Publicité
Publicité
Format du document : text/plain
Prévisualisation
Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:06-05-2016 03
Ran by Mouadh B (administrator) on MOUADH (07-05-2016 03:20:20)
Running from C:\Users\Mouadh B\Desktop
Loaded Profiles: Mouadh B (Available Profiles: Mouadh B)
Platform: Windows 8.1 Pro (X64) Language: English (United States)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(Intel Corporation) C:\Windows\System32\igfxCUIService.exe
(Agnitum Ltd.) C:\Program Files\Agnitum\Outpost Firewall Pro\acs.exe
(Microsoft Corporation) C:\Windows\System32\mqsvc.exe
(Microsoft Corporation) C:\Windows\System32\TCPSVCS.EXE
(Microsoft Corporation) C:\Windows\System32\snmp.exe
(Microsoft Corporation) C:\Windows\System32\vmms.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
() C:\Windows\SECOH-QAD.exe
(Microsoft Corporation) C:\Windows\System32\SppExtComObj.Exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Intel Corporation) C:\Windows\System32\igfxEM.exe
(Intel Corporation) C:\Windows\System32\igfxHK.exe
(Intel Corporation) C:\Windows\System32\igfxTray.exe
(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(Agnitum Ltd.) C:\Program Files\Agnitum\Outpost Firewall Pro\op_mon.exe
() C:\Program Files (x86)\RocketDock\RocketDock.exe
(hxxp://winaero.com) C:\Program Files (x86)\Black 8\WinaeroGlass\WinaeroGlass.exe
(Mega Limited) C:\Users\Mouadh B\AppData\Local\MEGAsync\MEGAsync.exe
(Microsoft Corporation) C:\Windows\System32\GWX\GWX.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Tonec Inc.) C:\Program Files (x86)\internet doznload manager\IDMan.exe
(Tonec Inc.) C:\Program Files (x86)\internet doznload manager\IEMonitor.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
==================== Registry (Whitelisted) ===========================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [OutpostMonitor] => C:\Program Files\Agnitum\Outpost Firewall Pro\op_mon.exe [4544208 2015-11-30] (Agnitum Ltd.)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1021128 2014-12-03] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [CamtasiaUD] => C:\Users\Mouadh B\AppData\Roaming\Camtasia\CamtasiaUD
HKU\S-1-5-21-3312846245-256796695-1462527662-1001\...\Run: [DrvUpdater] => C:\Users\Mouadh B\AppData\Roaming\DRPSu\DrvUpdater.exe [195256 2016-02-26] ()
HKU\S-1-5-21-3312846245-256796695-1462527662-1001\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [8641240 2016-02-12] (Piriform Ltd)
HKU\S-1-5-21-3312846245-256796695-1462527662-1001\...\Run: [CamtasiaUD] => C:\Users\Mouadh B\AppData\Roaming\Camtasia\CamtasiaUD
HKU\S-1-5-21-3312846245-256796695-1462527662-1001\...\Run: [IDMan] => C:\Program Files (x86)\internet doznload manager\IDMan.exe [3931728 2015-12-30] (Tonec Inc.)
HKU\S-1-5-21-3312846245-256796695-1462527662-1001\...\Run: [AceStream] => C:\Users\Mouadh B\AppData\Roaming\ACEStream\engine\ace_engine.exe
AppInit_DLLs: c:\progra~1\agnitum\outpos~1\wl_hoo~1.dll => c:\Program Files\Agnitum\Outpost Firewall Pro\wl_hook64.dll [1431024 2015-11-26] (Agnitum Ltd.)
AppInit_DLLs-x32: c:\progra~1\agnitum\outpos~1\wl_hook.dll => c:\Program Files\Agnitum\Outpost Firewall Pro\wl_hook.dll [1056664 2015-11-26] (Agnitum Ltd.)
IFEO\SppExtComObj.exe: [Debugger] C:\Windows\SECOH-QAD.exe
ShellIconOverlayIdentifiers: [ IDM Shell Extension] -> {CDC95B92-E27C-4745-A8C5-64A52A78855D} => C:\Program Files (x86)\internet doznload manager\IDMShellExt64.dll [2015-08-14] (Tonec Inc.)
