ComboFix 15-10-23.01 - Mahmoud 10/23/2015 20:15:39.1.4 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1256.20.1033.18.6092.3879 [GMT 3:00]
Running from: g:\programs\ComboFix.exe
AV: ESET NOD32 Antivirus 9.0.318.0 *Disabled/Updated* {19259FAE-8396-A113-46DB-15B0E7DFA289}
AV: Norton Internet Security *Disabled/Outdated* {63DF5164-9100-186D-2187-8DC619EFD8BF}
FW: Norton Internet Security *Disabled* {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}
SP: ESET NOD32 Antivirus 9.0.318.0 *Disabled/Updated* {A2447E4A-A5AC-AE9D-7C6B-2EC29C58E834}
SP: Norton Internet Security *Disabled/Outdated* {D8BEB080-B73A-17E3-1B37-B6B462689202}
SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Created a new restore point
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files (x86)\HDD Regenerator\HDD Regenerator.exe
c:\program files (x86)\OApps
c:\programdata\Download keeEper
c:\programdata\savenshareo
c:\programdata\SearchNewTab
c:\programdata\SearchNewTab\5193685d9a0bb.tlb
c:\programdata\SearchNewTab\51937497754be.tlb
c:\programdata\SearchNewTab\51b363cd4b9be.tlb
c:\programdata\SearchNewTab\data\SearchNewTab.dat
c:\programdata\SearchNewTab\settings.ini
c:\programdata\ssavEnshhare
c:\programdata\ssavEnshhare\51fc0d4fd96a5.tlb
c:\programdata\ssavEnshhare\data\ssaVenshhaRE .dat
c:\programdata\ssavEnshhare\settings.ini
c:\programdata\ssavEnshhare\uninstall.exe
c:\programdata\Weeekapp
c:\programdata\Weeekapp\51fc0de196a43.tlb
c:\programdata\Weeekapp\data\Weeekapp.dat
c:\programdata\Weeekapp\settings.ini
c:\users\Afa2eef\AppData\Local\Google\Chrome\User Data\Default\Extensions\khgndcahbmcdgmoplhiccmnhekkobdcj
c:\users\Afa2eef\AppData\Local\Google\Chrome\User Data\Default\Extensions\khgndcahbmcdgmoplhiccmnhekkobdcj\1.6\background.html
c:\users\Afa2eef\AppData\Local\Google\Chrome\User Data\Default\Extensions\khgndcahbmcdgmoplhiccmnhekkobdcj\1.6\content.js
c:\users\Afa2eef\AppData\Local\Google\Chrome\User Data\Default\Extensions\khgndcahbmcdgmoplhiccmnhekkobdcj\1.6\eXvLM6B.js
c:\users\Afa2eef\AppData\Local\Google\Chrome\User Data\Default\Extensions\khgndcahbmcdgmoplhiccmnhekkobdcj\1.6\lsdb.js
c:\users\Afa2eef\AppData\Local\Google\Chrome\User Data\Default\Extensions\khgndcahbmcdgmoplhiccmnhekkobdcj\1.6\manifest.json
c:\users\Afa2eef\AppData\Local\Google\Chrome\User Data\Default\Extensions\khgndcahbmcdgmoplhiccmnhekkobdcj\1.6\sqlite.js
c:\users\Afa2eef\AppData\Local\Google\Chrome\User Data\Default\Extensions\mhkicbgjjokgjokaflgabeimbkonooip
c:\users\Afa2eef\AppData\Local\Google\Chrome\User Data\Default\Extensions\mhkicbgjjokgjokaflgabeimbkonooip\5.10\background.html
c:\users\Afa2eef\AppData\Local\Google\Chrome\User Data\Default\Extensions\mhkicbgjjokgjokaflgabeimbkonooip\5.10\content.js
c:\users\Afa2eef\AppData\Local\Google\Chrome\User Data\Default\Extensions\mhkicbgjjokgjokaflgabeimbkonooip\5.10\dnSaj0.js
c:\users\Afa2eef\AppData\Local\Google\Chrome\User Data\Default\Extensions\mhkicbgjjokgjokaflgabeimbkonooip\5.10\lsdb.js
c:\users\Afa2eef\AppData\Local\Google\Chrome\User Data\Default\Extensions\mhkicbgjjokgjokaflgabeimbkonooip\5.10\manifest.json
c:\users\Afa2eef\AppData\Local\Google\Chrome\User Data\Default\Extensions\mhkicbgjjokgjokaflgabeimbkonooip\5.10\sqlite.js
c:\users\Afa2eef\AppData\Local\Google\Chrome\User Data\Default\Extensions\mnnceockmknkblljanfndejiefakhdmg
c:\users\Afa2eef\AppData\Local\Google\Chrome\User Data\Default\Extensions\mnnceockmknkblljanfndejiefakhdmg\5.10\background.html
c:\users\Afa2eef\AppData\Local\Google\Chrome\User Data\Default\Extensions\mnnceockmknkblljanfndejiefakhdmg\5.10\content.js
c:\users\Afa2eef\AppData\Local\Google\Chrome\User Data\Default\Extensions\mnnceockmknkblljanfndejiefakhdmg\5.10\k70sSOajo.js
c:\users\Afa2eef\AppData\Local\Google\Chrome\User Data\Default\Extensions\mnnceockmknkblljanfndejiefakhdmg\5.10\lsdb.js
c:\users\Afa2eef\AppData\Local\Google\Chrome\User Data\Default\Extensions\mnnceockmknkblljanfndejiefakhdmg\5.10\manifest.json
c:\users\Afa2eef\AppData\Local\Google\Chrome\User Data\Default\Extensions\mnnceockmknkblljanfndejiefakhdmg\5.10\sqlite.js
c:\users\Afa2eef\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\khgndcahbmcdgmoplhiccmnhekkobdcj
c:\users\Afa2eef\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\khgndcahbmcdgmoplhiccmnhekkobdcj\001151.ldb
c:\users\Afa2eef\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\khgndcahbmcdgmoplhiccmnhekkobdcj\001153.ldb
c:\users\Afa2eef\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\khgndcahbmcdgmoplhiccmnhekkobdcj\001164.ldb
c:\users\Afa2eef\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\khgndcahbmcdgmoplhiccmnhekkobdcj\001171.log
c:\users\Afa2eef\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\khgndcahbmcdgmoplhiccmnhekkobdcj\CURRENT
c:\users\Afa2eef\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\khgndcahbmcdgmoplhiccmnhekkobdcj\LOCK
c:\users\Afa2eef\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\khgndcahbmcdgmoplhiccmnhekkobdcj\LOG
c:\users\Afa2eef\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\khgndcahbmcdgmoplhiccmnhekkobdcj\LOG.old
c:\users\Afa2eef\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\khgndcahbmcdgmoplhiccmnhekkobdcj\MANIFEST-001170
c:\users\Afa2eef\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mhkicbgjjokgjokaflgabeimbkonooip
c:\users\Afa2eef\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mhkicbgjjokgjokaflgabeimbkonooip\001477.ldb
c:\users\Afa2eef\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mhkicbgjjokgjokaflgabeimbkonooip\001497.ldb
c:\users\Afa2eef\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mhkicbgjjokgjokaflgabeimbkonooip\001510.ldb
