1. You are viewing our forum as a guest. For full access please Register. WindowsBBS.com is completely free, paid for by advertisers and donations.

Solved Error during startup: Stop: c000021a (Fatal System Error)

Discussion in 'Malware and Virus Removal Archive' started by maelkaka, 2015/10/18.

  1. 2015/10/18
    maelkaka

    maelkaka Inactive Thread Starter

    Joined:
    2015/10/18
    Messages:
    15
    Likes Received:
    0
    [Solved] Error during startup: Stop: c000021a (Fatal System Error)

    I have error while i start my windows. its showing blue screen with error code c000021a (Fatal System Error).
    i think its same problem like jharry has posted here.

    I cant do it myself as broni mentioned that the script was written specifically for one user. and i think i need help. so can anyone help me in this case? especially broni.

    Thanks for the attention.
     
  2. 2015/10/18
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Welcome aboard [​IMG]

    Please, observe following rules:
    • Read all of my instructions very carefully. Your mistakes during cleaning process may have very serious consequences, like unbootable computer.
    • If you're stuck, or you're not sure about certain step, always ask before doing anything else.
    • Please refrain from running any tools, fixes or applying any changes to your computer other than those I suggest.
    • Never run more than one scan at a time.
    • Keep updating me regarding your computer behavior, good, or bad.
    • The cleaning process, once started, has to be completed. Even if your computer appears to act better, it may still be infected. Once the computer is totally clean, I'll certainly let you know.
    • If you leave the topic without explanation in the middle of a cleaning process, you may not be eligible to receive any more help in malware removal forum.
    • I close my topics if you have not replied in 5 days. If you need more time, simply let me know. If I closed your topic and you need it to be reopened, simply PM me.

    =================================

    What Windows version is it?
     

  3. to hide this advert.

  4. 2015/10/18
    maelkaka

    maelkaka Inactive Thread Starter

    Joined:
    2015/10/18
    Messages:
    15
    Likes Received:
    0
    Hi broni,
    I'm running win7 x86
     
  5. 2015/10/18
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    NOTE 1. Use another working computer to download Farbar Recovery Scan Tool. Use USB flash drive to transfer it from good computer to the bad one.
    NOTE 2. Install Panda USB Vaccine, or BitDefender’s USB Immunizer on GOOD computer to protect it from any infected USB device.

    For x32 (x86) bit systems download Farbar Recovery Scan Tool 32-Bit and save it to a flash drive.
    For x64 bit systems download Farbar Recovery Scan Tool 64-Bit and save it to a flash drive.

    Plug the flashdrive into the infected PC.

    If you are using Windows 10 If you're having problems accessing System Recovery Options create Windows 10 USB or DVD as described here: http://betanews.com/2015/07/29/how-to-download-windows-10-and-create-your-own-installation-usb-flash-drive-or-dvd/ and boot from it.

    If you are using Windows 8 consult How to use the Windows 8 System Recovery Environment Command Prompt to enter System Recovery Command prompt. To access Advanced Boot Options start and shut down computer TWICE. On third start you should see Advanced Boot Options.

    If you are using Vista or Windows 7 enter System Recovery Options.

    [color= "#0000FF"]To enter System Recovery Options from the Advanced Boot Options:[/color]
    • Restart the computer.
    • As soon as the BIOS is loaded begin tapping the F8 key until Advanced Boot Options appears.
    • Use the arrow keys to select the Repair your computer menu item.
    • Select US as the keyboard language settings, and then click Next.
    • Select the operating system you want to repair, and then click Next.
    • Select your user account an click Next.

    [color= "#0000FF"]To enter System Recovery Options by using Windows installation disc:[/color]
    • Insert the installation disc.
    • Restart your computer.
    • If prompted, press any key to start Windows from the installation disc. If your computer is not configured to start from a CD or DVD, check your BIOS settings.
    • Click Repair your computer.
    • Select US as the keyboard language settings, and then click Next.
    • Select the operating system you want to repair, and then click Next.
    • Select your user account and click Next.

    [color= "#008000"]On the System Recovery Options menu you will get the following options:[/color]

    • Startup Repair
    • System Restore
    • Windows Complete PC Restore
    • Windows Memory Diagnostic Tool
    • Command Prompt
    • Select Command Prompt
    • In the command window type in notepad and press Enter.
    • The notepad opens. Under File menu select Open.
    • Select "Computer" and find your flash drive letter and close the notepad.
    • In the command window type [color= "#FF0000"]e[/color]:\frst (for x64 bit version type [color= "#FF0000"]e[/color]:\frst64) and press Enter
      Note: Replace letter [color= "#FF0000"]e[/color] with the drive letter of your flash drive.
    • The tool will start to run.
    • When the tool opens click Yes to disclaimer.
    • Press Scan button.
    • It will make a log (FRST.txt) on the flash drive. Please copy and paste it to your reply.
     
  6. 2015/10/18
    maelkaka

    maelkaka Inactive Thread Starter

    Joined:
    2015/10/18
    Messages:
    15
    Likes Received:
    0
    Here's the content of frst.txt:

    Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:18-10-2015
    Ran by SYSTEM on MININT-14K1OOE (19-10-2015 06:03:17)
    Running from I:\
    Platform: WIN_7 Service Pack 1 (X86) Language: English (United States)
    Internet Explorer Version 8
    Boot Mode: Recovery
    Default: ControlSet001
    ATTENTION!:=====> If the system is bootable FRST must be run from normal or Safe mode to create a complete log.

    Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

    ==================== Registry (Whitelisted) ===========================

    (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

    HKLM\...\Run: [MSC] => C:\Program Files\Microsoft Security Client\msseces.exe [931200 2012-03-26] (Microsoft Corporation)
    HKLM\...\Run: [ATKOSD2] => C:\Program Files\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe [406328 2013-09-08] (ASUSTek Computer Inc.)
    HKLM\...\Run: [ATKMEDIA] => C:\Program Files\ASUS\ATK Package\ATK Media\DMedia.exe [205624 2013-05-29] (ASUSTek Computer Inc.)
    HKLM\...\Run: [HControlUser] => C:\Program Files\ASUS\ATK Package\ATK Hotkey\HControlUser.exe [105016 2009-06-18] (ASUS)
    HKLM\...\Run: [IAStorIcon] => C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [287592 2013-08-06] (Intel Corporation)
    HKLM\...\Run: [USB3MON] => C:\Program Files\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [292848 2014-02-20] (Intel Corporation)
    HKLM\...\Run: [NvBackend] => C:\Program Files\NVIDIA Corporation\Update Core\NvBackend.exe [2464072 2014-11-06] (NVIDIA Corporation)
    HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap.dll,ShadowPlayOnSystemStart
    HKLM\...\Run: [Baidu PC Faster 4.0.0.0] => C:\Program Files\PC Faster\5.1.0.0\PCFTray.exe [2333152 2015-05-13] (Baidu, Inc.)
    HKLM\...\Winlogon: [Userinit]
    HKLM\...\Winlogon: [Shell] [x ] () <=== ATTENTION
    HKLM\...\InprocServer32: [Default-wbemess] ATTENTION! ====> ZeroAccess?
    HKLM\...D6A79037F57F\InprocServer32: [Default-fastprox] ATTENTION! ====> ZeroAccess?
    HKLM\...\Policies\Explorer\Run: [BtvStack] => C:\Program Files\Bluetooth Suite\BtvStack.exe [125568 2014-01-01] (Qualcomm®Atheros®)
    HKU\Mael\...\Run: [IDMan] => C:\Program Files\Internet Download Manager\IDMan.exe [3278232 2011-04-05] (Tonec Inc.)
    HKU\Mael\...\Policies\Explorer: [NoLowDiskSpaceChecks] 1
    HKU\Mael\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\Windows\system32\ssText3d.scr [293888 2010-11-20] (Microsoft Corporation)
    GroupPolicy: Restriction - Chrome <======= ATTENTION

    ==================== Services (Whitelisted) ========================

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

    S2 ASLDRService; C:\Program Files\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe [111416 2013-09-08] (ASUSTek Computer Inc.)
    S2 AtherosSvc; C:\Program Files\Bluetooth Suite\adminservice.exe [275072 2014-01-01] (Windows (R) Win 7 DDK provider)
    S3 ATKGFNEXSrv; C:\Program Files\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe [96896 2011-11-20] (ASUS)
    S4 BASSVC; C:\Program Files\Baidu Security\MoboMarket\1.2.8.4379\bassvc.exe [208928 2014-12-17] (Baidu, Inc.)
    S4 Bonjour Service; C:\Program Files\Xamarin\Bonjour\mDNSResponder.exe [384512 2015-05-20] (Apple Inc.)
    S2 c2cautoupdatesvc; C:\Program Files\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1394816 2015-04-30] (Microsoft Corporation)
    S2 c2cpnrsvc; C:\Program Files\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1772672 2015-04-30] (Microsoft Corporation)
    S3 Connectify; C:\Program Files\Connectify\ConnectifyService.exe [487936 2013-11-05] (Connectify)
    S3 cphs; C:\Windows\system32\IntelCpHeciSvc.exe [279024 2014-04-08] (Intel Corporation)
    S2 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [915784 2014-11-06] (NVIDIA Corporation)
    S2 igfxCUIService1.0.0.0; C:\Windows\system32\igfxCUIService.exe [261616 2014-04-08] (Intel Corporation)
    S3 IJPLMSVC; C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE [140936 2013-05-14] ()
    S2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [586240 2013-05-11] (Intel(R) Corporation)
    S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [637912 2013-05-11] (Intel(R) Corporation)
    S2 jhi_service; C:\Program Files\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2013-11-06] (Intel Corporation)
    S2 MouseWithoutBordersSvc; C:\Program Files\Microsoft Garage\Mouse without Borders\MouseWithoutBordersSvc.exe [27872 2012-12-27] (Microsoft)
    S2 MsMpSvc; C:\Program Files\Microsoft Security Client\MsMpEng.exe [11552 2012-03-26] (Microsoft Corporation)
    S2 MSSQLSERVER; C:\Program Files\Microsoft SQL Server\MSSQL10_50.MSSQLSERVER\MSSQL\Binn\sqlservr.exe [42884448 2010-04-03] (Microsoft Corporation)
    S3 NisSrv; C:\Program Files\Microsoft Security Client\NisSrv.exe [214952 2012-03-26] (Microsoft Corporation)
    S2 NvNetworkService; C:\Program Files\NVIDIA Corporation\NetService\NvNetworkService.exe [1795912 2014-11-06] (NVIDIA Corporation)
    S2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [18182984 2014-11-06] (NVIDIA Corporation)
    S4 PanService; C:\Program Files\PANDORA.TV\PanService\PandoraService.exe [625304 2012-09-27] (Pandora.TV)
    S2 PCFasterSvc_{PCFaster_5.1.0.0}; C:\Program Files\PC Faster\5.1.0.0\PCFasterSvc.exe [1714448 2015-05-13] (Baidu, Inc.)
    S4 PinnacleUpdateSvc; C:\Program Files\PowerUp Software\Pinnacle Game Profiler\pinnacle_updater.exe [438272 2014-01-11] (PowerUp Software, LLC)
    S4 Sony PC Companion; C:\Program Files\Sony\Sony PC Companion\PCCService.exe [155824 2013-02-04] (Avanquest Software)
    S4 SQLSERVERAGENT; C:\Program Files\Microsoft SQL Server\MSSQL10_50.MSSQLSERVER\MSSQL\Binn\SQLAGENT.EXE [367456 2010-04-03] (Microsoft Corporation)
    S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [680960 2009-07-13] (Microsoft Corporation)
    S2 ZAtheros Bt and Wlan Coex Agent; C:\Program Files\Bluetooth Suite\Ath_CoexAgent.exe [323584 2014-01-01] (Atheros)
    S0 msahci; system32\drivers\msahci.sys [X]