ShellIconOverlayIdentifiers: [###MegaShellExtPending] -> {056D528D-CE28-4194-9BA3-BA2E9197FF8C} => C:\Users\Mouadh B\AppData\Local\MEGAsync\ShellExtX64.dll [2014-05-01] ()
ShellIconOverlayIdentifiers: [###MegaShellExtSynced] -> {05B38830-F4E9-4329-978B-1DD28605D202} => C:\Users\Mouadh B\AppData\Local\MEGAsync\ShellExtX64.dll [2014-05-01] ()
ShellIconOverlayIdentifiers: [###MegaShellExtSyncing] -> {0596C850-7BDD-4C9D-AFDF-873BE6890637} => C:\Users\Mouadh B\AppData\Local\MEGAsync\ShellExtX64.dll [2014-05-01] ()
ShellIconOverlayIdentifiers-x32: [###MegaShellExtPending] -> {056D528D-CE28-4194-9BA3-BA2E9197FF8C} => C:\Users\Mouadh B\AppData\Local\MEGAsync\ShellExtX32.dll [2014-05-01] ()
ShellIconOverlayIdentifiers-x32: [###MegaShellExtSynced] -> {05B38830-F4E9-4329-978B-1DD28605D202} => C:\Users\Mouadh B\AppData\Local\MEGAsync\ShellExtX32.dll [2014-05-01] ()
ShellIconOverlayIdentifiers-x32: [###MegaShellExtSyncing] -> {0596C850-7BDD-4C9D-AFDF-873BE6890637} => C:\Users\Mouadh B\AppData\Local\MEGAsync\ShellExtX32.dll [2014-05-01] ()
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Rainmeter.exe - Shortcut.lnk [2015-03-30]
ShortcutTarget: Rainmeter.exe - Shortcut.lnk -> C:\Rainmeter\Rainmeter.exe ()
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\RocketDock.exe - Shortcut.lnk [2015-05-05]
ShortcutTarget: RocketDock.exe - Shortcut.lnk -> C:\Program Files (x86)\RocketDock\RocketDock.exe ()
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\WinaeroGlass.lnk [2014-10-07]
ShortcutTarget: WinaeroGlass.lnk -> C:\Program Files (x86)\Black 8\WinaeroGlass\WinaeroGlass.exe (http://winaero.com)
Startup: C:\Users\Mouadh B\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MEGAsync.lnk [2016-05-06]
ShortcutTarget: MEGAsync.lnk -> C:\Users\Mouadh B\AppData\Local\MEGAsync\MEGAsync.exe (Mega Limited)
GroupPolicyScripts: Restriction <======= ATTENTION
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
Tcpip\Parameters: [DhcpNameServer] 54.186.51.153 8.8.8.8
Tcpip\..\Interfaces\{A43C5231-44AB-4CB0-B713-633C3E309A18}: [DhcpNameServer] 54.186.51.153 8.8.8.8
Internet Explorer:
==================
HKU\S-1-5-21-3312846245-256796695-1462527662-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://ocherus.ru/?utm_content=697e4ed49a9ee39d52daa60c5fa3c7e2&utm_source=startpm&utm_term=16A235D698EF61F80616CBAF5476792F
BHO: IDM integration (IDMIEHlprObj Class) -> {0055C089-8582-441B-A0BF-17B458C2A3A8} -> C:\Program Files (x86)\internet doznload manager\IDMIECC64.dll [2015-12-08] (Internet Download Manager, Tonec Inc.)
BHO: No Name -> {27DD0F8B-3E0E-4ADC-A78A-66047E71ADC5} -> C:\skinpack\OldNewExplorer64.dll [2014-02-14] (www.startisback.com)
BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office\Office15\OCHelper.dll [2012-10-01] (Microsoft Corporation)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office15\URLREDIR.DLL [2012-10-01] (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL [2012-10-01] (Microsoft Corporation)
BHO-x32: IDM integration (IDMIEHlprObj Class) -> {0055C089-8582-441B-A0BF-17B458C2A3A8} -> C:\Program Files (x86)\internet doznload manager\IDMIECC.dll [2015-12-08] (Internet Download Manager, Tonec Inc.)