c:\users\Afa2eef\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mhkicbgjjokgjokaflgabeimbkonooip\001513.log
c:\users\Afa2eef\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mhkicbgjjokgjokaflgabeimbkonooip\CURRENT
c:\users\Afa2eef\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mhkicbgjjokgjokaflgabeimbkonooip\LOCK
c:\users\Afa2eef\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mhkicbgjjokgjokaflgabeimbkonooip\LOG
c:\users\Afa2eef\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mhkicbgjjokgjokaflgabeimbkonooip\LOG.old
c:\users\Afa2eef\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mhkicbgjjokgjokaflgabeimbkonooip\MANIFEST-001512
c:\users\Afa2eef\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnnceockmknkblljanfndejiefakhdmg
c:\users\Afa2eef\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnnceockmknkblljanfndejiefakhdmg\001477.ldb
c:\users\Afa2eef\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnnceockmknkblljanfndejiefakhdmg\001497.ldb
c:\users\Afa2eef\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnnceockmknkblljanfndejiefakhdmg\001510.ldb
c:\users\Afa2eef\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnnceockmknkblljanfndejiefakhdmg\001513.log
c:\users\Afa2eef\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnnceockmknkblljanfndejiefakhdmg\CURRENT
c:\users\Afa2eef\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnnceockmknkblljanfndejiefakhdmg\LOCK
c:\users\Afa2eef\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnnceockmknkblljanfndejiefakhdmg\LOG
c:\users\Afa2eef\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnnceockmknkblljanfndejiefakhdmg\LOG.old
c:\users\Afa2eef\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnnceockmknkblljanfndejiefakhdmg\MANIFEST-001512
c:\users\Afa2eef\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_khgndcahbmcdgmoplhiccmnhekkobdcj_0.localstorage-journal
c:\users\Afa2eef\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_khgndcahbmcdgmoplhiccmnhekkobdcj_0.localstorage
c:\users\Afa2eef\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_mhkicbgjjokgjokaflgabeimbkonooip_0.localstorage-journal
c:\users\Afa2eef\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_mhkicbgjjokgjokaflgabeimbkonooip_0.localstorage
c:\users\Afa2eef\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_mnnceockmknkblljanfndejiefakhdmg_0.localstorage-journal
c:\users\Afa2eef\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_mnnceockmknkblljanfndejiefakhdmg_0.localstorage
c:\users\Afa2eef\AppData\Local\Google\Chrome\User Data\Default\Preferences
c:\users\Afa2eef\AppData\Local\Microsoft\Windows\Temporary Internet Files\{2D87776D-EC44-430D-B649-6CCD75A18F42}.xps
c:\users\Mahmoud\AppData\Roaming\337
c:\users\Mahmoud\AppData\Roaming\337\youtv_dsk\gamelogin.exe
c:\users\Mahmoud\AppData\Roaming\337\youtv_dsk\gl.db
c:\users\Mahmoud\AppData\Roaming\337\youtv_dsk\image\default\cmn\game_bk_wnd.png
c:\users\Mahmoud\AppData\Roaming\337\youtv_dsk\image\default\cmn\game_close.png
c:\users\Mahmoud\AppData\Roaming\337\youtv_dsk\image\default\cmn\game_hide.png
c:\users\Mahmoud\AppData\Roaming\337\youtv_dsk\image\default\cmn\game_max.png
c:\users\Mahmoud\AppData\Roaming\337\youtv_dsk\image\default\cmn\game_min.png
c:\users\Mahmoud\AppData\Roaming\337\youtv_dsk\image\default\cmn\game_restore.png
c:\users\Mahmoud\AppData\Roaming\337\youtv_dsk\image\default\cmn\game_system.png
c:\users\Mahmoud\AppData\Roaming\337\youtv_dsk\image\default\cmn\menu_bg.png
c:\users\Mahmoud\AppData\Roaming\337\youtv_dsk\image\default\cmn\menu_item_over.png
c:\users\Mahmoud\AppData\Roaming\337\youtv_dsk\image\default\cmn\pic-error.png
c:\users\Mahmoud\AppData\Roaming\337\youtv_dsk\image\default\cmn\pic-info.png
c:\users\Mahmoud\AppData\Roaming\337\youtv_dsk\image\default\cmn\pic-question.png
c:\users\Mahmoud\AppData\Roaming\337\youtv_dsk\image\default\cmn\pic-warning.png
c:\users\Mahmoud\AppData\Roaming\337\youtv_dsk\image\default\cmn\popup_dialog_bk.bmp
c:\users\Mahmoud\AppData\Roaming\337\youtv_dsk\image\default\cmn\prepare.png
c:\users\Mahmoud\AppData\Roaming\337\youtv_dsk\image\default\resource.xml
c:\users\Mahmoud\AppData\Roaming\337\youtv_dsk\image\default\torntv\app_icon_en_us.png
c:\users\Mahmoud\AppData\Roaming\337\youtv_dsk\language\en_us\game_login.ini
c:\users\Mahmoud\AppData\Roaming\337\youtv_dsk\language\es_es\game_login.ini
c:\users\Mahmoud\AppData\Roaming\337\youtv_dsk\language\protocol.txt
c:\users\Mahmoud\AppData\Roaming\337\youtv_dsk\language\pt_br\game_login.ini
c:\users\Mahmoud\AppData\Roaming\337\youtv_dsk\language\tr_tr\game_login.ini
c:\users\Mahmoud\AppData\Roaming\337\youtv_dsk\language\zh_tw\game_login.ini
c:\users\Mahmoud\AppData\Roaming\337\youtv_dsk\layout\default\game.xml
c:\users\Mahmoud\AppData\Roaming\337\youtv_dsk\layout\default\game_login_torntv_all.xml
c:\users\Mahmoud\AppData\Roaming\337\youtv_dsk\layout\default\msgbox.xml
c:\users\Mahmoud\AppData\Roaming\337\youtv_dsk\layout\default\newwindow.xml
c:\users\Mahmoud\AppData\Roaming\337\youtv_dsk\main
c:\users\Mahmoud\AppData\Roaming\337\youtv_dsk\style\style.xml
c:\users\Mahmoud\AppData\Roaming\337\youtv_dsk\TrayDownloader.exe
c:\users\Mahmoud\AppData\Roaming\Desktopicon
c:\users\Mahmoud\AppData\Roaming\Mozilla\Firefox\Profiles\m9y1z992.default\extensions\579sba62zbqt@yoehlmgvvlfr.net
c:\users\Mahmoud\AppData\Roaming\Mozilla\Firefox\Profiles\m9y1z992.default\extensions\579sba62zbqt@yoehlmgvvlfr.net\bootstrap.js
c:\users\Mahmoud\AppData\Roaming\Mozilla\Firefox\Profiles\m9y1z992.default\extensions\579sba62zbqt@yoehlmgvvlfr.net\chrome.manifest