    ===================== Drivers (Whitelisted) ==========================

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

    S3 AiCharger; C:\Windows\System32\DRIVERS\AiCharger.sys [14720 2013-04-17] (ASUSTek Computer Inc.)
    S2 ASMMAP; C:\Program Files\ASUS\ATK Package\ATKGFNEX\ASMMAP.sys [13880 2009-07-02] (ASUS)
    S3 AthBTPort; C:\Windows\System32\DRIVERS\btath_flt.sys [80680 2014-01-01] (Qualcomm Atheros)
    S3 athr; C:\Windows\System32\DRIVERS\athr.sys [3244544 2013-12-23] (Qualcomm Atheros Communications, Inc.)
    S1 ATKWMIACPIIO; C:\Program Files\ASUS\ATK Package\ATK WMIACPI\atkwmiacpi.sys [17720 2013-07-02] (ASUSTek Computer Inc.)
    S3 ATP; C:\Windows\System32\DRIVERS\AsusTP.sys [60104 2013-12-11] (ASUS Corporation)
    S3 Baidu PC Faster FileShredder; C:\Program Files\PC Faster\5.1.0.0\FileKill_x86.sys [18880 2013-03-18] ()
    S0 Bhbase; C:\Windows\System32\drivers\Bhbase.sys [46440 2015-04-10] (Baidu, Inc.)
    S1 BprotectEx; C:\Windows\System32\drivers\BprotectEx.sys [113992 2015-04-10] (Baidu, Inc.)
    S3 BTATH_A2DP; C:\Windows\System32\drivers\btath_a2dp.sys [295208 2014-01-01] (Qualcomm Atheros)
    S3 btath_avdt; C:\Windows\System32\drivers\btath_avdt.sys [102184 2014-01-01] (Qualcomm Atheros)
    S3 BTATH_BUS; C:\Windows\System32\DRIVERS\btath_bus.sys [27976 2014-01-01] (Qualcomm Atheros)
    S3 BTATH_HCRP; C:\Windows\System32\DRIVERS\btath_hcrp.sys [158688 2014-01-01] (Qualcomm Atheros)
    S3 BTATH_LWFLT; C:\Windows\System32\DRIVERS\btath_lwflt.sys [66448 2014-01-01] (Qualcomm Atheros)
    S3 BTATH_RCP; C:\Windows\System32\DRIVERS\btath_rcp.sys [120616 2014-01-01] (Qualcomm Atheros)
    S3 BtFilter; C:\Windows\System32\DRIVERS\btfilter.sys [506664 2014-01-01] (Qualcomm Atheros)
    S1 cnnctfy3; C:\Windows\System32\DRIVERS\cnnctfy3.sys [29672 2015-01-05] (Connectify)
    S1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [243128 2015-05-28] (Disc Soft Ltd)
    S3 hwusbfake; C:\Windows\System32\DRIVERS\ewusbfake.sys [103040 2008-12-30] (Huawei Technologies Co., Ltd.)
    S0 iaStorA; C:\Windows\System32\DRIVERS\iaStorA.sys [505192 2013-08-06] (Intel Corporation)
    S0 iaStorF; C:\Windows\System32\DRIVERS\iaStorF.sys [25448 2013-08-06] (Intel Corporation)
    S2 IntelHaxm; C:\Windows\System32\DRIVERS\IntelHaxm.sys [78848 2015-01-29] (Intel Corporation)
    S0 iusb3hcs; C:\Windows\System32\DRIVERS\iusb3hcs.sys [16880 2014-02-20] (Intel Corporation)
    S3 iusb3hub; C:\Windows\System32\DRIVERS\iusb3hub.sys [364528 2014-02-20] (Intel Corporation)
    S3 iusb3xhc; C:\Windows\System32\DRIVERS\iusb3xhc.sys [800240 2014-02-20] (Intel Corporation)
    S3 L1C; C:\Windows\System32\DRIVERS\L1C62x86.sys [110280 2013-07-17] (Qualcomm Atheros Co., Ltd.)
    S3 MEI; C:\Windows\System32\DRIVERS\TeeDriver.sys [85464 2013-11-06] (Intel Corporation)
    S0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [171064 2012-03-20] (Microsoft Corporation)
    S0 nvpciflt; C:\Windows\System32\DRIVERS\nvpciflt.sys [25800 2014-11-03] (NVIDIA Corporation)
    S3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [18760 2014-11-06] (NVIDIA Corporation)
    S3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad32v.sys [33096 2014-10-03] (NVIDIA Corporation)
    S3 PCFApiUtil; C:\Program Files\PC Faster\5.1.0.0\PCFApiUtil.sys [118152 2015-04-10] (Baidu, Inc.)
    S2 plctrl; C:\Program Files\ASUS\P4G\plctrl.sys [14136 2014-01-03] (Windows (R) Win 7 DDK provider)
    S3 pwdrvio; C:\Windows\system32\pwdrvio.sys [15688 2013-09-30] ()
    S3 pwdspio; C:\Windows\system32\pwdspio.sys [10320 2013-09-30] ()
    S4 RsFx0150; C:\Windows\System32\DRIVERS\RsFx0150.sys [240608 2010-04-02] (Microsoft Corporation)
    S3 VSPerfDrv100; C:\Program Files\Microsoft Visual Studio 10.0\Team Tools\Performance Tools\VSPerfDrv100.sys [48128 2009-12-08] (Microsoft Corporation)
    S1 {88dab020-0802-4f33-9294-5fccbb774bac}Gw; C:\Windows\System32\drivers\{88dab020-0802-4f33-9294-5fccbb774bac}Gw.sys [43152 2015-03-06] (StdLib)
    S1 {c6cf689f-ec21-4add-accd-adc0bafcbba6}Gw; C:\Windows\System32\drivers\{c6cf689f-ec21-4add-accd-adc0bafcbba6}Gw.sys [43152 2015-02-19] (StdLib)
    S3 VGPU; System32\drivers\rdvgkmd.sys [X]

    ==================== NetSvcs (Whitelisted) ===================

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


    ==================== One Month Created files and folders ========

    (If an entry is included in the fixlist, the file/folder will be moved.)

    2015-10-19 06:03 - 2015-10-19 06:03 - 00000000 ____D C:\FRST
    2015-10-19 01:56 - 2015-10-19 01:56 - 00028672 _____ C:\BCD_Backup
    2015-10-19 01:56 - 2015-10-19 01:56 - 00025600 ___SH C:\BCD_Backup.LOG
    2015-10-12 14:13 - 2015-10-12 14:13 - 00000000 ____D C:\Users\Mael\Tracing
    2015-10-12 14:10 - 2015-10-12 14:30 - 00000000 ____D C:\Users\Mael\AppData\Roaming\Skype
    2015-10-12 14:10 - 2015-10-12 14:16 - 00000000 ___RD C:\Program Files\Skype
    2015-10-12 14:10 - 2015-10-12 14:10 - 00000000 ____D C:\Users\Mael\AppData\Local\Skype
    2015-10-12 14:10 - 2015-10-12 14:10 - 00000000 ____D C:\ProgramData\Skype
    2015-10-12 14:10 - 2015-10-12 14:10 - 00000000 ____D C:\Program Files\Common Files\Skype
    2015-10-12 14:06 - 2015-10-12 14:06 - 12623872 _____ C:\Users\Mael\Downloads\SkypeWebPlugin.msi
    2015-10-12 14:06 - 2015-10-12 14:06 - 00000000 ____D C:\Users\Mael\AppData\Local\SkypePlugin
    2015-10-12 12:27 - 2015-10-12 12:27 - 00011344 _____ C:\Users\Mael\Documents\teredo.reg
    2015-10-11 08:48 - 2015-10-11 08:48 - 00000000 ____D C:\Users\Mael\AppData\Local\NFS Underground 2
    2015-10-07 02:58 - 2014-11-03 12:32 - 00616768 _____ (NVIDIA Corporation) C:\Windows\System32\nvStreaming.exe
    2015-10-07 02:57 - 2015-10-07 02:57 - 00000000 ____D C:\Windows\System32\NV
    2015-10-07 02:56 - 2015-10-07 02:56 - 00000000 ____D C:\temp
    2015-10-04 21:54 - 2015-10-05 00:45 - 00000700 _____ C:\Users\Mael\Documents\payapinang.txt
    2015-10-04 19:56 - 2015-10-04 21:53 - 00000000 ____D C:\Program Files\Sistem Paya Pinang
    2015-10-02 01:05 - 2015-10-02 01:05 - 00038615 _____ C:\Users\Mael\Downloads\ToolTipTest.rar
    2015-10-01 01:26 - 2015-10-01 01:27 - 00059602 _____ C:\Users\Mael\Documents\properti_rumah.sql
    2015-09-30 11:08 - 2015-09-30 11:08 - 00040535 _____ C:\Windows\System32\energy-report.html
    2015-09-20 23:45 - 2015-09-20 23:45 - 00000000 ____D C:\ProgramData\EPSON

    ==================== One Month Modified files and folders ========

    (If an entry is included in the fixlist, the file/folder will be moved.)

    2015-10-19 01:04 - 2009-07-13 18:37 - 00000000 ____D C:\Windows\System32\LogFiles
    2015-10-16 02:02 - 2014-11-07 12:58 - 01056506 _____ C:\Windows\WindowsUpdate.log
    2015-10-16 02:01 - 2014-11-07 13:26 - 00000000 ____D C:\Users\Mael\AppData\Roaming\DMCache
    2015-10-16 02:00 - 2014-11-07 13:26 - 00000000 ____D C:\Users\Mael\Downloads\Video
    2015-10-15 23:38 - 2014-11-08 11:53 - 00000000 ____D C:\Users\Mael\AppData\Local\Eclipse
    2015-10-15 23:33 - 2015-07-29 21:43 - 00026835 _____ C:\Windows\setupact.log
    2015-10-15 23:32 - 2014-11-09 23:00 - 00000000 ____D C:\ProgramData\NVIDIA
    2015-10-15 11:42 - 2014-11-07 13:26 - 00000000 ____D C:\Users\Mael\Downloads\Compressed
    2015-10-15 11:41 - 2010-11-20 13:01 - 00970638 _____ C:\Windows\System32\PerfStringBackup.INI
    2015-10-15 11:36 - 2014-11-08 13:00 - 00000000 ____D C:\Users\Mael\AppData\Local\TSVNCache
    2015-10-13 00:43 - 2009-07-13 20:52 - 00000000 ____D C:\Windows\System32\FxsTmp
    2015-10-12 14:26 - 2014-11-07 12:59 - 00000000 ____D C:\Users\Mael\AppData\Local\VirtualStore
    2015-10-12 14:13 - 2014-11-07 12:59 - 00000000 ____D C:\users\Mael
    2015-10-12 13:57 - 2014-11-07 13:29 - 00000000 ____D C:\Program Files\ASUS
    2015-10-12 13:55 - 2014-12-30 14:31 - 00000000 ____D C:\ProgramData\ASUS
    2015-10-12 09:45 - 2015-05-01 00:03 - 00000464 __RSH C:\ProgramData\ntuser.pol
    2015-10-09 16:06 - 2009-07-13 20:34 - 00020832 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
    2015-10-09 16:06 - 2009-07-13 20:34 - 00020832 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
    2015-10-09 15:31 - 2015-01-01 23:44 - 00003584 _____ C:\Users\Mael\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
    2015-10-09 11:59 - 2015-05-16 02:23 - 00000000 ____D C:\Program Files\Opera
    2015-10-09 11:54 - 2015-06-25 02:39 - 00119296 _____ C:\Windows\System32\zlib.dll
    2015-10-07 23:52 - 2014-11-08 11:58 - 00000000 ____D C:\Users\Mael\Documents\Visual Studio 2010
    2015-10-07 02:59 - 2014-11-09 22:53 - 00000000 ____D C:\ProgramData\NVIDIA Corporation
    2015-10-07 02:58 - 2014-11-09 22:50 - 00000000 ____D C:\Program Files\NVIDIA Corporation
    2015-10-07 02:49 - 2015-03-07 14:39 - 00000000 ____D C:\ProgramData\{a1794b38-68f4-ef5e-a179-94b3868f2ce1}
    2015-10-07 02:12 - 2014-12-11 12:12 - 00000000 ____D C:\Users\Mael\AppData\Local\CrashDumps
    2015-10-07 02:12 - 2014-11-10 22:10 - 00000000 ____D C:\Windows\Minidump
    2015-10-07 02:11 - 2014-11-07 13:16 - 00000000 ____D C:\Users\Mael\AppData\Roaming\Winamp
    2015-10-02 01:08 - 2009-07-13 18:37 - 00000000 ____D C:\Windows\System32\NDF
    2015-09-25 02:35 - 2014-11-07 14:07 - 00000000 ____D C:\Users\Mael\AppData\Roaming\Adobe

    Files to move or delete:
    ====================
    C:\ProgramData\Duplicaterecord.js


    ==================== Known DLLs (Whitelisted) =========================


    ==================== Bamital & volsnap =================

    (There is no automatic fix for files that do not pass verification.)

