------- d-----w- c:\program files (x86)\KeePass Password Safe 2
    2014-09-02 16:00 . 2014-09-02 16:02 -------- d-----w- c:\users\Ahmed\AppData\Roaming\Dropbox
    2014-09-02 15:59 . 2014-09-02 15:59 -------- d-----w- c:\users\Ahmed\AppData\Roaming\Gyazo
    2014-09-02 15:58 . 2014-09-02 15:58 -------- d-----w- c:\program files (x86)\SystemRequirementsLab
    2014-09-02 15:54 . 2014-09-02 15:54 -------- d-----w- c:\users\Ahmed\AppData\Roaming\Foxit Software
    2014-09-02 15:54 . 2014-09-02 15:54 -------- d-----w- c:\users\Public\Foxit Software
    2014-09-02 14:22 . 2014-09-02 14:22 -------- d-----w- c:\program files (x86)\Foxit Software
    2014-09-02 14:02 . 2014-09-02 14:02 -------- d-----w- c:\program files\7-Zip
    2014-09-02 14:01 . 2014-09-02 14:01 -------- d-----w- c:\windows\SysWow64\Adobe
    2014-09-02 14:00 . 2014-09-02 14:00 319912 ----a-w- c:\windows\system32\javaws.exe
    2014-09-02 14:00 . 2014-09-02 14:00 111016 ----a-w- c:\windows\system32\WindowsAccessBridge-64.dll
    2014-09-02 14:00 . 2014-09-02 14:00 189352 ----a-w- c:\windows\system32\javaw.exe
    2014-09-02 14:00 . 2014-09-02 14:00 189352 ----a-w- c:\windows\system32\java.exe
    2014-09-02 14:00 . 2014-09-02 14:00 -------- d-----w- c:\program files\Java
    2014-09-02 13:58 . 2014-09-02 13:58 -------- d-----w- c:\program files (x86)\Common Files\Java
    2014-09-02 13:57 . 2014-09-02 13:57 98216 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll
    2014-09-02 13:46 . 2014-09-02 16:39 -------- d---a-w- C:\3590F75ABA9E485486C100C1A9D4FF06ZZ.Z..ZZZZZ....Z
    2014-09-02 13:45 . 2013-09-20 07:49 21040 ----a-w- c:\windows\system32\sdnclean64.exe
    2014-09-02 13:45 . 2014-09-02 13:50 -------- d-----w- c:\programdata\Spybot - Search & Destroy
    2014-09-02 13:45 . 2014-09-02 13:52 -------- d-----w- c:\program files (x86)\Spybot - Search & Destroy 2
    2014-09-02 13:40 . 2014-09-02 13:41 -------- d-----w- c:\program files\Defraggler
    2014-09-02 12:40 . 2014-09-02 12:40 -------- d-----w- C:\SUPERDelete
    2014-09-02 12:38 . 2014-09-02 12:38 -------- d-----w- c:\users\Ahmed\AppData\Roaming\SUPERAntiSpyware.com
    2014-09-02 12:36 . 2014-09-03 22:34 -------- d-----w- c:\program files\SUPERAntiSpyware
    2014-09-02 12:36 . 2014-09-02 12:36 -------- d-----w- c:\programdata\SUPERAntiSpyware.com
    2014-09-02 12:25 . 2014-09-02 12:25 1169712 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{748542A2-DAFC-4239-9186-33CE169A7321}\gapaengine.dll
    2014-09-02 12:25 . 2014-08-20 17:43 11319192 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
    2014-09-02 12:20 . 2014-09-04 10:12 122584 ----a-w- c:\windows\system32\drivers\MBAMSwissArmy.sys
    2014-09-02 12:20 . 2014-09-03 11:08 92888 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys
    2014-09-02 12:20 . 2014-05-12 04:26 63704 ----a-w- c:\windows\system32\drivers\mwac.sys
    2014-09-02 12:20 . 2014-09-02 12:20 -------- d-----w- c:\program files (x86)\Malwarebytes Anti-Malware
    2014-09-02 12:20 . 2014-09-02 12:20 -------- d-----w- c:\program files (x86)\Microsoft Security Client
    2014-09-02 12:19 . 2014-09-02 12:20 -------- d-----w- c:\program files\Microsoft Security Client
    2014-09-02 07:49 . 2014-08-21 03:43 11319192 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{1939B7FD-1B0E-46DC-9ED2-DAA779942156}\mpengine.dll
    2014-08-31 16:04 . 2014-08-31 16:04 -------- d-----w- c:\program files (x86)\psx emulation cheater
    2014-08-28 16:29 . 2014-08-23 00:59 3163648 ----a-w- c:\windows\system32\win32k.sys
    2014-08-28 16:29 . 2014-08-23 02:07 404480 ----a-w- c:\windows\system32\gdi32.dll
    2014-08-28 16:29 . 2014-08-23 01:45 311808 ----a-w- c:\windows\SysWow64\gdi32.dll
    2014-08-25 18:38 . 2014-08-25 18:38 136568 ----a-r- c:\users\Ahmed\AppData\Roaming\Microsoft\Installer\{5A336D74-E680-4986-96F4-E9CEBC784F56}\ShortcutUpdater_DF0BD54B5FA14948AAC4D5BDB1FBFCF2.exe
    2014-08-25 18:38 . 2014-08-25 18:38 300408 ----a-r- c:\users\Ahmed\AppData\Roaming\Microsoft\Installer\{5A336D74-E680-4986-96F4-E9CEBC784F56}\ARPPRODUCTICON.exe
    2014-08-24 23:31 . 2014-08-24 23:34 -------- d-----w- c:\program files (x86)\Daily Alarm Clock
    2014-08-18 02:01 . 2014-03-09 21:48 171160 ----a-w- c:\windows\system32\infocardapi.dll
    2014-08-18 02:01 . 2014-03-09 21:48 1389208 ----a-w- c:\windows\system32\icardagt.exe
    2014-08-18 02:01 . 2014-03-09 21:47 99480 ----a-w- c:\windows\SysWow64\infocardapi.dll
    2014-08-18 02:01 . 2014-03-09 21:47 619672 ----a-w- c:\windows\SysWow64\icardagt.exe
    2014-08-18 02:01 . 2014-06-30 22:24 8856 ----a-w- c:\windows\system32\icardres.dll
    2014-08-18 02:01 . 2014-06-30 22:14 8856 ----a-w- c:\windows\SysWow64\icardres.dll
    2014-08-18 02:00 . 2014-06-06 06:16 35480 ----a-w- c:\windows\SysWow64\TsWpfWrp.exe
    2014-08-18 02:00 . 2014-06-06 06:12 35480 ----a-w- c:\windows\system32\TsWpfWrp.exe
    2014-08-13 20:28 . 2014-07-09 02:03 7168 ----a-w- c:\windows\system32\KBDTAT.DLL
    2014-08-13 20:28 . 2014-07-09 01:31 7168 ----a-w- c:\windows\SysWow64\KBDYAK.DLL
    2014-08-13 20:28 . 2014-07-09 02:03 7168 ----a-w- c:\windows\system32\KBDYAK.DLL
    2014-08-13 20:28 . 2014-07-09 02:03 7168 ----a-w- c:\windows\system32\KBDRU1.DLL
    2014-08-13 20:28 . 2014-07-09 02:03 6656 ----a-w- c:\windows\system32\KBDRU.DLL
    2014-08-13 20:28 . 2014-07-09 02:03 7168 ----a-w- c:\windows\system32\KBDBASH.DLL
    2014-08-13 20:28 . 2014-07-09 01:31 6656 ----a-w- c:\windows\SysWow64\KBDBASH.DLL
    2014-08-13 20:28 . 2014-07-16 03:23 2048 ----a-w- c:\windows\system32\tzres.dll
    2014-08-13 20:28 . 2014-07-16 02:46 2048 ----a-w- c:\windows\SysWow64\tzres.dll
    2014-08-13 20:26 . 2014-07-25 13:00 139264 ----a-w- c:\windows\system32\ieUnatt.exe
    2014-08-13 20:24 . 2014-07-14 02:02 1216000 ----a-w- c:\windows\system32\rpcrt4.dll
    2014-08-13 20:24 . 2014-07-14 01:40 664064 ----a-w- c:\windows\SysWow64\rpcrt4.dll
    2014-08-12 02:28 . 2014-08-12 02:28 -------- d-----w- c:\users\Ahmed\AppData\Local\Installer
    2014-08-12 02:20 . 2014-08-12 02:20 -------- d-sh--w- c:\users\Ahmed\AppData\Local\EmieUserList
    2014-08-12 02:20 . 2014-08-12 02:20 -------- d-sh--w- c:\users\Ahmed\AppData\Local\EmieSiteList
    2014-08-12 02:20 . 2014-08-12 02:20 14304 ----a-w- c:\programdata\Duplicaterecord.js
    2014-08-12 02:11 . 2014-08-12 02:11 172032 ----a-w- c:\windows\SysWow64\AniGIF.ocx
    2014-08-12 02:10 . 2014-08-12 02:10 -------- d-----w- c:\program files (x86)\PCSXR
    2014-08-11 18:12 . 2013-05-19 07:02 39168 ----a-w- c:\windows\system32\drivers\ScpVBus.sys
    2014-08-11 18:12 . 2013-01-07 14:56 1002728 ----a-w- c:\windows\system32\WinUSBCoInstaller2.dll
    2014-08-11 18:11 . 2014-09-02 18:38 -------- d-----w- c:\program files\Scarlet.Crush Productions
    2014-08-10 21:29 . 2014-08-10 21:29 -------- d-----w- c:\users\Ahmed\AppData\Roaming\ImgBurn
    2014-08-10 21:22 . 2014-08-10 21:22 -------- d-----w- c:\users\Ahmed\AppData\Roaming\AVG
    2014-08-10 21:22 . 2014-08-10 21:22 -------- d-----w- c:\users\Ahmed\AppData\Local\AVG
    2014-08-10 21:20 . 2014-08-10 22:30 -------- d-----w- c:\programdata\AVG
    2014-08-10 21:20 . 2014-08-10 21:20 -------- d-sh--w- c:\programdata\{01BD4FC9-2F86-4706-A62E-774BB7E9D308}
    2014-08-10 21:20 . 2014-08-10 21:20 -------- d--h--w- c:\programdata\Common Files
    2014-08-10 21:18 . 2014-08-10 21:18 -------- d-----w- c:\program files (x86)\ImgBurn
    2014-08-10 20:56 . 2014-08-10 20:59 -------- d-----w- c:\program files (x86)\PCSX2 1.2.1
    2014-08-09 18:36 . 2014-08-09 18:36 455328 ----a-w- c:\windows\SysWow64\msvcp120.dll
    2014-08-09 18:36 . 2014-08-09 18:36 660128 ----a-w- c:\windows\system32\msvcp120.dll
    2014-08-09 18:35 . 2014-08-09 18:35 -------- d-----w- c:\programdata\Logs
    .
    .
    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2014-08-14 03:07 . 2013-06-07 14:23 99218768 ----a-w- c:\windows\system32\MRT.exe
    2014-07-19 17:59 . 2014-07-19 17:59 31232 ----a-w- c:\windows\system32\drivers\tap0901.sys
    2014-07-09 14:15 . 2013-10-15 01:03 71344 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
    2014-07-09 14:15 . 2013-10-15 01:03 699056 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
    2014-06-18 02:18 . 2014-07-09 17:03 692736 ----a-w- c:\windows\system32\osk.exe
    2014-06-18 01:51 . 2014-07-09 17:03 646144 ----a-w- c:\windows\SysWow64\osk.exe
    2014-06-13 02:11 . 2014-07-25 16:22 70912 ----a-w- c:\windows\system32\drivers\Bndef.sys
    .
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4
    .
    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt1"]
    @="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
    [HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
    2014-08-18 17:22 131480 ----a-w- c:\users\Ahmed\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll
    .
    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt2"]
    @="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
    [HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
    2014-08-18 17:22 131480 ----a-w- c:\users\Ahmed\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll
    .
    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt3"]
    @="{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}"
    [HKEY_CLASSES_ROOT\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}]
    2014-08-18 17:22 131480 ----a-w- c:\users\Ahmed\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll
    .
    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt4"]
    @="{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}"
    [HKEY_CLASSES_ROOT\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}]
    2014-08-18 17:22 131480 ----a-w- c:\users\Ahmed\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll
    .
    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt5"]
    @="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
    [HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
    2014-08-18 17:22 131480 ----a-w- c:\users\Ahmed\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll
    .
    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt6"]
    @="{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}"
    [HKEY_CLASSES_ROOT\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}]
    2014-08-18 17:22 131480 ----a-w- c:\users\Ahmed\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll
    .
    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt7"]
    @="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
    [HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
    2014-08-18 17:22 131480 ----a-w- c:\users\Ahmed\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll
    .
    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt8"]
    @="{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}"
    [HKEY_CLASSES_ROOT\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}]
    2014-08-18 17:22 131480 ----a-w- c:\users\Ahmed\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll
    .
    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\1TortoiseNormal]
    @="{C5994560-53D9-4125-87C9-F193FC689CB2}"
    [HKEY_CLASSES_ROOT\CLSID\{C5994560-53D9-4125-87C9-F193FC689CB2}]
    2011-06-13 08:20 64792 ----a-w- c:\program files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll
    .
    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\2TortoiseModified]
    @="{C5994561-53D9-4125-87C9-F193FC689CB2}"
    [HKEY_CLASSES_ROOT\CLSID\{C5994561-53D9-4125-87C9-F193FC689CB2}]
    2011-06-13 08:20 64792 ----a-w- c:\program files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll
    .
    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\3TortoiseConflict]
    @="{C5994562-53D9-4125-87C9-F193FC689CB2}"
    [HKEY_CLASSES_ROOT\CLSID\{C5994562-53D9-4125-87C9-F193FC689CB2}]
    2011-06-13 08:20 64792 ----a-w- c:\program files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll
    .
    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\4TortoiseLocked]
    @="{C5994563-53D9-4125-87C9-F193FC689CB2}"
    [HKEY_CLASSES_ROOT\CLSID\{C5994563-53D9-4125-87C9-F193FC689CB2}]
    2011-06-13 08:20 64792 ----a-w- c:\program files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll
    .
    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\5TortoiseReadOnly]
    @="{C5994564-53D9-4125-87C9-F193FC689CB2}"
    [HKEY_CLASSES_ROOT\CLSID\{C5994564-53D9-4125-87C9-F193FC689CB2}]
    2011-06-13 08:20 64792 ----a-w- c:\program files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll
    .
    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\6TortoiseDeleted]
    @="{C5994565-53D9-4125-87C9-F193FC689CB2}"
    [HKEY_CLASSES_ROOT\CLSID\{C5994565-53D9-4125-87C9-F193FC689CB2}]
    2011-06-13 08:20 64792 ----a-w- c:\program files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll
    .
    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\7TortoiseAdded]
    @="{C5994566-53D9-4125-87C9-F193FC689CB2}"
    [HKEY_CLASSES_ROOT\CLSID\{C5994566-53D9-4125-87C9-F193FC689CB2}]
    2011-06-13 08:20 64792 ----a-w- c:\program files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll
    .
    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\8TortoiseIgnored]
    @="{C5994567-53D9-4125-87C9-F193FC689CB2}"
    [HKEY_CLASSES_ROOT\CLSID\{C5994567-53D9-4125-87C9-F193FC689CB2}]
    2011-06-13 08:20 64792 ----a-w- c:\program files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll
    .
    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\9TortoiseUnversioned]
    @="{C5994568-53D9-4125-87C9-F193FC689CB2}"
    [HKEY_CLASSES_ROOT\CLSID\{C5994568-53D9-4125-87C9-F193FC689CB2}]
    2011-06-13 08:20 64792 ----a-w- c:\program files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll
    .
    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2014-08-14 7762712]
    "F.lux"="c:\users\Ahmed\AppData\Local\FluxSoftware\Flux\flux.exe" [2013-10-15 1016712]
    "GUDelayStartup"="c:\program files (x86)\Glary Utilities 5\StartupManager.exe" [2014-09-01 37152]
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
    "SDTray"="c:\program files (x86)\Spybot - Search & Destroy 2\SDTray.exe" [2014-06-24 4101576]
    "AlienwareOn-ScreenDisplay"="c:\program files (x86)\Alienware On-Screen Display\AlienwareOn-ScreenDisplay.exe" [2011-01-10 1545584]
    "KeePass 2 PreLoad"="c:\program files (x86)\KeePass Password Safe 2\KeePass.exe" [2014-07-06 2117632]
    "NUSB3MON"="c:\program files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe" [2011-02-01 113288]
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
    "ConsentPromptBehaviorUser"= 3 (0x3)
    "EnableUIADesktopToggle"= 0 (0x0)
    .
    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
    "LoadAppInit_DLLs"=1 (0x1)
    "AppInit_DLLs"=c:\windows\SysWOW64\nvinit.dll
    .
    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
    BootExecute REG_MULTI_SZ autocheck autochk *
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]
    @=""
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
    @="Service"
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\security center]
    "AutoUpdateDisableNotify"=dword:00000001
    .
    R1 Bfilter;Baidu Antivirus Minifilter Driver;c:\windows\System32\drivers\Bfilter.sys;c:\windows\SYSNATIVE\drivers\Bfilter.sys [x]
    R1 Bfmon;Baidu FS Monitor Driver;c:\windows\System32\drivers\Bfmon.sys;c:\windows\SYSNATIVE\drivers\Bfmon.sys [x]
    R1 Bnbase;Bnbase;c:\windows\system32\drivers\bnbasex64.sys;c:\windows\SYSNATIVE\drivers\bnbasex64.sys [x]
    R1 Bndef;Baidu NetDefense;c:\windows\System32\drivers\bndef64.sys;c:\windows\SYSNATIVE\drivers\bndef64.sys [x]
    R1 Bprotect;Baidu Protect;c:\windows\System32\drivers\Bprotect.sys;c:\windows\SYSNATIVE\drivers\Bprotect.sys [x]
    R1 MpKsl01f98610;MpKsl01f98610;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{6BB67563-7113-4011-AED3-D722B41E2734}\MpKsl01f98610.sys;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{6BB67563-7113-4011-AED3-D722B41E2734}\MpKsl01f98610.sys [x]
    R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
    R2 libusbd;LibUsb-Win32 - Daemon, Version 0.1.10.1;c:\windows\system32\libusbd-nt.exe;c:\windows\SYSNATIVE\libusbd-nt.exe [x]
    R2 LMIInfo;LogMeIn Kernel Information Provider;c:\program files (x86)\LogMeIn\x64\RaInfo.sys;c:\program files (x86)\LogMeIn\x64\RaInfo.sys [x]
    R2 SDScannerService;Spybot-S&D 2 Scanner Service;c:\program files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe;c:\program files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [x]
    R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
    R3 BprotectEx;Baidu ProtectEx;c:\windows\System32\drivers\BprotectEx.sys;c:\windows\SYSNATIVE\drivers\BprotectEx.sys [x]
    R3 CoordinatorServiceHost;SW Distributed TS Coordinator Service;c:\program files\SolidWorks Corp\SolidWorks\swScheduler\DTSCoordinatorService.exe;c:\program files\SolidWorks Corp\SolidWorks\swScheduler\DTSCoordinatorService.exe [x]
    R3 FLEXnet Licensing Service 64;FLEXnet Licensing Service 64;c:\program files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe;c:\program files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe [x]
    R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
    R3 libusb0;LibUsb-Win32 - Kernel Driver, Version 0.1.10.1;c:\windows\system32\drivers\libusb0.sys;c:\windows\SYSNATIVE\drivers\libusb0.sys [x]
    R3 MyWiFiDHCPDNS;Wireless PAN DHCP Server;c:\program files\Intel\WiFi\bin\PanDhcpDns.exe;c:\program files\Intel\WiFi\bin\PanDhcpDns.exe [x]
    R3 Netaapl;Apple Mobile Device Ethernet Service;c:\windows\system32\DRIVERS\netaapl64.sys;c:\windows\SYSNATIVE\DRIVERS\netaapl64.sys [x]
    R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys;c:\windows\SYSNATIVE\DRIVERS\NisDrvWFP.sys [x]
    R3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\NisSrv.exe;c:\program files\Microsoft Security Client\NisSrv.exe [x]
    R3 PCFApiUtil;PCFApiUtil;c:\program files (x86)\Baidu Security\PC Faster\4.0.0.0\PCFApiUtil64.sys;c:\program files (x86)\Baidu Security\PC Faster\4.0.0.0\PCFApiUtil64.sys [x]
    R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]
    R3 rzudd;Razer Mouse Driver;c:\windows\system32\DRIVERS\rzudd.sys;c:\windows\SYSNATIVE\DRIVERS\rzudd.sys [x]
    R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
    R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
    R3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\DRIVERS\wdcsam64.sys;c:\windows\SYSNATIVE\DRIVERS\wdcsam64.sys [x]
    R4 TeamViewer9;TeamViewer 9;c:\program files (x86)\TeamViewer\Version9\TeamViewer_Service.exe;c:\program files (x86)\TeamViewer\Version9\TeamViewer_Service.exe [x]
    R4 TunngleService;TunngleService;c:\program files (x86)\Tunngle\TnglCtrl.exe;c:\program files (x86)\Tunngle\TnglCtrl.exe [x]
    R4 YouTubeAcceleratorService;YouTubeAcceleratorService;c:\progra~2\YOUTUB~1\YouTubeAcceleratorService.exe;c:\progra~2\YOUTUB~1\YouTubeAcceleratorService.exe [x]
    S0 EMSC;COMPAL Embedded System Control;c:\windows\system32\DRIVERS\EMSC.SYS;c:\windows\SYSNATIVE\DRIVERS\EMSC.SYS [x]
    S0 nvpciflt;nvpciflt;c:\windows\system32\DRIVERS\nvpciflt.sys;c:\windows\SYSNATIVE\DRIVERS\nvpciflt.sys [x]
    S0 stdcfltn;Disk Class Filter Driver for Accelerometer;c:\windows\system32\DRIVERS\stdcfltn.sys;c:\windows\SYSNATIVE\DRIVERS\stdcfltn.sys [x]
    S1 GUBootStartup;GUBootStartup;c:\windows\System32\drivers\GUBootStartup.sys;c:\windows\SYSNATIVE\drivers\GUBootStartup.sys [x]
    S1 nvkflt;nvkflt;c:\windows\system32\DRIVERS\nvkflt.sys;c:\windows\SYSNATIVE\DRIVERS\nvkflt.sys [x]
    S1 RzFilter;RzFilter;c:\windows\system32\drivers\RzFilter.sys;c:\windows\SYSNATIVE\drivers\RzFilter.sys [x]
    S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV64.SYS;c:\program files\SUPERAntiSpyware\SASDIFSV64.SYS [x]
    S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL64.SYS;c:\program files\SUPERAntiSpyware\SASKUTIL64.SYS [x]
    S2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCORE64.EXE;c:\program files\SUPERAntiSpyware\SASCORE64.EXE [x]
    S2 c2cautoupdatesvc;Skype Click to Call Updater;c:\program files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe;c:\program files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [x]
    S2 c2cpnrsvc;Skype Click to Call PNR Service;c:\program files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe;c:\program files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [x]
    S2 FoxitCloudUpdateService;Foxit Cloud Safe Update Service;c:\program files (x86)\Foxit Software\Foxit Reader\Foxit Cloud\FCUpdateService.exe;c:\program files (x86)\Foxit Software\Foxit Reader\Foxit Cloud\FCUpdateService.exe [x]
    S2 NvNetworkService;NVIDIA Network Service;c:\program files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe;c:\program files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [x]
    S2 NvStreamSvc;NVIDIA Streamer Service;c:\program files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe;c:\program files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [x]
    S2 RzOvlMon;Razer Overlay Subsystem Emergency Service;c:\program files (x86)\Razer\Core\64bit\rzovlmon.exe;c:\program files (x86)\Razer\Core\64bit\rzovlmon.exe [x]
    S2 SDUpdateService;Spybot-S&D 2 Updating Service;c:\program files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe;c:\program files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [x]
    S2 SDWSCService;Spybot-S&D 2 Security Center Service;c:\program files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe;c:\program files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [x]
    S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [x]
    S2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [x]
    S3 Acceler;Accelerometer Service;c:\windows\system32\DRIVERS\Accelern.sys;c:\windows\SYSNATIVE\DRIVERS\Accelern.sys [x]
    S3 dcdbas;System Management Driver;c:\windows\system32\DRIVERS\dcdbas64.sys;c:\windows\SYSNATIVE\DRIVERS\dcdbas64.sys [x]
    S3 IntcDAud;Intel(R) Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys;c:\windows\SYSNATIVE\DRIVERS\IntcDAud.sys [x]
    S3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\L1C62x64.sys;c:\windows\SYSNATIVE\DRIVERS\L1C62x64.sys [x]
    S3 MotioninJoyXFilter;MotioninJoy Virtual Xinput device Filter Driver;c:\windows\system32\DRIVERS\MijXfilt.sys;c:\windows\SYSNATIVE\DRIVERS\MijXfilt.sys [x]
    S3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\nusb3hub.sys;c:\windows\SYSNATIVE\DRIVERS\nusb3hub.sys [x]
    S3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;c:\windows\system32\DRIVERS\nusb3xhc.sys;c:\windows\SYSNATIVE\DRIVERS\nusb3xhc.sys [x]
    S3 nvvad_WaveExtensible;NVIDIA Virtual Audio Device (Wave Extensible) (WDM);c:\windows\system32\drivers\nvvad64v.sys;c:\windows\SYSNATIVE\drivers\nvvad64v.sys [x]
    S3 RSPCIESTOR;Realtek PCIE CardReader Driver;c:\windows\system32\DRIVERS\RtsPStor.sys;c:\windows\SYSNATIVE\DRIVERS\RtsPStor.sys [x]
    S3 RzDxgk;RzDxgk;c:\windows\system32\drivers\RzDxgk.sys;c:\windows\SYSNATIVE\drivers\RzDxgk.sys [x]
    S3 ScpVBus;Scp Virtual Bus Driver;c:\windows\system32\DRIVERS\ScpVBus.sys;c:\windows\SYSNATIVE\DRIVERS\ScpVBus.sys [x]
    S3 tap0901t;TAP-Win32 Adapter V9 (Tunngle);c:\windows\system32\DRIVERS\tap0901t.sys;c:\windows\SYSNATIVE\DRIVERS\tap0901t.sys [x]
    S3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys;c:\windows\SYSNATIVE\Drivers\usbaapl64.sys [x]
    .
    .
    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
    2014-09-03 10:05 1096520 ----a-w- c:\program files (x86)\Google\Chrome\Application\37.0.2062.103\Installer\chrmstp.exe
    .
    Contents of the 'Scheduled Tasks' folder
    .
    2014-09-04 c:\windows\Tasks\Adobe Flash Player Updater.job
    - c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-10-15 14:15]
    .
    2014-09-04 c:\windows\Tasks\GlaryInitialize 5.job
    - c:\program files (x86)\Glary Utilities 5\Initialize.exe [2014-09-01 06:13]
    .
    2014-09-04 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
    - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-06-07 10:32]
    .
    2014-09-04 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
    - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-06-07 10:32]
    .
    .
    --------- X64 Entries -----------
    .
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt1"]
    @="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
    [HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
    2014-08-18 17:22 164760 ----a-w- c:\users\Ahmed\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt2"]
    @="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
    [HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
    2014-08-18 17:22 164760 ----a-w- c:\users\Ahmed\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt3"]
    @="{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}"
    [HKEY_CLASSES_ROOT\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}]
    2014-08-18 17:22 164760 ----a-w- c:\users\Ahmed\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt4"]
    @="{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}"
    [HKEY_CLASSES_ROOT\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}]
    2014-08-18 17:22 164760 ----a-w- c:\users\Ahmed\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt5"]
    @="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
    [HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
    2014-08-18 17:22 164760 ----a-w- c:\users\Ahmed\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt6"]
    @="{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}"
    [HKEY_CLASSES_ROOT\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}]
    2014-08-18 17:22 164760 ----a-w- c:\users\Ahmed\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt7"]
    @="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
    [HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
    2014-08-18 17:22 164760 ----a-w- c:\users\Ahmed\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt8"]
    @="{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}"
    [HKEY_CLASSES_ROOT\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}]
    2014-08-18 17:22 164760 ----a-w- c:\users\Ahmed\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\1TortoiseNormal]
    @="{C5994560-53D9-4125-87C9-F193FC689CB2}"
    [HKEY_CLASSES_ROOT\CLSID\{C5994560-53D9-4125-87C9-F193FC689CB2}]
    2011-06-13 08:20 75544 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\2TortoiseModified]
    @="{C5994561-53D9-4125-87C9-F193FC689CB2}"
    [HKEY_CLASSES_ROOT\CLSID\{C5994561-53D9-4125-87C9-F193FC689CB2}]
    2011-06-13 08:20 75544 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\3TortoiseConflict]
    @="{C5994562-53D9-4125-87C9-F193FC689CB2}"
    [HKEY_CLASSES_ROOT\CLSID\{C5994562-53D9-4125-87C9-F193FC689CB2}]
    2011-06-13 08:20 75544 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\4TortoiseLocked]
    @="{C5994563-53D9-4125-87C9-F193FC689CB2}"
    [HKEY_CLASSES_ROOT\CLSID\{C5994563-53D9-4125-87C9-F193FC689CB2}]
    2011-06-13 08:20 75544 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\5TortoiseReadOnly]
    @="{C5994564-53D9-4125-87C9-F193FC689CB2}"
    [HKEY_CLASSES_ROOT\CLSID\{C5994564-53D9-4125-87C9-F193FC689CB2}]
    2011-06-13 08:20 75544 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\6TortoiseDeleted]
    @="{C5994565-53D9-4125-87C9-F193FC689CB2}"
    [HKEY_CLASSES_ROOT\CLSID\{C5994565-53D9-4125-87C9-F193FC689CB2}]
    2011-06-13 08:20 75544 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\7TortoiseAdded]
    @="{C5994566-53D9-4125-87C9-F193FC689CB2}"
    [HKEY_CLASSES_ROOT\CLSID\{C5994566-53D9-4125-87C9-F193FC689CB2}]
    2011-06-13 08:20 75544 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\8TortoiseIgnored]
    @="{C5994567-53D9-4125-87C9-F193FC689CB2}"
    [HKEY_CLASSES_ROOT\CLSID\{C5994567-53D9-4125-87C9-F193FC689CB2}]
    2011-06-13 08:20 75544 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\9TortoiseUnversioned]
    @="{C5994568-53D9-4125-87C9-F193FC689CB2}"
    [HKEY_CLASSES_ROOT\CLSID\{C5994568-53D9-4125-87C9-F193FC689CB2}]
    2011-06-13 08:20 75544 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Command Center Controllers"="c:\program files\Alienware\Command Center\AWCCStartupOrchestrator.exe" [2012-06-15 12656]
    "ShadowPlay"="c:\windows\system32\nvspcap64.dll" [2014-02-05 1179576]
    "NvBackend"="c:\program files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe" [2014-02-05 2234144]
    "MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2014-03-11 1271072]
    "IntelWireless"="c:\program files\Common Files\Intel\WirelessCommon\iFrmewrk.exe" [2010-12-17 1933584]
    "Persistence"="c:\windows\system32\igfxpers.exe" [2013-11-06 442328]
    "IgfxTray"="c:\windows\system32\igfxtray.exe" [2013-11-06 171992]
    "FreeFallProtection"="c:\program files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe" [2010-12-17 703088]
    "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2013-11-06 399832]
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
    "AppInit_DLLs"=c:\windows\System32\nvinitx.dll
    .
    ------- Supplementary Scan -------
    .
    uLocal Page = c:\windows\system32\blank.htm
    mDefault_Page_URL = hxxp://www.google.com
    mStart Page = hxxp://www.google.com
    mLocal Page = c:\windows\SysWOW64\blank.htm
    IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~3\Office12\EXCEL.EXE/3000
    Trusted Zone: dell.com
    TCP: DhcpNameServer = 192.168.1.1 192.168.1.1
    TCP: Interfaces\{CC4F8F04-1967-40BA-ACB9-D35D82530A16}: NameServer = 41.128.225.225,42.128.225.226
    FF - ProfilePath - c:\users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\
    FF - prefs.js: browser.search.selectedEngine - Bing
    FF - prefs.js: keyword.URL - hxxp://www.bing.com/search?FORM=UP97DF&PC=UP97&q=
    .
    - - - - ORPHANS REMOVED - - - -
    .
    Wow6432Node-HKLM-Run-<NO NAME> - (no file)
    Wow6432Node-HKU-Default-RunOnce-SPReview - c:\windows\System32\SPReview\SPReview.exe
    Notify-SDWinLogon - SDWinLogon.dll
    SafeBoot-58754566.sys
    HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
    ShellIconOverlayIdentifiers-{472083B0-C522-11CF-8763-00608CC02F24} - (no file)
    HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe
    AddRemove-Clownfish - c:\program files (x86)\Clownfish\uninstall.exe
    AddRemove-DaleSearch Chrome Toolbar - c:\users\Ahmed\AppData\Roaming\BabSolution\Shared\GUninstaller.exe
    AddRemove-Debut - c:\program files (x86)\NCH Software\Debut\debut.exe
    AddRemove-YouTube Accelerator - c:\program files (x86)\YouTube Accelerator\YTAUninstall.exe
    .
    .
    .
    --------------------- LOCKED REGISTRY KEYS ---------------------
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
    @Denied: (A 2) (Everyone)
    @="FlashBroker"
    "LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_14_0_0_145_ActiveX.exe,-101"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
    "Enabled"=dword:00000001
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
    @="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_14_0_0_145_ActiveX.exe"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
    @Denied: (A 2) (Everyone)
    @="IFlashBroker5"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
    @="{00020424-0000-0000-C000-000000000046}"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
    "Version"="1.0"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
    @Denied: (A 2) (Everyone)
    @="FlashBroker"
    "LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_14_0_0_145_ActiveX.exe,-101"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
    "Enabled"=dword:00000001
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_14_0_0_145_ActiveX.exe"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
    @Denied: (A 2) (Everyone)
    @="Shockwave Flash Object"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_14_0_0_145.ocx"
    "ThreadingModel"="Apartment"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
    @="0"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
    @="ShockwaveFlash.ShockwaveFlash.14"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_14_0_0_145.ocx, 1"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
    @="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
    @="1.0"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
    @="ShockwaveFlash.ShockwaveFlash"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
    @Denied: (A 2) (Everyone)
    @="Macromedia Flash Factory Object"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_14_0_0_145.ocx"
    "ThreadingModel"="Apartment"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
    @="FlashFactory.FlashFactory.1"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_14_0_0_145.ocx, 1"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
    @="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
    @="1.0"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
    @="FlashFactory.FlashFactory"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
    @Denied: (A 2) (Everyone)
    @="IFlashBroker5"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
    @="{00020424-0000-0000-C000-000000000046}"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
    "Version"="1.0"
    .
    Completion time: 2014-09-04 13:30:14
    ComboFix-quarantined-files.txt 2014-09-04 10:30
    .
    Pre-Run: 372,635,512,832 bytes free
    Post-Run: 372,298,461,184 bytes free
    .
    - - End Of File - - 19CFFAADC5F431906B71481646A0460A
    A36C5E4F47E84449FF07ED3517B43A31
     