c:\users\Mahmoud\AppData\Roaming\Mozilla\Firefox\Profiles\m9y1z992.default\extensions\579sba62zbqt@yoehlmgvvlfr.net\install.rdf
c:\users\Mahmoud\AppData\Roaming\Mozilla\Firefox\Profiles\m9y1z992.default\extensions\8crgxgdc@wzrgee.org
c:\users\Mahmoud\AppData\Roaming\Mozilla\Firefox\Profiles\m9y1z992.default\extensions\8crgxgdc@wzrgee.org\bootstrap.js
c:\users\Mahmoud\AppData\Roaming\Mozilla\Firefox\Profiles\m9y1z992.default\extensions\8crgxgdc@wzrgee.org\chrome.manifest
c:\users\Mahmoud\AppData\Roaming\Mozilla\Firefox\Profiles\m9y1z992.default\extensions\8crgxgdc@wzrgee.org\install.rdf
c:\users\Mahmoud\AppData\Roaming\Mozilla\Firefox\Profiles\m9y1z992.default\extensions\auaeea@axvt.org
c:\users\Mahmoud\AppData\Roaming\Mozilla\Firefox\Profiles\m9y1z992.default\extensions\auaeea@axvt.org\bootstrap.js
c:\users\Mahmoud\AppData\Roaming\Mozilla\Firefox\Profiles\m9y1z992.default\extensions\auaeea@axvt.org\chrome.manifest
c:\users\Mahmoud\AppData\Roaming\Mozilla\Firefox\Profiles\m9y1z992.default\extensions\auaeea@axvt.org\install.rdf
c:\users\Mahmoud\AppData\Roaming\Mozilla\Firefox\Profiles\m9y1z992.default\extensions\auuaaobxw@s-a.org
c:\users\Mahmoud\AppData\Roaming\Mozilla\Firefox\Profiles\m9y1z992.default\extensions\auuaaobxw@s-a.org\bootstrap.js
c:\users\Mahmoud\AppData\Roaming\Mozilla\Firefox\Profiles\m9y1z992.default\extensions\auuaaobxw@s-a.org\chrome.manifest
c:\users\Mahmoud\AppData\Roaming\Mozilla\Firefox\Profiles\m9y1z992.default\extensions\auuaaobxw@s-a.org\install.rdf
c:\users\Mahmoud\AppData\Roaming\Mozilla\Firefox\Profiles\m9y1z992.default\extensions\dqqiuau-1d@e-souexwff.net
c:\users\Mahmoud\AppData\Roaming\Mozilla\Firefox\Profiles\m9y1z992.default\extensions\dqqiuau-1d@e-souexwff.net\bootstrap.js
c:\users\Mahmoud\AppData\Roaming\Mozilla\Firefox\Profiles\m9y1z992.default\extensions\dqqiuau-1d@e-souexwff.net\chrome.manifest
c:\users\Mahmoud\AppData\Roaming\Mozilla\Firefox\Profiles\m9y1z992.default\extensions\dqqiuau-1d@e-souexwff.net\install.rdf
c:\users\Mahmoud\AppData\Roaming\Mozilla\Firefox\Profiles\m9y1z992.default\extensions\ftj-ehdrw@d-bbeoj.com
c:\users\Mahmoud\AppData\Roaming\Mozilla\Firefox\Profiles\m9y1z992.default\extensions\ftj-ehdrw@d-bbeoj.com\bootstrap.js
c:\users\Mahmoud\AppData\Roaming\Mozilla\Firefox\Profiles\m9y1z992.default\extensions\ftj-ehdrw@d-bbeoj.com\chrome.manifest
c:\users\Mahmoud\AppData\Roaming\Mozilla\Firefox\Profiles\m9y1z992.default\extensions\ftj-ehdrw@d-bbeoj.com\install.rdf
c:\users\Mahmoud\AppData\Roaming\Mozilla\Firefox\Profiles\m9y1z992.default\extensions\i3d4ay@xbxk-.co.uk
c:\users\Mahmoud\AppData\Roaming\Mozilla\Firefox\Profiles\m9y1z992.default\extensions\i3d4ay@xbxk-.co.uk\bootstrap.js
c:\users\Mahmoud\AppData\Roaming\Mozilla\Firefox\Profiles\m9y1z992.default\extensions\i3d4ay@xbxk-.co.uk\chrome.manifest
c:\users\Mahmoud\AppData\Roaming\Mozilla\Firefox\Profiles\m9y1z992.default\extensions\i3d4ay@xbxk-.co.uk\content\zy.xul
c:\users\Mahmoud\AppData\Roaming\Mozilla\Firefox\Profiles\m9y1z992.default\extensions\i3d4ay@xbxk-.co.uk\install.rdf
c:\users\Mahmoud\AppData\Roaming\Mozilla\Firefox\Profiles\m9y1z992.default\extensions\k_ya3uyo@ntuu-aiixt.net
c:\users\Mahmoud\AppData\Roaming\Mozilla\Firefox\Profiles\m9y1z992.default\extensions\k_ya3uyo@ntuu-aiixt.net\bootstrap.js
c:\users\Mahmoud\AppData\Roaming\Mozilla\Firefox\Profiles\m9y1z992.default\extensions\k_ya3uyo@ntuu-aiixt.net\chrome.manifest
c:\users\Mahmoud\AppData\Roaming\Mozilla\Firefox\Profiles\m9y1z992.default\extensions\k_ya3uyo@ntuu-aiixt.net\install.rdf
c:\users\Mahmoud\AppData\Roaming\Mozilla\Firefox\Profiles\m9y1z992.default\extensions\mn1zp@axivettslt.com
c:\users\Mahmoud\AppData\Roaming\Mozilla\Firefox\Profiles\m9y1z992.default\extensions\mn1zp@axivettslt.com\bootstrap.js
c:\users\Mahmoud\AppData\Roaming\Mozilla\Firefox\Profiles\m9y1z992.default\extensions\mn1zp@axivettslt.com\chrome.manifest
c:\users\Mahmoud\AppData\Roaming\Mozilla\Firefox\Profiles\m9y1z992.default\extensions\mn1zp@axivettslt.com\install.rdf
c:\users\Mahmoud\AppData\Roaming\Mozilla\Firefox\Profiles\m9y1z992.default\extensions\oyulf@zjqe.co.uk
c:\users\Mahmoud\AppData\Roaming\Mozilla\Firefox\Profiles\m9y1z992.default\extensions\oyulf@zjqe.co.uk\bootstrap.js
c:\users\Mahmoud\AppData\Roaming\Mozilla\Firefox\Profiles\m9y1z992.default\extensions\oyulf@zjqe.co.uk\chrome.manifest
c:\users\Mahmoud\AppData\Roaming\Mozilla\Firefox\Profiles\m9y1z992.default\extensions\oyulf@zjqe.co.uk\install.rdf
c:\users\Mahmoud\AppData\Roaming\Mozilla\Firefox\Profiles\m9y1z992.default\extensions\ue2iu19x@rbjk-yfuu.com
c:\users\Mahmoud\AppData\Roaming\Mozilla\Firefox\Profiles\m9y1z992.default\extensions\ue2iu19x@rbjk-yfuu.com\bootstrap.js
c:\users\Mahmoud\AppData\Roaming\Mozilla\Firefox\Profiles\m9y1z992.default\extensions\ue2iu19x@rbjk-yfuu.com\chrome.manifest
c:\users\Mahmoud\AppData\Roaming\Mozilla\Firefox\Profiles\m9y1z992.default\extensions\ue2iu19x@rbjk-yfuu.com\install.rdf
c:\users\Mahmoud\AppData\Roaming\Mozilla\Firefox\Profiles\m9y1z992.default\extensions\yimrz@oeaegaqk.org
c:\users\Mahmoud\AppData\Roaming\Mozilla\Firefox\Profiles\m9y1z992.default\extensions\yimrz@oeaegaqk.org\bootstrap.js
c:\users\Mahmoud\AppData\Roaming\Mozilla\Firefox\Profiles\m9y1z992.default\extensions\yimrz@oeaegaqk.org\chrome.manifest
c:\users\Mahmoud\AppData\Roaming\Mozilla\Firefox\Profiles\m9y1z992.default\extensions\yimrz@oeaegaqk.org\install.rdf
c:\windows\SysWow64\DEBUG.log
c:\windows\SysWow64\TBD2414.tmp
c:\windows\SysWow64\TBD2492.tmp
.
.
((((((((((((((((((((((((( Files Created from 2015-09-23 to 2015-10-23 )))))))))))))))))))))))))))))))
.
.