    C:\Windows\explorer.exe => MD5 is legit
    C:\Windows\System32\winlogon.exe => MD5 is legit
    C:\Windows\System32\wininit.exe => MD5 is legit
    C:\Windows\System32\svchost.exe => MD5 is legit
    C:\Windows\System32\services.exe => MD5 is legit
    C:\Windows\System32\User32.dll => MD5 is legit
    C:\Windows\System32\userinit.exe => MD5 is legit
    C:\Windows\System32\rpcss.dll => MD5 is legit
    C:\Windows\System32\dnsapi.dll => MD5 is legit
    C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

    ==================== EXE Association (Whitelisted) =============



    HKLM\...\.exe: => <===== ATTENTION
    HKLM\...\exefile\DefaultIcon: <===== ATTENTION
    HKLM\...\exefile\open\command: <===== ATTENTION

    ==================== Restore Points =========================

    Restore point date: 2015-09-28 12:33:24
    Restore point date: 2015-10-02 23:49:54
    Restore point date: 2015-10-06 22:12:15
    Restore point date: 2015-10-07 03:00:10
    Restore point date: 2015-10-12 09:57:50
    Restore point date: 2015-10-12 12:58:20
    Restore point date: 2015-10-12 13:00:18
    Restore point date: 2015-10-12 13:48:10
    Restore point date: 2015-10-12 13:54:11
    Restore point date: 2015-10-12 13:54:48
    Restore point date: 2015-10-12 13:56:08
    Restore point date: 2015-10-12 13:57:31
    Restore point date: 2015-10-15 11:48:02

    ==================== Memory info ===========================

    Percentage of memory in use: 14%
    Total physical RAM: 3976.96 MB
    Available physical RAM: 3401.47 MB
    Total Virtual: 3975.25 MB
    Available Virtual: 3407.01 MB

    ==================== Drives ================================

    Drive c: (OS) (Fixed) (Total:156.15 GB) (Free:74.27 GB) NTFS
    Drive e: (Part I) (Fixed) (Total:400 GB) (Free:96.92 GB) NTFS
    Drive f: (Part II) (Fixed) (Total:375.26 GB) (Free:327.3 GB) NTFS
    Drive h: () (Removable) (Total:14.99 GB) (Free:2.32 GB) FAT32
    Drive i: (USB DRIVE) (Removable) (Total:3.76 GB) (Free:1.3 GB) FAT32
    Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS
    Drive y: (System Reserved) (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS ==>[system with boot components (obtained from drive)]

    ==================== MBR & Partition Table ==================

    ========================================================
    Disk: 0 (MBR Code: Windows 7 or 8) (Size: 931.5 GB) (Disk ID: 741D2ACD)
    Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
    Partition 2: (Not Active) - (Size=156.2 GB) - (Type=07 NTFS)
    Partition 3: (Not Active) - (Size=400 GB) - (Type=07 NTFS)
    Partition 4: (Not Active) - (Size=375.3 GB) - (Type=07 NTFS)

    ========================================================
    Disk: 1 (Size: 15 GB) (Disk ID: B560D43E)
    Partition 1: (Active) - (Size=15 GB) - (Type=0C)

    ========================================================
    Disk: 2 (Size: 3.8 GB) (Disk ID: 863AD623)
    Partition 1: (Active) - (Size=3.8 GB) - (Type=0B)


    LastRegBack: 2015-10-15 01:35

    ==================== End of FRST.txt ============================
     
  7. 2015/10/18
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Download attached fixlist.txt file and save it to the very same USB flash drive you've been using. Plug the drive back in.

    NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

    On Vista or Windows 7/8: Now please enter System Recovery Options.
    On Windows XP: Now please boot into the OTLPE CD.
    Run [color= "#0000FF"]FRST(FRST64)[/color] and press the Fix button just once and wait.
    The tool will make a log on the flashdrive (Fixlog.txt) please post it to your reply.


    See if you can boot normally.
     

    Attached Files:

    Last edited: 2015/10/18
  8. 2015/10/18
    maelkaka

    maelkaka Inactive Thread Starter

    Joined:
    2015/10/18
    Messages:
    15
    Likes Received:
    0
    I did all the instruction, but windows still can't start normally.
    I tried safe mode and still the same.

    Here's the fixlog.txt:

    Fix result of Farbar Recovery Scan Tool (x86) Version:18-10-2015
    Ran by SYSTEM (2015-10-19 08:29:55) Run:1
    Running from I:\
    Boot Mode: Recovery

    ==============================================

    fixlist content:
    *****************
    HKLM\...\Winlogon: [Userinit]
    HKLM\...\Winlogon: [Shell] [x ] () <=== ATTENTION
    HKLM\...\InprocServer32: [Default-wbemess] ATTENTION! ====> ZeroAccess?
    HKLM\...D6A79037F57F\InprocServer32: [Default-fastprox] ATTENTION! ====> ZeroAccess?
    GroupPolicy: Restriction - Chrome <======= ATTENTION
    S0 msahci; system32\drivers\msahci.sys [X]
    S3 VGPU; System32\drivers\rdvgkmd.sys [X]
    C:\ProgramData\Duplicaterecord.js
    HKLM\...\.exe: => <===== ATTENTION
    HKLM\...\exefile\DefaultIcon: <===== ATTENTION
    HKLM\...\exefile\open\command: <===== ATTENTION

    *****************

    HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\\Userinit => value restored successfully
    HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell => value restored successfully
    HKLM\Software\Classes\CLSID\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InprocServer32\\Default => value restored successfully
    HKLM\Software\Classes\CLSID\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InprocServer32\\Default => value restored successfully
    C:\Windows\System32\GroupPolicy\Machine => moved successfully
    C:\Windows\System32\GroupPolicy\GPT.ini => moved successfully
    msahci => service removed successfully.
    VGPU => service removed successfully.
    C:\ProgramData\Duplicaterecord.js => moved successfully
    HKLM\Software\Classes\.exe\\Default => value restored successfully
    HKLM\Software\Classes\exefile\DefaultIcon\\Default => value restored successfully
    HKLM\Software\Classes\exefile\shell\open\command\\Default => value restored successfully

    ==== End of Fixlog 08:29:56 ====
     
  9. 2015/10/18
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Same error?

    Please give me fresh FRST log.
     
  10. 2015/10/18
    maelkaka

    maelkaka Inactive Thread Starter

    Joined:
    2015/10/18
    Messages:
    15
    Likes Received:
    0
    how can i get it?

    did you mean start FRST again and get the FRST.txt is the fresh log?
     
    Last edited: 2015/10/18
  11. 2015/10/18
    maelkaka

    maelkaka Inactive Thread Starter

    Joined:
    2015/10/18
    Messages:
    15
    Likes Received:
    0
    Sorry if I dont get it. but if you mean fresh FRST log is FRST.txt after re-run FRST again, here it is:

    Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:18-10-2015
    Ran by SYSTEM on MININT-6VAJ9RK (19-10-2015 09:26:00)
    Running from I:\
    Platform: WIN_7 Service Pack 1 (X86) Language: English (United States)
    Internet Explorer Version 8
    Boot Mode: Recovery
    Default: ControlSet001
    ATTENTION!:=====> If the system is bootable FRST must be run from normal or Safe mode to create a complete log.

    Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

    ==================== Registry (Whitelisted) ===========================

    (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

    HKLM\...\Run: [MSC] => C:\Program Files\Microsoft Security Client\msseces.exe [931200 2012-03-26] (Microsoft Corporation)
    HKLM\...\Run: [ATKOSD2] => C:\Program Files\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe [406328 2013-09-08] (ASUSTek Computer Inc.)
    HKLM\...\Run: [ATKMEDIA] => C:\Program Files\ASUS\ATK Package\ATK Media\DMedia.exe [205624 2013-05-29] (ASUSTek Computer Inc.)
    HKLM\...\Run: [HControlUser] => C:\Program Files\ASUS\ATK Package\ATK Hotkey\HControlUser.exe [105016 2009-06-18] (ASUS)
    HKLM\...\Run: [IAStorIcon] => C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [287592 2013-08-06] (Intel Corporation)
    HKLM\...\Run: [USB3MON] => C:\Program Files\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [292848 2014-02-20] (Intel Corporation)
    HKLM\...\Run: [NvBackend] => C:\Program Files\NVIDIA Corporation\Update Core\NvBackend.exe [2464072 2014-11-06] (NVIDIA Corporation)
    HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap.dll,ShadowPlayOnSystemStart
    HKLM\...\Run: [Baidu PC Faster 4.0.0.0] => C:\Program Files\PC Faster\5.1.0.0\PCFTray.exe [2333152 2015-05-13] (Baidu, Inc.)
    HKLM\...\Policies\Explorer\Run: [BtvStack] => C:\Program Files\Bluetooth Suite\BtvStack.exe [125568 2014-01-01] (Qualcomm®Atheros®)
    HKU\Mael\...\Run: [IDMan] => C:\Program Files\Internet Download Manager\IDMan.exe [3278232 2011-04-05] (Tonec Inc.)
    HKU\Mael\...\Policies\Explorer: [NoLowDiskSpaceChecks] 1
    HKU\Mael\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\Windows\system32\ssText3d.scr [293888 2010-11-20] (Microsoft Corporation)