  18. Broni

    Broni Malware Annihilator Posts: 47,048   +256

    [​IMG] Please download AdwCleaner by Xplode onto your desktop.
    • Close all open programs and internet browsers.
    • Double click on adwcleaner.exe to run the tool.
    • Click on Scan button.
    • When the scan has finished click on Clean button.
    • Your computer will be rebooted automatically. A text file will open after the restart.
    • Please post the contents of that logfile with your next reply.
    • You can find the logfile at C:\AdwCleaner[S1].txt as well.

    [​IMG] Please download Junkware Removal Tool to your desktop.
    • Shut down your protection software now to avoid potential conflicts.
    • Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
    • The tool will open and start scanning your system.
    • Please be patient as this can take a while to complete depending on your system's specifications.
    • On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
    • Post the contents of JRT.txt into your next message.

    [​IMG] Please download Farbar Recovery Scan Tool and save it to your Desktop.

    Note: You need to run the version compatibale with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.
    • Double-click to run it. When the tool opens click Yes to disclaimer.
    • Press Scan button.
    • It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
    • The first time the tool is run, it makes also another log (Addition.txt). Please copy and paste it to your reply.
     
  19. Ryansee

    Ryansee TS Rookie Topic Starter Posts: 19

    update: During the cursor and black screen problem I saw a cmd screen running stuff from system32?? I couldnt read it fast enough.

    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    Junkware Removal Tool (JRT) by Thisisu
    Version: 6.1.4 (04.06.2014:1)
    OS: Windows 7 Home Premium x64
    Ran by Ahmed on Fri 09/05/2014 at 13:16:24.00
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




    ~~~ Services



    ~~~ Registry Values



    ~~~ Registry Keys

    Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\baidu
    Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\AskMrRobot-Setup_RASAPI32
    Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\AskMrRobot-Setup_RASMANCS
    Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\AskMrRobot-Setup_RASAPI32
    Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\AskMrRobot-Setup_RASMANCS



    ~~~ Files



    ~~~ Folders

    Successfully deleted: [Folder] "C:\Users\Ahmed\AppData\Roaming\software informer"
    Successfully deleted: [Folder] "C:\Windows\syswow64\ai_recyclebin"



    ~~~ FireFox

    Emptied folder: C:\Users\Ahmed\AppData\Roaming\mozilla\firefox\profiles\8trc4n2o.default\minidumps [2 files]



    ~~~ Event Viewer Logs were cleared





    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    Scan was completed on Fri 09/05/2014 at 13:23:13.28
    End of JRT log
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    # AdwCleaner v3.309 - Report created 05/09/2014 at 13:05:32
    # Updated 02/09/2014 by Xplode
    # Operating System : Windows 7 Home Premium Service Pack 1 (64 bits)
    # Username : Ahmed - AHMED-PC
    # Running from : C:\Users\Ahmed\Desktop\Week 1\adwcleaner_3.309.exe
    # Option : Clean

    ***** [ Services ] *****


    ***** [ Files / Folders ] *****

    Folder Deleted : C:\Users\Ahmed\AppData\Roaming\baidu
    Folder Deleted : C:\Users\Public\Documents\baidu
    Folder Deleted : C:\Users\Ahmed\AppData\Local\Google\Chrome\User Data\Default\Extensions\gkojfkhlekighikafcpjkiklfbnlmeio
    File Deleted : C:\Users\Ahmed\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.superfish.com_0.localstorage
    File Deleted : C:\Users\Ahmed\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.superfish.com_0.localstorage-journal

    ***** [ Scheduled Tasks ] *****

    Task Deleted : YTAUpdate_logon

    ***** [ Shortcuts ] *****


    ***** [ Registry ] *****


    ***** [ Browsers ] *****

    -\\ Internet Explorer v11.0.9600.17239


    -\\ Mozilla Firefox v30.0 (en-US)

    [ File : C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default\prefs.js ]


    -\\ Google Chrome v37.0.2062.103

    [ File : C:\Users\Ahmed\AppData\Local\Google\Chrome\User Data\Default\preferences ]

    Deleted [Search Provider] : hxxp://search.softonic.com/INF00234/tb_v1?q={searchTerms}&SearchSource=49&cc=&mi=fe5ade77000000000000a088b455621d&toi=16057
    Deleted [Search Provider] : hxxp://search.aol.com/aol/search?q={searchTerms}
    Deleted [Search Provider] : hxxp://www.ask.com/web?q={searchTerms}
    Deleted [Homepage] : hxxp://search.softonic.com/INF00234/tb_v1?SearchSource=48&cc=&mi=fe5ade77000000000000a088b455621d&toi=16057
    Deleted [Extension] : gkojfkhlekighikafcpjkiklfbnlmeio

    *************************

    AdwCleaner[R0].txt - [13775 octets] - [21/10/2013 20:11:40]
    AdwCleaner[R1].txt - [1812 octets] - [02/09/2014 20:28:15]
    AdwCleaner[R2].txt - [10730 octets] - [02/09/2014 22:36:02]
    AdwCleaner[R3].txt - [1948 octets] - [05/09/2014 13:02:11]
    AdwCleaner[S0].txt - [10983 octets] - [21/10/2013 20:12:47]
    AdwCleaner[S1].txt - [10896 octets] - [02/09/2014 22:50:42]
    AdwCleaner[S2].txt - [2184 octets] - [05/09/2014 13:05:32]

    ########## EOF - C:\AdwCleaner\AdwCleaner[S2].txt - [2244 octets] ##########
     
  20. Ryansee

    Ryansee TS Rookie Topic Starter Posts: 19

    Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 03-09-2014 02
    Ran by Ahmed (administrator) on AHMED-PC on 05-09-2014 13:26:01
    Running from C:\Users\Ahmed\Desktop\Week 1
    Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: English (United States)
    Internet Explorer Version 11
    Boot Mode: Normal

    The only official download link for FRST:
    Download link for 32-Bit version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/
    Download link for 64-Bit Version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/
    Download link from any site other than Bleeping Computer is unpermitted or outdated.
    See tutorial for FRST: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

    ==================== Processes (Whitelisted) =================

    (If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

    (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
    (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
    (Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
    (Microsoft Corporation) C:\Windows\System32\wlanext.exe
    (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
    (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
    (SUPERAntiSpyware.com) C:\Program Files\SUPERAntiSpyware\SASCore64.exe
    (Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe
    (Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe
    (Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
    (Foxit Corporation) C:\Program Files (x86)\Foxit Software\Foxit Reader\Foxit Cloud\FCUpdateService.exe
    (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
    (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
    (Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
    (Razer, Inc.) C:\Program Files (x86)\Razer\Core\64bit\RzOvlMon.exe
    (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
    (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
    (Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
    (Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe
    (Intel Corporation) C:\Windows\System32\igfxpers.exe
    (Intel Corporation) C:\Windows\System32\igfxtray.exe
    () C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe
    (Intel Corporation) C:\Windows\System32\hkcmd.exe
    (SUPERAntiSpyware) C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
    (Flux Software LLC) C:\Users\Ahmed\AppData\Local\FluxSoftware\Flux\flux.exe
    (http://tortoisesvn.net) C:\Program Files\TortoiseSVN\bin\TSVNCache.exe
    (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
    (Alienware) C:\Program Files\Alienware\Command Center\AWCCServiceController.exe
    (Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
    () C:\Program Files (x86)\Alienware On-Screen Display\AlienwareOn-ScreenDisplay.exe
    (Renesas Electronics Corporation) C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
    (Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
    (Alienware) C:\Program Files\Alienware\Command Center\AlienwareAlienFXController.exe
    (Glarysoft Ltd) C:\Program Files (x86)\Glary Utilities 5\Integrator.exe
    (Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
    (Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
    (Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
    (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
    (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
    (PC-Doctor, Inc.) C:\Program Files\AlienAutopsy\uaclauncher.exe
    (Microsoft Corporation) C:\Windows\System32\msconfig.exe
    (http://tortoisesvn.net) C:\Program Files\TortoiseSVN\bin\TSVNCache.exe
    (Microsoft Corporation) C:\Windows\System32\SndVol.exe
    (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe


    ==================== Registry (Whitelisted) ==================

    (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

    HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2392872 2011-02-22] (Synaptics Incorporated)
    HKLM\...\Run: [Command Center Controllers] => C:\Program Files\Alienware\Command Center\AWCCStartupOrchestrator.exe [12656 2012-06-15] (Alienware)
    HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart
    HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2234144 2014-02-05] (NVIDIA Corporation)
    HKLM\...\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [1271072 2014-03-11] (Microsoft Corporation)
    HKLM\...\Run: [IntelWireless] => C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe [1933584 2010-12-17] (Intel(R) Corporation)
    HKLM\...\Run: [FreeFallProtection] => C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe [703088 2010-12-17] ()
    HKLM-x32\...\Run: [] => [X]
    HKLM-x32\...\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [4101576 2014-06-24] (Safer-Networking Ltd.)
    HKLM-x32\...\Run: [AlienwareOn-ScreenDisplay] => C:\Program Files (x86)\Alienware On-Screen Display\AlienwareOn-ScreenDisplay.exe [1545584 2011-01-10] ()
    HKLM-x32\...\Run: [KeePass 2 PreLoad] => C:\Program Files (x86)\KeePass Password Safe 2\KeePass.exe [2117632 2014-07-06] (Dominik Reichl)
    HKLM-x32\...\Run: [NUSB3MON] => C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [113288 2011-02-01] (Renesas Electronics Corporation)
    Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
    Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
    HKU\S-1-5-21-4037467554-2527304460-3365707105-1000\...\Run: [SUPERAntiSpyware] => C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe [7762712 2014-08-14] (SUPERAntiSpyware)
    HKU\S-1-5-21-4037467554-2527304460-3365707105-1000\...\Run: [F.lux] => C:\Users\Ahmed\AppData\Local\FluxSoftware\Flux\flux.exe [1016712 2013-10-16] (Flux Software LLC)
    HKU\S-1-5-21-4037467554-2527304460-3365707105-1000\...\Run: [GUDelayStartup] => C:\Program Files (x86)\Glary Utilities 5\StartupManager.exe [37152 2014-09-01] (Glarysoft Ltd)
    HKU\S-1-5-21-4037467554-2527304460-3365707105-1000\...\Policies\Explorer: [NoLowDiskSpaceChecks] 1
    AppInit_DLLs: C:\Windows\System32\nvinitx.dll => C:\Windows\System32\nvinitx.dll [174296 2014-03-04] (NVIDIA Corporation)
    AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll => C:\Windows\SysWOW64\nvinit.dll [148016 2014-03-04] (NVIDIA Corporation)
    ShellIconOverlayIdentifiers: 00avast -> {472083B0-C522-11CF-8763-00608CC02F24} => No File
    ShellIconOverlayIdentifiers: 1TortoiseNormal -> {C5994560-53D9-4125-87C9-F193FC689CB2} => C:\Program Files\Common Files\TortoiseOverlays\TortoiseOverlays.dll (http://tortoisesvn.net)
    ShellIconOverlayIdentifiers: 2TortoiseModified -> {C5994561-53D9-4125-87C9-F193FC689CB2} => C:\Program Files\Common Files\TortoiseOverlays\TortoiseOverlays.dll (http://tortoisesvn.net)
    ShellIconOverlayIdentifiers: 3TortoiseConflict -> {C5994562-53D9-4125-87C9-F193FC689CB2} => C:\Program Files\Common Files\TortoiseOverlays\TortoiseOverlays.dll (http://tortoisesvn.net)
    ShellIconOverlayIdentifiers: 4TortoiseLocked -> {C5994563-53D9-4125-87C9-F193FC689CB2} => C:\Program Files\Common Files\TortoiseOverlays\TortoiseOverlays.dll (http://tortoisesvn.net)
    ShellIconOverlayIdentifiers: 5TortoiseReadOnly -> {C5994564-53D9-4125-87C9-F193FC689CB2} => C:\Program Files\Common Files\TortoiseOverlays\TortoiseOverlays.dll (http://tortoisesvn.net)
    ShellIconOverlayIdentifiers: 6TortoiseDeleted -> {C5994565-53D9-4125-87C9-F193FC689CB2} => C:\Program Files\Common Files\TortoiseOverlays\TortoiseOverlays.dll (http://tortoisesvn.net)
    ShellIconOverlayIdentifiers: 7TortoiseAdded -> {C5994566-53D9-4125-87C9-F193FC689CB2} => C:\Program Files\Common Files\TortoiseOverlays\TortoiseOverlays.dll (http://tortoisesvn.net)
    ShellIconOverlayIdentifiers: 8TortoiseIgnored -> {C5994567-53D9-4125-87C9-F193FC689CB2} => C:\Program Files\Common Files\TortoiseOverlays\TortoiseOverlays.dll (http://tortoisesvn.net)
    ShellIconOverlayIdentifiers: 9TortoiseUnversioned -> {C5994568-53D9-4125-87C9-F193FC689CB2} => C:\Program Files\Common Files\TortoiseOverlays\TortoiseOverlays.dll (http://tortoisesvn.net)
    ShellIconOverlayIdentifiers-x32: 1TortoiseNormal -> {C5994560-53D9-4125-87C9-F193FC689CB2} => C:\Program Files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll (http://tortoisesvn.net)
    ShellIconOverlayIdentifiers-x32: 2TortoiseModified -> {C5994561-53D9-4125-87C9-F193FC689CB2} => C:\Program Files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll (http://tortoisesvn.net)
    ShellIconOverlayIdentifiers-x32: 3TortoiseConflict -> {C5994562-53D9-4125-87C9-F193FC689CB2} => C:\Program Files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll (http://tortoisesvn.net)
    ShellIconOverlayIdentifiers-x32: 4TortoiseLocked -> {C5994563-53D9-4125-87C9-F193FC689CB2} => C:\Program Files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll (http://tortoisesvn.net)
    ShellIconOverlayIdentifiers-x32: 5TortoiseReadOnly -> {C5994564-53D9-4125-87C9-F193FC689CB2} => C:\Program Files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll (http://tortoisesvn.net)
    ShellIconOverlayIdentifiers-x32: 6TortoiseDeleted -> {C5994565-53D9-4125-87C9-F193FC689CB2} => C:\Program Files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll (http://tortoisesvn.net)
    ShellIconOverlayIdentifiers-x32: 7TortoiseAdded -> {C5994566-53D9-4125-87C9-F193FC689CB2} => C:\Program Files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll (http://tortoisesvn.net)
    ShellIconOverlayIdentifiers-x32: 8TortoiseIgnored -> {C5994567-53D9-4125-87C9-F193FC689CB2} => C:\Program Files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll (http://tortoisesvn.net)
    ShellIconOverlayIdentifiers-x32: 9TortoiseUnversioned -> {C5994568-53D9-4125-87C9-F193FC689CB2} => C:\Program Files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll (http://tortoisesvn.net)
    BootExecute: autocheck autochk *

    ==================== Internet (Whitelisted) ====================

    (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

    HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
    HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-US
    HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com/?pc=UP97&ocid=UP97DHP
    HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x0E18639C83EFCE01
    HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = http://g.msn.com/1ewenusDefaultPack/UP97_FRPage
    StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
    BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
    BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)
    BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
    BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
    BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
    BHO-x32: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
    BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
    Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)
    Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
    Handler-x32: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
    Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 192.168.1.1
    Tcpip\..\Interfaces\{CC4F8F04-1967-40BA-ACB9-D35D82530A16}: [NameServer] 41.128.225.225,42.128.225.226

    FireFox:
    ========
    FF ProfilePath: C:\Users\Ahmed\AppData\Roaming\Mozilla\Firefox\Profiles\8trc4n2o.default
    FF DefaultSearchEngine: Bing
    FF SearchEngineOrder.3: Bing
    FF SelectedSearchEngine: Bing
    FF Keyword.URL: hxxp://www.bing.com/search?FORM=UP97DF&PC=UP97&q=
    FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_14_0_0_145.dll ()
    FF Plugin: @java.com/DTPlugin,version=10.67.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
    FF Plugin: @java.com/JavaPlugin,version=10.67.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
    FF Plugin: @microsoft.com/GENUINE -> C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
    FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
    FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_14_0_0_145.dll ()
    FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\SysWOW64\Adobe\Director\np32dsw_1213153.dll (Adobe Systems, Inc.)
    FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
    FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 -> C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
    FF Plugin-x32: @divx.com/DivX Web Player Plug-In,version=1.0.0 -> C:\Program Files (x86)\DivX\DivX Web Player\npdivx32.dll (DivX, LLC)
    FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf -> C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll (Foxit Corporation)
    FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.fdf -> C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll (Foxit Corporation)
    FF Plugin-x32: @java.com/DTPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
    FF Plugin-x32: @java.com/JavaPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
    FF Plugin-x32: @messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.6 -> C:\Program Files (x86)\Yahoo!\Shared\npYState.dll (Yahoo! Inc.)
    FF Plugin-x32: @microsoft.com/GENUINE -> C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
    FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
    FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
    FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
    FF Plugin-x32: @raidcall.en/RCplugin -> C:\Users\Ahmed\AppData\Roaming\raidcall\plugins\nprcplugin.dll (Raidcall)
    FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
    FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
    FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
    FF Plugin HKCU: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\Ahmed\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
    FF Plugin HKCU: ubisoft.com/uplaypc -> C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll ()
    FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi [2014-07-14]

    Chrome:
    =======
    CHR HomePage: Default -> hxxp://search.softonic.com/INF00234/tb_v1?SearchSource=48&cc=&mi=fe5ade77000000000000a088b455621d&toi=16057
    CHR StartupUrls: Default -> "hxxp://www.google.com/", "https://workflowy.com/", "hxxp://www.msn.com/?pc=UP97&ocid=UP97DHP"
    CHR DefaultSearchKeyword: Default -> 32B50213958ADF4D541A0FE15A960D8D6F8C2675D5A348F1A275D9BFFBF93FF8
    CHR DefaultSearchURL: Default -> 2502C45294EF9D0DD0B9F0FF0C27ADCDD2C71B1CA59CAE3E431910BADF2E0BCA
    CHR Profile: C:\Users\Ahmed\AppData\Local\Google\Chrome\User Data\Default
    CHR Extension: (Google Drive) - C:\Users\Ahmed\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-09-21]
    CHR Extension: (CIRC) - C:\Users\Ahmed\AppData\Local\Google\Chrome\User Data\Default\Extensions\bebigdkelppomhhjaaianniiifjbgocn [2014-01-07]
    CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Ahmed\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-05-23]
    CHR Extension: (WOT) - C:\Users\Ahmed\AppData\Local\Google\Chrome\User Data\Default\Extensions\bhmmomiinigofkjcapegjjndpbikblnp [2014-09-02]
    CHR Extension: (Nanny for Google Chrome (TM)) - C:\Users\Ahmed\AppData\Local\Google\Chrome\User Data\Default\Extensions\cljcgchbnolheggdgaeclffeagnnmhno [2013-12-21]
    CHR Extension: (Tampermonkey) - C:\Users\Ahmed\AppData\Local\Google\Chrome\User Data\Default\Extensions\dhdgffkkebhmkfjojejmpbldmpobfkfo [2014-01-25]
    CHR Extension: (AdBlock) - C:\Users\Ahmed\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2013-12-28]
    CHR Extension: (Hola Better Internet) - C:\Users\Ahmed\AppData\Local\Google\Chrome\User Data\Default\Extensions\gkojfkhlekighikafcpjkiklfbnlmeio [2014-09-05]
    CHR Extension: (avast! Online Security) - C:\Users\Ahmed\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2013-09-20]
    CHR Extension: (Hearthstone Linkifier) - C:\Users\Ahmed\AppData\Local\Google\Chrome\User Data\Default\Extensions\hgfciolhdhbagnccplcficnahgleflam [2013-12-19]
    CHR Extension: (Reddit Enhancement Suite) - C:\Users\Ahmed\AppData\Local\Google\Chrome\User Data\Default\Extensions\kbmfpngjjgdllneeigpgjifpgocmfgmb [2013-12-28]
    CHR Extension: (StayFocusd) - C:\Users\Ahmed\AppData\Local\Google\Chrome\User Data\Default\Extensions\laankejkbhbdhmipfmgcngdelahlfoji [2013-12-21]
    CHR Extension: (Skype Click to Call) - C:\Users\Ahmed\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl [2014-07-21]
    CHR Extension: (Sense) - C:\Users\Ahmed\AppData\Local\Google\Chrome\User Data\Default\Extensions\mihcahmgecmbnbcchbopgniflfhgnkff [2014-08-15]
    CHR Extension: (Google Wallet) - C:\Users\Ahmed\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-23]
    CHR Extension: (League Streams: Stream Browser) - C:\Users\Ahmed\AppData\Local\Google\Chrome\User Data\Default\Extensions\plbfmpfcbppeepkmbgphjpgldpgglbob [2013-12-03]
    CHR HKCU\...\Chrome\Extension: [cflheckfmhopnialghigdlggahiomebp] - C:\Users\Ahmed\AppData\Local\CRE\cflheckfmhopnialghigdlggahiomebp.crx []
    CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\ChromeExtension\skype_chrome_extension.crx [2014-07-14]
    CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

    ==================== Services (Whitelisted) =================

    (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

    R2 !SASCORE; C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE [172344 2014-07-23] (SUPERAntiSpyware.com)
    R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1390176 2014-07-14] (Microsoft Corporation)
    R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1767520 2014-07-14] (Microsoft Corporation)
    R2 FoxitCloudUpdateService; C:\Program Files (x86)\Foxit Software\Foxit Reader\Foxit Cloud\FCUpdateService.exe [242216 2014-06-17] (Foxit Corporation)
    S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe [73728 2004-10-22] (Macrovision Corporation) [File not signed]
    S2 libusbd; C:\Windows\SysWOW64\libusbd-nt.exe [18944 2005-03-09] (http://libusb-win32.sourceforge.net) [File not signed]
    R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [23808 2014-03-11] (Microsoft Corporation)
    S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [340240 2010-12-17] ()
    S3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [347872 2014-03-11] (Microsoft Corporation)
    R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1593632 2014-02-05] (NVIDIA Corporation)
    R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [16941856 2014-02-05] (NVIDIA Corporation)
    R2 RzOvlMon; C:\Program Files (x86)\Razer\Core\64bit\rzovlmon.exe [32960 2014-04-18] (Razer, Inc.)
    R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1738168 2014-06-24] (Safer-Networking Ltd.)
    R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [2088408 2014-06-27] (Safer-Networking Ltd.)
    R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2014-04-25] (Safer-Networking Ltd.)
    S4 SolidWorks Licensing Service; C:\Program Files (x86)\Common Files\SolidWorks Shared\Service\SolidWorksLicensing.exe [79360 2014-01-22] (SolidWorks) [File not signed]
    S4 TunngleService; C:\Program Files (x86)\Tunngle\TnglCtrl.exe [758224 2013-11-06] (Tunngle.net GmbH)
    S4 YouTubeAcceleratorService; C:\PROGRA~2\YOUTUB~1\YouTubeAcceleratorService.exe -start -scm [X]

    ==================== Drivers (Whitelisted) ====================

    (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

    U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
    R3 dcdbas; C:\Windows\System32\DRIVERS\dcdbas64.sys [38472 2011-02-02] (Dell Inc.)
    R1 GUBootStartup; C:\Windows\System32\drivers\GUBootStartup.sys [20672 2014-09-03] (Glarysoft Ltd)
    S3 libusb0; C:\Windows\SysWOW64\drivers\libusb0.sys [33792 2005-03-09] () [File not signed]
    S4 LMIRfsClientNP; No ImagePath
    R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [268512 2014-01-25] (Microsoft Corporation)
    S3 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [133928 2014-03-11] (Microsoft Corporation)
    R1 nvkflt; C:\Windows\System32\DRIVERS\nvkflt.sys [300320 2014-03-04] (NVIDIA Corporation)
    R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [39200 2013-12-27] (NVIDIA Corporation)
    R3 RzDxgk; C:\Windows\system32\drivers\RzDxgk.sys [129472 2014-04-18] (Razer, Inc.)
    R1 RzFilter; C:\Windows\system32\drivers\RzFilter.sys [74432 2014-04-18] (Razer, Inc.)
    R1 SASDIFSV; C:\Program Files\SUPERAntiSpyware\SASDIFSV64.SYS [14928 2011-07-22] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
    R1 SASKUTIL; C:\Program Files\SUPERAntiSpyware\SASKUTIL64.SYS [12368 2011-07-13] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
    R3 ScpVBus; C:\Windows\System32\DRIVERS\ScpVBus.sys [39168 2013-05-19] (Scarlet.Crush Productions)
    R3 tap0901t; C:\Windows\System32\DRIVERS\tap0901t.sys [31232 2009-09-16] (Tunngle.net)
    U3 TrueSight; C:\Windows\SysWOW64\drivers\TrueSight.sys [33512 2014-09-03] ()
    S1 BAPIDRV; system32\DRIVERS\BAPIDRV64.sys [X]
    S1 Bfilter; \??\C:\Windows\System32\drivers\Bfilter.sys [X]
    S1 Bfmon; \??\C:\Windows\System32\drivers\Bfmon.sys [X]
    S1 Bnbase; System32\drivers\bnbasex64.sys [X]
    S1 Bndef; \??\C:\Windows\System32\drivers\bndef64.sys [X]
    S1 Bprotect; \??\C:\Windows\System32\drivers\Bprotect.sys [X]
    S3 BprotectEx; \??\C:\Windows\System32\drivers\BprotectEx.sys [X]
    S3 catchme; \??\C:\ComboFix\catchme.sys [X]
    S3 IntcAzAudAddService; system32\drivers\RTKVHD64.sys [X]
    S2 LMIInfo; \??\C:\Program Files (x86)\LogMeIn\x64\RaInfo.sys [X]
    S3 PCFApiUtil; \??\C:\Program Files (x86)\Baidu Security\PC Faster\4.0.0.0\PCFApiUtil64.sys [X]
     
  21. Ryansee

    Ryansee TS Rookie Topic Starter Posts: 19

    ==================== NetSvcs (Whitelisted) ===================

    (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


    ==================== One Month Created Files and Folders ========

    (If an entry is included in the fixlist, the file\folder will be moved.)