BHO-x32: No Name -> {27DD0F8B-3E0E-4ADC-A78A-66047E71ADC5} -> C:\skinpack\OldNewExplorer32.dll [2014-02-14] (www.startisback.com)
BHO-x32: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll [2012-10-01] (Microsoft Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office15\URLREDIR.DLL [2012-10-01] (Microsoft Corporation)
BHO-x32: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\Office15\GROOVEEX.DLL [2012-10-01] (Microsoft Corporation)
FireFox:
========
FF ProfilePath: C:\Users\Mouadh B\AppData\Roaming\Mozilla\Firefox\Profiles\xx64uc92.default
FF Homepage: hxxps://www.google.com/
FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files (x86)\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2012-10-01] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office15\NPSPWRAP.DLL [2012-10-01] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.29.5\npGoogleUpdate3.dll [2016-04-23] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.29.5\npGoogleUpdate3.dll [2016-04-23] (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.2.2 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2016-01-21] (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2014-12-03] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-3312846245-256796695-1462527662-1001: @acestream.net/acestreamplugin,version=3.1.2 -> C:\Users\Mouadh B\AppData\Roaming\ACEStream\player\npace_plugin.dll [No File]
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npMeetingJoinPluginOC.dll [2012-10-01] (Microsoft Corporation)
FF Extension: IDM integration - C:\Program Files (x86)\internet doznload manager\idmmzcc2.xpi [2016-03-10]
FF Extension: Google Image Search - C:\Users\Mouadh B\AppData\Roaming\Mozilla\Firefox\Profiles\xx64uc92.default\extensions\{73007fef-a6e0-47d3-b4e7-dfc116ed6f65}.xpi [2016-05-01]
FF Extension: AdBlocker Ultimate - C:\Users\Mouadh B\AppData\Roaming\Mozilla\Firefox\Profiles\xx64uc92.default\Extensions\adblockultimate@adblockultimate.net.xpi [2016-04-23]
FF Extension: cyscon Security Shield - C:\Users\Mouadh B\AppData\Roaming\Mozilla\Firefox\Profiles\xx64uc92.default\Extensions\cyscon-phishing-protection@patugo.com.xpi [2016-05-01]
FF Extension: LavaFox V2 - C:\Users\Mouadh B\AppData\Roaming\Mozilla\Firefox\Profiles\xx64uc92.default\Extensions\info@djzig.com [2016-04-23]
FF Extension: Zapyo - C:\Users\Mouadh B\AppData\Roaming\Mozilla\Firefox\Profiles\xx64uc92.default\Extensions\jid1-AlAaAeISf3xDHw@jetpack.xpi [2016-04-23]
FF Extension: Game Debate PC System Requirement Tool - C:\Users\Mouadh B\AppData\Roaming\Mozilla\Firefox\Profiles\xx64uc92.default\Extensions\jid1-E6k1NoroBGfTwA@jetpack.xpi [2016-05-01]
FF Extension: Firefox Hello Beta - C:\Users\Mouadh B\AppData\Roaming\Mozilla\Firefox\Profiles\xx64uc92.default\Extensions\loop@mozilla.org.xpi [2016-04-23]
FF Extension: IE Tab 2 (FF 3.6+) - C:\Users\Mouadh B\AppData\Roaming\Mozilla\Firefox\Profiles\xx64uc92.default\Extensions\{1BC9BA34-1EED-42ca-A505-6D2F1A935BBB} [2016-04-23]
FF Extension: Adblock Plus - C:\Users\Mouadh B\AppData\Roaming\Mozilla\Firefox\Profiles\xx64uc92.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2016-05-01]
FF HKU\S-1-5-21-3312846245-256796695-1462527662-1001\...\Firefox\Extensions: [mozilla_cc2@internetdownloadmanager.com] - C:\Program Files (x86)\internet doznload manager\idmmzcc2.xpi
FF HKU\S-1-5-21-3312846245-256796695-1462527662-1001\...\Firefox\Extensions: [acewebextension_unlisted@acestream.org] - C:\Users\Mouadh B\AppData\Roaming\ACEStream\extensions\awe\firefox\acewebextension_unlisted.xpi => not found
FF HKU\S-1-5-21-3312846245-256796695-1462527662-1001\...\SeaMonkey\Extensions: [mozilla_cc@internetdownloadmanager.com] - C:\Users\Mouadh B\AppData\Roaming\IDM\idmmzcc5
FF Extension: IDM CC - C:\Users\Mouadh B\AppData\Roaming\IDM\idmmzcc5 [2016-05-07] [not signed]
FF HKU\S-1-5-21-3312846245-256796695-1462527662-1001\...\SeaMonkey\Extensions: [mozilla_cc2@internetdownloadmanager.com] - C:\Program Files (x86)\internet doznload manager\idmmzcc2.xpi
Chrome:
=======
CHR Profile: C:\Users\Mouadh B\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Docs) - C:\Users\Mouadh B\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2016-04-23]
CHR Extension: (Google Drive) - C:\Users\Mouadh B\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2016-04-23]
CHR Extension: (YouTube) - C:\Users\Mouadh B\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2016-04-23]
CHR Extension: (Adblock Plus) - C:\Users\Mouadh B\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2016-04-23]
CHR Extension: (Búsqueda de Google) - C:\Users\Mouadh B\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2016-04-23]
CHR Extension: (Documentos de Google sin conexión) - C:\Users\Mouadh B\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-04-23]
CHR Extension: (Ace Stream Web Extension) - C:\Users\Mouadh B\AppData\Local\Google\Chrome\User Data\Default\Extensions\mjbepbhonbojpoaenhckjocchgfiaofo [2016-04-30]
CHR Extension: (Ad.Block Pro) - C:\Users\Mouadh B\AppData\Local\Google\Chrome\User Data\Default\Extensions\mljkgfgobpciaigomceclhljklcpmihl [2016-04-23]
CHR Extension: (IDM Integration Module) - C:\Users\Mouadh B\AppData\Local\Google\Chrome\User Data\Default\Extensions\ngpampappnmepgilojfohadhhmbhlaek [2016-04-23]
CHR Extension: (Sistema de pagos de Chrome Web Store) - C:\Users\Mouadh B\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2016-04-23]
CHR Extension: (Gmail) - C:\Users\Mouadh B\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2016-04-23]
CHR HKLM\...\Chrome\Extension: [ngpampappnmepgilojfohadhhmbhlaek] - C:\Program Files (x86)\internet doznload manager\IDMGCExt.crx [2016-04-15]
CHR HKU\S-1-5-21-3312846245-256796695-1462527662-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [mjbepbhonbojpoaenhckjocchgfiaofo] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [ngpampappnmepgilojfohadhhmbhlaek] - C:\Program Files (x86)\internet doznload manager\IDMGCExt.crx [2016-04-15]
==================== Services (Whitelisted) ========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R2 acssrv; C:\Program Files\Agnitum\Outpost Firewall Pro\acs.exe [3421008 2015-11-30] (Agnitum Ltd.)