2015-10-23 17:51 . 2015-10-23 17:51 -------- d-----w- c:\users\Default\AppData\Local\temp
2015-10-23 17:51 . 2015-10-23 17:51 -------- d-----w- c:\users\Afa2eef\AppData\Local\temp
2015-10-23 17:15 . 2015-10-23 17:15 75888 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{26112AAB-0160-440A-9927-0F79E37F0A83}\offreg.2008.dll
2015-10-23 12:53 . 2015-10-23 12:54 -------- d-----w- c:\users\Mahmoud\AppData\Roaming\ZHP
2015-10-23 05:22 . 2011-05-06 06:01 1658368 ----a-w- c:\program files (x86)\Mozilla Firefox\extensions\websitelogon@truesuite.com\components\FFXPCOM.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2015-09-09 01:05 . 2015-09-09 01:05 75888 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{26112AAB-0160-440A-9927-0F79E37F0A83}\offreg.5616.dll
2015-08-25 21:19 . 2015-08-25 21:19 778440 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2015-08-25 21:19 . 2011-07-16 12:41 142536 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2015-08-20 01:18 . 2015-09-09 00:58 11745192 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{26112AAB-0160-440A-9927-0F79E37F0A83}\mpengine.dll
2015-07-30 09:41 . 2015-07-30 09:41 170792 ----a-w- c:\windows\system32\drivers\epfwwfpr.sys
2015-07-30 09:41 . 2012-03-14 06:40 264040 ----a-w- c:\windows\system32\drivers\eamonm.sys
2015-07-30 09:41 . 2012-03-14 06:40 186784 ----a-w- c:\windows\system32\drivers\ehdrv.sys
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2015-10-12 23:34 194824 ----a-w- c:\users\Mahmoud\AppData\Roaming\Dropbox\bin\DropboxExt.28.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2015-10-12 23:34 194824 ----a-w- c:\users\Mahmoud\AppData\Roaming\Dropbox\bin\DropboxExt.28.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2015-10-12 23:34 194824 ----a-w- c:\users\Mahmoud\AppData\Roaming\Dropbox\bin\DropboxExt.28.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Lite"="c:\program files (x86)\DAEMON Tools Lite\DTLite.exe" [2009-10-30 369200]
"googletalk"="c:\users\Mahmoud\AppData\Roaming\Google\Google Talk\googletalk.exe" [2007-01-01 3739648]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-21 1475584]
"uTorrent"="c:\users\Afa2eef\Downloads\uTorrent-3.3.exe" [2013-01-19 1077584]
"PC Suite Tray"="c:\program files (x86)\Nokia\Nokia PC Suite 7\PCSuite.exe" [2012-03-26 1516600]
"Dropbox Update"="c:\users\Mahmoud\AppData\Local\Dropbox\Update\DropboxUpdate.exe" [2015-08-31 136048]
"FlashGet 3"="c:\program files (x86)\FlashGet Network\FlashGet 3\FlashGet3.exe" [2012-11-08 3372720]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2011-05-08 336384]
"IAStorIcon"="c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe" [2011-04-30 284440]
"HPQuickWebProxy"="c:\program files (x86)\Hewlett-Packard\HP QuickWeb\hpqwutils.exe" [2011-06-28 168504]
"HP Quick Launch"="c:\program files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe" [2011-04-08 586808]
"HPOSD"="c:\program files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe" [2011-01-27 318520]
"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe" [2010-11-10 35736]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-11-10 932288]
"AdobeCS5ServiceManager"="c:\program files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" [2010-02-22 406992]
"TkBellExe"="c:\program files (x86)\Common Files\Real\Update_OB\realsched.exe" [2013-05-14 198160]
"Wondershare Helper Compact.exe"="c:\program files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe" [2013-08-26 1989920]
"BrowserPlugInHelper"="c:\program files (x86)\Wondershare\Video Converter Ultimate\BrowserPlugInHelper.exe" [2013-09-04 1966992]
"DelaypluginInstall"="c:\programdata\Wondershare\Player\DelayPluginI.exe" [2013-09-28 1960008]
"Skype"="c:\programdata\Skype\Skype.vbs" [2012-09-18 103]
"SwitchBoard"="c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]
"MobileBroadband"="c:\program files (x86)\Vodafone\Vodafone Mobile Broadband\Bin\MobileBroadband.exe" [2011-03-29 408576]
"GrooveMonitor"="c:\program files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-26 31016]
.
c:\users\Mahmoud\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
bm.lnk - c:\users\Mahmoud\AppData\Local\iexplorer\Browsers Monitor\iexplorer_monitor.exe [2013-7-2 74118]
Dropbox.lnk - c:\users\Mahmoud\AppData\Roaming\Dropbox\bin\Dropbox.exe /systemstartup [2015-8-31 36711472]
GameRanger.lnk - c:\users\Mahmoud\AppData\Roaming\GameRanger\GameRanger\GameRanger.exe /autostart [2015-1-22 1792664]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2011-6-17 1333024]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"HideFastUserSwitching"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"EnableShellExecuteHooks"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Userinit"="c:\windows\system32\userinit.exe"
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Notification Packages REG_MULTI_SZ scecli c:\program files\WIDCOMM\Bluetooth Software\BtwProximityCP.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AutoUpdateDisableNotify"=dword:00000001
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 FPLService;TrueSuiteService;c:\program files (x86)\HP SimplePass 2011\TrueSuiteService.exe;c:\program files (x86)\HP SimplePass 2011\TrueSuiteService.exe [x]
R2 HPAuto;HP Auto;c:\program files\Hewlett-Packard\HP Auto\HPAuto.exe;c:\program files\Hewlett-Packard\HP Auto\HPAuto.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R2 WCMVCAM;WebcamMax, WDM Video Capture;c:\windows\system32\DRIVERS\wcmvcam64.sys;c:\windows\SYSNATIVE\DRIVERS\wcmvcam64.sys [x]
R3 bcbtums;Bluetooth RAM Firmware Download USB Filter;c:\windows\system32\drivers\bcbtums.sys;c:\windows\SYSNATIVE\drivers\bcbtums.sys [x]
R3 btwampfl;btwampfl;c:\windows\system32\DRIVERS\btwampfl.sys;c:\windows\SYSNATIVE\DRIVERS\btwampfl.sys [x]
R3 BTWDPAN;Bluetooth Personal Area Network;c:\windows\system32\DRIVERS\btwdpan.sys;c:\windows\SYSNATIVE\DRIVERS\btwdpan.sys [x]
R3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys;c:\windows\SYSNATIVE\DRIVERS\btwl2cap.sys [x]
R3 clwvd;CyberLink WebCam Virtual Driver;c:\windows\system32\DRIVERS\clwvd.sys;c:\windows\SYSNATIVE\DRIVERS\clwvd.sys [x]
R3 epmntdrv;epmntdrv;c:\windows\system32\epmntdrv.sys;c:\windows\SYSNATIVE\epmntdrv.sys [x]
R3 EuGdiDrv;EuGdiDrv;c:\windows\system32\EuGdiDrv.sys;c:\windows\SYSNATIVE\EuGdiDrv.sys [x]
R3 ew_hwusbdev;Huawei MobileBroadband USB PNP Device;c:\windows\system32\DRIVERS\ew_hwusbdev.sys;c:\windows\SYSNATIVE\DRIVERS\ew_hwusbdev.sys [x]
R3 ew_usbenumfilter;huawei_CompositeFilter;c:\windows\system32\DRIVERS\ew_usbenumfilter.sys;c:\windows\SYSNATIVE\DRIVERS\ew_usbenumfilter.sys [x]
R3 ewusbnet;HUAWEI USB-NDIS miniport;c:\windows\system32\DRIVERS\ewusbnet.sys;c:\windows\SYSNATIVE\DRIVERS\ewusbnet.sys [x]
R3 GamesAppService;GamesAppService;c:\program files (x86)\WildTangent Games\App\GamesAppService.exe;c:\program files (x86)\WildTangent Games\App\GamesAppService.exe [x]