    ==================== Services (Whitelisted) ========================

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

    S2 ASLDRService; C:\Program Files\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe [111416 2013-09-08] (ASUSTek Computer Inc.)
    S2 AtherosSvc; C:\Program Files\Bluetooth Suite\adminservice.exe [275072 2014-01-01] (Windows (R) Win 7 DDK provider)
    S3 ATKGFNEXSrv; C:\Program Files\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe [96896 2011-11-20] (ASUS)
    S4 BASSVC; C:\Program Files\Baidu Security\MoboMarket\1.2.8.4379\bassvc.exe [208928 2014-12-17] (Baidu, Inc.)
    S4 Bonjour Service; C:\Program Files\Xamarin\Bonjour\mDNSResponder.exe [384512 2015-05-20] (Apple Inc.)
    S2 c2cautoupdatesvc; C:\Program Files\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1394816 2015-04-30] (Microsoft Corporation)
    S2 c2cpnrsvc; C:\Program Files\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1772672 2015-04-30] (Microsoft Corporation)
    S3 Connectify; C:\Program Files\Connectify\ConnectifyService.exe [487936 2013-11-05] (Connectify)
    S3 cphs; C:\Windows\system32\IntelCpHeciSvc.exe [279024 2014-04-08] (Intel Corporation)
    S2 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [915784 2014-11-06] (NVIDIA Corporation)
    S2 igfxCUIService1.0.0.0; C:\Windows\system32\igfxCUIService.exe [261616 2014-04-08] (Intel Corporation)
    S3 IJPLMSVC; C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE [140936 2013-05-14] ()
    S2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [586240 2013-05-11] (Intel(R) Corporation)
    S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [637912 2013-05-11] (Intel(R) Corporation)
    S2 jhi_service; C:\Program Files\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2013-11-06] (Intel Corporation)
    S2 MouseWithoutBordersSvc; C:\Program Files\Microsoft Garage\Mouse without Borders\MouseWithoutBordersSvc.exe [27872 2012-12-27] (Microsoft)
    S2 MsMpSvc; C:\Program Files\Microsoft Security Client\MsMpEng.exe [11552 2012-03-26] (Microsoft Corporation)
    S2 MSSQLSERVER; C:\Program Files\Microsoft SQL Server\MSSQL10_50.MSSQLSERVER\MSSQL\Binn\sqlservr.exe [42884448 2010-04-03] (Microsoft Corporation)
    S3 NisSrv; C:\Program Files\Microsoft Security Client\NisSrv.exe [214952 2012-03-26] (Microsoft Corporation)
    S2 NvNetworkService; C:\Program Files\NVIDIA Corporation\NetService\NvNetworkService.exe [1795912 2014-11-06] (NVIDIA Corporation)
    S2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [18182984 2014-11-06] (NVIDIA Corporation)
    S4 PanService; C:\Program Files\PANDORA.TV\PanService\PandoraService.exe [625304 2012-09-27] (Pandora.TV)
    S2 PCFasterSvc_{PCFaster_5.1.0.0}; C:\Program Files\PC Faster\5.1.0.0\PCFasterSvc.exe [1714448 2015-05-13] (Baidu, Inc.)
    S4 PinnacleUpdateSvc; C:\Program Files\PowerUp Software\Pinnacle Game Profiler\pinnacle_updater.exe [438272 2014-01-11] (PowerUp Software, LLC)
    S4 Sony PC Companion; C:\Program Files\Sony\Sony PC Companion\PCCService.exe [155824 2013-02-04] (Avanquest Software)
    S4 SQLSERVERAGENT; C:\Program Files\Microsoft SQL Server\MSSQL10_50.MSSQLSERVER\MSSQL\Binn\SQLAGENT.EXE [367456 2010-04-03] (Microsoft Corporation)
    S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [680960 2009-07-13] (Microsoft Corporation)
    S2 ZAtheros Bt and Wlan Coex Agent; C:\Program Files\Bluetooth Suite\Ath_CoexAgent.exe [323584 2014-01-01] (Atheros)

    ===================== Drivers (Whitelisted) ==========================

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

    S3 AiCharger; C:\Windows\System32\DRIVERS\AiCharger.sys [14720 2013-04-17] (ASUSTek Computer Inc.)
    S2 ASMMAP; C:\Program Files\ASUS\ATK Package\ATKGFNEX\ASMMAP.sys [13880 2009-07-02] (ASUS)
    S3 AthBTPort; C:\Windows\System32\DRIVERS\btath_flt.sys [80680 2014-01-01] (Qualcomm Atheros)
    S3 athr; C:\Windows\System32\DRIVERS\athr.sys [3244544 2013-12-23] (Qualcomm Atheros Communications, Inc.)
    S1 ATKWMIACPIIO; C:\Program Files\ASUS\ATK Package\ATK WMIACPI\atkwmiacpi.sys [17720 2013-07-02] (ASUSTek Computer Inc.)
    S3 ATP; C:\Windows\System32\DRIVERS\AsusTP.sys [60104 2013-12-11] (ASUS Corporation)
    S3 Baidu PC Faster FileShredder; C:\Program Files\PC Faster\5.1.0.0\FileKill_x86.sys [18880 2013-03-18] ()
    S0 Bhbase; C:\Windows\System32\drivers\Bhbase.sys [46440 2015-04-10] (Baidu, Inc.)
    S1 BprotectEx; C:\Windows\System32\drivers\BprotectEx.sys [113992 2015-04-10] (Baidu, Inc.)
    S3 BTATH_A2DP; C:\Windows\System32\drivers\btath_a2dp.sys [295208 2014-01-01] (Qualcomm Atheros)
    S3 btath_avdt; C:\Windows\System32\drivers\btath_avdt.sys [102184 2014-01-01] (Qualcomm Atheros)
    S3 BTATH_BUS; C:\Windows\System32\DRIVERS\btath_bus.sys [27976 2014-01-01] (Qualcomm Atheros)
    S3 BTATH_HCRP; C:\Windows\System32\DRIVERS\btath_hcrp.sys [158688 2014-01-01] (Qualcomm Atheros)
    S3 BTATH_LWFLT; C:\Windows\System32\DRIVERS\btath_lwflt.sys [66448 2014-01-01] (Qualcomm Atheros)
    S3 BTATH_RCP; C:\Windows\System32\DRIVERS\btath_rcp.sys [120616 2014-01-01] (Qualcomm Atheros)
    S3 BtFilter; C:\Windows\System32\DRIVERS\btfilter.sys [506664 2014-01-01] (Qualcomm Atheros)
    S1 cnnctfy3; C:\Windows\System32\DRIVERS\cnnctfy3.sys [29672 2015-01-05] (Connectify)
    S1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [243128 2015-05-28] (Disc Soft Ltd)
    S3 hwusbfake; C:\Windows\System32\DRIVERS\ewusbfake.sys [103040 2008-12-30] (Huawei Technologies Co., Ltd.)
    S0 iaStorA; C:\Windows\System32\DRIVERS\iaStorA.sys [505192 2013-08-06] (Intel Corporation)
    S0 iaStorF; C:\Windows\System32\DRIVERS\iaStorF.sys [25448 2013-08-06] (Intel Corporation)
    S2 IntelHaxm; C:\Windows\System32\DRIVERS\IntelHaxm.sys [78848 2015-01-29] (Intel Corporation)
    S0 iusb3hcs; C:\Windows\System32\DRIVERS\iusb3hcs.sys [16880 2014-02-20] (Intel Corporation)
    S3 iusb3hub; C:\Windows\System32\DRIVERS\iusb3hub.sys [364528 2014-02-20] (Intel Corporation)
    S3 iusb3xhc; C:\Windows\System32\DRIVERS\iusb3xhc.sys [800240 2014-02-20] (Intel Corporation)
    S3 L1C; C:\Windows\System32\DRIVERS\L1C62x86.sys [110280 2013-07-17] (Qualcomm Atheros Co., Ltd.)
    S3 MEI; C:\Windows\System32\DRIVERS\TeeDriver.sys [85464 2013-11-06] (Intel Corporation)
    S0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [171064 2012-03-20] (Microsoft Corporation)
    S0 nvpciflt; C:\Windows\System32\DRIVERS\nvpciflt.sys [25800 2014-11-03] (NVIDIA Corporation)
    S3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [18760 2014-11-06] (NVIDIA Corporation)
    S3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad32v.sys [33096 2014-10-03] (NVIDIA Corporation)
    S3 PCFApiUtil; C:\Program Files\PC Faster\5.1.0.0\PCFApiUtil.sys [118152 2015-04-10] (Baidu, Inc.)
    S2 plctrl; C:\Program Files\ASUS\P4G\plctrl.sys [14136 2014-01-03] (Windows (R) Win 7 DDK provider)
    S3 pwdrvio; C:\Windows\system32\pwdrvio.sys [15688 2013-09-30] ()
    S3 pwdspio; C:\Windows\system32\pwdspio.sys [10320 2013-09-30] ()
    S4 RsFx0150; C:\Windows\System32\DRIVERS\RsFx0150.sys [240608 2010-04-02] (Microsoft Corporation)
    S3 VSPerfDrv100; C:\Program Files\Microsoft Visual Studio 10.0\Team Tools\Performance Tools\VSPerfDrv100.sys [48128 2009-12-08] (Microsoft Corporation)
    S1 {88dab020-0802-4f33-9294-5fccbb774bac}Gw; C:\Windows\System32\drivers\{88dab020-0802-4f33-9294-5fccbb774bac}Gw.sys [43152 2015-03-06] (StdLib)
    S1 {c6cf689f-ec21-4add-accd-adc0bafcbba6}Gw; C:\Windows\System32\drivers\{c6cf689f-ec21-4add-accd-adc0bafcbba6}Gw.sys [43152 2015-02-19] (StdLib)

    ==================== NetSvcs (Whitelisted) ===================

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


    ==================== One Month Created files and folders ========

    (If an entry is included in the fixlist, the file/folder will be moved.)

    2015-10-19 06:03 - 2015-10-19 09:26 - 00000000 ____D C:\FRST
    2015-10-19 01:56 - 2015-10-19 01:56 - 00028672 _____ C:\BCD_Backup
    2015-10-19 01:56 - 2015-10-19 01:56 - 00025600 ___SH C:\BCD_Backup.LOG
    2015-10-12 14:13 - 2015-10-12 14:13 - 00000000 ____D C:\Users\Mael\Tracing
    2015-10-12 14:10 - 2015-10-12 14:30 - 00000000 ____D C:\Users\Mael\AppData\Roaming\Skype
    2015-10-12 14:10 - 2015-10-12 14:16 - 00000000 ___RD C:\Program Files\Skype
    2015-10-12 14:10 - 2015-10-12 14:10 - 00000000 ____D C:\Users\Mael\AppData\Local\Skype
    2015-10-12 14:10 - 2015-10-12 14:10 - 00000000 ____D C:\ProgramData\Skype
    2015-10-12 14:10 - 2015-10-12 14:10 - 00000000 ____D C:\Program Files\Common Files\Skype
    2015-10-12 14:06 - 2015-10-12 14:06 - 12623872 _____ C:\Users\Mael\Downloads\SkypeWebPlugin.msi
    2015-10-12 14:06 - 2015-10-12 14:06 - 00000000 ____D C:\Users\Mael\AppData\Local\SkypePlugin
    2015-10-12 12:27 - 2015-10-12 12:27 - 00011344 _____ C:\Users\Mael\Documents\teredo.reg
    2015-10-11 08:48 - 2015-10-11 08:48 - 00000000 ____D C:\Users\Mael\AppData\Local\NFS Underground 2
    2015-10-07 02:58 - 2014-11-03 12:32 - 00616768 _____ (NVIDIA Corporation) C:\Windows\System32\nvStreaming.exe
    2015-10-07 02:57 - 2015-10-07 02:57 - 00000000 ____D C:\Windows\System32\NV
    2015-10-07 02:56 - 2015-10-07 02:56 - 00000000 ____D C:\temp
    2015-10-04 21:54 - 2015-10-05 00:45 - 00000700 _____ C:\Users\Mael\Documents\payapinang.txt
    2015-10-04 19:56 - 2015-10-04 21:53 - 00000000 ____D C:\Program Files\Sistem Paya Pinang
    2015-10-02 01:05 - 2015-10-02 01:05 - 00038615 _____ C:\Users\Mael\Downloads\ToolTipTest.rar
    2015-10-01 01:26 - 2015-10-01 01:27 - 00059602 _____ C:\Users\Mael\Documents\properti_rumah.sql
    2015-09-30 11:08 - 2015-09-30 11:08 - 00040535 _____ C:\Windows\System32\energy-report.html
    2015-09-20 23:45 - 2015-09-20 23:45 - 00000000 ____D C:\ProgramData\EPSON

    ==================== One Month Modified files and folders ========

    (If an entry is included in the fixlist, the file/folder will be moved.)