S3 c2wts; C:\Program Files\Windows Identity Foundation\v3.5\c2wtshost.exe [5632 2016-05-06] (Microsoft Corporation)
S3 DsRoleSvc; C:\Windows\system32\dsrolesrv.dll [280064 2016-05-06] (Microsoft Corporation)
R2 igfxCUIService1.0.0.0; C:\Windows\system32\igfxCUIService.exe [330136 2015-08-27] (Intel Corporation)
R2 iprip; C:\Windows\System32\iprip.dll [34816 2016-05-06] (Microsoft Corporation)
S2 Service KMSELDI; C:\Program Files\KMSpico\Service_KMS.exe [965312 2014-10-08] (@ByELDI) [File not signed]
R2 SNMP; C:\Windows\System32\snmp.exe [50688 2016-05-06] (Microsoft Corporation)
R2 SNMP; C:\Windows\SysWOW64\snmp.exe [46080 2016-05-06] (Microsoft Corporation)
S4 TlntSvr; C:\Windows\System32\tlntsvr.exe [146944 2016-05-06] (Microsoft Corporation)
S2 Update service; C:\Program Files (x86)\Popcorn Time\Updater.exe [339968 2015-10-20] (Popcorn Time) [File not signed]
R2 vmms; C:\Windows\system32\vmms.exe [13784576 2016-05-06] (Microsoft Corporation)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [366552 2015-07-07] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23824 2015-07-07] (Microsoft Corporation)
===================== Drivers (Whitelisted) ==========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R1 afw; C:\Windows\system32\DRIVERS\afw.sys [52904 2015-07-21] (Agnitum Ltd.)
R3 afwcore; C:\Windows\System32\drivers\afwcore.sys [465072 2015-07-21] (Agnitum Ltd.)
S0 ebdrv; C:\Windows\System32\drivers\evbda.sys [3357024 2013-08-22] (Broadcom Corporation)
R1 hvservice; C:\Windows\System32\drivers\hvservice.sys [68960 2016-05-06] (Microsoft Corporation)
R3 int0800; C:\Windows\System32\drivers\flashud.sys [51712 2009-09-09] (Intel Corporation)
R1 ISODrive; C:\Program Files (x86)\UltraISO\drivers\ISODrv64.sys [115448 2013-11-21] (EZB Systems, Inc.)
S3 lunparser; C:\Windows\System32\drivers\lunparser.sys [19456 2016-05-06] (Microsoft Corporation)
R3 MEIx64; C:\Windows\System32\drivers\TeeDriverW8x64.sys [194624 2016-02-10] (Intel Corporation)
S3 passthruparser; C:\Windows\System32\drivers\passthruparser.sys [22016 2016-05-06] (Microsoft Corporation)
S3 pvhdparser; C:\Windows\System32\drivers\pvhdparser.sys [27136 2016-05-06] (Microsoft Corporation)
R1 SandBox; C:\Windows\system32\drivers\SandBox64.sys [1712168 2015-11-18] (Agnitum Ltd.)