R3 GSService;GSService;c:\windows\SysWOW64\GSService.exe;c:\windows\SysWOW64\GSService.exe [x]
R3 huawei_cdcacm;huawei_cdcacm;c:\windows\system32\DRIVERS\ew_jucdcacm.sys;c:\windows\SYSNATIVE\DRIVERS\ew_jucdcacm.sys [x]
R3 huawei_ext_ctrl;huawei_ext_ctrl;c:\windows\system32\DRIVERS\ew_juextctrl.sys;c:\windows\SYSNATIVE\DRIVERS\ew_juextctrl.sys [x]
R3 huawei_wwanecm;huawei_wwanecm;c:\windows\system32\DRIVERS\ew_juwwanecm.sys;c:\windows\SYSNATIVE\DRIVERS\ew_juwwanecm.sys [x]
R3 hwusbdev;Huawei DataCard USB PNP Device;c:\windows\system32\DRIVERS\ewusbdev.sys;c:\windows\SYSNATIVE\DRIVERS\ewusbdev.sys [x]
R3 hwusbfake;Huawei DataCard USB Fake;c:\windows\system32\DRIVERS\ewusbfake.sys;c:\windows\SYSNATIVE\DRIVERS\ewusbfake.sys [x]
R3 nmwcdnsux64;Nokia USB Flashing Phone Parent;c:\windows\system32\drivers\nmwcdnsux64.sys;c:\windows\SYSNATIVE\drivers\nmwcdnsux64.sys [x]
R3 RSPCIESTOR;Realtek PCIE CardReader Driver;c:\windows\system32\DRIVERS\RtsPStor.sys;c:\windows\SYSNATIVE\DRIVERS\RtsPStor.sys [x]
R3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL6.SYS;c:\windows\SYSNATIVE\DRIVERS\VSTAZL6.SYS [x]
R3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV6.SYS;c:\windows\SYSNATIVE\DRIVERS\VSTDPV6.SYS [x]
R3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT6.SYS;c:\windows\SYSNATIVE\DRIVERS\VSTCNXT6.SYS [x]
R3 SwitchBoard;SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R3 VBoxNetAdp;VirtualBox Host-Only Ethernet Adapter;c:\windows\system32\DRIVERS\VBoxNetAdp.sys;c:\windows\SYSNATIVE\DRIVERS\VBoxNetAdp.sys [x]
R3 VBoxUSB;VirtualBox USB;c:\windows\system32\Drivers\VBoxUSB.sys;c:\windows\SYSNATIVE\Drivers\VBoxUSB.sys [x]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe;c:\program files\Windows Live\Mesh\wlcrasvc.exe [x]
S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys;c:\windows\SYSNATIVE\Drivers\PxHlpa64.sys [x]
S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys;c:\windows\SYSNATIVE\Drivers\sptd.sys [x]
S0 SymDS;Symantec Data Store;c:\windows\system32\drivers\NISx64\1302000.00A\SYMDS64.SYS;c:\windows\SYSNATIVE\drivers\NISx64\1302000.00A\SYMDS64.SYS [x]
S0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\NISx64\1302000.00A\SYMEFA64.SYS;c:\windows\SYSNATIVE\drivers\NISx64\1302000.00A\SYMEFA64.SYS [x]
S1 BHDrvx64;BHDrvx64;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.0.0.128\Definitions\BASHDefs\20120302.001\BHDrvx64.sys;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.0.0.128\Definitions\BASHDefs\20120302.001\BHDrvx64.sys [x]
S1 ccSet_NIS;Norton Internet Security Settings Manager;c:\windows\system32\drivers\NISx64\1302000.00A\ccSetx64.sys;c:\windows\SYSNATIVE\drivers\NISx64\1302000.00A\ccSetx64.sys [x]
S1 eamonm;eamonm;c:\windows\system32\DRIVERS\eamonm.sys;c:\windows\SYSNATIVE\DRIVERS\eamonm.sys [x]
S1 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys;c:\windows\SYSNATIVE\DRIVERS\ehdrv.sys [x]
S1 IDSVia64;IDSVia64;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.0.0.128\Definitions\IPSDefs\20120308.001\IDSvia64.sys;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.0.0.128\Definitions\IPSDefs\20120308.001\IDSvia64.sys [x]
S1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\NISx64\1302000.00A\Ironx64.SYS;c:\windows\SYSNATIVE\drivers\NISx64\1302000.00A\Ironx64.SYS [x]
S1 SymNetS;Symantec Network Security WFP Driver;c:\windows\System32\Drivers\NISx64\1302000.00A\SYMNETS.SYS;c:\windows\SYSNATIVE\Drivers\NISx64\1302000.00A\SYMNETS.SYS [x]
S1 VBoxDrv;VirtualBox Service;c:\windows\system32\DRIVERS\VBoxDrv.sys;c:\windows\SYSNATIVE\DRIVERS\VBoxDrv.sys [x]
S1 VBoxUSBMon;VirtualBox USB Monitor Driver;c:\windows\system32\DRIVERS\VBoxUSBMon.sys;c:\windows\SYSNATIVE\DRIVERS\VBoxUSBMon.sys [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe;c:\windows\SYSNATIVE\atiesrxx.exe [x]
S2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [x]
S2 epfwwfpr;epfwwfpr;c:\windows\system32\DRIVERS\epfwwfpr.sys;c:\windows\SYSNATIVE\DRIVERS\epfwwfpr.sys [x]
S2 ezSharedSvc;Easybits Services for Windows;c:\windows\System32\ezSharedSvcHost.exe;c:\windows\SYSNATIVE\ezSharedSvcHost.exe [x]
S2 HP Support Assistant Service;HP Support Assistant Service;c:\program files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe;c:\program files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe [x]
S2 HPDrvMntSvc.exe;HP Quick Synchronization Service;c:\program files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe;c:\program files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe [x]
S2 HPWMISVC;HPWMISVC;c:\program files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe;c:\program files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe [x]
S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [x]
S2 IconMan_R;IconMan_R;c:\program files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe;c:\program files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe [x]
S2 IDMWFP;IDMWFP;c:\windows\system32\DRIVERS\idmwfp.sys;c:\windows\SYSNATIVE\DRIVERS\idmwfp.sys [x]
S2 jhi_service;Intel(R) Identity Protection Technology Host Interface Service;c:\program files (x86)\Intel\Services\IPT\jhi_service.exe;c:\program files (x86)\Intel\Services\IPT\jhi_service.exe [x]
S2 NIS;Norton Internet Security;c:\program files (x86)\Norton Internet Security\Engine\19.2.0.10\ccSvcHst.exe;c:\program files (x86)\Norton Internet Security\Engine\19.2.0.10\ccSvcHst.exe [x]
S2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [x]
S2 VmbService;ÎÏãÉ Vodafone Mobile Broadband;c:\program files (x86)\Vodafone\Vodafone Mobile Broadband\Bin\VmbService.exe;c:\program files (x86)\Vodafone\Vodafone Mobile Broadband\Bin\VmbService.exe [x]
S3 dc3d;MS Hardware Device Detection Driver (USB);c:\windows\system32\DRIVERS\dc3d.sys;c:\windows\SYSNATIVE\DRIVERS\dc3d.sys [x]
S3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys;c:\program files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [x]
S3 huawei_enumerator;huawei_enumerator;c:\windows\system32\DRIVERS\ew_jubusenum.sys;c:\windows\SYSNATIVE\DRIVERS\ew_jubusenum.sys [x]
S3 IntcDAud;Intel(R) Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys;c:\windows\SYSNATIVE\DRIVERS\IntcDAud.sys [x]
S3 intelkmd;intelkmd;c:\windows\system32\DRIVERS\igdpmd64.sys;c:\windows\SYSNATIVE\DRIVERS\igdpmd64.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
S3 VBoxNetFlt;VirtualBox Bridged Networking Service;c:\windows\system32\DRIVERS\VBoxNetFlt.sys;c:\windows\SYSNATIVE\DRIVERS\VBoxNetFlt.sys [x]
S3 WsAudio_Device;WsAudio_Device;c:\windows\system32\drivers\VirtualAudio.sys;c:\windows\SYSNATIVE\drivers\VirtualAudio.sys [x]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2015-10-16 20:06 997704 ----a-w- c:\program files (x86)\Google\Chrome\Application\46.0.2490.71\Installer\chrmstp.exe
.