    2014-09-05 13:25 - 2014-09-05 13:26 - 00000000 ____D () C:\FRST
    2014-09-05 13:23 - 2014-09-05 13:23 - 00001455 _____ () C:\Users\Ahmed\Desktop\JRT.txt
    2014-09-05 13:07 - 2014-09-05 13:07 - 00002324 _____ () C:\Users\Ahmed\Desktop\AdwCleaner[S2].txt
    2014-09-04 15:41 - 2014-09-04 15:41 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MotioninJoy
    2014-09-04 15:41 - 2011-12-07 19:42 - 00328712 _____ (Logitech Inc.) C:\Windows\system32\MijFrc.dll
    2014-09-04 15:28 - 2014-09-04 15:28 - 04117346 _____ () C:\Users\Ahmed\Documents\motioninjoy-0-7-1001-en-win.zip
    2014-09-04 15:00 - 2014-09-04 15:00 - 00000000 ____D () C:\Users\Ahmed\Desktop\New folder (4)
    2014-09-04 15:00 - 2014-09-04 15:00 - 00000000 ____D () C:\Users\Ahmed\Desktop\breath of fire
    2014-09-04 14:47 - 2014-08-21 16:22 - 00023752 _____ (360安全中心) C:\Windows\SysWOW64\Drivers\efimon.sys
    2014-09-04 14:43 - 2014-09-04 14:43 - 162499401 _____ () C:\Users\Ahmed\Desktop\Breath of Fire IV.7z
    2014-09-04 14:36 - 2014-09-05 12:57 - 00000000 ____D () C:\Program Files (x86)\360
    2014-09-04 13:30 - 2014-09-04 13:30 - 00042534 _____ () C:\ComboFix.txt
    2014-09-04 13:16 - 2014-09-04 13:30 - 00000000 ____D () C:\Qoobox
    2014-09-04 13:16 - 2011-06-26 09:45 - 00256000 _____ () C:\Windows\PEV.exe
    2014-09-04 13:16 - 2010-11-07 20:20 - 00208896 _____ () C:\Windows\MBR.exe
    2014-09-04 13:16 - 2009-04-20 07:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
    2014-09-04 13:16 - 2000-08-31 03:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
    2014-09-04 13:16 - 2000-08-31 03:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
    2014-09-04 13:16 - 2000-08-31 03:00 - 00098816 _____ () C:\Windows\sed.exe
    2014-09-04 13:16 - 2000-08-31 03:00 - 00080412 _____ () C:\Windows\grep.exe
    2014-09-04 13:16 - 2000-08-31 03:00 - 00068096 _____ () C:\Windows\zip.exe
    2014-09-04 13:15 - 2014-09-04 13:28 - 00000000 ____D () C:\Windows\erdnt
    2014-09-04 12:59 - 2014-09-04 13:00 - 05576326 ____R (Swearware) C:\Users\Ahmed\Desktop\ComboFix.exe
    2014-09-03 15:55 - 2014-09-05 13:07 - 00000332 _____ () C:\Windows\Tasks\GlaryInitialize 5.job
    2014-09-03 15:55 - 2014-09-05 13:07 - 00000000 ____D () C:\Program Files (x86)\Glary Utilities 5
    2014-09-03 15:55 - 2014-09-03 15:55 - 00020672 _____ (Glarysoft Ltd) C:\Windows\system32\Drivers\GUBootStartup.sys
    2014-09-03 15:55 - 2014-09-03 15:55 - 00002972 _____ () C:\Windows\System32\Tasks\GU5SkipUAC
    2014-09-03 15:55 - 2014-09-03 15:55 - 00002628 _____ () C:\Windows\System32\Tasks\GlaryInitialize 5
    2014-09-03 15:55 - 2014-09-03 15:55 - 00001096 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Glary Utilities 5.lnk
    2014-09-03 15:55 - 2014-09-03 15:55 - 00001084 _____ () C:\Users\Public\Desktop\Glary Utilities 5.lnk
    2014-09-03 15:55 - 2014-09-03 15:55 - 00000000 ____D () C:\Users\Ahmed\AppData\Roaming\GlarySoft
    2014-09-03 15:55 - 2014-09-03 15:55 - 00000000 ____D () C:\Users\Ahmed\AppData\Roaming\DiskDefrag
    2014-09-03 15:55 - 2014-09-03 15:55 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Glary Utilities 5
    2014-09-03 14:10 - 2014-09-03 14:26 - 00000000 ____D () C:\ProgramData\Malwarebytes' Anti-Malware (portable)
    2014-09-03 14:00 - 2014-09-03 14:26 - 00000000 ____D () C:\Users\Ahmed\Desktop\mbar
    2014-09-03 13:59 - 2014-09-03 13:59 - 14349744 _____ (Malwarebytes Corp.) C:\Users\Ahmed\Desktop\mbar-1.07.0.1012.exe
    2014-09-03 13:53 - 2014-09-03 13:54 - 00005349 _____ () C:\Users\Ahmed\Desktop\RKreport_DEL_09032014_135209.log
    2014-09-03 13:43 - 2014-09-03 13:45 - 00033512 _____ () C:\Windows\SysWOW64\Drivers\TrueSight.sys
    2014-09-03 13:43 - 2014-09-03 13:43 - 00000000 ____D () C:\ProgramData\RogueKiller
    2014-09-03 13:41 - 2014-09-03 13:41 - 04857944 _____ () C:\Users\Ahmed\Desktop\RogueKiller.exe
    2014-09-03 13:33 - 2014-09-05 12:58 - 00000000 ____D () C:\Users\Ahmed\AppData\Local\CrashDumps
    2014-09-02 22:38 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\Windows\SysWOW64\sqlite3.dll
    2014-09-02 22:25 - 2014-09-02 22:25 - 00039025 _____ () C:\Users\Ahmed\Desktop\dds.txt
    2014-09-02 22:25 - 2014-09-02 22:25 - 00020697 _____ () C:\Users\Ahmed\Desktop\attach.txt
    2014-09-02 21:31 - 2014-09-02 21:31 - 00000000 ____D () C:\TDSSKiller_Quarantine
    2014-09-02 20:04 - 2014-09-02 20:04 - 00000000 ____D () C:\Users\Ahmed\AppData\Roaming\KeePass
    2014-09-02 19:42 - 2014-09-05 13:07 - 00002632 _____ () C:\Windows\setupact.log
    2014-09-02 19:42 - 2014-09-02 19:42 - 00000000 _____ () C:\Windows\setuperr.log
    2014-09-02 19:41 - 2014-09-05 13:06 - 00128960 _____ () C:\Windows\PFRO.log
    2014-09-02 19:25 - 2014-09-02 19:25 - 00000000 ____D () C:\ProgramData\Informer Technologies, Inc
    2014-09-02 19:24 - 2014-09-02 19:24 - 00003306 _____ () C:\Windows\System32\Tasks\SoftwareInformerService
    2014-09-02 19:24 - 2014-09-02 19:24 - 00000875 _____ () C:\Users\Public\Desktop\Software Informer.lnk
    2014-09-02 19:24 - 2014-09-02 19:24 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Software Informer
    2014-09-02 19:24 - 2014-09-02 19:24 - 00000000 ____D () C:\Program Files\Software Informer
    2014-09-02 19:14 - 2014-09-02 19:14 - 00002003 _____ () C:\Users\Ahmed\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Update Checker.lnk
    2014-09-02 19:14 - 2014-09-02 19:14 - 00001973 _____ () C:\Users\Ahmed\Desktop\Update Checker.lnk
    2014-09-02 19:14 - 2014-09-02 19:14 - 00000000 ____D () C:\Program Files (x86)\FileHippo.com
    2014-09-02 19:03 - 2014-09-02 19:03 - 00001121 _____ () C:\Users\Public\Desktop\KeePass 2.lnk
    2014-09-02 19:03 - 2014-09-02 19:03 - 00001121 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\KeePass 2.lnk
    2014-09-02 19:03 - 2014-09-02 19:03 - 00000000 ____D () C:\Program Files (x86)\KeePass Password Safe 2
    2014-09-02 19:03 - 2014-09-02 19:02 - 00001009 _____ () C:\Users\Ahmed\Desktop\Dropbox.lnk
    2014-09-02 19:02 - 2014-09-02 19:02 - 00000000 ____D () C:\Users\Ahmed\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
    2014-09-02 19:00 - 2014-09-02 19:02 - 00000000 ____D () C:\Users\Ahmed\AppData\Roaming\Dropbox
    2014-09-02 18:59 - 2014-09-02 18:59 - 00000000 ____D () C:\Users\Ahmed\AppData\Roaming\Gyazo
    2014-09-02 18:58 - 2014-09-02 18:58 - 00000000 ____D () C:\Program Files (x86)\SystemRequirementsLab
    2014-09-02 18:54 - 2014-09-02 18:54 - 00000000 ____D () C:\Users\Public\Foxit Software
    2014-09-02 18:54 - 2014-09-02 18:54 - 00000000 ____D () C:\Users\Ahmed\AppData\Roaming\Foxit Software
    2014-09-02 18:53 - 2014-09-02 18:53 - 00001362 _____ () C:\Users\Public\Desktop\Foxit Reader.lnk
    2014-09-02 18:53 - 2014-09-02 18:53 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Foxit Reader
    2014-09-02 17:22 - 2014-09-02 17:22 - 00000000 ____D () C:\Program Files (x86)\Foxit Software
    2014-09-02 17:07 - 2013-11-03 23:15 - 00000855 _____ () C:\Windows\system32\Drivers\etc\hosts.20140902-170736.backup
    2014-09-02 17:02 - 2014-09-02 17:02 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip
    2014-09-02 17:02 - 2014-09-02 17:02 - 00000000 ____D () C:\Program Files\7-Zip
    2014-09-02 17:01 - 2014-09-02 17:01 - 00000000 ____D () C:\Windows\SysWOW64\Adobe
    2014-09-02 17:01 - 2014-09-02 17:01 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Everything
    2014-09-02 17:00 - 2014-09-02 17:00 - 00319912 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
    2014-09-02 17:00 - 2014-09-02 17:00 - 00189352 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
    2014-09-02 17:00 - 2014-09-02 17:00 - 00189352 _____ (Oracle Corporation) C:\Windows\system32\java.exe
    2014-09-02 17:00 - 2014-09-02 17:00 - 00111016 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge-64.dll
    2014-09-02 17:00 - 2014-09-02 17:00 - 00000000 ____D () C:\Program Files\Java
    2014-09-02 16:58 - 2014-09-02 16:58 - 00001011 _____ () C:\Users\Ahmed\Desktop\SpeedFan.lnk
    2014-09-02 16:58 - 2014-09-02 16:57 - 00272808 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
    2014-09-02 16:57 - 2014-09-02 16:57 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
    2014-09-02 16:57 - 2014-09-02 16:57 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
    2014-09-02 16:57 - 2014-09-02 16:57 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
    2014-09-02 16:54 - 2014-09-03 13:10 - 00002183 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
    2014-09-02 16:46 - 2014-09-02 19:39 - 00000000 ____D () C:\3590F75ABA9E485486C100C1A9D4FF06ZZ.Z..ZZZZZ....Z
    2014-09-02 16:46 - 2014-09-02 16:46 - 00001395 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot-S&D Start Center.lnk
    2014-09-02 16:46 - 2014-09-02 16:46 - 00001383 _____ () C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
    2014-09-02 16:46 - 2014-09-02 16:46 - 00000000 ____D () C:\Windows\System32\Tasks\Safer-Networking
    2014-09-02 16:46 - 2014-09-02 16:46 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy 2
    2014-09-02 16:45 - 2014-09-02 16:52 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2
    2014-09-02 16:45 - 2014-09-02 16:50 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
    2014-09-02 16:45 - 2013-09-20 10:49 - 00021040 _____ (Safer Networking Limited) C:\Windows\system32\sdnclean64.exe
    2014-09-02 16:40 - 2014-09-02 16:41 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Defraggler
    2014-09-02 16:40 - 2014-09-02 16:41 - 00000000 ____D () C:\Program Files\Defraggler
    2014-09-02 16:40 - 2014-09-02 16:40 - 00001724 _____ () C:\Users\Public\Desktop\Defraggler.lnk
    2014-09-02 15:40 - 2014-09-02 15:40 - 00000000 ____D () C:\SUPERDelete
    2014-09-02 15:38 - 2014-09-02 15:38 - 00000000 ____D () C:\Users\Ahmed\AppData\Roaming\SUPERAntiSpyware.com
    2014-09-02 15:37 - 2014-09-02 15:37 - 00001808 _____ () C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk
    2014-09-02 15:37 - 2014-09-02 15:37 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SUPERAntiSpyware
    2014-09-02 15:36 - 2014-09-05 12:58 - 00000000 ____D () C:\Program Files\SUPERAntiSpyware
    2014-09-02 15:36 - 2014-09-02 15:36 - 00000000 ____D () C:\ProgramData\SUPERAntiSpyware.com
    2014-09-02 15:20 - 2014-09-04 15:43 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
    2014-09-02 15:20 - 2014-09-03 14:08 - 00092888 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
    2014-09-02 15:20 - 2014-09-02 15:20 - 00002117 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Security Essentials.lnk
    2014-09-02 15:20 - 2014-09-02 15:20 - 00001945 _____ () C:\Windows\epplauncher.mif
    2014-09-02 15:20 - 2014-09-02 15:20 - 00001106 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
    2014-09-02 15:20 - 2014-09-02 15:20 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
    2014-09-02 15:20 - 2014-09-02 15:20 - 00000000 ____D () C:\Program Files (x86)\Microsoft Security Client
    2014-09-02 15:20 - 2014-09-02 15:20 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
    2014-09-02 15:20 - 2014-05-12 07:26 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
    2014-09-02 15:19 - 2014-09-02 15:20 - 00000000 ____D () C:\Program Files\Microsoft Security Client
    2014-08-31 19:04 - 2014-08-31 19:04 - 00001965 _____ () C:\Users\Ahmed\Desktop\psx emulation cheater.lnk
    2014-08-31 19:04 - 2014-08-31 19:04 - 00000000 ____D () C:\Users\Ahmed\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\psx emulation cheater
    2014-08-31 19:04 - 2014-08-31 19:04 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\psx emulation cheater
    2014-08-31 19:04 - 2014-08-31 19:04 - 00000000 ____D () C:\Program Files (x86)\psx emulation cheater
    2014-08-31 18:33 - 2003-09-06 07:23 - 00000080 _____ () C:\Users\Ahmed\Desktop\GameShark v5.cue
    2014-08-31 18:33 - 2003-09-06 07:19 - 14667072 _____ () C:\Users\Ahmed\Desktop\GameShark v5.img
    2014-08-31 18:33 - 2003-09-06 07:19 - 00598656 _____ () C:\Users\Ahmed\Desktop\GameShark v5.sub
    2014-08-31 18:33 - 2003-09-06 07:19 - 00000770 _____ () C:\Users\Ahmed\Desktop\GameShark v5.ccd
    2014-08-28 19:29 - 2014-08-23 05:07 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
    2014-08-28 19:29 - 2014-08-23 04:45 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
    2014-08-28 19:29 - 2014-08-23 03:59 - 03163648 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
    2014-08-25 22:05 - 2014-08-25 22:05 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_WinUsb_01005.Wdf
    2014-08-25 21:38 - 2014-08-25 21:38 - 00000000 ____D () C:\Users\Ahmed\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Razer
    2014-08-25 02:36 - 2014-08-25 02:36 - 00003608 _____ () C:\Windows\System32\Tasks\Alarm
    2014-08-25 02:31 - 2014-08-25 02:34 - 00000000 ____D () C:\Program Files (x86)\Daily Alarm Clock
    2014-08-25 02:31 - 2014-08-25 02:31 - 00002633 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Daily Alarm Clock.lnk
    2014-08-18 05:01 - 2014-07-01 01:24 - 00008856 _____ (Microsoft Corporation) C:\Windows\system32\icardres.dll
    2014-08-18 05:01 - 2014-07-01 01:14 - 00008856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardres.dll
    2014-08-18 05:01 - 2014-03-10 00:48 - 01389208 _____ (Microsoft Corporation) C:\Windows\system32\icardagt.exe
    2014-08-18 05:01 - 2014-03-10 00:48 - 00171160 _____ (Microsoft Corporation) C:\Windows\system32\infocardapi.dll
    2014-08-18 05:01 - 2014-03-10 00:47 - 00619672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardagt.exe
    2014-08-18 05:01 - 2014-03-10 00:47 - 00099480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\infocardapi.dll
    2014-08-18 05:00 - 2014-06-06 09:16 - 00035480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TsWpfWrp.exe
    2014-08-18 05:00 - 2014-06-06 09:12 - 00035480 _____ (Microsoft Corporation) C:\Windows\system32\TsWpfWrp.exe
    2014-08-15 02:38 - 2014-08-15 02:49 - 00000290 _____ () C:\Users\Ahmed\Desktop\lol.txt
    2014-08-13 23:28 - 2014-07-16 06:23 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
    2014-08-13 23:28 - 2014-07-16 05:46 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
    2014-08-13 23:28 - 2014-07-09 05:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDYAK.DLL
    2014-08-13 23:28 - 2014-07-09 05:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDTAT.DLL
    2014-08-13 23:28 - 2014-07-09 05:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDRU1.DLL
    2014-08-13 23:28 - 2014-07-09 05:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDBASH.DLL
    2014-08-13 23:28 - 2014-07-09 05:03 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\KBDRU.DLL
    2014-08-13 23:28 - 2014-07-09 04:31 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDYAK.DLL
    2014-08-13 23:28 - 2014-07-09 04:31 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDTAT.DLL
    2014-08-13 23:28 - 2014-07-09 04:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDRU1.DLL
    2014-08-13 23:28 - 2014-07-09 04:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDRU.DLL
    2014-08-13 23:28 - 2014-07-09 04:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDBASH.DLL
    2014-08-13 23:28 - 2014-07-09 01:38 - 00419992 _____ () C:\Windows\system32\locale.nls
    2014-08-13 23:28 - 2014-07-09 01:30 - 00419992 _____ () C:\Windows\SysWOW64\locale.nls
    2014-08-13 23:27 - 2014-08-01 02:41 - 00348856 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
    2014-08-13 23:27 - 2014-08-01 02:16 - 00307384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
    2014-08-13 23:27 - 2014-07-25 17:02 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
    2014-08-13 23:27 - 2014-07-25 17:01 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
    2014-08-13 23:27 - 2014-07-25 16:51 - 17524224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
    2014-08-13 23:27 - 2014-07-25 16:30 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
    2014-08-13 23:27 - 2014-07-25 16:28 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
    2014-08-13 23:27 - 2014-07-25 16:25 - 02774528 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
    2014-08-13 23:27 - 2014-07-25 16:11 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
    2014-08-13 23:27 - 2014-07-25 16:10 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
    2014-08-13 23:27 - 2014-07-25 16:04 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
    2014-08-13 23:27 - 2014-07-25 16:03 - 00598016 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
    2014-08-13 23:27 - 2014-07-25 16:00 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
    2014-08-13 23:27 - 2014-07-25 15:40 - 00452096 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
    2014-08-13 23:27 - 2014-07-25 15:34 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
    2014-08-13 23:27 - 2014-07-25 15:34 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
    2014-08-13 23:27 - 2014-07-25 15:33 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
    2014-08-13 23:27 - 2014-07-25 15:30 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
    2014-08-13 23:27 - 2014-07-25 15:28 - 00072704 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
    2014-08-13 23:27 - 2014-07-25 15:21 - 02184704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
    2014-08-13 23:27 - 2014-07-25 15:18 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
    2014-08-13 23:27 - 2014-07-25 15:17 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
    2014-08-13 23:27 - 2014-07-25 15:12 - 00438784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
    2014-08-13 23:27 - 2014-07-25 15:10 - 00292864 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
    2014-08-13 23:27 - 2014-07-25 15:10 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
    2014-08-13 23:27 - 2014-07-25 15:08 - 00597504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
    2014-08-13 23:27 - 2014-07-25 15:06 - 04204032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
    2014-08-13 23:27 - 2014-07-25 14:52 - 00367104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
    2014-08-13 23:27 - 2014-07-25 14:47 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
    2014-08-13 23:27 - 2014-07-25 14:43 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
    2014-08-13 23:27 - 2014-07-25 14:42 - 00692736 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
    2014-08-13 23:27 - 2014-07-25 14:39 - 02087936 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
    2014-08-13 23:27 - 2014-07-25 14:36 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
    2014-08-13 23:27 - 2014-07-25 14:34 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
    2014-08-13 23:27 - 2014-07-25 14:29 - 00239616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
    2014-08-13 23:27 - 2014-07-25 14:23 - 13547008 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
    2014-08-13 23:27 - 2014-07-25 14:13 - 00526336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
    2014-08-13 23:27 - 2014-07-25 14:07 - 02001920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
    2014-08-13 23:27 - 2014-07-25 14:07 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
    2014-08-13 23:27 - 2014-07-25 14:03 - 11772928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
    2014-08-13 23:27 - 2014-07-25 13:26 - 01431040 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
    2014-08-13 23:27 - 2014-07-25 13:09 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
    2014-08-13 23:27 - 2014-07-25 13:05 - 01792512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
    2014-08-13 23:27 - 2014-07-25 13:00 - 01169920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
    2014-08-13 23:27 - 2014-06-25 05:05 - 14175744 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
    2014-08-13 23:27 - 2014-06-25 04:41 - 12874240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
    2014-08-13 23:27 - 2014-06-16 05:10 - 00985536 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
    2014-08-13 23:27 - 2014-06-03 13:02 - 03241984 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
    2014-08-13 23:27 - 2014-06-03 13:02 - 01941504 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
    2014-08-13 23:27 - 2014-06-03 13:02 - 00504320 _____ (Microsoft Corporation) C:\Windows\system32\msihnd.dll
    2014-08-13 23:27 - 2014-06-03 13:02 - 00112064 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe
    2014-08-13 23:27 - 2014-06-03 12:29 - 02363392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
    2014-08-13 23:27 - 2014-06-03 12:29 - 01805824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
    2014-08-13 23:27 - 2014-06-03 12:29 - 00337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msihnd.dll
    2014-08-13 23:26 - 2014-07-25 17:52 - 23645696 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
    2014-08-13 23:26 - 2014-07-25 16:28 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
    2014-08-13 23:26 - 2014-07-25 16:25 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
    2014-08-13 23:26 - 2014-07-25 16:00 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
    2014-08-13 23:26 - 2014-07-25 15:59 - 00758272 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
    2014-08-13 23:26 - 2014-07-25 15:47 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
    2014-08-13 23:26 - 2014-07-25 15:28 - 05824512 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
    2014-08-13 23:26 - 2014-07-25 15:19 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
    2014-08-13 23:26 - 2014-07-25 15:17 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
    2014-08-13 23:26 - 2014-07-25 14:39 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
    2014-08-13 23:26 - 2014-07-25 13:52 - 02266624 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
    2014-08-13 23:26 - 2014-07-25 13:17 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
    2014-08-13 23:24 - 2014-07-14 05:02 - 01216000 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
    2014-08-13 23:24 - 2014-07-14 04:40 - 00664064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
    2014-08-13 17:19 - 2014-08-13 17:19 - 00000701 _____ () C:\Users\Ahmed\Desktop\ePSXe - Shortcut.lnk
    2014-08-12 05:42 - 2006-03-12 01:29 - 00000000 ____D () C:\Users\Ahmed\Desktop\Digimon World 2 [SLUS-01193]
    2014-08-12 05:20 - 2014-08-12 05:20 - 00014304 _____ () C:\ProgramData\Duplicaterecord.js
    2014-08-12 05:20 - 2014-08-12 05:20 - 00000000 __SHD () C:\Users\Ahmed\AppData\Local\EmieUserList
    2014-08-12 05:20 - 2014-08-12 05:20 - 00000000 __SHD () C:\Users\Ahmed\AppData\Local\EmieSiteList
    2014-08-12 05:11 - 2014-08-12 05:11 - 00172032 _____ (Jin Hui E-mail: jinhui@jcomsoft.com Web: http://www.jcomsoft.com) C:\Windows\SysWOW64\AniGIF.ocx
    2014-08-12 05:11 - 2014-08-12 05:11 - 00003446 _____ () C:\Windows\System32\Tasks\YTAUpdate
    2014-08-12 05:10 - 2014-08-12 05:10 - 00000000 ____D () C:\Program Files (x86)\PCSXR
    2014-08-12 05:09 - 2014-08-12 05:09 - 00001796 _____ () C:\Users\Ahmed\Desktop\Continue PCSX-Reloaded.lnk
    2014-08-11 22:25 - 2014-08-11 22:25 - 00013500 _____ () C:\Users\Ahmed\Desktop\final_fantasy_x_eu_h.max
    2014-08-11 22:09 - 2014-08-11 22:16 - 00000000 ___DC () C:\Users\Ahmed\Desktop\pls
    2014-08-11 22:05 - 2007-05-13 17:29 - 00000000 ____D () C:\Users\Ahmed\Desktop\state5
    2014-08-11 22:00 - 2014-08-11 22:00 - 00010851 _____ () C:\Users\Ahmed\Desktop\final_fantasy_x_g.cbs
    2014-08-11 21:34 - 2014-08-11 21:35 - 00000258 __RSH () C:\ProgramData\ntuser.pol
    2014-08-11 21:14 - 2014-08-11 21:14 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_WinUsb_01009.Wdf
    2014-08-11 21:12 - 2013-05-19 10:02 - 00039168 _____ (Scarlet.Crush Productions) C:\Windows\system32\Drivers\ScpVBus.sys
    2014-08-11 21:12 - 2013-01-07 17:56 - 01002728 _____ (Microsoft Corporation) C:\Windows\system32\WinUSBCoInstaller2.dll
    2014-08-11 21:11 - 2014-09-02 21:38 - 00000000 ____D () C:\Program Files\Scarlet.Crush Productions
    2014-08-11 21:10 - 2014-03-11 08:18 - 00000000 ____D () C:\Users\Ahmed\Desktop\ScpServer
    2014-08-11 20:56 - 2014-08-11 20:56 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_xusb21_01009.Wdf
    2014-08-11 20:56 - 2014-08-11 20:56 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_MijXfilt_01009.Wdf
    2014-08-11 20:53 - 2014-08-11 20:52 - 04117346 _____ () C:\Users\Ahmed\Desktop\motioninjoy-0-7-1001-en-win.zip
    2014-08-11 20:53 - 2012-05-12 07:33 - 04199240 _____ (www.motioninjoy.com ) C:\Users\Ahmed\Desktop\MotioninJoy_071001_signed.exe
    2014-08-11 00:29 - 2014-08-11 00:29 - 00000000 ____D () C:\Users\Ahmed\AppData\Roaming\ImgBurn
    2014-08-11 00:22 - 2014-08-11 00:22 - 00000000 ____D () C:\Users\Ahmed\AppData\Roaming\AVG
    2014-08-11 00:22 - 2014-08-11 00:22 - 00000000 ____D () C:\Users\Ahmed\AppData\Local\AVG
    2014-08-11 00:20 - 2014-08-11 01:30 - 00000000 ____D () C:\ProgramData\AVG
    2014-08-11 00:20 - 2014-08-11 00:20 - 00000000 __SHD () C:\ProgramData\{01BD4FC9-2F86-4706-A62E-774BB7E9D308}
    2014-08-11 00:19 - 2014-08-11 00:29 - 303202304 _____ () C:\Users\Ahmed\Documents\FINAL_FANTASY_X.ISO
    2014-08-11 00:18 - 2014-08-11 00:18 - 00001881 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ImgBurn.lnk
    2014-08-11 00:18 - 2014-08-11 00:18 - 00001869 _____ () C:\Users\Public\Desktop\ImgBurn.lnk
    2014-08-11 00:18 - 2014-08-11 00:18 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ImgBurn
    2014-08-11 00:18 - 2014-08-11 00:18 - 00000000 ____D () C:\Program Files (x86)\ImgBurn
    2014-08-11 00:07 - 2014-08-12 02:48 - 303202304 _____ () C:\Users\Ahmed\Downloads\FINAL_FANTASY_X.iso
    2014-08-11 00:04 - 2014-08-11 00:04 - 00000000 ____D () C:\Users\Ahmed\Desktop\bios
    2014-08-10 23:57 - 2014-08-10 23:57 - 00001989 _____ () C:\Users\Public\Desktop\PCSX2 1.2.1 (r5875).lnk
    2014-08-10 23:56 - 2014-08-10 23:59 - 00000000 ____D () C:\Program Files (x86)\PCSX2 1.2.1
    2014-08-09 21:36 - 2014-08-09 21:36 - 00660128 _____ (Microsoft Corporation) C:\Windows\system32\msvcp120.dll
    2014-08-09 21:36 - 2014-08-09 21:36 - 00455328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msvcp120.dll
    2014-08-09 21:02 - 2014-08-09 21:02 - 00000000 ____D () C:\Users\Ahmed\Desktop\ppsspp_win