    2015-10-19 08:29 - 2009-07-13 18:37 - 00000000 ___HD C:\Windows\System32\GroupPolicy
    2015-10-19 01:04 - 2009-07-13 18:37 - 00000000 ____D C:\Windows\System32\LogFiles
    2015-10-16 02:02 - 2014-11-07 12:58 - 01056506 _____ C:\Windows\WindowsUpdate.log
    2015-10-16 02:01 - 2014-11-07 13:26 - 00000000 ____D C:\Users\Mael\AppData\Roaming\DMCache
    2015-10-16 02:00 - 2014-11-07 13:26 - 00000000 ____D C:\Users\Mael\Downloads\Video
    2015-10-15 23:38 - 2014-11-08 11:53 - 00000000 ____D C:\Users\Mael\AppData\Local\Eclipse
    2015-10-15 23:33 - 2015-07-29 21:43 - 00026835 _____ C:\Windows\setupact.log
    2015-10-15 23:32 - 2014-11-09 23:00 - 00000000 ____D C:\ProgramData\NVIDIA
    2015-10-15 11:42 - 2014-11-07 13:26 - 00000000 ____D C:\Users\Mael\Downloads\Compressed
    2015-10-15 11:41 - 2010-11-20 13:01 - 00970638 _____ C:\Windows\System32\PerfStringBackup.INI
    2015-10-15 11:36 - 2014-11-08 13:00 - 00000000 ____D C:\Users\Mael\AppData\Local\TSVNCache
    2015-10-13 00:43 - 2009-07-13 20:52 - 00000000 ____D C:\Windows\System32\FxsTmp
    2015-10-12 14:26 - 2014-11-07 12:59 - 00000000 ____D C:\Users\Mael\AppData\Local\VirtualStore
    2015-10-12 14:13 - 2014-11-07 12:59 - 00000000 ____D C:\users\Mael
    2015-10-12 13:57 - 2014-11-07 13:29 - 00000000 ____D C:\Program Files\ASUS
    2015-10-12 13:55 - 2014-12-30 14:31 - 00000000 ____D C:\ProgramData\ASUS
    2015-10-12 09:45 - 2015-05-01 00:03 - 00000464 __RSH C:\ProgramData\ntuser.pol
    2015-10-09 16:06 - 2009-07-13 20:34 - 00020832 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
    2015-10-09 16:06 - 2009-07-13 20:34 - 00020832 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
    2015-10-09 15:31 - 2015-01-01 23:44 - 00003584 _____ C:\Users\Mael\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
    2015-10-09 11:59 - 2015-05-16 02:23 - 00000000 ____D C:\Program Files\Opera
    2015-10-09 11:54 - 2015-06-25 02:39 - 00119296 _____ C:\Windows\System32\zlib.dll
    2015-10-07 23:52 - 2014-11-08 11:58 - 00000000 ____D C:\Users\Mael\Documents\Visual Studio 2010
    2015-10-07 02:59 - 2014-11-09 22:53 - 00000000 ____D C:\ProgramData\NVIDIA Corporation
    2015-10-07 02:58 - 2014-11-09 22:50 - 00000000 ____D C:\Program Files\NVIDIA Corporation
    2015-10-07 02:49 - 2015-03-07 14:39 - 00000000 ____D C:\ProgramData\{a1794b38-68f4-ef5e-a179-94b3868f2ce1}
    2015-10-07 02:12 - 2014-12-11 12:12 - 00000000 ____D C:\Users\Mael\AppData\Local\CrashDumps
    2015-10-07 02:12 - 2014-11-10 22:10 - 00000000 ____D C:\Windows\Minidump
    2015-10-07 02:11 - 2014-11-07 13:16 - 00000000 ____D C:\Users\Mael\AppData\Roaming\Winamp
    2015-10-02 01:08 - 2009-07-13 18:37 - 00000000 ____D C:\Windows\System32\NDF
    2015-09-25 02:35 - 2014-11-07 14:07 - 00000000 ____D C:\Users\Mael\AppData\Roaming\Adobe

    ==================== Known DLLs (Whitelisted) =========================


    ==================== Bamital & volsnap =================

    (There is no automatic fix for files that do not pass verification.)

    C:\Windows\explorer.exe => MD5 is legit
    C:\Windows\System32\winlogon.exe => MD5 is legit
    C:\Windows\System32\wininit.exe => MD5 is legit
    C:\Windows\System32\svchost.exe => MD5 is legit
    C:\Windows\System32\services.exe => MD5 is legit
    C:\Windows\System32\User32.dll => MD5 is legit
    C:\Windows\System32\userinit.exe => MD5 is legit
    C:\Windows\System32\rpcss.dll => MD5 is legit
    C:\Windows\System32\dnsapi.dll => MD5 is legit
    C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

    ==================== EXE Association (Whitelisted) =============


    ==================== Restore Points =========================

    Restore point date: 2015-09-28 12:33:24
    Restore point date: 2015-10-02 23:49:54
    Restore point date: 2015-10-06 22:12:15
    Restore point date: 2015-10-07 03:00:10
    Restore point date: 2015-10-12 09:57:50
    Restore point date: 2015-10-12 12:58:20
    Restore point date: 2015-10-12 13:00:18
    Restore point date: 2015-10-12 13:48:10
    Restore point date: 2015-10-12 13:54:11
    Restore point date: 2015-10-12 13:54:48
    Restore point date: 2015-10-12 13:56:08
    Restore point date: 2015-10-12 13:57:31
    Restore point date: 2015-10-15 11:48:02

    ==================== Memory info ===========================

    Percentage of memory in use: 14%
    Total physical RAM: 3976.96 MB
    Available physical RAM: 3408.37 MB
    Total Virtual: 3975.25 MB
    Available Virtual: 3411.03 MB

    ==================== Drives ================================

    Drive c: (OS) (Fixed) (Total:156.15 GB) (Free:74.27 GB) NTFS
    Drive e: (Part I) (Fixed) (Total:400 GB) (Free:96.92 GB) NTFS
    Drive f: (Part II) (Fixed) (Total:375.26 GB) (Free:327.3 GB) NTFS
    Drive h: () (Removable) (Total:14.99 GB) (Free:2.32 GB) FAT32
    Drive i: (USB DRIVE) (Removable) (Total:3.76 GB) (Free:1.3 GB) FAT32
    Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS
    Drive y: (System Reserved) (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS ==>[system with boot components (obtained from drive)]

    ==================== MBR & Partition Table ==================

    ========================================================
    Disk: 0 (MBR Code: Windows 7 or 8) (Size: 931.5 GB) (Disk ID: 741D2ACD)
    Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
    Partition 2: (Not Active) - (Size=156.2 GB) - (Type=07 NTFS)
    Partition 3: (Not Active) - (Size=400 GB) - (Type=07 NTFS)
    Partition 4: (Not Active) - (Size=375.3 GB) - (Type=07 NTFS)

    ========================================================
    Disk: 1 (Size: 15 GB) (Disk ID: B560D43E)
    Partition 1: (Active) - (Size=15 GB) - (Type=0C)

    ========================================================
    Disk: 2 (Size: 3.8 GB) (Disk ID: 863AD623)
    Partition 1: (Active) - (Size=3.8 GB) - (Type=0B)


    LastRegBack: 2015-10-15 01:35

    ==================== End of FRST.txt ============================
     
  12. 2015/10/18
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    ZeroAccess rootkit infection is gone but sometimes it causes irreversible damage to Windows installation.

    Let's try one more fix.

    Download attached fixlist.txt file and save it to the very same USB flash drive you've been using. Plug the drive back in.

    NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

    On Vista or Windows 7/8: Now please enter System Recovery Options.
    On Windows XP: Now please boot into the OTLPE CD.
    Run [color= "#0000FF"]FRST(FRST64)[/color] and press the Fix button just once and wait.
    The tool will make a log on the flashdrive (Fixlog.txt) please post it to your reply.
     

    Attached Files:

  13. 2015/10/18
    maelkaka

    maelkaka Inactive Thread Starter

    Joined:
    2015/10/18
    Messages:
    15
    Likes Received:
    0
    Awesome.... Thank you so much. it works. and my laptop start normally again.

    Here's content of Fixlog.txt:
    Fix result of Farbar Recovery Scan Tool (x86) Version:18-10-2015
    Ran by SYSTEM (2015-10-19 10:14:10) Run:2
    Running from I:\
    Boot Mode: Recovery

    ==============================================

    fixlist content:
    *****************
    LastRegBack: 2015-10-15 01:35
    *****************

    DEFAULT => copied successfully to System32\config\HiveBackup
    DEFAULT => restored successfully from registry back up
    SAM => copied successfully to System32\config\HiveBackup
    SAM => restored successfully from registry back up
    SECURITY => copied successfully to System32\config\HiveBackup
    SECURITY => restored successfully from registry back up
    SOFTWARE => copied successfully to System32\config\HiveBackup
    SOFTWARE => restored successfully from registry back up
    SYSTEM => copied successfully to System32\config\HiveBackup
    SYSTEM => restored successfully from registry back up

    ==== End of Fixlog 10:14:17 ====
     
  14. 2015/10/19
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Good news but since you were infected with a rootkit we need to run some more scans to make sure you're totally clean.

    [​IMG] Download RogueKiller from one of the following links and save it to your Desktop:

    Link 1
    Link 2
    • Close all the running programs
    • Windows Vista/7/8 users: right click on RogueKiller.exe, click Run as Administrator
    • Otherwise just double-click on RogueKiller.exe
    • Pre-scan will start. Let it finish.
    • Click on SCAN button.
    • Wait until the Status box shows Scan Finished
    • Click on Delete.
    • Wait until the Status box shows Deleting Finished.
    • Click on Report and copy/paste the content of the Notepad into your next reply.
    • RKreport.txt could also be found on your desktop.
    • If more than one log is produced post all logs.
    • If RogueKiller has been blocked, do not hesitate to try a few times more. If really won't run, rename it to winlogon.exe (or winlogon.com) and try again
    [​IMG] Please download Malwarebytes Anti-Malware (MBAM) to your desktop.
    NOTE. If you already have MBAM 2.0 installed scroll down.
    • Double-click mbam-setup-2.0.0.1000.exe and follow the prompts to install the program.
    • At the end, be sure a checkmark is placed next to the following:
    • Launch Malwarebytes Anti-Malware
    • A 14 day trial of the Premium features is pre-selected. You may deselect this if you wish, and it will not diminish the scanning and removal capabilities of the program.
    • Click Finish.
    • On the Dashboard, click the 'Update Now >>' link
    • After the update completes, click the 'Scan Now >>' button.
    • Or, on the Dashboard, click the Scan Now >> button.
    • If an update is available, click the Update Now button.
    • A Threat Scan will begin.
    • When the scan is complete, if there have been detections, click Apply Actions to allow MBAM to clean what was detected.
    • In most cases, a restart will be required.
    • Wait for the prompt to restart the computer to appear, then click on Yes.
    If you already have MBAM 2.0 installed:
    • On the Dashboard, click the 'Update Now >>' link
    • After the update completes, click the 'Scan Now >>' button.
    • Or, on the Dashboard, click the Scan Now >> button.
    • If an update is available, click the Update Now button.
    • A Threat Scan will begin.
    • When the scan is complete, if there have been detections, click Apply Actions to allow MBAM to clean what was detected.
    • In most cases, a restart will be required.
    • Wait for the prompt to restart the computer to appear, then click on Yes.
    How to get logs:
    (Export log to save as txt)
    • After the restart once you are back at your desktop, open MBAM once more.
    • Click on the History tab > Application Logs.
    • Double click on the Scan Log which shows the Date and time of the scan just performed.
    • Click 'Export'.
    • Click 'Text file (*.txt)'
    • In the Save File dialog box which appears, click on Desktop.
    • In the File name: box type a name for your scan log.
    • A message box named 'File Saved' should appear stating "Your file has been successfully exported ".
    • Click Ok
    • Attach that saved log to your next reply.
    (Copy to clipboard for pasting into forum replies or tickets)
    • After the restart once you are back at your desktop, open MBAM once more.
    • Click on the History tab > Application Logs.
    • Double click on the Scan Log which shows the Date and time of the scan just performed.
    • Click 'Copy to Clipboard'
    • Paste the contents of the clipboard into your reply.
    [​IMG] Please download AdwCleaner by Xplode onto your desktop.
    • Close all open programs and internet browsers.
    • Double click on adwcleaner.exe to run the tool.
    • Click on Scan button.
    • When the scan has finished click on Clean button.
    • Your computer will be rebooted automatically. A text file will open after the restart.
    • Please post the contents of that logfile with your next reply.
    • You can find the logfile at C:\AdwCleaner[S1].txt as well.
    [​IMG] Please download Junkware Removal Tool to your desktop.
    • Shut down your protection software now to avoid potential conflicts.
    • Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator ".
    • The tool will open and start scanning your system.
    • Please be patient as this can take a while to complete depending on your system's specifications.
    • On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
    • Post the contents of JRT.txt into your next message.
     