Contents of the 'Scheduled Tasks' folder
.
2015-10-23 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-08-25 21:19]
.
2015-10-23 c:\windows\Tasks\DropboxUpdateTaskUserS-1-5-21-1928098380-3744966502-37342962-1000Core.job
- c:\users\Mahmoud\AppData\Local\Dropbox\Update\DropboxUpdate.exe [2015-08-31 16:46]
.
2015-10-23 c:\windows\Tasks\DropboxUpdateTaskUserS-1-5-21-1928098380-3744966502-37342962-1000UA.job
- c:\users\Mahmoud\AppData\Local\Dropbox\Update\DropboxUpdate.exe [2015-08-31 16:46]
.
2015-10-22 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1928098380-3744966502-37342962-1000Core.job
- c:\users\Mahmoud\AppData\Local\Facebook\Update\FacebookUpdate.exe [2014-10-15 23:42]
.
2015-10-23 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1928098380-3744966502-37342962-1000UA.job
- c:\users\Mahmoud\AppData\Local\Facebook\Update\FacebookUpdate.exe [2014-10-15 23:42]
.
2015-10-22 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1928098380-3744966502-37342962-1004Core.job
- c:\users\Afa2eef\AppData\Local\Facebook\Update\FacebookUpdate.exe [2013-06-20 00:11]
.
2015-10-23 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1928098380-3744966502-37342962-1004UA.job
- c:\users\Afa2eef\AppData\Local\Facebook\Update\FacebookUpdate.exe [2013-06-20 00:11]
.
2015-10-23 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-01-11 07:53]
.
2015-10-23 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-01-11 07:53]
.
2015-10-21 c:\windows\Tasks\HPCeeScheduleForMahmoud.job
- c:\program files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-09-14 05:15]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2015-10-12 23:34 232712 ----a-w- c:\users\Mahmoud\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2015-10-12 23:34 232712 ----a-w- c:\users\Mahmoud\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2015-10-12 23:34 232712 ----a-w- c:\users\Mahmoud\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2015-10-12 23:34 232712 ----a-w- c:\users\Mahmoud\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\IDM Shell Extension]
@="{CDC95B92-E27C-4745-A8C5-64A52A78855D}"
[HKEY_CLASSES_ROOT\CLSID\{CDC95B92-E27C-4745-A8C5-64A52A78855D}]
2014-04-21 08:02 25112 ----a-w- c:\program files (x86)\IDM615\IDMShellExt64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2011-04-15 168216]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2011-04-15 392472]
"Persistence"="c:\windows\system32\igfxpers.exe" [2011-04-15 416024]
"SetDefault"="c:\program files\Hewlett-Packard\HP LaunchBox\SetDefault.exe" [2011-06-27 42808]
"AdobeAAMUpdater-1.0"="c:\program files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2012-09-20 444904]
"SysTrayApp"="c:\program files\IDT\WDM\sttray64.exe" [2011-06-07 1128448]
.
------- Supplementary Scan -------
.
uLocal Page = c:\windows\system32\blank.htm
mDefault_Page_URL = hxxp://start.qone8.com/?type=hp&ts=1382357413&from=wpc&uid=HitachiXHTS547564A9E384_J2130053H1MH8AH1MH8AX
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
IE: &Download All with FlashGet - c:\users\Mahmoud\Downloads\FlashGet 1.81_Full_Tr_Portable\FlashGet 1.81 Portable\FlashGet\jc_all.htm
IE: &Download with FlashGet - c:\users\Mahmoud\Downloads\FlashGet 1.81_Full_Tr_Portable\FlashGet 1.81 Portable\FlashGet\jc_link.htm
IE: Download all links by FlashGet3 - c:\program files (x86)\FlashGet Network\FlashGet 3\BHO\fdgetallurl.htm
IE: Download all videos by FlashGet3 - c:\program files (x86)\FlashGet Network\FlashGet 3\BHO\fdgetallflvurl.htm
IE: Download by FlashGet3 - c:\program files (x86)\FlashGet Network\FlashGet 3\BHO\fdgeturl.htm
IE: Download current video by FlashGet3 - c:\program files (x86)\FlashGet Network\FlashGet 3\BHO\fdgetflvurl.htm
IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000
IE: Se&nd to OneNote - c:\progra~2\MICROS~1\Office15\ONBttnIE.dll/105
IE: Send image to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Send page to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
IE: ÊÍãíá Çáßá ÈæÇÓØÉ Internet Download Manager - c:\program files (x86)\IDM615\IEGetAll.htm
IE: ÊÍãíá ÈæÇÓØÉ Internet Download Manager - c:\program files (x86)\IDM615\IEExt.htm
Trusted Zone: com\*.Wondershare
Trusted Zone: eset.com\help
TCP: Interfaces\{7AEDA1B9-1059-472C-B03E-9A18F3995161}: NameServer = 62.240.110.197 62.240.110.198
TCP: Interfaces\{8A2EA6C5-CE87-4F34-9666-34D0C50E356B}: NameServer = 62.240.110.197 62.240.110.198
FF - ProfilePath - c:\users\Mahmoud\AppData\Roaming\Mozilla\Firefox\Profiles\m9y1z992.default\
FF - prefs.js: browser.search.defaulturl - hxxp://websearch.searchiseasy.info/?pid=298&r=2013/08/28&hid=1373912961250097813&lg=EN&cc=EG&unqvl=33&l=1&q=
FF - ExtSQL: !HIDDEN! 2013-10-14 10:58; i3d4ay@xbxk-.co.uk; c:\users\Mahmoud\AppData\Roaming\Mozilla\Firefox\Profiles\m9y1z992.default\extensions\i3d4ay@xbxk-.co.uk
FF - ExtSQL: !HIDDEN! 2013-10-14 10:58; mn1zp@axivettslt.com; c:\users\Mahmoud\AppData\Roaming\Mozilla\Firefox\Profiles\m9y1z992.default\extensions\mn1zp@axivettslt.com
FF - ExtSQL: !HIDDEN! 2013-10-14 10:58; auuaaobxw@s-a.org; c:\users\Mahmoud\AppData\Roaming\Mozilla\Firefox\Profiles\m9y1z992.default\extensions\auuaaobxw@s-a.org
FF - ExtSQL: !HIDDEN! 2013-10-14 10:58; auaeea@axvt.org; c:\users\Mahmoud\AppData\Roaming\Mozilla\Firefox\Profiles\m9y1z992.default\extensions\auaeea@axvt.org
FF - ExtSQL: !HIDDEN! 2013-10-14 10:58; 8crgxgdc@wzrgee.org; c:\users\Mahmoud\AppData\Roaming\Mozilla\Firefox\Profiles\m9y1z992.default\extensions\8crgxgdc@wzrgee.org