    ==================== One Month Modified Files and Folders =======

    (If an entry is included in the fixlist, the file\folder will be moved.)

    2014-09-05 13:26 - 2014-09-05 13:25 - 00000000 ____D () C:\FRST
    2014-09-05 13:26 - 2014-08-03 16:02 - 00000000 ____D () C:\Users\Ahmed\Desktop\Week 1
    2014-09-05 13:23 - 2014-09-05 13:23 - 00001455 _____ () C:\Users\Ahmed\Desktop\JRT.txt
    2014-09-05 13:16 - 2013-09-26 19:49 - 00000000 ____D () C:\Windows\pss
    2014-09-05 13:15 - 2014-06-10 18:44 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
    2014-09-05 13:13 - 2013-06-07 13:04 - 01568674 _____ () C:\Windows\WindowsUpdate.log
    2014-09-05 13:13 - 2009-07-14 07:45 - 00014240 _____ () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
    2014-09-05 13:13 - 2009-07-14 07:45 - 00014240 _____ () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
    2014-09-05 13:07 - 2014-09-05 13:07 - 00002324 _____ () C:\Users\Ahmed\Desktop\AdwCleaner[S2].txt
    2014-09-05 13:07 - 2014-09-03 15:55 - 00000332 _____ () C:\Windows\Tasks\GlaryInitialize 5.job
    2014-09-05 13:07 - 2014-09-03 15:55 - 00000000 ____D () C:\Program Files (x86)\Glary Utilities 5
    2014-09-05 13:07 - 2014-09-02 19:42 - 00002632 _____ () C:\Windows\setupact.log
    2014-09-05 13:07 - 2013-06-07 13:32 - 00000892 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
    2014-09-05 13:06 - 2014-09-02 19:41 - 00128960 _____ () C:\Windows\PFRO.log
    2014-09-05 13:06 - 2013-06-07 11:56 - 00000000 ____D () C:\ProgramData\NVIDIA
    2014-09-05 13:06 - 2009-07-14 08:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
    2014-09-05 13:05 - 2013-10-21 20:11 - 00000000 ____D () C:\AdwCleaner
    2014-09-05 13:02 - 2013-06-07 16:58 - 00000000 ____D () C:\Users\Ahmed\AppData\Roaming\Skype
    2014-09-05 13:02 - 2013-06-07 13:32 - 00000896 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
    2014-09-05 12:58 - 2014-09-03 13:33 - 00000000 ____D () C:\Users\Ahmed\AppData\Local\CrashDumps
    2014-09-05 12:58 - 2014-09-02 15:36 - 00000000 ____D () C:\Program Files\SUPERAntiSpyware
    2014-09-05 12:57 - 2014-09-04 14:36 - 00000000 ____D () C:\Program Files (x86)\360
    2014-09-05 12:57 - 2013-10-01 01:41 - 00000000 ____D () C:\Users\Ahmed\AppData\Local\TSVNCache
    2014-09-04 15:49 - 2014-06-13 11:43 - 00000000 ____D () C:\Users\Ahmed\AppData\Local\BetterDS3
    2014-09-04 15:43 - 2014-09-02 15:20 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
    2014-09-04 15:41 - 2014-09-04 15:41 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MotioninJoy
    2014-09-04 15:28 - 2014-09-04 15:28 - 04117346 _____ () C:\Users\Ahmed\Documents\motioninjoy-0-7-1001-en-win.zip
    2014-09-04 15:00 - 2014-09-04 15:00 - 00000000 ____D () C:\Users\Ahmed\Desktop\New folder (4)
    2014-09-04 15:00 - 2014-09-04 15:00 - 00000000 ____D () C:\Users\Ahmed\Desktop\breath of fire
    2014-09-04 14:46 - 2013-06-07 12:31 - 00000000 ____D () C:\Users\Ahmed\AppData\Local\Apps\2.0
    2014-09-04 14:43 - 2014-09-04 14:43 - 162499401 _____ () C:\Users\Ahmed\Desktop\Breath of Fire IV.7z
    2014-09-04 13:30 - 2014-09-04 13:30 - 00042534 _____ () C:\ComboFix.txt
    2014-09-04 13:30 - 2014-09-04 13:16 - 00000000 ____D () C:\Qoobox
    2014-09-04 13:30 - 2009-07-14 06:20 - 00000000 ___RD () C:\Users\Default
    2014-09-04 13:28 - 2014-09-04 13:15 - 00000000 ____D () C:\Windows\erdnt
    2014-09-04 13:27 - 2009-07-14 05:34 - 00000215 _____ () C:\Windows\system.ini
    2014-09-04 13:24 - 2013-09-10 20:51 - 00000000 ____D () C:\ProgramData\TEMP
    2014-09-04 13:00 - 2014-09-04 12:59 - 05576326 ____R (Swearware) C:\Users\Ahmed\Desktop\ComboFix.exe
    2014-09-04 12:33 - 2009-07-14 06:20 - 00000000 ____D () C:\Windows\system32\NDF
    2014-09-04 02:06 - 2013-12-06 13:55 - 00000000 ____D () C:\Users\Ahmed\AppData\Local\Battle.net
    2014-09-03 17:25 - 2013-07-05 03:25 - 00007604 _____ () C:\Users\Ahmed\AppData\Local\Resmon.ResmonCfg
    2014-09-03 15:57 - 2014-07-19 21:00 - 00003160 _____ () C:\Windows\System32\Tasks\Private Internet Access Startup
    2014-09-03 15:57 - 2013-09-20 13:56 - 00004184 _____ () C:\Windows\System32\Tasks\avast! Emergency Update
    2014-09-03 15:57 - 2013-06-10 17:41 - 00004008 _____ () C:\Windows\System32\Tasks\PCDoctorBackgroundMonitorTask
    2014-09-03 15:57 - 2013-06-10 17:41 - 00003462 _____ () C:\Windows\System32\Tasks\PCDEventLauncherTask
    2014-09-03 15:55 - 2014-09-03 15:55 - 00020672 _____ (Glarysoft Ltd) C:\Windows\system32\Drivers\GUBootStartup.sys
    2014-09-03 15:55 - 2014-09-03 15:55 - 00002972 _____ () C:\Windows\System32\Tasks\GU5SkipUAC
    2014-09-03 15:55 - 2014-09-03 15:55 - 00002628 _____ () C:\Windows\System32\Tasks\GlaryInitialize 5
    2014-09-03 15:55 - 2014-09-03 15:55 - 00001096 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Glary Utilities 5.lnk
    2014-09-03 15:55 - 2014-09-03 15:55 - 00001084 _____ () C:\Users\Public\Desktop\Glary Utilities 5.lnk
    2014-09-03 15:55 - 2014-09-03 15:55 - 00000000 ____D () C:\Users\Ahmed\AppData\Roaming\GlarySoft
    2014-09-03 15:55 - 2014-09-03 15:55 - 00000000 ____D () C:\Users\Ahmed\AppData\Roaming\DiskDefrag
    2014-09-03 15:55 - 2014-09-03 15:55 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Glary Utilities 5
    2014-09-03 14:26 - 2014-09-03 14:10 - 00000000 ____D () C:\ProgramData\Malwarebytes' Anti-Malware (portable)
    2014-09-03 14:26 - 2014-09-03 14:00 - 00000000 ____D () C:\Users\Ahmed\Desktop\mbar
    2014-09-03 14:08 - 2014-09-02 15:20 - 00092888 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
    2014-09-03 13:59 - 2014-09-03 13:59 - 14349744 _____ (Malwarebytes Corp.) C:\Users\Ahmed\Desktop\mbar-1.07.0.1012.exe
    2014-09-03 13:54 - 2014-09-03 13:53 - 00005349 _____ () C:\Users\Ahmed\Desktop\RKreport_DEL_09032014_135209.log
    2014-09-03 13:45 - 2014-09-03 13:43 - 00033512 _____ () C:\Windows\SysWOW64\Drivers\TrueSight.sys
    2014-09-03 13:43 - 2014-09-03 13:43 - 00000000 ____D () C:\ProgramData\RogueKiller
    2014-09-03 13:41 - 2014-09-03 13:41 - 04857944 _____ () C:\Users\Ahmed\Desktop\RogueKiller.exe
    2014-09-03 13:38 - 2013-09-10 20:43 - 00000000 ____D () C:\ProgramData\Baidu Security
    2014-09-03 13:28 - 2013-09-20 13:56 - 00000000 ____D () C:\Program Files\AVAST Software
    2014-09-03 13:28 - 2013-09-20 13:56 - 00000000 _____ () C:\Windows\SysWOW64\config.nt
    2014-09-03 13:10 - 2014-09-02 16:54 - 00002183 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
    2014-09-02 23:18 - 2014-04-03 21:40 - 00000000 ____D () C:\Program Files (x86)\SpeedFan
    2014-09-02 22:51 - 2013-06-07 11:35 - 00000000 ____D () C:\Users\Ahmed
    2014-09-02 22:25 - 2014-09-02 22:25 - 00039025 _____ () C:\Users\Ahmed\Desktop\dds.txt
    2014-09-02 22:25 - 2014-09-02 22:25 - 00020697 _____ () C:\Users\Ahmed\Desktop\attach.txt
    2014-09-02 21:38 - 2014-08-11 21:11 - 00000000 ____D () C:\Program Files\Scarlet.Crush Productions
    2014-09-02 21:31 - 2014-09-02 21:31 - 00000000 ____D () C:\TDSSKiller_Quarantine
    2014-09-02 21:14 - 2013-09-26 19:43 - 00000000 ____D () C:\Windows\Minidump
    2014-09-02 20:04 - 2014-09-02 20:04 - 00000000 ____D () C:\Users\Ahmed\AppData\Roaming\KeePass
    2014-09-02 19:42 - 2014-09-02 19:42 - 00000000 _____ () C:\Windows\setuperr.log
    2014-09-02 19:39 - 2014-09-02 16:46 - 00000000 ____D () C:\3590F75ABA9E485486C100C1A9D4FF06ZZ.Z..ZZZZZ....Z
    2014-09-02 19:25 - 2014-09-02 19:25 - 00000000 ____D () C:\ProgramData\Informer Technologies, Inc
    2014-09-02 19:24 - 2014-09-02 19:24 - 00003306 _____ () C:\Windows\System32\Tasks\SoftwareInformerService
    2014-09-02 19:24 - 2014-09-02 19:24 - 00000875 _____ () C:\Users\Public\Desktop\Software Informer.lnk
    2014-09-02 19:24 - 2014-09-02 19:24 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Software Informer
    2014-09-02 19:24 - 2014-09-02 19:24 - 00000000 ____D () C:\Program Files\Software Informer
    2014-09-02 19:14 - 2014-09-02 19:14 - 00002003 _____ () C:\Users\Ahmed\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Update Checker.lnk
    2014-09-02 19:14 - 2014-09-02 19:14 - 00001973 _____ () C:\Users\Ahmed\Desktop\Update Checker.lnk
    2014-09-02 19:14 - 2014-09-02 19:14 - 00000000 ____D () C:\Program Files (x86)\FileHippo.com
    2014-09-02 19:03 - 2014-09-02 19:03 - 00001121 _____ () C:\Users\Public\Desktop\KeePass 2.lnk
    2014-09-02 19:03 - 2014-09-02 19:03 - 00001121 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\KeePass 2.lnk
    2014-09-02 19:03 - 2014-09-02 19:03 - 00000000 ____D () C:\Program Files (x86)\KeePass Password Safe 2
    2014-09-02 19:02 - 2014-09-02 19:03 - 00001009 _____ () C:\Users\Ahmed\Desktop\Dropbox.lnk
    2014-09-02 19:02 - 2014-09-02 19:02 - 00000000 ____D () C:\Users\Ahmed\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
    2014-09-02 19:02 - 2014-09-02 19:00 - 00000000 ____D () C:\Users\Ahmed\AppData\Roaming\Dropbox
    2014-09-02 18:59 - 2014-09-02 18:59 - 00000000 ____D () C:\Users\Ahmed\AppData\Roaming\Gyazo
    2014-09-02 18:58 - 2014-09-02 18:58 - 00000000 ____D () C:\Program Files (x86)\SystemRequirementsLab
    2014-09-02 18:54 - 2014-09-02 18:54 - 00000000 ____D () C:\Users\Public\Foxit Software
    2014-09-02 18:54 - 2014-09-02 18:54 - 00000000 ____D () C:\Users\Ahmed\AppData\Roaming\Foxit Software
    2014-09-02 18:54 - 2013-06-07 12:31 - 00000000 ____D () C:\Users\Ahmed\AppData\Local\Deployment
    2014-09-02 18:53 - 2014-09-02 18:53 - 00001362 _____ () C:\Users\Public\Desktop\Foxit Reader.lnk
    2014-09-02 18:53 - 2014-09-02 18:53 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Foxit Reader
    2014-09-02 17:22 - 2014-09-02 17:22 - 00000000 ____D () C:\Program Files (x86)\Foxit Software
    2014-09-02 17:02 - 2014-09-02 17:02 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip
    2014-09-02 17:02 - 2014-09-02 17:02 - 00000000 ____D () C:\Program Files\7-Zip
    2014-09-02 17:01 - 2014-09-02 17:01 - 00000000 ____D () C:\Windows\SysWOW64\Adobe
    2014-09-02 17:01 - 2014-09-02 17:01 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Everything
    2014-09-02 17:00 - 2014-09-02 17:00 - 00319912 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
    2014-09-02 17:00 - 2014-09-02 17:00 - 00189352 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
    2014-09-02 17:00 - 2014-09-02 17:00 - 00189352 _____ (Oracle Corporation) C:\Windows\system32\java.exe
    2014-09-02 17:00 - 2014-09-02 17:00 - 00111016 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge-64.dll
    2014-09-02 17:00 - 2014-09-02 17:00 - 00000000 ____D () C:\Program Files\Java
    2014-09-02 16:58 - 2014-09-02 16:58 - 00001011 _____ () C:\Users\Ahmed\Desktop\SpeedFan.lnk
    2014-09-02 16:58 - 2014-04-03 21:40 - 00000045 _____ () C:\Windows\SysWOW64\initdebug.nfo
    2014-09-02 16:57 - 2014-09-02 16:58 - 00272808 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
    2014-09-02 16:57 - 2014-09-02 16:57 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
    2014-09-02 16:57 - 2014-09-02 16:57 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
    2014-09-02 16:57 - 2014-09-02 16:57 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
    2014-09-02 16:52 - 2014-09-02 16:45 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2
    2014-09-02 16:50 - 2014-09-02 16:45 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
    2014-09-02 16:46 - 2014-09-02 16:46 - 00001395 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot-S&D Start Center.lnk
    2014-09-02 16:46 - 2014-09-02 16:46 - 00001383 _____ () C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
    2014-09-02 16:46 - 2014-09-02 16:46 - 00000000 ____D () C:\Windows\System32\Tasks\Safer-Networking
    2014-09-02 16:46 - 2014-09-02 16:46 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy 2
    2014-09-02 16:45 - 2013-06-28 23:42 - 00000000 ____D () C:\Program Files (x86)\Steam
    2014-09-02 16:41 - 2014-09-02 16:40 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Defraggler
    2014-09-02 16:41 - 2014-09-02 16:40 - 00000000 ____D () C:\Program Files\Defraggler
    2014-09-02 16:40 - 2014-09-02 16:40 - 00001724 _____ () C:\Users\Public\Desktop\Defraggler.lnk
    2014-09-02 15:40 - 2014-09-02 15:40 - 00000000 ____D () C:\SUPERDelete
    2014-09-02 15:38 - 2014-09-02 15:38 - 00000000 ____D () C:\Users\Ahmed\AppData\Roaming\SUPERAntiSpyware.com
    2014-09-02 15:37 - 2014-09-02 15:37 - 00001808 _____ () C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk
    2014-09-02 15:37 - 2014-09-02 15:37 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SUPERAntiSpyware
    2014-09-02 15:36 - 2014-09-02 15:36 - 00000000 ____D () C:\ProgramData\SUPERAntiSpyware.com
    2014-09-02 15:20 - 2014-09-02 15:20 - 00002117 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Security Essentials.lnk
    2014-09-02 15:20 - 2014-09-02 15:20 - 00001945 _____ () C:\Windows\epplauncher.mif
    2014-09-02 15:20 - 2014-09-02 15:20 - 00001106 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
    2014-09-02 15:20 - 2014-09-02 15:20 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
    2014-09-02 15:20 - 2014-09-02 15:20 - 00000000 ____D () C:\Program Files (x86)\Microsoft Security Client
    2014-09-02 15:20 - 2014-09-02 15:20 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
    2014-09-02 15:20 - 2014-09-02 15:19 - 00000000 ____D () C:\Program Files\Microsoft Security Client
    2014-09-02 15:20 - 2013-11-03 22:29 - 00000000 ____D () C:\Users\Ahmed\AppData\Roaming\Malwarebytes
    2014-09-02 15:20 - 2013-11-03 22:29 - 00000000 ____D () C:\ProgramData\Malwarebytes
    2014-08-31 19:04 - 2014-08-31 19:04 - 00001965 _____ () C:\Users\Ahmed\Desktop\psx emulation cheater.lnk
    2014-08-31 19:04 - 2014-08-31 19:04 - 00000000 ____D () C:\Users\Ahmed\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\psx emulation cheater
    2014-08-31 19:04 - 2014-08-31 19:04 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\psx emulation cheater
    2014-08-31 19:04 - 2014-08-31 19:04 - 00000000 ____D () C:\Program Files (x86)\psx emulation cheater
    2014-08-29 13:29 - 2009-07-14 07:45 - 00450936 _____ () C:\Windows\system32\FNTCACHE.DAT
    2014-08-27 15:06 - 2013-06-07 16:56 - 00000000 ____D () C:\Program Files (x86)\World of Warcraft
    2014-08-26 01:32 - 2014-07-27 14:16 - 00000000 ____D () C:\Users\Ahmed\AppData\Local\Razer
    2014-08-25 22:05 - 2014-08-25 22:05 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_WinUsb_01005.Wdf
    2014-08-25 21:51 - 2013-06-07 12:31 - 00125072 _____ () C:\Users\Ahmed\AppData\Local\GDIPFONTCACHEV1.DAT
    2014-08-25 21:38 - 2014-08-25 21:38 - 00000000 ____D () C:\Users\Ahmed\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Razer
    2014-08-25 21:38 - 2014-06-29 17:59 - 00000000 ____D () C:\Program Files (x86)\Razer
    2014-08-25 02:36 - 2014-08-25 02:36 - 00003608 _____ () C:\Windows\System32\Tasks\Alarm
    2014-08-25 02:34 - 2014-08-25 02:31 - 00000000 ____D () C:\Program Files (x86)\Daily Alarm Clock
    2014-08-25 02:31 - 2014-08-25 02:31 - 00002633 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Daily Alarm Clock.lnk
    2014-08-23 19:06 - 2013-12-06 13:55 - 00000000 ____D () C:\Program Files (x86)\Battle.net
    2014-08-23 19:02 - 2013-12-06 14:57 - 00000000 ____D () C:\Program Files (x86)\Hearthstone
    2014-08-23 05:07 - 2014-08-28 19:29 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
    2014-08-23 04:45 - 2014-08-28 19:29 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
    2014-08-23 03:59 - 2014-08-28 19:29 - 03163648 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
    2014-08-21 16:22 - 2014-09-04 14:47 - 00023752 _____ (360安全中心) C:\Windows\SysWOW64\Drivers\efimon.sys
    2014-08-17 20:35 - 2009-07-14 08:13 - 00782662 _____ () C:\Windows\system32\PerfStringBackup.INI
    2014-08-15 02:49 - 2014-08-15 02:38 - 00000290 _____ () C:\Users\Ahmed\Desktop\lol.txt
    2014-08-14 10:40 - 2009-07-14 06:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
    2014-08-14 10:04 - 2013-06-10 17:33 - 00000000 ____D () C:\Users\Ahmed\AppData\Roaming\PCDr
    2014-08-14 06:23 - 2013-11-30 16:14 - 00000000 ____D () C:\ProgramData\Microsoft Help
    2014-08-14 06:12 - 2013-07-23 04:04 - 00000000 ____D () C:\Windows\system32\MRT
    2014-08-14 06:07 - 2013-06-07 17:23 - 99218768 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
    2014-08-13 17:19 - 2014-08-13 17:19 - 00000701 _____ () C:\Users\Ahmed\Desktop\ePSXe - Shortcut.lnk
    2014-08-12 17:01 - 2013-06-07 16:57 - 00000000 ____D () C:\ProgramData\Skype
    2014-08-12 05:25 - 2014-04-09 23:06 - 00000000 ____D () C:\Users\Ahmed\Documents\Pamela
    2014-08-12 05:25 - 2014-04-09 23:06 - 00000000 ____D () C:\Users\Ahmed\AppData\Roaming\Pamela
    2014-08-12 05:20 - 2014-08-12 05:20 - 00014304 _____ () C:\ProgramData\Duplicaterecord.js
    2014-08-12 05:20 - 2014-08-12 05:20 - 00000000 __SHD () C:\Users\Ahmed\AppData\Local\EmieUserList
    2014-08-12 05:20 - 2014-08-12 05:20 - 00000000 __SHD () C:\Users\Ahmed\AppData\Local\EmieSiteList
    2014-08-12 05:20 - 2013-09-10 20:45 - 00000000 ____D () C:\Users\Ahmed\AppData\Roaming\Baidu Security
    2014-08-12 05:20 - 2013-09-10 20:43 - 00000000 ____D () C:\Users\Public\Documents\Baidu Security
    2014-08-12 05:11 - 2014-08-12 05:11 - 00172032 _____ (Jin Hui E-mail: jinhui@jcomsoft.com Web: http://www.jcomsoft.com) C:\Windows\SysWOW64\AniGIF.ocx
    2014-08-12 05:11 - 2014-08-12 05:11 - 00003446 _____ () C:\Windows\System32\Tasks\YTAUpdate
    2014-08-12 05:10 - 2014-08-12 05:10 - 00000000 ____D () C:\Program Files (x86)\PCSXR
    2014-08-12 05:09 - 2014-08-12 05:09 - 00001796 _____ () C:\Users\Ahmed\Desktop\Continue PCSX-Reloaded.lnk
    2014-08-12 02:48 - 2014-08-11 00:07 - 303202304 _____ () C:\Users\Ahmed\Downloads\FINAL_FANTASY_X.iso
    2014-08-11 22:25 - 2014-08-11 22:25 - 00013500 _____ () C:\Users\Ahmed\Desktop\final_fantasy_x_eu_h.max
    2014-08-11 22:16 - 2014-08-11 22:09 - 00000000 ___DC () C:\Users\Ahmed\Desktop\pls
    2014-08-11 22:00 - 2014-08-11 22:00 - 00010851 _____ () C:\Users\Ahmed\Desktop\final_fantasy_x_g.cbs
    2014-08-11 21:35 - 2014-08-11 21:34 - 00000258 __RSH () C:\ProgramData\ntuser.pol
    2014-08-11 21:34 - 2009-07-14 06:20 - 00000000 ___HD () C:\Windows\system32\GroupPolicy
    2014-08-11 21:14 - 2014-08-11 21:14 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_WinUsb_01009.Wdf
    2014-08-11 20:56 - 2014-08-11 20:56 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_xusb21_01009.Wdf
    2014-08-11 20:56 - 2014-08-11 20:56 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_MijXfilt_01009.Wdf
    2014-08-11 20:52 - 2014-08-11 20:53 - 04117346 _____ () C:\Users\Ahmed\Desktop\motioninjoy-0-7-1001-en-win.zip
    2014-08-11 01:30 - 2014-08-11 00:20 - 00000000 ____D () C:\ProgramData\AVG
    2014-08-11 00:29 - 2014-08-11 00:29 - 00000000 ____D () C:\Users\Ahmed\AppData\Roaming\ImgBurn
    2014-08-11 00:29 - 2014-08-11 00:19 - 303202304 _____ () C:\Users\Ahmed\Documents\FINAL_FANTASY_X.ISO
    2014-08-11 00:22 - 2014-08-11 00:22 - 00000000 ____D () C:\Users\Ahmed\AppData\Roaming\AVG
    2014-08-11 00:22 - 2014-08-11 00:22 - 00000000 ____D () C:\Users\Ahmed\AppData\Local\AVG
    2014-08-11 00:20 - 2014-08-11 00:20 - 00000000 __SHD () C:\ProgramData\{01BD4FC9-2F86-4706-A62E-774BB7E9D308}
    2014-08-11 00:18 - 2014-08-11 00:18 - 00001881 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ImgBurn.lnk
    2014-08-11 00:18 - 2014-08-11 00:18 - 00001869 _____ () C:\Users\Public\Desktop\ImgBurn.lnk
    2014-08-11 00:18 - 2014-08-11 00:18 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ImgBurn
    2014-08-11 00:18 - 2014-08-11 00:18 - 00000000 ____D () C:\Program Files (x86)\ImgBurn
    2014-08-11 00:04 - 2014-08-11 00:04 - 00000000 ____D () C:\Users\Ahmed\Desktop\bios
    2014-08-10 23:59 - 2014-08-10 23:56 - 00000000 ____D () C:\Program Files (x86)\PCSX2 1.2.1
    2014-08-10 23:59 - 2014-06-06 14:04 - 00000000 ____D () C:\Users\Ahmed\Documents\PCSX2
    2014-08-10 23:58 - 2013-06-07 13:44 - 00000000 ____D () C:\Windows\SysWOW64\directx
    2014-08-10 23:58 - 2013-06-07 13:44 - 00000000 ____D () C:\Windows\msdownld.tmp
    2014-08-10 23:57 - 2014-08-10 23:57 - 00001989 _____ () C:\Users\Public\Desktop\PCSX2 1.2.1 (r5875).lnk
    2014-08-10 23:57 - 2014-06-06 14:03 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PCSX2
    2014-08-10 23:57 - 2013-07-10 23:34 - 00000000 ____D () C:\ProgramData\Package Cache
    2014-08-09 21:36 - 2014-08-09 21:36 - 00660128 _____ (Microsoft Corporation) C:\Windows\system32\msvcp120.dll
    2014-08-09 21:36 - 2014-08-09 21:36 - 00455328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msvcp120.dll
    2014-08-09 21:02 - 2014-08-09 21:02 - 00000000 ____D () C:\Users\Ahmed\Desktop\ppsspp_win
    2014-08-07 17:09 - 2013-07-01 01:49 - 00000000 ____D () C:\Program Files (x86)\Diablo III