  15. 2015/10/20
    maelkaka

    maelkaka Inactive Thread Starter

    Joined:
    2015/10/18
    Messages:
    15
    Likes Received:
    0
    Got it.
    I'll send the log report soon after I finish the whole scan.
     
  16. 2015/10/20
    maelkaka

    maelkaka Inactive Thread Starter

    Joined:
    2015/10/18
    Messages:
    15
    Likes Received:
    0
    Hi broni,
    I had been following all your instruction. and here the scan result.

    • Here's the log of Rouge Killer (RKReport.txt):
    RogueKiller V10.11.2.0 [Oct 20 2015] by Adlice Software
    mail : http://www.adlice.com/contact/
    Feedback : http://forum.adlice.com
    Website : http://www.adlice.com/software/roguekiller/
    Blog : http://www.adlice.com

    Operating System : Windows 7 (6.1.7601 Service Pack 1) 32 bits version
    Started in : Normal mode
    User : Mael [Administrator]
    Started from : C:\Users\Mael\Downloads\Programs\RogueKiller.exe
    Mode : Delete -- Date : 10/20/2015 23:26:22

    ¤¤¤ Processes : 1 ¤¤¤
    [Proc.Svchost] svchost.exe(4908) -- C:\Windows\System32\svchost.exe[7] -> Killed [TermProc]

    ¤¤¤ Registry : 9 ¤¤¤
    [PUP] HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\PanService (C:\Program Files\PANDORA.TV\PanService\PandoraService.exe) -> Not selected
    [PUP] HKEY_LOCAL_MACHINE\System\ControlSet001\Services\PanService (C:\Program Files\PANDORA.TV\PanService\PandoraService.exe) -> Not selected
    [PUP] HKEY_LOCAL_MACHINE\System\ControlSet002\Services\PanService (C:\Program Files\PANDORA.TV\PanService\PandoraService.exe) -> Not selected
    [PUM.HomePage] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main | Default_Page_URL : http://www.istartsurf.com/?type=hppp&ts=1431426071&from=xtab&uid=B7DCE3A627014f1989FFA9A854D71C39 -> Not selected
    [PUM.SearchPage] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main | Search Page : http://search.delta-homes.com/web/?type=ds&ts=1431425993&z=c9b77f31b41b21b56042a66g3zcccgbz5oawbt2t2o&from=ient05120&uid=ST1000LM024XHN-M101MBB_S32XJ9DF802310&q={searchTerms} -> Not selected
    [PUM.SearchPage] HKEY_USERS\S-1-5-21-1983062108-2153825218-3807267094-1000\Software\Microsoft\Internet Explorer\Main | Search Page : http://www.istartsurf.com/web/?type=dspp&ts=1431426071&from=xtab&uid=B7DCE3A627014f1989FFA9A854D71C39&q={searchTerms} -> Not selected
    [PUM.SearchPage] HKEY_USERS\S-1-5-21-1983062108-2153825218-3807267094-1000\Software\Microsoft\Internet Explorer\Main | Search Bar : Preserve -> Not selected
    [PUM.SearchPage] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main | Default_Search_URL : http://search.delta-homes.com/web/?type=ds&ts=1431425993&z=c9b77f31b41b21b56042a66g3zcccgbz5oawbt2t2o&from=ient05120&uid=ST1000LM024XHN-M101MBB_S32XJ9DF802310&q={searchTerms} -> Not selected
    [PUM.StartMenu] HKEY_USERS\S-1-5-21-1983062108-2153825218-3807267094-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowMyDocs : 2 -> Not selected

    ¤¤¤ Tasks : 1 ¤¤¤
    [Suspicious.Path] \060184C3-9766-46a0-B258-F4518A0B2633 -- C:\Windows\system32\CScript.exe ( "C:\ProgramData\Duplicaterecord.js ") -> Not selected

    ¤¤¤ Files : 0 ¤¤¤

    ¤¤¤ Hosts File : 0 ¤¤¤

    ¤¤¤ Antirootkit : 0 (Driver: Loaded) ¤¤¤

    ¤¤¤ Web browsers : 0 ¤¤¤

    ¤¤¤ MBR Check : ¤¤¤
    +++++ PhysicalDrive0: ST1000LM ST1000LM024 HN-M SCSI Disk Device +++++
    --- User ---
    [MBR] 1e2319ae6ad85fc5ceddd397046d5b09
    [BSP] 519d09c4812b82b0b18bc34acb434474 : Windows Vista/7/8 MBR Code
    Partition table:
    0 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 2048 | Size: 100 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
    1 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 206848 | Size: 159900 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
    2 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 327682048 | Size: 409600 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
    3 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 1166542848 | Size: 384267 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
    User = LL1 ... OK
    Error reading LL2 MBR! ([18] The program issued a command but the command length is incorrect. )

    • Here's the log of MBAM:
    Malwarebytes Anti-Malware
    www.malwarebytes.org

    Scan Date: 20-Oct-15
    Scan Time: 11:31 PM
    Logfile: MBAM Log.txt
    Administrator: Yes

    Version: 2.2.0.1024
    Malware Database: v2015.09.22.05
    Rootkit Database: v2015.09.18.01
    License: Free
    Malware Protection: Disabled
    Malicious Website Protection: Disabled
    Self-protection: Disabled

    OS: Windows 7 Service Pack 1
    CPU: x86
    File System: NTFS
    User: Mael

    Scan Type: Threat Scan
    Result: Completed
    Objects Scanned: 328137
    Time Elapsed: 8 min, 26 sec

    Memory: Enabled
    Startup: Enabled
    Filesystem: Enabled
    Archives: Enabled
    Rootkits: Disabled
    Heuristics: Enabled
    PUP: Enabled
    PUM: Enabled

    Processes: 0
    (No malicious items detected)

    Modules: 0
    (No malicious items detected)

    Registry Keys: 38
    PUP.Optional.RoundWorld, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\{c6cf689f-ec21-4add-accd-adc0bafcbba6}Gw, Quarantined, [e8053200503b03339ffa208b8a7b7090],
    PUP.Optional.WinToFlashSuggestor, HKLM\SOFTWARE\CLASSES\CLSID\{FC36B0BD-27F0-4cdd-8AB1-50651EFC3EFD}, Quarantined, [638ad65c5f2c0e285ecaba33f210ed13],
    PUP.Optional.WinToFlashSuggestor, HKU\S-1-5-21-1983062108-2153825218-3807267094-1000\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{FC36B0BD-27F0-4CDD-8AB1-50651EFC3EFD}, Quarantined, [638ad65c5f2c0e285ecaba33f210ed13],
    PUP.Optional.WinToFlashSuggestor, HKU\S-1-5-21-1983062108-2153825218-3807267094-1000\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{FC36B0BD-27F0-4CDD-8AB1-50651EFC3EFD}, Quarantined, [638ad65c5f2c0e285ecaba33f210ed13],
    PUP.Optional.MultiPlug, HKU\S-1-5-21-1983062108-2153825218-3807267094-1000_Classes\CLSID\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}, Quarantined, [05e8d35f3c4f87af57c62fb444bef50b],
    PUP.Optional.SupTab, HKU\S-1-5-21-1983062108-2153825218-3807267094-1000\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}, Quarantined, [905dc36f008b033349f915d71ce601ff],
    PUP.Optional.SupTab, HKU\S-1-5-21-1983062108-2153825218-3807267094-1000\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}, Quarantined, [905dc36f008b033349f915d71ce601ff],
    PUP.Optional.ThinkTanks, HKLM\SOFTWARE\CLASSES\TYPELIB\{2D9B1B31-D034-4738-8F6E-40F0AFCC742C}, Quarantined, [ce1fd55daeddff37794fbcef0df8926e],
    PUP.Optional.ThinkTanks, HKLM\SOFTWARE\CLASSES\INTERFACE\{78CE34FD-F6D4-4866-B79C-A37268D06A04}, Quarantined, [ce1fd55daeddff37794fbcef0df8926e],
    PUP.Optional.ThinkTanks, HKLM\SOFTWARE\CLASSES\INTERFACE\{80904944-C726-4C7D-A452-3FFF2A882095}, Quarantined, [ce1fd55daeddff37794fbcef0df8926e],
    PUP.Optional.WinToFlashSuggestor, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\WinToFlash Suggestor, Quarantined, [7875b280e1aa6cca818411b04eb3916f],
    PUP.Optional.Sanbreel, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\{88dab020-0802-4f33-9294-5fccbb774bac}Gw, Quarantined, [a746de544447ed4983ebcbec6d97926e],
    PUP.Optional.Delta.ShrtCln, HKLM\SOFTWARE\delta-homesSoftware, Quarantined, [ec01c76b9dee53e3bfdee85bb3507b85],
    PUP.Optional.FFPluginHp, HKLM\SOFTWARE\FFPluginHp, Quarantined, [8e5f1220dead290d43959dfda361936d],
    PUP.Optional.IHProtect, HKLM\SOFTWARE\IHProtect, Quarantined, [866779b9f695dd599794178bf70dae52],
    PUP.Optional.MyStartSearch.ShrtCln, HKLM\SOFTWARE\mystartsearchSoftware, Quarantined, [97562a08d3b8c76f74749e9dcc37748c],
    PUP.Optional.SupTab, HKLM\SOFTWARE\supWPM, Quarantined, [28c5d9590b80e3539d849a26c53fef11],
    PUP.Optional.CrossRider, HKLM\SOFTWARE\APPDATALOW\SOFTWARE\Crossrider, Quarantined, [6d80a1911c6ff83e1c04ade89272a15f],
    PUP.Optional.WinToFlashSuggestor, HKLM\SOFTWARE\GOOGLE\CHROME\EXTENSIONS\acaoakiamfeidcmgooclgeleejkbaecf, Quarantined, [41ac5fd31675c86e64b2aa1f808417e9],
    PUP.Optional.Binkiland, HKLM\SOFTWARE\GOOGLE\CHROME\EXTENSIONS\elggllhppljlljkgfeokjpehmdamkejk, Quarantined, [57965bd77f0c0f278df04e3b4fb554ac],
    PUP.Optional.GoodForYou, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{BB82DE59-BC4C-4172-9AC4-73315F71CFFE}, Quarantined, [3eaf77bbfd8e44f24758544a9b69af51],
    PUP.Optional.Binkiland, HKLM\SOFTWARE\MICROSOFT\MEDIAPLAYER\SHIMINCLUSIONLIST\binkiland.exe, Quarantined, [28c50131d2b983b30a7723669f65f808],
    PUM.Security.Hijack.DisableChromeUpdates, HKLM\SOFTWARE\POLICIES\GOOGLE\UPDATE, Quarantined, [6d803002d8b353e3ce71601c35cf5ba5],
    PUP.Optional.SupTab, HKLM\SOFTWARE\SUPTAB, Quarantined, [ae3fa68cd0bbb581d34d2e92c73de41c],
    PUP.Optional.IEPluginServices, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\EVENTLOG\APPLICATION\IePluginServices, Quarantined, [5d903101177456e07d3c4b56df250000],
    PUP.Optional.WindowsMangerProtect, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\EVENTLOG\APPLICATION\WindowsMangerProtect, Quarantined, [b6379c96f29975c15a81d1f78c784db3],
    PUP.Optional.TornTV, HKU\S-1-5-18\SOFTWARE\TornTv Downloader, Quarantined, [46a7b1812f5c65d157d77f44a3612ad6],
    PUP.Optional.CrossRider, HKU\S-1-5-18\SOFTWARE\APPDATALOW\SOFTWARE\_CrossriderRegNamePlaceHolder_, Quarantined, [0ce1240e93f8b38320bb266d749015eb],
    PUP.Optional.1ClickDownload, HKU\S-1-5-21-1983062108-2153825218-3807267094-1000\SOFTWARE\1ClickDownload, Quarantined, [13daca681b7092a463e6760f867e6d93],
    PUP.Optional.AppLid, HKU\S-1-5-21-1983062108-2153825218-3807267094-1000\SOFTWARE\App Lid-nv-ie, Quarantined, [a9444de5543700368eea1d6a020236ca],
    PUP.Optional.Binkiland, HKU\S-1-5-21-1983062108-2153825218-3807267094-1000\SOFTWARE\Binkiland Browser, Quarantined, [2ebf7bb7aedd47ef591c0b7e986cf40c],
    PUP.Optional.InstallCore, HKU\S-1-5-21-1983062108-2153825218-3807267094-1000\SOFTWARE\InstallCore, Quarantined, [8a63a48e464561d5dd6ff4af1fe5ad53],
    PUP.Optional.WebSearches.ShrtCln, HKU\S-1-5-21-1983062108-2153825218-3807267094-1000\SOFTWARE\SupHpUISoft, Quarantined, [24c98ba796f544f2ce6376ccc14227d9],
    PUP.Optional.CrossRider, HKU\S-1-5-21-1983062108-2153825218-3807267094-1000\SOFTWARE\APPDATALOW\SOFTWARE\Crossrider, Quarantined, [48a539f9167575c17566147f986c45bb],
    PUP.Optional.GlobalUpdate, HKU\S-1-5-21-1983062108-2153825218-3807267094-1000\SOFTWARE\GLOBALUPDATE\UPDATE\PROXY, Quarantined, [4ba2d260632844f21726aaf449bbfb05],
    PUP.Optional.Binkiland, HKU\S-1-5-21-1983062108-2153825218-3807267094-1000\SOFTWARE\GOOGLE\CHROME\EXTENSIONS\elggllhppljlljkgfeokjpehmdamkejk, Quarantined, [8c61300204871a1c760169207490e11f],
    PUP.Optional.CrossRider, HKU\S-1-5-21-1983062108-2153825218-3807267094-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{B9E10CA2-D8C7-4A5C-80BD-EC25AD111D88}, Quarantined, [42ab6bc7583363d37c8e742126ded12f],
    PUP.Optional.SweetSearch, HKU\S-1-5-21-1983062108-2153825218-3807267094-1000\SOFTWARE\MOZILLA\EXTENDS, Quarantined, [b83539f9711a8da90895e6dabf4505fb],