S3 vhdparser; C:\Windows\System32\drivers\vhdparser.sys [18944 2016-05-06] (Microsoft Corporation)
R3 VMSMP; C:\Windows\system32\DRIVERS\vmswitch.sys [689152 2016-03-03] (Microsoft Corporation)
S3 VMSP; C:\Windows\system32\DRIVERS\vmswitch.sys [689152 2016-03-03] (Microsoft Corporation)
S3 VMSVSF; C:\Windows\system32\DRIVERS\vmswitch.sys [689152 2016-03-03] (Microsoft Corporation)
S3 VMSVSP; C:\Windows\system32\DRIVERS\vmswitch.sys [689152 2016-03-03] (Microsoft Corporation)
S3 WdBoot; C:\Windows\system32\drivers\WdBoot.sys [44560 2015-07-07] (Microsoft Corporation)
S3 WdFilter; C:\Windows\system32\drivers\WdFilter.sys [270168 2015-07-07] (Microsoft Corporation)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114520 2015-07-07] (Microsoft Corporation)
==================== NetSvcs (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
Ran by Mouadh B (administrator) on MOUADH (07-05-2016 03:20:20)
Running from C:\Users\Mouadh B\Desktop
Loaded Profiles: Mouadh B (Available Profiles: Mouadh B)
Platform: Windows 8.1 Pro (X64) Language: English (United States)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(Intel Corporation) C:\Windows\System32\igfxCUIService.exe
(Agnitum Ltd.) C:\Program Files\Agnitum\Outpost Firewall Pro\acs.exe
(Microsoft Corporation) C:\Windows\System32\mqsvc.exe
(Microsoft Corporation) C:\Windows\System32\TCPSVCS.EXE
(Microsoft Corporation) C:\Windows\System32\snmp.exe
(Microsoft Corporation) C:\Windows\System32\vmms.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
() C:\Windows\SECOH-QAD.exe
(Microsoft Corporation) C:\Windows\System32\SppExtComObj.Exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Intel Corporation) C:\Windows\System32\igfxEM.exe
(Intel Corporation) C:\Windows\System32\igfxHK.exe
(Intel Corporation) C:\Windows\System32\igfxTray.exe
(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(Agnitum Ltd.) C:\Program Files\Agnitum\Outpost Firewall Pro\op_mon.exe
() C:\Program Files (x86)\RocketDock\RocketDock.exe
(hxxp://winaero.com) C:\Program Files (x86)\Black 8\WinaeroGlass\WinaeroGlass.exe
(Mega Limited) C:\Users\Mouadh B\AppData\Local\MEGAsync\MEGAsync.exe
(Microsoft Corporation) C:\Windows\System32\GWX\GWX.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Tonec Inc.) C:\Program Files (x86)\internet doznload manager\IDMan.exe
(Tonec Inc.) C:\Program Files (x86)\internet doznload manager\IEMonitor.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
==================== Registry (Whitelisted) ===========================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [OutpostMonitor] => C:\Program Files\Agnitum\Outpost Firewall Pro\op_mon.exe [4544208 2015-11-30] (Agnitum Ltd.)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1021128 2014-12-03] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [CamtasiaUD] => C:\Users\Mouadh B\AppData\Roaming\Camtasia\CamtasiaUD
HKU\S-1-5-21-3312846245-256796695-1462527662-1001\...\Run: [DrvUpdater] => C:\Users\Mouadh B\AppData\Roaming\DRPSu\DrvUpdater.exe [195256 2016-02-26] ()
HKU\S-1-5-21-3312846245-256796695-1462527662-1001\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [8641240 2016-02-12] (Piriform Ltd)
HKU\S-1-5-21-3312846245-256796695-1462527662-1001\...\Run: [CamtasiaUD] => C:\Users\Mouadh B\AppData\Roaming\Camtasia\CamtasiaUD
HKU\S-1-5-21-3312846245-256796695-1462527662-1001\...\Run: [IDMan] => C:\Program Files (x86)\internet doznload manager\IDMan.exe [3931728 2015-12-30] (Tonec Inc.)
HKU\S-1-5-21-3312846245-256796695-1462527662-1001\...\Run: [AceStream] => C:\Users\Mouadh B\AppData\Roaming\ACEStream\engine\ace_engine.exe
AppInit_DLLs: c:\progra~1\agnitum\outpos~1\wl_hoo~1.dll => c:\Program Files\Agnitum\Outpost Firewall Pro\wl_hook64.dll [1431024 2015-11-26] (Agnitum Ltd.)
AppInit_DLLs-x32: c:\progra~1\agnitum\outpos~1\wl_hook.dll => c:\Program Files\Agnitum\Outpost Firewall Pro\wl_hook.dll [1056664 2015-11-26] (Agnitum Ltd.)
IFEO\SppExtComObj.exe: [Debugger] C:\Windows\SECOH-QAD.exe
ShellIconOverlayIdentifiers: [ IDM Shell Extension] -> {CDC95B92-E27C-4745-A8C5-64A52A78855D} => C:\Program Files (x86)\internet doznload manager\IDMShellExt64.dll [2015-08-14] (Tonec Inc.)