    Files to move or delete:
    ====================
    C:\ProgramData\Duplicaterecord.js


    Some content of TEMP:
    ====================
    C:\Users\Ahmed\AppData\Local\Temp\Quarantine.exe


    ==================== Bamital & volsnap Check =================

    (There is no automatic fix for files that do not pass verification.)

    C:\Windows\System32\winlogon.exe => File is digitally signed
    C:\Windows\System32\wininit.exe => File is digitally signed
    C:\Windows\SysWOW64\wininit.exe => File is digitally signed
    C:\Windows\explorer.exe => File is digitally signed
    C:\Windows\SysWOW64\explorer.exe => File is digitally signed
    C:\Windows\System32\svchost.exe => File is digitally signed
    C:\Windows\SysWOW64\svchost.exe => File is digitally signed
    C:\Windows\System32\services.exe => File is digitally signed
    C:\Windows\System32\User32.dll => File is digitally signed
    C:\Windows\SysWOW64\User32.dll => File is digitally signed
    C:\Windows\System32\userinit.exe => File is digitally signed
    C:\Windows\SysWOW64\userinit.exe => File is digitally signed
    C:\Windows\System32\rpcss.dll => File is digitally signed
    C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


    LastRegBack: 2014-08-27 18:02

    ==================== End Of Log ============================
     
    Last edited by a moderator: Sep 5, 2014
  22. Ryansee

    Ryansee TS Rookie Topic Starter Posts: 19

    Additional scan result of Farbar Recovery Scan Tool (x64) Version: 03-09-2014 02
    Ran by Ahmed at 2014-09-05 13:27:42
    Running from C:\Users\Ahmed\Desktop\Week 1
    Boot Mode: Normal
    ==========================================================


    ==================== Security Center ========================

    (If an entry is included in the fixlist, it will be removed.)

    AV: Microsoft Security Essentials (Disabled - Up to date) {641105E6-77ED-3F35-A304-765193BCB75F}
    AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    AS: Spybot - Search and Destroy (Enabled - Up to date) {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}
    AS: Microsoft Security Essentials (Disabled - Up to date) {DF70E402-51D7-30BB-99B4-4D23E83BFDE2}