    Registry Values: 12
    PUP.Optional.Binkiland, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY|AppPath, C:\Program Files\WSE_Binkiland\\, Quarantined, [9a53b280cebdc472c9b6c1c8c53f5ba5]
    PUP.Optional.GoodForYou, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{BB82DE59-BC4C-4172-9AC4-73315F71CFFE}|FaviconURL, http://websearch.goodforsearch.info/favicon.ico, Quarantined, [3eaf77bbfd8e44f24758544a9b69af51]
    PUP.Optional.GoodForYou, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{BB82DE59-BC4C-4172-9AC4-73315F71CFFE}|FaviconURLFallback, http://websearch.goodforsearch.info/favicon.ico, Quarantined, [cd20a092305b49edfda225791de7ac54]
    PUP.Optional.GoodForYou, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{BB82DE59-BC4C-4172-9AC4-73315F71CFFE}|URL, http://websearch.goodforsearch.info/?l=1&q={searchTerms}&pid=21086&r=2015/04/28&hid=8648110734131852962&lg=EN&cc=ID&unqvl=86, Quarantined, [975683af1e6dbf778a154d51be4608f8]
    PUP.Optional.FastStart, HKLM\SOFTWARE\MOZILLA\FIREFOX\EXTENSIONS|faststartff@gmail.com, C:\Users\Mael\AppData\Roaming\Mozilla\Firefox\Profiles\b3lyyjwu.default\extensions\faststartff@gmail.com, Quarantined, [4ba269c9b9d23501065816849c68e818]
    PUP.Optional.QuickSearch, HKLM\SOFTWARE\MOZILLA\FIREFOX\EXTENSIONS|quick_searchff@gmail.com, C:\Users\Mael\AppData\Roaming\Mozilla\Firefox\Profiles\pffvk00h.default-1420015774234\extensions\quick_searchff@gmail.com, Quarantined, [eeff02301d6edb5be414e2d2e0243fc1]
    PUP.Optional.SweetSearch, HKLM\SOFTWARE\MOZILLA\FIREFOX\EXTENSIONS|sweetsearch@gmail.com, C:\Users\Mael\AppData\Roaming\Mozilla\Firefox\Profiles\gs4d222s.default-1431508211565\extensions\sweetsearch@gmail.com, Quarantined, [07e681b193f8b2842579338df212bb45]
    PUM.Security.Hijack.DisableChromeUpdates, HKLM\SOFTWARE\POLICIES\GOOGLE\UPDATE|DisableAutoUpdateChecksCheckboxValue, 1, Quarantined, [6d803002d8b353e3ce71601c35cf5ba5]
    PUP.Optional.SupTab, HKLM\SOFTWARE\SUPTAB|ptid, ient05120, Quarantined, [ae3fa68cd0bbb581d34d2e92c73de41c]
    PUP.Optional.GlobalUpdate, HKU\S-1-5-21-1983062108-2153825218-3807267094-1000\SOFTWARE\GLOBALUPDATE\UPDATE\PROXY|source, IE, Quarantined, [4ba2d260632844f21726aaf449bbfb05]
    PUP.Optional.CrossRider, HKU\S-1-5-21-1983062108-2153825218-3807267094-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{B9E10CA2-D8C7-4A5C-80BD-EC25AD111D88}|AppName, c8387ef7-5cad-4cc6-9e1b-28c39e730689-2.exe-buttonutil.exe, Quarantined, [42ab6bc7583363d37c8e742126ded12f]
    PUP.Optional.SweetSearch, HKU\S-1-5-21-1983062108-2153825218-3807267094-1000\SOFTWARE\MOZILLA\EXTENDS|appid, sweetsearch@gmail.com, Quarantined, [b83539f9711a8da90895e6dabf4505fb]

    Registry Data: 5
    PUP.Optional.Delta.ShrtCln, HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE\SHELL\OPEN\COMMAND, C:\Program Files\Internet Explorer\iexplore.exe http://www.delta-homes.com/?type=sc...120&uid=ST1000LM024XHN-M101MBB_S32XJ9DF802310, Good: (iexplore.exe), Bad: (C:\Program Files\Internet Explorer\iexplore.exe http://www.delta-homes.com/?type=sc...1000LM024XHN-M101MBB_S32XJ9DF802310),Replaced,[19d4f9393754a4928f0b571db64f34cc]
    PUP.Optional.Delta.ShrtCln, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Default_Search_URL, http://search.delta-homes.com/web/?type=ds&ts=1431425993&z=c9b77f31b41b21b56042a66g3zcccgbz5oawbt2t2o&from=ient05120&uid=ST1000LM024XHN-M101MBB_S32XJ9DF802310&q={searchTerms}, Good: (www.google.com), Bad: (http://search.delta-homes.com/web/?type=ds&ts=1431425993&z=c9b77f31b41b21b56042a66g3zcccgbz5oawbt2t2o&from=ient05120&uid=ST1000LM024XHN-M101MBB_S32XJ9DF802310&q={searchTerms}),Replaced,[d6179e94a2e9a98d692c0173a362817f]
    PUP.Optional.IStartSurf.ShrtCln, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Default_Page_URL, http://www.istartsurf.com/?type=hppp&ts=1431426071&from=xtab&uid=B7DCE3A627014f1989FFA9A854D71C39, Good: (www.google.com), Bad: (http://www.istartsurf.com/?type=hpp...id=B7DCE3A627014f1989FFA9A854D71C39),Replaced,[1ad32012acdf003600b1f5753acbc63a]
    PUP.Optional.Delta.ShrtCln, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Search Page, http://search.delta-homes.com/web/?type=ds&ts=1431425993&z=c9b77f31b41b21b56042a66g3zcccgbz5oawbt2t2o&from=ient05120&uid=ST1000LM024XHN-M101MBB_S32XJ9DF802310&q={searchTerms}, Good: (www.google.com), Bad: (http://search.delta-homes.com/web/?type=ds&ts=1431425993&z=c9b77f31b41b21b56042a66g3zcccgbz5oawbt2t2o&from=ient05120&uid=ST1000LM024XHN-M101MBB_S32XJ9DF802310&q={searchTerms}),Replaced,[7b7237fbb4d7f83ed8bd1e5618ede61a]
    PUP.Optional.IStartSurf.ShrtCln, HKU\S-1-5-21-1983062108-2153825218-3807267094-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Search Page, http://www.istartsurf.com/web/?type=dspp&ts=1431426071&from=xtab&uid=B7DCE3A627014f1989FFA9A854D71C39&q={searchTerms}, Good: (www.google.com), Bad: (http://www.istartsurf.com/web/?type=dspp&ts=1431426071&from=xtab&uid=B7DCE3A627014f1989FFA9A854D71C39&q={searchTerms}),Replaced,[1dd066cc2d5eeb4baf0088e2e61f05fb]

    Folders: 18
    PUP.Optional.MultiPlug, C:\ProgramData\ohnmpjpinljpemocbeagncnepiaigflg, Quarantined, [bd30949e4f3c8caaf0f97dfc32d2ca36],
    PUP.Optional.MultiPlug.Gen, C:\ProgramData\3700829711426164567, Quarantined, [16d7ec4687044aecc950225d30d4ce32],
    PUP.Optional.MultiPlug.Gen, C:\ProgramData\{998088f2-1cb3-982c-9980-088f21cb23c8}, Quarantined, [1ecff73ba5e668ce310e8bf85da7f30d],
    PUP.Optional.UpdateProc, C:\Users\Mael\AppData\Roaming\Binkiland\UpdateProc, Quarantined, [0be269c9e0ab60d63f719d27bf459b65],
    PUP.Optional.UpdateProc, C:\Users\Mael\AppData\Roaming\Binkiland, Quarantined, [0be269c9e0ab60d63f719d27bf459b65],
    PUP.Optional.OpenCandy, C:\Users\Mael\AppData\Roaming\OpenCandy, Quarantined, [539aae84711ac670c5f37e7e867cb848],
    PUP.Optional.OpenCandy, C:\Users\Mael\AppData\Roaming\OpenCandy\1F8B38EB63394872B1449BD230CD43A9, Quarantined, [539aae84711ac670c5f37e7e867cb848],
    PUP.Optional.Binkiland, C:\Users\Mael\AppData\Local\Binkiland, Quarantined, [836a8da55b30092d2c39a365ef146a96],
    PUP.Optional.Binkiland, C:\Users\Mael\AppData\Local\Binkiland\Application, Quarantined, [836a8da55b30092d2c39a365ef146a96],
    PUP.Optional.Binkiland, C:\Users\Mael\AppData\Local\Binkiland\Application\31.0.1650.23, Quarantined, [836a8da55b30092d2c39a365ef146a96],
    PUP.Optional.IEPluginServices, C:\ProgramData\IePluginServices, Quarantined, [5b9283af1675f244ffd4c852b84b758b],
    PUP.Optional.IEPluginServices, C:\ProgramData\IePluginServices\update, Quarantined, [5b9283af1675f244ffd4c852b84b758b],
    PUP.Optional.IHProtectUpDate, C:\ProgramData\IHProtectUpDate, Quarantined, [f3fa36fc6d1ef244a83556c4b74cb848],
    PUP.Optional.IHProtectUpDate, C:\ProgramData\IHProtectUpDate\update, Quarantined, [f3fa36fc6d1ef244a83556c4b74cb848],
    PUP.Optional.RedAdBlocker, C:\ProgramData\Red AdBlocker, Quarantined, [6d800032ed9eeb4b873cb27293700bf5],
    PUP.Optional.WinToFlashSuggestor, C:\Program Files\WinToFlash Suggestor, Quarantined, [28c5b47e7d0ef343d05e9f8fcc376a96],
    PUP.Optional.WPM, C:\ProgramData\WindowsMangerProtect, Quarantined, [3bb22c06dfaca98d3e3541ed3fc49868],
    PUP.Optional.WPM, C:\ProgramData\WindowsMangerProtect\update, Quarantined, [3bb22c06dfaca98d3e3541ed3fc49868],