ShellIconOverlayIdentifiers: [###MegaShellExtPending] -> {056D528D-CE28-4194-9BA3-BA2E9197FF8C} => C:\Users\Mouadh B\AppData\Local\MEGAsync\ShellExtX64.dll [2014-05-01] ()
ShellIconOverlayIdentifiers: [###MegaShellExtSynced] -> {05B38830-F4E9-4329-978B-1DD28605D202} => C:\Users\Mouadh B\AppData\Local\MEGAsync\ShellExtX64.dll [2014-05-01] ()
ShellIconOverlayIdentifiers: [###MegaShellExtSyncing] -> {0596C850-7BDD-4C9D-AFDF-873BE6890637} => C:\Users\Mouadh B\AppData\Local\MEGAsync\ShellExtX64.dll [2014-05-01] ()
ShellIconOverlayIdentifiers-x32: [###MegaShellExtPending] -> {056D528D-CE28-4194-9BA3-BA2E9197FF8C} => C:\Users\Mouadh B\AppData\Local\MEGAsync\ShellExtX32.dll [2014-05-01] ()
ShellIconOverlayIdentifiers-x32: [###MegaShellExtSynced] -> {05B38830-F4E9-4329-978B-1DD28605D202} => C:\Users\Mouadh B\AppData\Local\MEGAsync\ShellExtX32.dll [2014-05-01] ()
ShellIconOverlayIdentifiers-x32: [###MegaShellExtSyncing] -> {0596C850-7BDD-4C9D-AFDF-873BE6890637} => C:\Users\Mouadh B\AppData\Local\MEGAsync\ShellExtX32.dll [2014-05-01] ()
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Rainmeter.exe - Shortcut.lnk [2015-03-30]
ShortcutTarget: Rainmeter.exe - Shortcut.lnk -> C:\Rainmeter\Rainmeter.exe ()
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\RocketDock.exe - Shortcut.lnk [2015-05-05]
ShortcutTarget: RocketDock.exe - Shortcut.lnk -> C:\Program Files (x86)\RocketDock\RocketDock.exe ()
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\WinaeroGlass.lnk [2014-10-07]
ShortcutTarget: WinaeroGlass.lnk -> C:\Program Files (x86)\Black 8\WinaeroGlass\WinaeroGlass.exe (http://winaero.com)
Startup: C:\Users\Mouadh B\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MEGAsync.lnk [2016-05-06]
ShortcutTarget: MEGAsync.lnk -> C:\Users\Mouadh B\AppData\Local\MEGAsync\MEGAsync.exe (Mega Limited)
GroupPolicyScripts: Restriction <======= ATTENTION
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
Tcpip\Parameters: [DhcpNameServer] 54.186.51.153 8.8.8.8
Tcpip\..\Interfaces\{A43C5231-44AB-4CB0-B713-633C3E309A18}: [DhcpNameServer] 54.186.51.153 8.8.8.8
Internet Explorer:
==================
HKU\S-1-5-21-3312846245-256796695-1462527662-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://ocherus.ru/?utm_content=697e4ed49a9ee39d52daa60c5fa3c7e2&utm_source=startpm&utm_term=16A235D698EF61F80616CBAF5476792F
BHO: IDM integration (IDMIEHlprObj Class) -> {0055C089-8582-441B-A0BF-17B458C2A3A8} -> C:\Program Files (x86)\internet doznload manager\IDMIECC64.dll [2015-12-08] (Internet Download Manager, Tonec Inc.)
BHO: No Name -> {27DD0F8B-3E0E-4ADC-A78A-66047E71ADC5} -> C:\skinpack\OldNewExplorer64.dll [2014-02-14] (www.startisback.com)
BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office\Office15\OCHelper.dll [2012-10-01] (Microsoft Corporation)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office15\URLREDIR.DLL [2012-10-01] (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL [2012-10-01] (Microsoft Corporation)
BHO-x32: IDM integration (IDMIEHlprObj Class) -> {0055C089-8582-441B-A0BF-17B458C2A3A8} -> C:\Program Files (x86)\internet doznload manager\IDMIECC.dll [2015-12-08] (Internet Download Manager, Tonec Inc.)