FF - ExtSQL: !HIDDEN! 2013-10-14 10:58; yimrz@oeaegaqk.org; c:\users\Mahmoud\AppData\Roaming\Mozilla\Firefox\Profiles\m9y1z992.default\extensions\yimrz@oeaegaqk.org
FF - ExtSQL: !HIDDEN! 2013-10-14 10:58; 579sba62zbqt@yoehlmgvvlfr.net; c:\users\Mahmoud\AppData\Roaming\Mozilla\Firefox\Profiles\m9y1z992.default\extensions\579sba62zbqt@yoehlmgvvlfr.net
FF - ExtSQL: !HIDDEN! 2013-10-14 10:58; ftj-ehdrw@d-bbeoj.com; c:\users\Mahmoud\AppData\Roaming\Mozilla\Firefox\Profiles\m9y1z992.default\extensions\ftj-ehdrw@d-bbeoj.com
FF - ExtSQL: !HIDDEN! 2013-10-14 10:58; k_ya3uyo@ntuu-aiixt.net; c:\users\Mahmoud\AppData\Roaming\Mozilla\Firefox\Profiles\m9y1z992.default\extensions\k_ya3uyo@ntuu-aiixt.net
FF - ExtSQL: !HIDDEN! 2013-10-14 10:58; ue2iu19x@rbjk-yfuu.com; c:\users\Mahmoud\AppData\Roaming\Mozilla\Firefox\Profiles\m9y1z992.default\extensions\ue2iu19x@rbjk-yfuu.com
FF - ExtSQL: !HIDDEN! 2013-10-26 14:42; {8D150B8F-EFE8-45a3-A4A3-053020F48FAC}; c:\program files (x86)\Wondershare\Video Converter Ultimate\SVRFirefoxExt
FF - ExtSQL: !HIDDEN! 2014-03-28 15:36; quick_start@gmail.com; c:\users\Mahmoud\AppData\Roaming\Mozilla\Firefox\Profiles\m9y1z992.default\extensions\quick_start@gmail.com
FF - user.js: extensions.delta.tlbrSrchUrl -
FF - user.js: extensions.delta.id - 0c2e2ef90000000000009439e55db228
FF - user.js: extensions.delta.appId - {C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}
FF - user.js: extensions.delta.instlDay - 15861
FF - user.js: extensions.delta.vrsn - 1.8.21.5
FF - user.js: extensions.delta.vrsni - 1.8.21.5
FF - user.js: extensions.delta.vrsnTs - 1.8.21.510:17
FF - user.js: extensions.delta.prtnrId - delta
FF - user.js: extensions.delta.prdct - delta
FF - user.js: extensions.delta.aflt - babsst
FF - user.js: extensions.delta.smplGrp - none
FF - user.js: extensions.delta.tlbrId - base
FF - user.js: extensions.delta.instlRef - sst
FF - user.js: extensions.delta.dfltLng - en
FF - user.js: extensions.delta.excTlbr - false
FF - user.js: extensions.delta.ffxUnstlRst - true
FF - user.js: extensions.delta.admin - false
FF - user.js: extensions.delta_i.babTrack - affID=119291&tt=gc_
FF - user.js: extensions.delta_i.babExt -
FF - user.js: extensions.delta_i.srcExt - ss
FF - user.js: extensions.delta.autoRvrt - false
FF - user.js: extensions.delta.rvrt - false
FF - user.js: extensions.delta.newTab - false
FF - user.js: extensions.buenosearch.tlbrSrchUrl - hxxp://www.buenosearch.com/?q={searchTerms}&babsrc=TB_ss&mntrId=0C2E9439E55DB228&affID=128235&tsp=5276
FF - user.js: extensions.buenosearch.tb_url - hxxp://www.buenosearch.com/?q={searchTerms}&babsrc=TB_ss&mntrId=0C2E9439E55DB228&affID=128235&tsp=5276
FF - user.js: extensions.buenosearch.id - 0c2e2ef90000000000009439e55db228
FF - user.js: extensions.buenosearch.appId - {37EB75F2-7392-4DBE-B5AD-147EC6D7BF5F}
FF - user.js: extensions.buenosearch.instlDay - 16233
FF - user.js: extensions.buenosearch.vrsn - 1.8.28.7
FF - user.js: extensions.buenosearch.vrsni - 1.8.28.7
FF - user.js: extensions.buenosearch.vrsnTs - 1.8.28.70:06
FF - user.js: extensions.buenosearch.prtnrId - buenosearch
FF - user.js: extensions.buenosearch.prdct - buenosearch
FF - user.js: extensions.buenosearch.aflt - babsst
FF - user.js: extensions.buenosearch.smplGrp - none
FF - user.js: extensions.buenosearch.tlbrId - base
FF - user.js: extensions.buenosearch.instlRef - sst
FF - user.js: extensions.buenosearch.dfltLng - ar
FF - user.js: extensions.buenosearch.excTlbr - false
FF - user.js: extensions.buenosearch.ffxUnstlRst - true
FF - user.js: extensions.buenosearch.admin - false
FF - user.js: extensions.buenosearch.autoRvrt - false
FF - user.js: extensions.buenosearch.rvrt - false
FF - user.js: extensions.buenosearch.newTab - false
.
- - - - ORPHANS REMOVED - - - -
.
BHO-{7825CFB6-490A-436B-9F26-4A7B5CFC01A9} - (no file)
Wow6432Node-HKCU-Run-AdobeBridge - (no file)
Wow6432Node-HKCU-Run-GameTracker - c:\program files (x86)\GameTracker\GTLite.exe
Wow6432Node-HKCU-Run-RatioFaker - c:\program files (x86)\Ratio Faker\RatioFaker.exe
Wow6432Node-HKCU-Run-Viber - c:\users\Mahmoud\AppData\Local\Viber\Viber.exe
Wow6432Node-HKCU-Run-VoipBuster - c:\program files (x86)\VoipBuster.com\VoipBuster\VoipBuster.exe
Wow6432Node-HKCU-Run-LiveSupport - c:\program files (x86)\LiveSupport\LiveSupport.exe
Wow6432Node-HKCU-Run-IDMan - c:\program files (x86)\IDM615\IDMan.exe
Wow6432Node-HKLM-Run-Easybits Recovery - c:\program files (x86)\EasyBits For Kids\ezRecover.exe
Wow6432Node-HKLM-Run-WinampAgent - c:\program files (x86)\Winamp\winampa.exe
Wow6432Node-HKLM-Run-HDD Regenerator - c:\program files (x86)\HDD Regenerator\HDD Regenerator.exe
Wow6432Node-HKLM-Run-Yahoo Messenger - (no file)
Wow6432Node-HKLM-Run-CSV To vCard VCF Converter Software.exe - (no file)
c:\users\Mahmoud\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Facebook Messenger.lnk - c:\users\Mahmoud\AppData\Local\Facebook\Messenger\2.1.4814.0\FacebookMessenger.exe
AddRemove-FinalAlert - c:\program files (x86)\FinalAlert\SMUninstall.exe
AddRemove-Need For Speed.Most Wanted 2012.Limited Edition.~A175A0FD_is1 - e:\need for speed.most wanted 2012.limited edition.v 1.1.0.0 + 3 dlc\Uninstall\unins000.exe
AddRemove-Wubi - j:\ubuntu\uninstall-wubi.exe
AddRemove-{47D6F3E4-D158-4E47-84C4-0D6452DB2488}_is1 - g:\call of duty black ops 2\unins000.exe
AddRemove-{CA43FE4F-9FF2-4AD7-88F0-CC3BAC17B226} - c:\program files (x86)\InstallShield Installation Information\{CA43FE4F-9FF2-4AD7-88F0-CC3BAC17B226}\setup.exe
.
.