    ==================== Installed Programs ======================

    (Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

    7-Zip 9.20 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov)
    AccelerometerP11 (HKLM-x32\...\{87434D51-51DB-4109-B68F-A829ECDCF380}) (Version: 2.00.11.22 - STMicroelectronics)
    Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 14.0.0.178 - Adobe Systems Incorporated)
    Adobe AIR (x32 Version: 14.0.0.178 - Adobe Systems Incorporated) Hidden
    Adobe Digital Editions 2.0 (HKLM-x32\...\Adobe Digital Editions 2.0) (Version: 2.0.1 - Adobe Systems Incorporated)
    Adobe Flash Player 14 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 14.0.0.145 - Adobe Systems Incorporated)
    Adobe Flash Player 14 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 14.0.0.145 - Adobe Systems Incorporated)
    Adobe Reader XI (11.0.06) (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AB0000000001}) (Version: 11.0.06 - Adobe Systems Incorporated)
    Adobe Shockwave Player 12.1 (HKLM-x32\...\Adobe Shockwave Player) (Version: 12.1.3.153 - Adobe Systems, Inc.)
    AlienAutopsy (HKLM\...\PC-Doctor for Windows) (Version: 3.5.6426.22 - PC-Doctor, Inc.)
    Alienware Command Center (HKLM-x32\...\InstallShield_{FD1AE10F-163C-4D4B-9FCE-AC667AF1DC6E}) (Version: 2.8.8.0 - Alienware Corp.)
    Alienware Command Center (Version: 2.8.8.0 - Alienware Corp.) Hidden
    Alienware On-Screen Display (HKLM-x32\...\InstallShield_{0D69462F-99CC-4F8D-942E-666E21CE59F8}) (Version: 0.31.1.8C - )
    Alienware On-Screen Display (x32 Version: 0.31.1.8C - ) Hidden
    Amnesia: A Machine for Pigs (HKLM-x32\...\Steam App 239200) (Version: - The Chinese Room)
    Amnesia: The Dark Descent (HKLM-x32\...\Steam App 57300) (Version: - Frictional Games)
    AmrAddonInstall (Version: 1.0.9.0 - Microsoft) Hidden
    Anki (HKLM-x32\...\Anki) (Version: - )
    Anno 2070 (HKLM-x32\...\Steam App 48240) (Version: - BlueByte)
    Apple Application Support (HKLM-x32\...\{46F044A5-CE8B-4196-984E-5BD6525E361D}) (Version: 2.3.6 - Apple Inc.)
    Apple Mobile Device Support (HKLM\...\{2EF5D87E-B7BD-458F-8428-E4D0B8B4E65C}) (Version: 7.0.0.117 - Apple Inc.)
    Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
    Ask Mr. Robot (HKLM-x32\...\{02465e28-384a-49d0-a3ef-a1986d3f02d0}) (Version: 1.3.5.0 - Ask Mr. Robot)
    Ask Mr. Robot (Version: 1.3.5.0 - Ask Mr. Robot) Hidden
    Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver (HKLM-x32\...\{3108C217-BE83-42E4-AE9E-A56A2A92E549}) (Version: 1.0.0.36 - Atheros Communications Inc.)
    Battle.net (HKLM-x32\...\Battle.net) (Version: - Blizzard Entertainment)
    Bloody Trapland (HKLM-x32\...\Steam App 257750) (Version: - )
    Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
    Castle Crashers (HKLM-x32\...\Steam App 204360) (Version: - The Behemoth)
    CCleaner (HKLM\...\CCleaner) (Version: 4.12 - Piriform)
    Clownfish for Skype (HKLM-x32\...\Clownfish) (Version: - )
    Contagion (HKLM-x32\...\Steam App 238430) (Version: - Monochrome LLC)
    Counter-Strike: Source (HKLM-x32\...\Steam App 240) (Version: - Valve)
    Curse (HKLM-x32\...\{DEE70742-F4E9-44CA-B2B9-EE95DCF37295}) (Version: 6.0.0.0 - Curse)
    Curse Client (HKCU\...\101a9f93b8f0bb6f) (Version: 5.1.1.810 - Curse)
    Daily Alarm Clock (HKLM-x32\...\{38FA7EE0-0222-4F98-9464-A084C15744B0}) (Version: 2.0.0 - Sean Regan)
    DaleSearch Chrome Toolbar (HKLM-x32\...\DaleSearch Chrome Toolbar) (Version: - DaleSearch) <==== ATTENTION
    Damned (HKLM-x32\...\Steam App 251170) (Version: - )
    Dawngate (HKLM-x32\...\{25FAB7E0-526C-437F-8D55-7F00436B873D}) (Version: 180.16.77.0 - Electronic Arts, Inc.)
    DayZ (HKLM-x32\...\Steam App 221100) (Version: - Bohemia Interactive)
    Debut Video Capture Software (HKLM-x32\...\Debut) (Version: 2.00 - NCH Software)
    Defraggler (HKLM\...\Defraggler) (Version: 2.18 - Piriform)
    Dell System Detect (HKCU\...\9204f5692a8faf3b) (Version: 5.9.0.5 - Dell)
    Democracy 3 (HKLM-x32\...\Steam App 245470) (Version: - Positech Games)
    Diablo III (HKLM-x32\...\Diablo III) (Version: - Blizzard Entertainment)
    DivX Setup (HKLM-x32\...\DivX Setup) (Version: 2.6.1.87 - DivX, LLC)
    Dropbox (HKCU\...\Dropbox) (Version: 2.10.29 - Dropbox, Inc.)
    Dungeon Crawl Stone Soup (HKLM-x32\...\Crawl) (Version: 0.14.0 - )
    Dungeon Defenders (HKLM-x32\...\Steam App 65800) (Version: - Trendy Entertainment)
    Dungeon Defenders Eternity (HKLM-x32\...\Steam App 302270) (Version: - Nom Nom Games)
    Dungeon Keeper 2 (HKLM-x32\...\GOGPACKDUNGEONKEEPER2_is1) (Version: 2.0.0.32 - GOG.com)
    Elsword (HKLM-x32\...\Steam App 237310) (Version: - KOG)
    EMSC (x32 Version: 0.0.0.22C - Compal Electronics, Inc.) Hidden
    f.lux (HKCU\...\Flux) (Version: - )
    FileHippo.com Update Checker (HKLM-x32\...\FileHippo.com) (Version: - )
    focus booster (HKLM-x32\...\com.focusboosterapp.focusbooster.air) (Version: 1.3.1 - UNKNOWN)
    focus booster (x32 Version: 1.3.1 - UNKNOWN) Hidden
    Foxit Cloud (HKLM-x32\...\{41914D8B-9D6E-4764-A1F9-BC43FB6782C1}_is1) (Version: 1.5.129.617 - Foxit Corporation)
    Foxit Reader (HKLM-x32\...\Foxit Reader_is1) (Version: 6.2.3.815 - Foxit Corporation)
    FTL: Faster Than Light (HKLM-x32\...\Steam App 212680) (Version: - Subset Games)
    Game Fire (HKLM-x32\...\{B72510EE-A13E-4844-90AB-3ABBFB4B06F3}) (Version: 3.1.200 - Smart PC Utilities)
    Garry's Mod (HKLM-x32\...\Steam App 4000) (Version: - Facepunch Studios)
    GeForce Experience NvStream Client Components (Version: 1.6.28 - NVIDIA Corporation) Hidden
    Glary Utilities 5.7 (HKLM-x32\...\Glary Utilities 5) (Version: 5.7.0.14 - Glarysoft Ltd)
    GOG.com Dungeon Keeper 2 (HKLM\...\{b6462b67-caf5-4a74-99df-cc2811bd1957}.sdb) (Version: - )
    Google Chrome (HKLM-x32\...\{5E326DEC-2D1F-30C1-AAC0-9716A5DA7707}) (Version: 66.3.32870 - Google, Inc.)
    Google Update Helper (x32 Version: 1.3.24.15 - Google Inc.) Hidden
    Guild Wars 2 (HKLM-x32\...\Guild Wars 2) (Version: - NCsoft Corporation, Ltd.)
    Gyazo 2.1 (HKLM-x32\...\{6DB8C365-E719-4BA5-9594-10DFC244D3FD}_is1) (Version: - Nota Inc.)
    Hearthstone (HKLM-x32\...\Hearthstone) (Version: - Blizzard Entertainment)
    ImgBurn (HKLM-x32\...\ImgBurn) (Version: 2.5.8.0 - LIGHTNING UK!)
    InfiniteCrisis_410193F41CAE (HKLM-x32\...\InfiniteCrisis_410193F41CAE) (Version: - Turbine, Inc)
    Intel PROSet Wireless (Version: - ) Hidden
    Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 7.0.0.1144 - Intel Corporation)
    Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 9.17.10.3347 - Intel Corporation)
    Intel(R) PROSet/Wireless WiFi Software (HKLM\...\{290D4DB2-F1B4-4B8E-918D-D71EF29A001B}) (Version: 14.00.1000 - Intel Corporation)
    iTunes (HKLM\...\{A535111D-95C8-487F-869E-CE4C239972D2}) (Version: 11.1.1.11 - Apple Inc.)
    Java 7 Update 67 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F06417067FF}) (Version: 7.0.670 - Oracle)
    Java 7 Update 67 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F03217067FF}) (Version: 7.0.670 - Oracle)
    Java Auto Updater (x32 Version: 2.1.67.1 - Oracle, Inc.) Hidden
    KeePass Password Safe 2.27 (HKLM-x32\...\KeePassPasswordSafe2_is1) (Version: 2.27 - Dominik Reichl)
    Killing Floor (HKLM-x32\...\Steam App 1250) (Version: - Tripwire Interactive)
    Kraven Manor (HKCU\...\Kraven Manor) (Version: 1.0.0 - The Guildhall at SMU)
    Left 4 Dead 2 (HKLM-x32\...\Steam App 550) (Version: - Valve)
    LibUSB-Win32-0.1.10.1 (HKLM-x32\...\LibUSB-Win32_is1) (Version: 0.1.10.1 - LibUSB-Win32)
    LOLReplay (HKLM-x32\...\LOLReplay) (Version: 0.8.5.1 - www.leaguereplays.com)
    Magic 2014 (HKLM-x32\...\Steam App 213850) (Version: - Stainless Games)
    Magicka (HKLM-x32\...\Steam App 42910) (Version: - Arrowhead Game Studios)
    Magicka: Wizard Wars (HKLM-x32\...\Steam App 202090) (Version: - Paradox North)
    Malwarebytes Anti-Malware version 2.0.2.1012 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.2.1012 - Malwarebytes Corporation)
    MATLAB R2009b (HKLM\...\MatlabR2009b) (Version: 7.9 - The MathWorks, Inc.)
    MediaInfo 0.7.8 (HKLM-x32\...\MediaInfo) (Version: 0.7.8 - )
    Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
    Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
    Microsoft Office 2003 Web Components (HKLM-x32\...\{90120000-00A4-0409-0000-0000000FF1CE}) (Version: 12.0.6213.1000 - Microsoft Corporation)
    Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version: - Microsoft)
    Microsoft Office 2007 Service Pack 3 (SP3) (x32 Version: - Microsoft) Hidden
    Microsoft Office Access MUI (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
    Microsoft Office Access Setup Metadata MUI (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
    Microsoft Office Enterprise 2007 (HKLM-x32\...\ENTERPRISE) (Version: 12.0.6612.1000 - Microsoft Corporation)
    Microsoft Office Enterprise 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
    Microsoft Office Excel MUI (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
    Microsoft Office Groove MUI (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
    Microsoft Office Groove Setup Metadata MUI (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
    Microsoft Office InfoPath MUI (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
    Microsoft Office Office 64-bit Components 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
    Microsoft Office OneNote MUI (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
    Microsoft Office Outlook MUI (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
    Microsoft Office PowerPoint MUI (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
    Microsoft Office Proof (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
    Microsoft Office Proof (French) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
    Microsoft Office Proof (Spanish) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
    Microsoft Office Proofing (English) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
    Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) (x32 Version: - Microsoft) Hidden
    Microsoft Office Publisher MUI (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
    Microsoft Office Shared 64-bit MUI (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
    Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
    Microsoft Office Shared MUI (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
    Microsoft Office Shared Setup Metadata MUI (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
    Microsoft Office Word MUI (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
    Microsoft Security Client (Version: 4.5.0216.0 - Microsoft Corporation) Hidden
    Microsoft Security Essentials (HKLM\...\Microsoft Security Client) (Version: 4.5.216.0 - Microsoft Corporation)
    Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
    Microsoft Visual Basic for Applications 7.1 (x64) (Version: 7.1.00.00 - Microsoft Corporation) Hidden
    Microsoft Visual Basic for Applications 7.1 (x64) English (Version: 7.1.0.0 - Microsoft Corporation) Hidden
    Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
    Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
    Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
    Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
    Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
    Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
    Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.60610 (HKLM-x32\...\{95716cce-fc71-413f-8ad5-56c2892d4b3a}) (Version: 11.0.60610.1 - Microsoft Corporation)
    Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.60610 (x32 Version: 11.0.60610 - Microsoft Corporation) Hidden
    Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.60610 (x32 Version: 11.0.60610 - Microsoft Corporation) Hidden
    Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.21005 (HKLM-x32\...\{7f51bdb9-ee21-49ee-94d6-90afc321780e}) (Version: 12.0.21005.1 - Microsoft Corporation)
    Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\...\{ce085a78-074e-4823-8dc1-8a721b94b76d}) (Version: 12.0.21005.1 - Microsoft Corporation)
    Microsoft Visual C++ 2013 x64 Additional Runtime - 12.0.21005 (Version: 12.0.21005 - Microsoft Corporation) Hidden
    Microsoft Visual C++ 2013 x64 Minimum Runtime - 12.0.21005 (Version: 12.0.21005 - Microsoft Corporation) Hidden
    Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005 (x32 Version: 12.0.21005 - Microsoft Corporation) Hidden
    Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 (x32 Version: 12.0.21005 - Microsoft Corporation) Hidden
    Microsoft Visual Studio 2005 Remote Debugger Light (x64) - ENU (HKLM\...\Microsoft Visual Studio 2005 Remote Debugger Light (x64) - ENU) (Version: - Microsoft Corporation)
    Microsoft Visual Studio 2005 Remote Debugger Light (x64) - ENU (Version: 8.0.52572 - Microsoft Corporation) Hidden
    Microsoft Visual Studio 2005 Tools for Applications - ENU (HKLM-x32\...\Microsoft Visual Studio 2005 Tools for Applications - ENU) (Version: - Microsoft Corporation)
    Microsoft Visual Studio 2005 Tools for Applications - ENU (x32 Version: 8.0.50727.146 - Microsoft Corporation) Hidden
    Microsoft XNA Framework Redistributable 3.1 (HKLM-x32\...\{19BFDA5D-1FE2-4F25-97F9-1A79DD04EE20}) (Version: 3.1.10527.0 - Microsoft Corporation)
    Microsoft XNA Framework Redistributable 4.0 Refresh (HKLM-x32\...\{D69C8EDE-BBC5-436B-8E0E-C5A6D311CF4F}) (Version: 4.0.30901.0 - Microsoft Corporation)
    Might & Magic: Heroes VI (HKLM-x32\...\Steam App 48220) (Version: - Blackhole)
    mIRC (HKLM-x32\...\mIRC) (Version: 7.32 - mIRC Co. Ltd.)
    MKV Player 2.1.15 (HKLM-x32\...\MKV Player_is1) (Version: - )
    MotioninJoy Gamepad tool 0.7.1001 (HKLM\...\{330DAC67-5B62-452A-A0E4-6B4A5923940F}_is1) (Version: 0.7.1001 - www.motioninjoy.com)
    Mozilla Firefox 30.0 (x86 en-US) (HKLM-x32\...\Mozilla Firefox 30.0 (x86 en-US)) (Version: 30.0 - Mozilla)
    Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 28.0 - Mozilla)
    MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
    MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
    Mumble 1.2.4 (HKLM-x32\...\{E0955568-4353-4C85-8988-285A8C0F5E87}) (Version: 1.2.4 - Thorvald Natvig)
    Naga Firmware Updater 1.13 (HKLM-x32\...\{5A336D74-E680-4986-96F4-E9CEBC784F56}) (Version: 1.13.01 - Razer)
    NVIDIA 3D Vision Driver 335.23 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 335.23 - NVIDIA Corporation)
    NVIDIA Control Panel 335.23 (Version: 335.23 - NVIDIA Corporation) Hidden
    NVIDIA GeForce Experience 1.8.2.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 1.8.2.1 - NVIDIA Corporation)
    NVIDIA Graphics Driver 335.23 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 335.23 - NVIDIA Corporation)
    NVIDIA HD Audio Driver 1.3.30.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.30.1 - NVIDIA Corporation)
    NVIDIA Install Application (Version: 2.1002.147.1067 - NVIDIA Corporation) Hidden
    NVIDIA LED Visualizer 1.0 (Version: 1.0 - NVIDIA Corporation) Hidden
    NVIDIA Network Service (Version: 1.0 - NVIDIA Corporation) Hidden
    NVIDIA Optimus Update 11.10.13 (Version: 11.10.13 - NVIDIA Corporation) Hidden
    NVIDIA PhysX (x32 Version: 9.13.1220 - NVIDIA Corporation) Hidden
    NVIDIA PhysX System Software 9.13.1220 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.13.1220 - NVIDIA Corporation)
    NVIDIA ShadowPlay 11.10.13 (Version: 11.10.13 - NVIDIA Corporation) Hidden
    NVIDIA Stereoscopic 3D Driver (x32 Version: 7.17.13.3523 - NVIDIA Corporation) Hidden
    NVIDIA Update 11.10.13 (Version: 11.10.13 - NVIDIA Corporation) Hidden
    NVIDIA Update Core (Version: 11.10.13 - NVIDIA Corporation) Hidden
    NVIDIA Virtual Audio 1.2.20 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_VirtualAudio.Driver) (Version: 1.2.20 - NVIDIA Corporation)
    Origin (HKLM-x32\...\Origin) (Version: 9.3.10.4710 - Electronic Arts, Inc.)
    Paranormal - CLOSED BETA 7.0 (HKLM\...\UDK-6d458bda-690f-49df-bca0-91726e75d79c) (Version: - Epic Games, Inc.)
    PCSX2 - Playstation 2 Emulator (HKLM-x32\...\pcsx2-r5875) (Version: - )
    Pharaoh Gold Bundle (HKLM-x32\...\Pharaoh Gold Bundle_is1) (Version: - GOG.com)
    Port Forward Network Utilities 2.0.1 (HKLM-x32\...\Port Forward Network Utilities) (Version: 2.0.1 - Portforward.com)
    Portal 2 (HKLM-x32\...\Steam App 620) (Version: - Valve)
    Private Internet Access Support Files (HKLM-x32\...\{7D72DAFF-DCB2-437B-BC22-4B2ABF21462B}) (Version: 1.0.0.0 - Private Internet Access)
    RaidCall (HKLM-x32\...\RaidCall) (Version: 7.3.0-1.0.10926.49 - raidcall.com)
    Razer Core (HKLM-x32\...\Razer Core) (Version: 1.0.1.66 - Razer Inc)
    Razer Synapse 2.0 (HKLM-x32\...\{0D78BEE2-F8FF-4498-AF1A-3FF81CED8AC6}) (Version: 1.18.15.20888 - Razer Inc.)
    Realtek PCIE Card Reader (HKLM-x32\...\{C1594429-8296-4652-BF54-9DBE4932A44C}) (Version: 6.1.7600.75 - Realtek Semiconductor Corp.)
    Renesas Electronics USB 3.0 Host Controller Driver (HKLM-x32\...\InstallShield_{5442DAB8-7177-49E1-8B22-09A049EA5996}) (Version: 2.0.32.0 - Renesas Electronics Corporation)
    Renesas Electronics USB 3.0 Host Controller Driver (x32 Version: 2.0.32.0 - Renesas Electronics Corporation) Hidden
    Rust (HKLM-x32\...\Steam App 252490) (Version: - Facepunch Studios)
    Saints Row IV (HKLM-x32\...\Steam App 206420) (Version: - Deep Silver Volition)
    SHIELD Streaming (Version: 1.7.321 - NVIDIA Corporation) Hidden
    Sid Meier's Civilization IV (HKLM-x32\...\Steam App 3900) (Version: - Firaxis Games)
    Sid Meier's Civilization IV: Beyond the Sword (HKLM-x32\...\Steam App 8800) (Version: - Firaxis Games)
    Sid Meier's Civilization IV: Warlords (HKLM-x32\...\Steam App 3990) (Version: - Firaxis Games)
    Sid Meier's Civilization V (HKLM-x32\...\Steam App 8930) (Version: - 2K Games, Inc.)
    SimCity™ (HKLM-x32\...\{F70FDE4B-8F86-4eb6-8C8E-636EC89F6419}) (Version: 1.0.0.0 - Electronic Arts)
    Skype Click to Call (HKLM-x32\...\{6D1221A9-17BF-4EC0-81F2-27D30EC30701}) (Version: 7.3.16540.9015 - Microsoft Corporation)
    Skype™ 6.18 (HKLM-x32\...\{7A3C7E05-EE37-47D6-99E1-2EB05A3DA3F7}) (Version: 6.18.106 - Skype Technologies S.A.)
    Software Informer 1.3.1107.0 (HKLM\...\Software Informer_is1) (Version: - Informer Technologies, Inc.)
    SolidWorks 2014 x64 Edition SP01 (HKLM-x32\...\SolidWorks Installation Manager 20140-40100-1100-100) (Version: 22.1.0.44 - SolidWorks Corporation)
    SolidWorks 2014 x64 Edition SP01 (Version: 22.110.44 - SolidWorks) Hidden
    SolidWorks Composer Player 2014 SP01 x64 Edition (Version: 22.10.44 - Dassault Systemes SolidWorks) Hidden
    SolidWorks eDrawings 2014 x64 Edition SP01 (Version: 14.1.116 - Dassault Systèmes SolidWorks Corp) Hidden
    SolidWorks Explorer 2014 SP01 x64 Edition (Version: 22.10.44 - SolidWorks Corporation) Hidden
    SolidWorks Plastics 2014 SP01 x64 Edition (Version: 22.10.44 - SolidWorks Corporation) Hidden
    Sonic & All-Stars Racing Transformed (HKLM-x32\...\Steam App 212480) (Version: - Sumo Digital)
    SpeedFan (remove only) (HKLM-x32\...\SpeedFan) (Version: - )
    Spybot - Search & Destroy (HKLM-x32\...\{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1) (Version: 2.4.40 - Safer-Networking Ltd.)
    Steam (HKLM-x32\...\{048298C9-A4D3-490B-9FF9-AB023A9238F3}) (Version: 1.0.0.0 - Valve Corporation)
    Strife (HKLM-x32\...\strife) (Version: 0.0.1 - S2 Games)
    SumatraPDF (HKLM-x32\...\SumatraPDF) (Version: 2.4 - Krzysztof Kowalczyk)
    SUPERAntiSpyware (HKLM\...\{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}) (Version: 6.0.1130 - SUPERAntiSpyware.com)
    swMSM (x32 Version: 12.0.0.1 - Adobe Systems, Inc) Hidden
    Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 15.1.19.0 - Synaptics Incorporated)
    System Requirements Lab Detection (HKLM-x32\...\{39D29B93-6553-4786-818D-1CBC5F4BE0DF}) (Version: 2.0.0.0 - Husdawg, LLC)
    TeamSpeak 3 Client (HKLM\...\TeamSpeak 3 Client) (Version: 3.0.11.1 - TeamSpeak Systems GmbH)
    TeamViewer 9 (HKLM-x32\...\TeamViewer 9) (Version: 9.0.29947 - TeamViewer)
    Terraria (HKLM-x32\...\Steam App 105600) (Version: - Re-Logic)
    The Wolf Among Us (HKLM-x32\...\Steam App 250320) (Version: - )
    TortoiseSVN 1.8.2.24708 (64 bit) (HKLM\...\{D0DC3918-460D-4229-811E-41F22D0CD7E9}) (Version: 1.8.24708 - TortoiseSVN)
    Tropico 4 (HKLM-x32\...\Steam App 57690) (Version: - Haemimont Games)
    Tropico 5 (HKLM-x32\...\Steam App 245620) (Version: - Haemimont Games)
    Tunngle beta (HKLM-x32\...\Tunngle beta_is1) (Version: - Tunngle.net GmbH)
    Tweaking.com - Windows Repair (All in One) (HKLM-x32\...\Tweaking.com - Windows Repair (All in One)) (Version: 2.0.1 - Tweaking.com)
    Ubisoft Game Launcher (HKLM-x32\...\{888F1505-C2B3-4FDE-835D-36353EBD4754}) (Version: 1.0.0.0 - UBISOFT)
    Unity Web Player (HKCU\...\UnityWebPlayer) (Version: - Unity Technologies ApS)
    Unreal Development Kit: 2012-10 (HKLM\...\UDK-4a414f0a-1816-459c-bad0-7e7647dd18c2) (Version: - Epic Games, Inc.)
    Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version: - Microsoft)
    Update for Microsoft Office 2007 Help for Common Features (KB963673) (HKLM-x32\...\{90120000-006E-0409-0000-0000000FF1CE}_ENTERPRISE_{AB365889-0395-4FAD-B702-CA5985D53D42}) (Version: - Microsoft)
    Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{A024FC7B-77DE-45DE-A058-1C049A17BFB3}) (Version: - Microsoft)
    Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (HKLM-x32\...\{90120000-002A-0000-1000-0000000FF1CE}_ENTERPRISE_{CB68A5B0-3508-4193-AEB9-AF636DAECE0F}) (Version: - Microsoft)
    Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{CB68A5B0-3508-4193-AEB9-AF636DAECE0F}) (Version: - Microsoft)
    Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{E9A82945-BA29-4EE8-8F2A-2F49545E9CF2}) (Version: - Microsoft)
    Update for Microsoft Office Access 2007 Help (KB963663) (HKLM-x32\...\{90120000-0015-0409-0000-0000000FF1CE}_ENTERPRISE_{6B76A18A-AA1E-42AB-A7AD-6C84BBB43987}) (Version: - Microsoft)
    Update for Microsoft Office Excel 2007 Help (KB963678) (HKLM-x32\...\{90120000-0016-0409-0000-0000000FF1CE}_ENTERPRISE_{199DF7B6-169C-448C-B511-1054101BE9C9}) (Version: - Microsoft)
    Update for Microsoft Office Infopath 2007 Help (KB963662) (HKLM-x32\...\{90120000-0044-0409-0000-0000000FF1CE}_ENTERPRISE_{716B81B8-B13C-41DF-8EAC-7A2F656CAB63}) (Version: - Microsoft)
    Update for Microsoft Office OneNote 2007 Help (KB963670) (HKLM-x32\...\{90120000-00A1-0409-0000-0000000FF1CE}_ENTERPRISE_{2744EF05-38E1-4D5D-B333-E021EDAEA245}) (Version: - Microsoft)
    Update for Microsoft Office Outlook 2007 (KB2687404) 32-Bit Edition (HKLM-x32\...\{90120000-001A-0409-0000-0000000FF1CE}_ENTERPRISE_{ED38F8A3-4F61-494E-8BCA-E3AC7760C924}) (Version: - Microsoft)
    Update for Microsoft Office Outlook 2007 (KB2863811) 32-Bit Edition (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{53DEC068-4690-4F6B-9946-7D21EF02236B}) (Version: - Microsoft)
    Update for Microsoft Office Outlook 2007 Help (KB963677) (HKLM-x32\...\{90120000-001A-0409-0000-0000000FF1CE}_ENTERPRISE_{0451F231-E3E3-4943-AB9F-58EB96171784}) (Version: - Microsoft)
    Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2883097) 32-Bit Edition (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{B2260BC9-D561-46EE-B33D-739CF760A2A9}) (Version: - Microsoft)
    Update for Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM-x32\...\{90120000-0018-0409-0000-0000000FF1CE}_ENTERPRISE_{397B1D4F-ED7B-4ACA-A637-43B670843876}) (Version: - Microsoft)
    Update for Microsoft Office Publisher 2007 Help (KB963667) (HKLM-x32\...\{90120000-0019-0409-0000-0000000FF1CE}_ENTERPRISE_{2E40DE55-B289-4C8B-8901-5D369B16814F}) (Version: - Microsoft)
    Update for Microsoft Office Script Editor Help (KB963671) (HKLM-x32\...\{90120000-006E-0409-0000-0000000FF1CE}_ENTERPRISE_{CD11C6A2-FFC6-4271-8EAB-79C3582F505C}) (Version: - Microsoft)
    Update for Microsoft Office Word 2007 Help (KB963665) (HKLM-x32\...\{90120000-001B-0409-0000-0000000FF1CE}_ENTERPRISE_{80E762AA-C921-4839-9D7D-DB62A72C0726}) (Version: - Microsoft)
    VC80CRTRedist - 8.0.50727.6195 (x32 Version: 1.2.0 - DivX, Inc) Hidden
    Ventrilo Client for Windows x64 (HKLM\...\{EEB3F6BB-318D-4CE5-989F-8191FCBFB578}) (Version: 3.0.8.0 - Flagship Industries, Inc.)
    Vista Services Optimizer (HKLM-x32\...\{C165D09F-FBC4-48C7-B951-CCD5177803F4}) (Version: 2.1.300 - Smart PC Utilities)
    Visual Boy Advance Packages (HKCU\...\Visual Boy Advance Packages) (Version: - ) <==== ATTENTION
    War of the Roses (HKLM-x32\...\Steam App 42160) (Version: - Fatshark)
    War of the Roses Balance Beta (HKLM-x32\...\Steam App 206980) (Version: - )
    War of the Vikings Alpha (HKLM-x32\...\Steam App 246190) (Version: - )
    WildStar (HKLM-x32\...\WildStar) (Version: - NCSOFT)
    WinRAR 5.00 beta 6 (64-bit) (HKLM\...\WinRAR archiver) (Version: 5.00.6 - win.rar GmbH)
    Yahoo! Messenger (HKLM-x32\...\Yahoo! Messenger) (Version: - Yahoo! Inc.)
    Yahoo! Software Update (HKLM-x32\...\Yahoo! Software Update) (Version: - )
    Yahoo! Toolbar (HKLM-x32\...\Yahoo! Companion) (Version: - Yahoo! Inc.)
    YouTube Accelerator (HKLM-x32\...\YouTube Accelerator) (Version: 3394(build_96) - Goobzo Ltd.)

    ==================== Custom CLSID (selected items): ==========================

    (If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

    CustomCLSID: HKU\S-1-5-21-4037467554-2527304460-3365707105-1000_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\Ahmed\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
    CustomCLSID: HKU\S-1-5-21-4037467554-2527304460-3365707105-1000_Classes\CLSID\{92c58f58-7e24-4a80-b590-142b6da8fec2}\InprocServer32 -> C:\Windows\system32\dfshim.dll (Microsoft Corporation)
    CustomCLSID: HKU\S-1-5-21-4037467554-2527304460-3365707105-1000_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Ahmed\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
    CustomCLSID: HKU\S-1-5-21-4037467554-2527304460-3365707105-1000_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Ahmed\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
    CustomCLSID: HKU\S-1-5-21-4037467554-2527304460-3365707105-1000_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Ahmed\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
    CustomCLSID: HKU\S-1-5-21-4037467554-2527304460-3365707105-1000_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Ahmed\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
    CustomCLSID: HKU\S-1-5-21-4037467554-2527304460-3365707105-1000_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Ahmed\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
    CustomCLSID: HKU\S-1-5-21-4037467554-2527304460-3365707105-1000_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Ahmed\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
    CustomCLSID: HKU\S-1-5-21-4037467554-2527304460-3365707105-1000_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Ahmed\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
    CustomCLSID: HKU\S-1-5-21-4037467554-2527304460-3365707105-1000_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Ahmed\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)

    ==================== Restore Points =========================

    24-08-2014 23:30:59 Installed Daily Alarm Clock
    25-08-2014 18:38:01 Installed Naga Firmware Updater 1.13.
    25-08-2014 19:09:49 Removed Razer Synapse 2.0.
    26-08-2014 13:11:17 Windows Update
    26-08-2014 13:44:25 Windows Modules Installer
    29-08-2014 00:51:05 Windows Update
    02-09-2014 07:48:41 Windows Update
    02-09-2014 15:56:14 Installed System Requirements Lab Detection
    03-09-2014 10:56:06 Before antirootkit

    ==================== Hosts content: ==========================

    (If needed Hosts: directive could be included in the fixlist to reset Hosts.)