BHO-x32: No Name -> {27DD0F8B-3E0E-4ADC-A78A-66047E71ADC5} -> C:\skinpack\OldNewExplorer32.dll [2014-02-14] (www.startisback.com)
BHO-x32: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll [2012-10-01] (Microsoft Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office15\URLREDIR.DLL [2012-10-01] (Microsoft Corporation)
BHO-x32: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\Office15\GROOVEEX.DLL [2012-10-01] (Microsoft Corporation)
FireFox:
========
FF ProfilePath: C:\Users\Mouadh B\AppData\Roaming\Mozilla\Firefox\Profiles\xx64uc92.default
FF Homepage: hxxps://www.google.com/
FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files (x86)\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2012-10-01] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office15\NPSPWRAP.DLL [2012-10-01] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.29.5\npGoogleUpdate3.dll [2016-04-23] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.29.5\npGoogleUpdate3.dll [2016-04-23] (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.2.2 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2016-01-21] (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2014-12-03] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-3312846245-256796695-1462527662-1001: @acestream.net/acestreamplugin,version=3.1.2 -> C:\Users\Mouadh B\AppData\Roaming\ACEStream\player\npace_plugin.dll [No File]
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npMeetingJoinPluginOC.dll [2012-10-01] (Microsoft Corporation)
FF Extension: IDM integration - C:\Program Files (x86)\internet doznload manager\idmmzcc2.xpi [2016-03-10]
FF Extension: Google Image Search - C:\Users\Mouadh B\AppData\Roaming\Mozilla\Firefox\Profiles\xx64uc92.default\extensions\{73007fef-a6e0-47d3-b4e7-dfc116ed6f65}.xpi [2016-05-01]
FF Extension: AdBlocker Ultimate - C:\Users\Mouadh B\AppData\Roaming\Mozilla\Firefox\Profiles\xx64uc92.default\Extensions\adblockultimate@adblockultimate.net.xpi [2016-04-23]
FF Extension: cyscon Security Shield - C:\Users\Mouadh B\AppData\Roaming\Mozilla\Firefox\Profiles\xx64uc92.default\Extensions\cyscon-phishing-protection@patugo.com.xpi [2016-05-01]
FF Extension: LavaFox V2 - C:\Users\Mouadh B\AppData\Roaming\Mozilla\Firefox\Profiles\xx64uc92.default\Extensions\info@djzig.com [2016-04-23]
FF Extension: Zapyo - C:\Users\Mouadh B\AppData\Roaming\Mozilla\Firefox\Profiles\xx64uc92.default\Extensions\jid1-AlAaAeISf3xDHw@jetpack.xpi [2016-04-23]
FF Extension: Game Debate PC System Requirement Tool - C:\Users\Mouadh B\AppData\Roaming\Mozilla\Firefox\Profiles\xx64uc92.default\Extensions\jid1-E6k1NoroBGfTwA@jetpack.xpi [2016-05-01]
FF Extension: Firefox Hello Beta - C:\Users\Mouadh B\AppData\Roaming\Mozilla\Firefox\Profiles\xx64uc92.default\Extensions\loop@mozilla.org.xpi [2016-04-23]
FF Extension: IE Tab 2 (FF 3.6+) - C:\Users\Mouadh B\AppData\Roaming\Mozilla\Firefox\Profiles\xx64uc92.default\Extensions\{1BC9BA34-1EED-42ca-A505-6D2F1A935BBB} [2016-04-23]
FF Extension: Adblock Plus - C:\Users\Mouadh B\AppData\Roaming\Mozilla\Firefox\Profiles\xx64uc92.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2016-05-01]
FF HKU\S-1-5-21-3312846245-256796695-1462527662-1001\...\Firefox\Extensions: [mozilla_cc2@internetdownloadmanager.com] - C:\Program Files (x86)\internet doznload manager\idmmzcc2.xpi
FF HKU\S-1-5-21-3312846245-256796695-1462527662-1001\...\Firefox\Extensions: [acewebextension_unlisted@acestream.org] - C:\Users\Mouadh B\AppData\Roaming\ACEStream\extensions\awe\firefox\acewebextension_unlisted.xpi => not found
FF HKU\S-1-5-21-3312846245-256796695-1462527662-1001\...\SeaMonkey\Extensions: [mozilla_cc@internetdownloadmanager.com] - C:\Users\Mouadh B\AppData\Roaming\IDM\idmmzcc5
FF Extension: IDM CC - C:\Users\Mouadh B\AppData\Roaming\IDM\idmmzcc5 [2016-05-07] [not signed]
FF HKU\S-1-5-21-3312846245-256796695-1462527662-1001\...\SeaMonkey\Extensions: [mozilla_cc2@internetdownloadmanager.com] - C:\Program Files (x86)\internet doznload manager\idmmzcc2.xpi
Chrome:
=======
CHR Profile: C:\Users\Mouadh B\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Docs) - C:\Users\Mouadh B\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2016-04-23]
CHR Extension: (Google Drive) - C:\Users\Mouadh B\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2016-04-23]
CHR Extension: (YouTube) - C:\Users\Mouadh B\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2016-04-23]
CHR Extension: (Adblock Plus) - C:\Users\Mouadh B\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2016-04-23]
CHR Extension: (Búsqueda de Google) - C:\Users\Mouadh B\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2016-04-23]
CHR Extension: (Documentos de Google sin conexión) - C:\Users\Mouadh B\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-04-23]
CHR Extension: (Ace Stream Web Extension) - C:\Users\Mouadh B\AppData\Local\Google\Chrome\User Data\Default\Extensions\mjbepbhonbojpoaenhckjocchgfiaofo [2016-04-30]
CHR Extension: (Ad.Block Pro) - C:\Users\Mouadh B\AppData\Local\Google\Chrome\User Data\Default\Extensions\mljkgfgobpciaigomceclhljklcpmihl [2016-04-23]
CHR Extension: (IDM Integration Module) - C:\Users\Mouadh B\AppData\Local\Google\Chrome\User Data\Default\Extensions\ngpampappnmepgilojfohadhhmbhlaek [2016-04-23]
CHR Extension: (Sistema de pagos de Chrome Web Store) - C:\Users\Mouadh B\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2016-04-23]
CHR Extension: (Gmail) - C:\Users\Mouadh B\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2016-04-23]
CHR HKLM\...\Chrome\Extension: [ngpampappnmepgilojfohadhhmbhlaek] - C:\Program Files (x86)\internet doznload manager\IDMGCExt.crx [2016-04-15]
CHR HKU\S-1-5-21-3312846245-256796695-1462527662-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [mjbepbhonbojpoaenhckjocchgfiaofo] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [ngpampappnmepgilojfohadhhmbhlaek] - C:\Program Files (x86)\internet doznload manager\IDMGCExt.crx [2016-04-15]
==================== Services (Whitelisted) ========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R2 acssrv; C:\Program Files\Agnitum\Outpost Firewall Pro\acs.exe [3421008 2015-11-30] (Agnitum Ltd.)