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\NIS]
"ImagePath"="\"c:\program files (x86)\Norton Internet Security\Engine\19.2.0.10\ccSvcHst.exe\" /s \"NIS\" /m \"c:\program files (x86)\Norton Internet Security\Engine\19.2.0.10\diMaster.dll\" /prefetch:1"
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\S-1-5-21-1928098380-3744966502-37342962-1000\Software\Microsoft\Internet Explorer\Approved Extensions]
@DACL=(02 0000)
"{18DF081C-E8AD-4283-A596-FA578C2EBDC3}"=hex:51,66,7a,6c,4c,1d,3b,1b,0c,17,c4,
03,92,bb,e5,07,ba,95,b8,17,8f,6a,fc,db
"{6D53EC84-6AAE-4787-AEEE-F4628F01010C}"=hex:51,66,7a,6c,4c,1d,3b,1b,94,f3,48,
76,91,39,e1,02,b1,ed,b6,22,8c,45,40,14
"{8590886E-EC8C-43C1-A32C-E4C2B0B6395B}"=hex:51,66,7a,6c,4c,1d,3b,1b,7e,97,8b,
9e,b3,bf,a7,06,bc,2f,a6,82,b3,f2,78,43
"{9030D464-4C02-4ABF-8ECC-5164760863C6}"=hex:51,66,7a,6c,4c,1d,3b,1b,74,cb,2b,
8b,3d,1f,d9,0f,91,cf,13,24,75,4c,22,de
"{2A541AE1-5BF6-4665-A8A3-CFA9672E4291}"=hex:51,66,7a,6c,4c,1d,3b,1b,f1,05,4f,
31,c9,08,03,03,b7,a0,8d,e9,64,6a,03,89
"{FF059E31-CC5A-4E2E-BF3B-96E929D65503}"=hex:51,66,7a,6c,4c,1d,3b,1b,21,81,1e,
e4,65,9f,48,0b,a0,38,d4,a9,2a,92,14,1b
"{BDEADE7F-C265-11D0-BCED-00A0C90AB50F}"=hex:51,66,7a,6c,4c,1d,3b,1b,6f,c1,f1,
a6,5a,91,b6,54,a3,ee,42,e0,ca,4e,f4,17
"{3049C3E9-B461-4BC5-8870-4C09146192CA}"=hex:51,66,7a,6c,4c,1d,3b,1b,f9,dc,52,
2b,5e,e7,a3,0e,97,73,0e,49,17,25,d3,d2
"{2F364306-AA45-47B5-9F9D-39A8B94E7EF7}"=hex:51,66,7a,6c,4c,1d,3b,1b,16,5c,2d,
34,7a,f9,d3,02,80,9e,7b,e8,ba,0a,3f,ef
"{F156768E-81EF-470C-9057-481BA8380DBA}"=hex:51,66,7a,6c,4c,1d,3b,1b,9e,69,4d,
ea,d0,d2,6a,02,8f,54,0a,5b,ab,7c,4c,a2
"{4D2D3B0F-69BE-477A-90F5-FDDB05357975}"=hex:51,66,7a,6c,4c,1d,3b,1b,1f,24,36,
56,81,3a,1c,02,8f,f6,bf,9b,06,71,38,6d
"{98889811-442D-49DD-99D7-DC866BE87DBC}"=hex:51,66,7a,6c,4c,1d,3b,1b,01,87,93,
83,12,17,bb,0c,86,d4,9e,c6,68,ac,3c,a4
"{4BB987E6-D7BA-500B-B774-1EE5D6E782A6}"=hex:51,66,7a,6c,4c,1d,3b,1b,f6,98,a2,
50,85,84,6d,15,a8,77,5c,a5,d5,a3,c3,be
"{7825CFB6-490A-436B-9F26-4A7B5CFC01A9}"=hex:51,66,7a,6c,4c,1d,3b,1b,a6,d0,3e,
63,35,1a,0d,06,80,25,08,3b,5f,b8,40,b1
"{7F6AFBF1-E065-4627-A2FD-810366367D01}"=hex:51,66,7a,6c,4c,1d,3b,1b,e1,e4,71,
64,5a,b3,41,03,bd,fe,c3,43,65,72,3c,19
.
[HKEY_USERS\S-1-5-21-1928098380-3744966502-37342962-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.* 3*g*p*\OpenWithList]
@Class="Shell"
.
[HKEY_USERS\S-1-5-21-1928098380-3744966502-37342962-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2]
@Denied: (Full) (Everyone)
.
[HKEY_USERS\S-1-5-21-1928098380-3744966502-37342962-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{25ad01ab-7669-11e1-b78d-3859f9ebae72}]
"_CommentFromDesktopINI"=""
.
[HKEY_USERS\S-1-5-21-1928098380-3744966502-37342962-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{28d7f5e3-ab82-11e2-8b92-3859f9ebae72}]
"_CommentFromDesktopINI"=""
.
[HKEY_USERS\S-1-5-21-1928098380-3744966502-37342962-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{28d7f60e-ab82-11e2-8b92-3859f9ebae72}]
"_CommentFromDesktopINI"=""
.
[HKEY_USERS\S-1-5-21-1928098380-3744966502-37342962-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{86febe28-10a8-11e2-997f-806e6f6e6963}]
"_CommentFromDesktopINI"=""
.
[HKEY_USERS\S-1-5-21-1928098380-3744966502-37342962-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b6e117fc-4af7-11e1-b620-3859f9ebae72}]
"_CommentFromDesktopINI"=""
.
[HKEY_USERS\S-1-5-21-1928098380-3744966502-37342962-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{bf4c51dc-3d30-11e1-80c6-806e6f6e6963}]
"_CommentFromDesktopINI"=""
.
[HKEY_USERS\S-1-5-21-1928098380-3744966502-37342962-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{bf4c521b-3d30-11e1-80c6-3859f9ebae72}]
"_CommentFromDesktopINI"=""
.
[HKEY_USERS\S-1-5-21-1928098380-3744966502-37342962-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e578a515-a443-11e2-8c20-3859f9ebae72}]
"_CommentFromDesktopINI"=""
.
[HKEY_USERS\S-1-5-21-1928098380-3744966502-37342962-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{f8490fbd-3b36-11e1-b1c7-806e6f6e6963}]
"_CommentFromDesktopINI"=""
.
[HKEY_USERS\S-1-5-21-1928098380-3744966502-37342962-1000_Classes\Wow6432Node\CLSID\{5393838f-df3e-4f57-98cc-45c56fd60b1c}]
@Denied: (Full) (Everyone)
@Allowed: (Read) (RestrictedCode)
"Model"=dword:0000007f
"Therad"=dword:00000015
"MData"=hex(0):73,d5,cf,b8,a4,07,89,80,31,e4,35,6b,2a,ca,fe,43,b6,1f,81,1f,5a,
1b,4d,36,46,8f,3c,f2,5c,68,ee,21,46,8f,3c,f2,5c,68,ee,21,46,8f,3c,f2,5c,68,\
.
[HKEY_USERS\S-1-5-21-1928098380-3744966502-37342962-1000_Classes\Wow6432Node\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}]
@Denied: (Full) (Everyone)
@Allowed: (Read) (RestrictedCode)
"scansk"=hex(0):00,a2,e2,83,78,42,e8,cf,a2,81,d4,b4,f0,da,d1,e7,42,6f,43,96,3d,
fa,91,33,1c,4d,0c,c2,46,32,6a,83,d8,19,44,5e,c3,ac,ff,06,00,00,00,00,00,00,\
.
[HKEY_USERS\S-1-5-21-1928098380-3744966502-37342962-1000_Classes\Wow6432Node\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}]
@Denied: (Full) (Everyone)
"scansk"=hex(0):5b,b0,84,ec,e2,f6,49,2c,0b,88,28,62,12,eb,3b,f5,ac,0b,3c,ec,3d,
4e,c8,ed,ae,e5,5d,79,97,5c,47,c7,9c,70,d5,6f,0b,7e,e8,b4,00,00,00,00,00,00,\
.
[HKEY_USERS\S-1-5-21-1928098380-3744966502-37342962-1000_Classes\Wow6432Node\CLSID\{d339b54a-d0d4-4d61-a864-21bfe14a2ae5}]
@Denied: (Full) (Everyone)
@Allowed: (Read) (RestrictedCode)
"Model"=dword:00000076
"Therad"=dword:00000015
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11e_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11e_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0005\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0006\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0007\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0008\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0009\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0010\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0011\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0012\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0013\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0014\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0015\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0016\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0017\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0021\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Completion time: 2015-10-23 20:59:47
ComboFix-quarantined-files.txt 2015-10-23 17:59
.
Pre-Run: 1,698,213,888 bytes free
Post-Run: 12,804,575,232 bytes free
.
- - End Of File - - 0E3758FD0E246D4A09D2A53AB1C490D3