    2009-07-14 05:34 - 2014-09-04 13:27 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts
    127.0.0.1 localhost

    ==================== Scheduled Tasks (whitelisted) =============

    (If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

    Task: {04BFF931-040D-44DB-9978-3135F2208EA7} - System32\Tasks\GU5SkipUAC => C:\Program Files (x86)\Glary Utilities 5\Integrator.exe [2014-09-01] (Glarysoft Ltd)
    Task: {0ABEDAA1-D3EC-4288-8F77-03667F1CB0AB} - System32\Tasks\SystemToolsDailyTest => uaclauncher.exe
    Task: {12FFA309-F827-4353-8176-9A61C2694D1B} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-07-09] (Adobe Systems Incorporated)
    Task: {2A712EC4-0D4A-4C23-8C00-602C0607AB99} - System32\Tasks\Private Internet Access Startup => C:\Program Files\pia_manager\pia_manager.exe [2014-07-19] ()
    Task: {329F7992-DB2D-4936-907B-0418CFF3F05D} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-06-07] (Google Inc.)
    Task: {33B4BB5A-EF42-4C95-B309-FF5378264020} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe
    Task: {36CA1824-B99F-4691-B2C8-2B77387C6288} - System32\Tasks\PCDoctorBackgroundMonitorTask => C:\Program Files\AlienAutopsy\uaclauncher.exe [2014-01-31] (PC-Doctor, Inc.)
    Task: {38E14CD4-0AE0-4CFF-9742-521D665D5438} - System32\Tasks\SidebarExecute => C:\Program Files (x86)\Windows Sidebar\sidebar.exe [2010-11-20] (Microsoft Corporation)
    Task: {4479AA1E-96CC-4269-A61C-FCAA8FD2AC5B} - System32\Tasks\Alarm => C:\Users\Ahmed\Desktop\Desktop\『Popipopoison』 Popipo League of Legends Parody - Copy.mp3 [2013-11-28] ()
    Task: {5B3993D5-2F24-47C1-BCCF-FE073EA1E8AC} - System32\Tasks\YTAUpdate => C:\PROGRA~2\YOUTUB~1\Updater.exe <==== ATTENTION
    Task: {6C648445-18C2-4DEE-A8CE-9B14815E3C6D} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Scan the system => C:\Program Files (x86)\Spybot - Search &amp; Destroy 2\SDScan.exe
    Task: {80D3B691-7F42-4D23-8651-E2E059381646} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-06-07] (Google Inc.)
    Task: {90F5A1D0-588E-4462-B847-E0D878D2AD6E} - System32\Tasks\Wake up => C:\Users\Ahmed\Desktop\Desktop\『Popipopoison』 Popipo League of Legends Parody - Copy.mp3 [2013-11-28] ()
    Task: {9CEDBD86-3ED1-4480-A94A-3E1C0844410F} - System32\Tasks\GlaryInitialize 5 => C:\Program Files (x86)\Glary Utilities 5\Initialize.exe [2014-09-01] (Glarysoft Ltd)
    Task: {A241A0CA-E007-46B4-9A1F-BE5CA0F49774} - System32\Tasks\Upload the friggin document ya ahbal
    Task: {A2506356-AC99-4B04-8394-2E1B9F3004F3} - System32\Tasks\SoftwareInformerService => C:\Program Files\Software Informer\softinfo.exe [2014-07-23] (Informer Technologies, Inc.)
    Task: {CB77D201-7295-4D4E-BD86-D5FFA82A3D22} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Check for updates => C:\Program Files (x86)\Spybot - Search &amp; Destroy 2\SDUpdate.exe
    Task: {D3371FD4-5E74-4258-A8E5-6EC3C2BD891D} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
    Task: {DF214550-B0CB-417E-AC88-F1CC448D9A4F} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2014-03-18] (Piriform Ltd)
    Task: {E1AC9C6B-3D06-43A9-B90D-B8A4DD5C6256} - System32\Tasks\GyazoUpdateTaskMachine => C:\Program Files (x86)\Gyazo\GyazoUpdate.exe [2014-05-08] ()
    Task: {E87B1D26-1F44-4BE0-8D9E-030943D1F444} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization => C:\Program Files (x86)\Spybot - Search &amp; Destroy 2\SDImmunize.exe
    Task: {EDC520D2-2AEB-44F1-B3F7-130CFA764372} - System32\Tasks\PCDEventLauncherTask => C:\Program Files\AlienAutopsy\sessionchecker.exe [2014-01-31] (PC-Doctor, Inc.)
    Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
    Task: C:\Windows\Tasks\GlaryInitialize 5.job => C:\Program Files (x86)\Glary Utilities 5\Initialize.exe
    Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
    Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

    ==================== Loaded Modules (whitelisted) =============

    2010-12-17 13:53 - 2010-12-17 13:53 - 01501696 _____ () C:\Program Files\Common Files\Intel\WirelessCommon\Libeay32.dll
    2014-04-04 00:02 - 2014-03-04 16:05 - 00116056 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
    2010-12-17 13:53 - 2010-12-17 13:53 - 01501696 _____ () C:\Program Files\Common Files\Intel\WirelessCommon\LIBEAY32.dll
    2013-06-07 11:50 - 2011-03-14 10:43 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
    2013-06-07 12:02 - 2010-12-17 10:27 - 00703088 _____ () C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe
    2013-08-27 23:59 - 2013-08-27 23:59 - 00088304 _____ () C:\Program Files\TortoiseSVN\bin\libsasl.dll
    2011-01-10 16:16 - 2011-01-10 16:16 - 01545584 _____ () C:\Program Files (x86)\Alienware On-Screen Display\AlienwareOn-ScreenDisplay.exe
    2013-08-28 00:00 - 2013-08-28 00:00 - 00075504 _____ () C:\Program Files\TortoiseSVN\bin\TortoiseStub.dll
    2014-04-03 23:46 - 2014-03-04 17:35 - 00014280 _____ () C:\Program Files (x86)\NVIDIA Corporation\CoProcManager\detoured.dll
    2014-09-02 16:45 - 2014-05-13 12:04 - 00109400 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlThirdParty150.bpl
    2014-09-02 16:45 - 2014-05-13 12:04 - 00416600 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\DEC150.bpl
    2014-09-02 16:45 - 2014-05-13 12:04 - 00167768 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlFileFormats150.bpl
    2009-12-18 11:07 - 2009-12-18 11:07 - 00577536 _____ () C:\Program Files (x86)\Alienware On-Screen Display\EMSC.dll
    2014-09-01 09:14 - 2014-09-01 09:14 - 00080160 _____ () C:\Program Files (x86)\Glary Utilities 5\zlib1.dll
    2013-08-27 23:05 - 2013-08-27 23:05 - 00065264 _____ () C:\Program Files\TortoiseSVN\bin\TortoiseStub32.dll
    2013-08-27 23:04 - 2013-08-27 23:04 - 00070896 _____ () C:\Program Files\TortoiseSVN\bin\libsasl32.dll
    2014-09-02 16:45 - 2012-08-23 10:38 - 00574840 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\sqlite3.dll
    2014-09-02 16:45 - 2012-04-03 17:06 - 00565640 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\av\BDSmartDB.dll
    2014-09-03 13:10 - 2014-08-30 05:49 - 01098056 _____ () C:\Program Files (x86)\Google\Chrome\Application\37.0.2062.103\libglesv2.dll
    2014-09-03 13:10 - 2014-08-30 05:49 - 00174408 _____ () C:\Program Files (x86)\Google\Chrome\Application\37.0.2062.103\libegl.dll
    2014-09-03 13:10 - 2014-08-30 05:49 - 08577864 _____ () C:\Program Files (x86)\Google\Chrome\Application\37.0.2062.103\pdf.dll
    2014-09-03 13:10 - 2014-08-30 05:49 - 00331592 _____ () C:\Program Files (x86)\Google\Chrome\Application\37.0.2062.103\ppGoogleNaClPluginChrome.dll
    2014-09-03 13:10 - 2014-08-30 05:49 - 01660232 _____ () C:\Program Files (x86)\Google\Chrome\Application\37.0.2062.103\ffmpegsumo.dll
    2014-09-03 13:10 - 2014-08-30 05:49 - 14669128 _____ () C:\Program Files (x86)\Google\Chrome\Application\37.0.2062.103\PepperFlash\pepflashplayer.dll

    ==================== Alternate Data Streams (whitelisted) =========

    (If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

    AlternateDataStreams: C:\ProgramData\TEMP:373E1720
    AlternateDataStreams: C:\ProgramData\TEMP:56E2E879

    ==================== Safe Mode (whitelisted) ===================

    (If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


    ==================== EXE Association (whitelisted) =============

    (If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


    ==================== MSCONFIG/TASK MANAGER disabled items =========

    (Currently there is no automatic fix for this section.)

    MSCONFIG\Services: Apple Mobile Device => 2
    MSCONFIG\Services: BAVSvc => 2
    MSCONFIG\Services: BHipsSvc => 2
    MSCONFIG\Services: Bonjour Service => 2
    MSCONFIG\Services: iPod Service => 3
    MSCONFIG\Services: MozillaMaintenance => 3
    MSCONFIG\Services: PCAppStoreSvc_{PCAppStore_4.0.6.5038} => 2
    MSCONFIG\Services: SolidWorks Licensing Service => 3
    MSCONFIG\Services: TeamViewer9 => 2
    MSCONFIG\Services: TunngleService => 3
    MSCONFIG\Services: YahooAUService => 2
    MSCONFIG\Services: YouTubeAcceleratorService => 2
    MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^LOLRecorder.lnk => C:\Windows\pss\LOLRecorder.lnk.CommonStartup
    MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^SolidWorks 2014 Fast Start.lnk => C:\Windows\pss\SolidWorks 2014 Fast Start.lnk.CommonStartup
    MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^SolidWorks Background Downloader.lnk => C:\Windows\pss\SolidWorks Background Downloader.lnk.CommonStartup
    MSCONFIG\startupfolder: C:^Users^Ahmed^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Curse.lnk => C:\Windows\pss\Curse.lnk.Startup
    MSCONFIG\startupfolder: C:^Users^Ahmed^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^CurseClientStartup.ccip => C:\Windows\pss\CurseClientStartup.ccip.Startup
    MSCONFIG\startupfolder: C:^Users^Ahmed^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^MyPC Backup.lnk => C:\Windows\pss\MyPC Backup.lnk.Startup
    MSCONFIG\startupreg: APSDaemon => "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
    MSCONFIG\startupreg: Clownfish => "C:\Program Files (x86)\Clownfish\Clownfish.exe"
    MSCONFIG\startupreg: DivXMediaServer => C:\Program Files (x86)\DivX\DivX Media Server\DivXMediaServer.exe
    MSCONFIG\startupreg: DivXUpdate => "C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
    MSCONFIG\startupreg: EADM => "C:\Program Files (x86)\Origin\Origin.exe" -AutoStart
    MSCONFIG\startupreg: Game Fire => C:\Program Files (x86)\Smart PC Utilities\Game Fire\GFTray.exe /START
    MSCONFIG\startupreg: GoobzoYouTubeAccelerator => "C:\Program Files (x86)\YouTube Accelerator\YouTubeAccelerator.exe" /startup
    MSCONFIG\startupreg: Gyazo => C:\Program Files (x86)\Gyazo\GyStation.exe
    MSCONFIG\startupreg: iTunesHelper => "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
    MSCONFIG\startupreg: LogMeIn GUI => "C:\Program Files (x86)\LogMeIn\x64\LogMeInSystray.exe"
    MSCONFIG\startupreg: LogMeIn Hamachi Ui => "C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe" --auto-start
    MSCONFIG\startupreg: Messenger (Yahoo!) => "C:\PROGRA~2\Yahoo!\Messenger\YahooMessenger.exe" -quiet
    MSCONFIG\startupreg: Optimizer Pro => C:\Program Files (x86)\Optimizer Pro\OptProLauncher.exe
    MSCONFIG\startupreg: Razer Synapse => "C:\Program Files (x86)\Razer\Synapse\RzSynapse.exe"
    MSCONFIG\startupreg: SearchProtectAll => C:\Program Files (x86)\SearchProtect\bin\cltmng.exe
    MSCONFIG\startupreg: uTorrent => "C:\Users\Ahmed\AppData\Roaming\uTorrent\uTorrent.exe" /MINIMIZED

    ==================== Faulty Device Manager Devices =============

    Name: Bnbase
    Description: Bnbase
    Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
    Manufacturer:
    Service: Bnbase
    Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
    Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
    Devices stay in this state if they have been prepared for removal.
    After you remove the device, this error disappears.Remove the device, and this error should be resolved.

    Name: Baidu NetDefense
    Description: Baidu NetDefense
    Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
    Manufacturer:
    Service: Bndef
    Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
    Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
    Devices stay in this state if they have been prepared for removal.
    After you remove the device, this error disappears.Remove the device, and this error should be resolved.

    Name: LogMeIn Kernel Information Provider
    Description: LogMeIn Kernel Information Provider
    Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
    Manufacturer:
    Service: LMIInfo
    Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
    Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
    Devices stay in this state if they have been prepared for removal.
    After you remove the device, this error disappears.Remove the device, and this error should be resolved.

    Name: Baidu Protect
    Description: Baidu Protect
    Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
    Manufacturer:
    Service: Bprotect
    Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
    Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
    Devices stay in this state if they have been prepared for removal.
    After you remove the device, this error disappears.Remove the device, and this error should be resolved.

    Name: BAPIDRV
    Description: BAPIDRV
    Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
    Manufacturer:
    Service: BAPIDRV
    Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
    Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
    Devices stay in this state if they have been prepared for removal.
    After you remove the device, this error disappears.Remove the device, and this error should be resolved.

    Name: TAP-Win32 Adapter V9
    Description: TAP-Win32 Adapter V9
    Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
    Manufacturer: TAP-Win32 Provider V9
    Service: tap0901
    Problem: : Windows cannot start this hardware device because its configuration information (in the registry) is incomplete or damaged. (Code 19)
    Resolution: A registry problem was detected.
    This can occur when more than one service is defined for a device, if there is a failure opening the service subkey, or if the driver name cannot be obtained from the service subkey. Try these options:
    On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.
    Click "Uninstall", and then click "Scan for hardware changes" to load a usable driver.


    ==================== Event log errors: =========================

    Application errors:
    ==================

    System errors:
    =============

    Microsoft Office Sessions:
    =========================

    CodeIntegrity Errors:
    ===================================
    Date: 2014-09-04 13:26:52.992
    Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

    Date: 2014-09-04 13:26:52.882
    Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.


    ==================== Memory info ===========================

    Processor: Intel(R) Core(TM) i7-2630QM CPU @ 2.00GHz
    Percentage of memory in use: 41%
    Total physical RAM: 8139.86 MB
    Available physical RAM: 4789.78 MB
    Total Pagefile: 16277.9 MB
    Available Pagefile: 12586.68 MB
    Total Virtual: 8192 MB
    Available Virtual: 8191.83 MB

    ==================== Drives ================================

    Drive c: () (Fixed) (Total:698.54 GB) (Free:345.67 GB) NTFS
    Drive d: (FINAL_FANTASY_X) (CDROM) (Total:4.28 GB) (Free:0 GB) CDFS

    ==================== MBR & Partition Table ==================

    ========================================================
    Disk: 0 (MBR Code: Windows 7 or 8) (Size: 698.6 GB) (Disk ID: 44B1E201)
    Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
    Partition 2: (Not Active) - (Size=698.5 GB) - (Type=07 NTFS)

    ==================== End Of Log ============================
     
  23. Broni

    Broni Malware Annihilator Posts: 47,048   +256

    [​IMG] Uninstall:
    - DaleSearch Chrome Toolbar
    - Visual Boy Advance Packages

    [​IMG]
    Download attached fixlist.txt file and save it to the Desktop.
    NOTE. It's important that both files, FRST and fixlist.txt are in the same location or the fix will not work.

    NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

    Run FRST(FRST64) and press the Fix button just once and wait.
    The tool will make a log on the Desktop (Fixlog.txt). Please post it to your reply.
     

    Attached Files:

  24. Ryansee

    Ryansee TS Rookie Topic Starter Posts: 19

    Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 03-09-2014 02
    Ran by Ahmed at 2014-09-06 15:41:59 Run:1
    Running from C:\Users\Ahmed\Desktop\Week 1
    Boot Mode: Normal
    ==============================================

    Content of fixlist:
    *****************
    HKLM-x32\...\Run: [] => [X]
    ShellIconOverlayIdentifiers: 00avast -> {472083B0-C522-11CF-8763-00608CC02F24} => No File
    CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
    S4 YouTubeAcceleratorService; C:\PROGRA~2\YOUTUB~1\YouTubeAcceleratorService.exe -start -scm [X]
    S4 LMIRfsClientNP; No ImagePath
    S1 BAPIDRV; system32\DRIVERS\BAPIDRV64.sys [X]
    S1 Bfilter; \??\C:\Windows\System32\drivers\Bfilter.sys [X]
    S1 Bfmon; \??\C:\Windows\System32\drivers\Bfmon.sys [X]
    S1 Bnbase; System32\drivers\bnbasex64.sys [X]
    S1 Bndef; \??\C:\Windows\System32\drivers\bndef64.sys [X]
    S1 Bprotect; \??\C:\Windows\System32\drivers\Bprotect.sys [X]
    S3 BprotectEx; \??\C:\Windows\System32\drivers\BprotectEx.sys [X]
    S3 catchme; \??\C:\ComboFix\catchme.sys [X]
    S3 IntcAzAudAddService; system32\drivers\RTKVHD64.sys [X]
    S2 LMIInfo; \??\C:\Program Files (x86)\LogMeIn\x64\RaInfo.sys [X]
    S3 PCFApiUtil; \??\C:\Program Files (x86)\Baidu Security\PC Faster\4.0.0.0\PCFApiUtil64.sys [X]
    2014-09-02 16:46 - 2014-09-02 19:39 - 00000000 ____D () C:\3590F75ABA9E485486C100C1A9D4FF06ZZ.Z..ZZZZZ....Z
    C:\ProgramData\Duplicaterecord.js
    C:\Users\Ahmed\AppData\Local\Temp\Quarantine.exe
    Task: {5B3993D5-2F24-47C1-BCCF-FE073EA1E8AC} - System32\Tasks\YTAUpdate => C:\PROGRA~2\YOUTUB~1\Updater.exe <==== ATTENTION
    AlternateDataStreams: C:\ProgramData\TEMP:373E1720
    AlternateDataStreams: C:\ProgramData\TEMP:56E2E879

    *****************

    HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\ => value deleted successfully.
    "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\00avast" => Key deleted successfully.
    "HKCR\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}" => Key not found.
    "HKLM\SOFTWARE\Policies\Google" => Key deleted successfully.
    YouTubeAcceleratorService => Service deleted successfully.
    LMIRfsClientNP => Service deleted successfully.
    BAPIDRV => Service deleted successfully.
    Bfilter => Service deleted successfully.
    Bfmon => Service deleted successfully.
    Bnbase => Service deleted successfully.
    Bndef => Service deleted successfully.
    Bprotect => Service deleted successfully.
    BprotectEx => Service deleted successfully.
    catchme => Service deleted successfully.
    IntcAzAudAddService => Service deleted successfully.
    LMIInfo => Service deleted successfully.
    PCFApiUtil => Service deleted successfully.
    C:\3590F75ABA9E485486C100C1A9D4FF06ZZ.Z..ZZZZZ....Z => Moved successfully.
    C:\ProgramData\Duplicaterecord.js => Moved successfully.
    C:\Users\Ahmed\AppData\Local\Temp\Quarantine.exe => Moved successfully.
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{5B3993D5-2F24-47C1-BCCF-FE073EA1E8AC}" => Key deleted successfully.
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{5B3993D5-2F24-47C1-BCCF-FE073EA1E8AC}" => Key deleted successfully.
    C:\Windows\System32\Tasks\YTAUpdate => Moved successfully.
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\YTAUpdate" => Key deleted successfully.
    C:\ProgramData\TEMP => ":373E1720" ADS removed successfully.
    C:\ProgramData\TEMP => ":56E2E879" ADS removed successfully.

    ==== End of Fixlog ====
     
  25. Broni

    Broni Malware Annihilator Posts: 47,048   +256

    How is computer doing?

    Last scans...

    [​IMG] Download Security Check from here or here and save it to your Desktop.
    • Double-click SecurityCheck.exe
    • Follow the onscreen instructions inside of the black box.
    • A Notepad document should open automatically called checkup.txt; please post the contents of that document.
    NOTE 1. If one of your security applications (e.g., third-party firewall) requests permission to allow DIG.EXE access the Internet, allow it to do so.
    NOTE 2 SecurityCheck may produce some false warning(s), so leave the results reading to me.
    NOTE 3. If you receive UNSUPPORTED OPERATING SYSTEM! ABORTED! message restart computer and Security Check should run


    [​IMG] Please download Farbar Service Scanner (FSS) and run it on the computer with the issue.
    • Make sure the following options are checked:
      • Internet Services
      • Windows Firewall
      • System Restore
      • Security Center
      • Windows Update
      • Windows Defender
      • Other Services
    • Press "Scan".
    • It will create a log (FSS.txt) in the same directory the tool is run.
    • Please copy and paste the log to your reply.

    [​IMG] Download Temp File Cleaner (TFC)
    Alternate download: http://www.itxassociates.com/OT-Tools/TFC.exe
    • Double click on TFC.exe to run the program.
    • Click on Start button to begin cleaning process.
    • TFC will close all running programs, and it may ask you to restart computer.

    [​IMG] Please run a free online scan with the ESET Online Scanner

    • Disable your antivirus program
    • Internet Explorer users - Click on this link to open ESET OnlineScan.
    • For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
      • Click on ESET Smart Installer to download the ESET Smart Installer. Save it to your desktop.
      • Double click on the [img=[url]http://www.bleepstatic.com/fhost/uploads/0/esetsmartinstaller_enu.png][/url] icon on your desktop.
    • Check "YES, I accept the Terms of Use."
    • Click the Start button.
    • Accept any security warnings from your browser.[/*]
    • Check "Enable detection of potentially unwanted applications".
    • Click Advanced settings and make sure all 4 boxes are checkmarked (two of them are already checkmarked by default).
      Do NOT checkmark "Use custom proxy settings"
    • Click the Start button.
    • ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
    • When the scan completes, click List Threats[/*]
    • Click Export, and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
    • Click the Back button.
    • Click the Finish button.
     
Topic Status:
Not open for further replies.


Add New Comment

TechSpot Members
Login or sign up for free,
it takes about 30 seconds.
You may also...


Get complete access to the TechSpot community. Join thousands of technology enthusiasts that contribute and share knowledge in our forum. Get a private inbox, upload your own photo gallery and more.