S3 c2wts; C:\Program Files\Windows Identity Foundation\v3.5\c2wtshost.exe [5632 2016-05-06] (Microsoft Corporation)
S3 DsRoleSvc; C:\Windows\system32\dsrolesrv.dll [280064 2016-05-06] (Microsoft Corporation)
R2 igfxCUIService1.0.0.0; C:\Windows\system32\igfxCUIService.exe [330136 2015-08-27] (Intel Corporation)
R2 iprip; C:\Windows\System32\iprip.dll [34816 2016-05-06] (Microsoft Corporation)
S2 Service KMSELDI; C:\Program Files\KMSpico\Service_KMS.exe [965312 2014-10-08] (@ByELDI) [File not signed]
R2 SNMP; C:\Windows\System32\snmp.exe [50688 2016-05-06] (Microsoft Corporation)
R2 SNMP; C:\Windows\SysWOW64\snmp.exe [46080 2016-05-06] (Microsoft Corporation)
S4 TlntSvr; C:\Windows\System32\tlntsvr.exe [146944 2016-05-06] (Microsoft Corporation)
S2 Update service; C:\Program Files (x86)\Popcorn Time\Updater.exe [339968 2015-10-20] (Popcorn Time) [File not signed]
R2 vmms; C:\Windows\system32\vmms.exe [13784576 2016-05-06] (Microsoft Corporation)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [366552 2015-07-07] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23824 2015-07-07] (Microsoft Corporation)
===================== Drivers (Whitelisted) ==========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R1 afw; C:\Windows\system32\DRIVERS\afw.sys [52904 2015-07-21] (Agnitum Ltd.)
R3 afwcore; C:\Windows\System32\drivers\afwcore.sys [465072 2015-07-21] (Agnitum Ltd.)
S0 ebdrv; C:\Windows\System32\drivers\evbda.sys [3357024 2013-08-22] (Broadcom Corporation)
R1 hvservice; C:\Windows\System32\drivers\hvservice.sys [68960 2016-05-06] (Microsoft Corporation)
R3 int0800; C:\Windows\System32\drivers\flashud.sys [51712 2009-09-09] (Intel Corporation)
R1 ISODrive; C:\Program Files (x86)\UltraISO\drivers\ISODrv64.sys [115448 2013-11-21] (EZB Systems, Inc.)
S3 lunparser; C:\Windows\System32\drivers\lunparser.sys [19456 2016-05-06] (Microsoft Corporation)
R3 MEIx64; C:\Windows\System32\drivers\TeeDriverW8x64.sys [194624 2016-02-10] (Intel Corporation)
S3 passthruparser; C:\Windows\System32\drivers\passthruparser.sys [22016 2016-05-06] (Microsoft Corporation)
S3 pvhdparser; C:\Windows\System32\drivers\pvhdparser.sys [27136 2016-05-06] (Microsoft Corporation)
R1 SandBox; C:\Windows\system32\drivers\SandBox64.sys [1712168 2015-11-18] (Agnitum Ltd.)
S3 vhdparser; C:\Windows\System32\drivers\vhdparser.sys [18944 2016-05-06] (Microsoft Corporation)
R3 VMSMP; C:\Windows\system32\DRIVERS\vmswitch.sys [689152 2016-03-03] (Microsoft Corporation)
S3 VMSP; C:\Windows\system32\DRIVERS\vmswitch.sys [689152 2016-03-03] (Microsoft Corporation)
S3 VMSVSF; C:\Windows\system32\DRIVERS\vmswitch.sys [689152 2016-03-03] (Microsoft Corporation)
S3 VMSVSP; C:\Windows\system32\DRIVERS\vmswitch.sys [689152 2016-03-03] (Microsoft Corporation)
S3 WdBoot; C:\Windows\system32\drivers\WdBoot.sys [44560 2015-07-07] (Microsoft Corporation)
S3 WdFilter; C:\Windows\system32\drivers\WdFilter.sys [270168 2015-07-07] (Microsoft Corporation)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114520 2015-07-07] (Microsoft Corporation)
==================== NetSvcs (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)