    Files: 36
    PUP.Optional.RoundWorld, C:\Windows\System32\drivers\{c6cf689f-ec21-4add-accd-adc0bafcbba6}Gw.sys, Quarantined, [e8053200503b03339ffa208b8a7b7090],
    PUP.Optional.WinToFlashSuggestor, C:\Program Files\WinToFlash Suggestor\WinToFlashSuggestor.dll, Quarantined, [638ad65c5f2c0e285ecaba33f210ed13],
    PUP.Optional.MultiPlug.Uns, C:\ProgramData\Red AdBlocker\Red AdBlocker.exe, Quarantined, [04e965cd6e1dce68eadc60291be7a25e],
    PUP.Optional.CrossRider, C:\Users\Mael\AppData\Roaming\DZTDONR.exe, Quarantined, [d91452e0bbd06cca2ba6881f37ce6b95],
    PUP.Optional.CrossRider, C:\Users\Mael\AppData\Roaming\FFWOAU.exe, Quarantined, [9b52e151d6b53501dfe79710a36206fa],
    PUP.Optional.CrossRider, C:\Users\Mael\AppData\Roaming\MAGAJB.exe, Quarantined, [8766989a6b208bab14b25453d233ad53],
    PUP.Optional.CrossRider, C:\Users\Mael\AppData\Roaming\OGXWLGS.exe, Quarantined, [8e5fa88ac0cb082e7160f7b04bba6799],
    PUP.Optional.ThinkTanks, C:\Program Files\WinToFlash Suggestor\AddressBarInstance.dll, Quarantined, [a449ba78800b3df981474a6117eec43c],
    PUP.Optional.ThinkTanks, C:\Program Files\WinToFlash Suggestor\RestartIE.exe, Quarantined, [b8356fc39af122146f59a20940c57d83],
    PUP.Optional.ThinkTanks, C:\Program Files\WinToFlash Suggestor\SMBarBroker.exe, Quarantined, [ce1fd55daeddff37794fbcef0df8926e],
    PUP.Optional.ThinkTanks, C:\Program Files\WinToFlash Suggestor\SMBarBroker.exe.remove, Quarantined, [09e43cf6395239fd8048d3d8cc3939c7],
    PUP.Optional.WinToFlashSuggestor, C:\Program Files\WinToFlash Suggestor\Uninstall.exe, Quarantined, [7875b280e1aa6cca818411b04eb3916f],
    PUP.Optional.MyStartSearch.ShrtCln, C:\Program Files\Mozilla Firefox\browser\searchplugins\mystartsearch.xml, Quarantined, [d914e44e543768ced51189b201026e92],
    PUP.Optional.MultiPlug, C:\ProgramData\ohnmpjpinljpemocbeagncnepiaigflg\lsdb.js, Quarantined, [bd30949e4f3c8caaf0f97dfc32d2ca36],
    PUP.Optional.MultiPlug, C:\ProgramData\ohnmpjpinljpemocbeagncnepiaigflg\background.html, Quarantined, [bd30949e4f3c8caaf0f97dfc32d2ca36],
    PUP.Optional.MultiPlug, C:\ProgramData\ohnmpjpinljpemocbeagncnepiaigflg\content.js, Quarantined, [bd30949e4f3c8caaf0f97dfc32d2ca36],
    PUP.Optional.MultiPlug, C:\ProgramData\ohnmpjpinljpemocbeagncnepiaigflg\manifest.json, Quarantined, [bd30949e4f3c8caaf0f97dfc32d2ca36],
    PUP.Optional.MultiPlug.Gen, C:\ProgramData\3700829711426164567\616c85c8b2e84b98780442e49e2bf6a2.ini, Quarantined, [16d7ec4687044aecc950225d30d4ce32],
    PUP.Optional.MultiPlug.Gen, C:\ProgramData\3700829711426164567\6acffe5634508135780442e49e2bf6a2.ini, Quarantined, [16d7ec4687044aecc950225d30d4ce32],
    PUP.Optional.MultiPlug.Gen, C:\ProgramData\3700829711426164567\dd011c1ccd279821780442e49e2bf6a2.ini, Quarantined, [16d7ec4687044aecc950225d30d4ce32],
    PUP.Optional.MultiPlug.Gen, C:\ProgramData\3700829711426164567\e5b769613969f04a780442e49e2bf6a2.ini, Quarantined, [16d7ec4687044aecc950225d30d4ce32],
    PUP.Optional.MultiPlug.Gen, C:\ProgramData\{998088f2-1cb3-982c-9980-088f21cb23c8}\Download.dat, Quarantined, [1ecff73ba5e668ce310e8bf85da7f30d],
    PUP.Optional.MultiPlug.Gen, C:\ProgramData\{998088f2-1cb3-982c-9980-088f21cb23c8}\359efb5500d056c9, Quarantined, [1ecff73ba5e668ce310e8bf85da7f30d],
    PUP.Optional.MultiPlug.Gen, C:\ProgramData\{998088f2-1cb3-982c-9980-088f21cb23c8}\f8635d002704b11d, Quarantined, [1ecff73ba5e668ce310e8bf85da7f30d],
    PUP.Optional.Sanbreel, C:\Windows\System32\drivers\{88dab020-0802-4f33-9294-5fccbb774bac}Gw.sys, Quarantined, [a746de544447ed4983ebcbec6d97926e],
    PUP.Optional.UpdateProc, C:\Users\Mael\AppData\Roaming\Binkiland\UpdateProc\bkup.dat, Quarantined, [0be269c9e0ab60d63f719d27bf459b65],
    PUP.Optional.UpdateProc, C:\Users\Mael\AppData\Roaming\Binkiland\UpdateProc\config.dat, Quarantined, [0be269c9e0ab60d63f719d27bf459b65],
    PUP.Optional.UpdateProc, C:\Users\Mael\AppData\Roaming\Binkiland\UpdateProc\info.dat, Quarantined, [0be269c9e0ab60d63f719d27bf459b65],
    PUP.Optional.UpdateProc, C:\Users\Mael\AppData\Roaming\Binkiland\UpdateProc\STTL.DAT, Quarantined, [0be269c9e0ab60d63f719d27bf459b65],
    PUP.Optional.UpdateProc, C:\Users\Mael\AppData\Roaming\Binkiland\UpdateProc\TTL.DAT, Quarantined, [0be269c9e0ab60d63f719d27bf459b65],
    PUP.Optional.UpdateProc, C:\Users\Mael\AppData\Roaming\Binkiland\UpdateProc\UpdateTask.exe, Quarantined, [0be269c9e0ab60d63f719d27bf459b65],
    PUP.Optional.OpenCandy, C:\Users\Mael\AppData\Roaming\OpenCandy\1F8B38EB63394872B1449BD230CD43A9\Opera_NI_stable.exe, Quarantined, [539aae84711ac670c5f37e7e867cb848],
    PUP.Optional.IEPluginServices, C:\ProgramData\IePluginServices\update\conf, Quarantined, [5b9283af1675f244ffd4c852b84b758b],
    PUP.Optional.WinToFlashSuggestor, C:\Program Files\WinToFlash Suggestor\icon.png, Quarantined, [28c5b47e7d0ef343d05e9f8fcc376a96],
    PUP.Optional.WinToFlashSuggestor, C:\Program Files\WinToFlash Suggestor\WinToFlashSuggestor.crx, Quarantined, [28c5b47e7d0ef343d05e9f8fcc376a96],
    PUP.Optional.WPM, C:\ProgramData\WindowsMangerProtect\update\conf, Quarantined, [3bb22c06dfaca98d3e3541ed3fc49868],

    Physical Sectors: 0
    (No malicious items detected)


    (end)

    • And here's the log of adwCleaner (AdwCleaner[S1].txt):
    # AdwCleaner v5.014 - Logfile created 20/10/2015 at 23:57:31
    # Updated 18/10/2015 by Xplode
    # Database : 2015-10-18.5 [Local]
    # Operating system : Windows 7 Ultimate Service Pack 1 (x86)
    # Username : Mael - MAEL-PC
    # Running from : C:\Users\Mael\Downloads\Programs\adwcleaner_5.014.exe
    # Option : Cleaning
    # Support : http://toolslib.net/forum

    ***** [ Services ] *****

    [-] Service Deleted : PanService
    [-] Service Deleted : PCFasterSvc_{PCFaster_5.1.0.0}

    ***** [ Folders ] *****

    [-] Folder Deleted : C:\Program Files\globalUpdate
    [-] Folder Deleted : C:\Program Files\PANDORA.TV
    [-] Folder Deleted : C:\ProgramData\2e1efdd40000566b
    [-] Folder Deleted : C:\ProgramData\52031db100003f1d
    [-] Folder Deleted : C:\ProgramData\aa46887f000062d2
    [-] Folder Deleted : C:\ProgramData\{a1794b38-68f4-ef5e-a179-94b3868f2ce1}
    [-] Folder Deleted : C:\Users\Mael\AppData\Local\globalUpdate

    ***** [ Files ] *****

    [-] File Deleted : C:\Program Files\Mozilla Firefox\browser\searchplugins\yahoo.xml
    [-] File Deleted : C:\Users\Mael\AppData\Local\Google\Chrome\User Data\Default\local storage\hxxp_www.azlyrics.com_0.localstorage
    [-] File Deleted : C:\Users\Mael\AppData\Local\Google\Chrome\User Data\Default\local storage\hxxp_www.azlyrics.com_0.localstorage-journal
    [-] File Deleted : C:\Users\Mael\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_st.chatango.com_0.localstorage
    [-] File Deleted : C:\Users\Mael\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_st.chatango.com_0.localstorage-journal

    ***** [ DLLs ] *****


    ***** [ Shortcuts ] *****


    ***** [ Scheduled tasks ] *****


    ***** [ Registry ] *****

    [-] Key Deleted : HKLM\SOFTWARE\Classes\AppID\SMBarBroker.EXE
    [-] Key Deleted : HKLM\SOFTWARE\Classes\SMBarBroker.SMBarDealer
    [-] Key Deleted : HKLM\SOFTWARE\Classes\SMBarBroker.SMBarDealer.1
    [-] Key Deleted : HKLM\SOFTWARE\b2d23367-1522-36ad-75e4-fe11296571e9
    [-] Key Deleted : HKLM\SOFTWARE\Classes\AppID\{3A188115-B81B-48F2-A958-F974C8F3F309}
    [-] Key Deleted : HKLM\SOFTWARE\Classes\AppID\{C007DADD-132A-624C-088E-59EE6CF0711F}
    [-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}
    [-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{43769158-3B03-4932-8D8A-8F0F344BF024}
    [-] Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{EB559340-3A8F-4456-B24D-160098054EF0}
    [-] Key Deleted : HKU\.DEFAULT\Software\AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}
    [-] Key Deleted : HKCU\Software\APN PIP
    [-] Key Deleted : HKCU\Software\BI
    [-] Key Deleted : HKCU\Software\GlobalUpdate
    [-] Key Deleted : HKCU\Software\WEBAPP
    [-] Key Deleted : HKCU\Software\AppDataLow\{4A0F38A9-FE55-4B89-B73F-E60FDC0F72E9}
    [-] Key Deleted : HKCU\Software\AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}
    [-] Key Deleted : HKCU\Software\AppDataLow\Software\WinToFlash Suggestor
    [-] Key Deleted : HKLM\SOFTWARE\{3A7D3E19-1B79-4E4E-BD96-5467DA2C4EF0}
    [-] Key Deleted : HKLM\SOFTWARE\{4A0F38A9-FE55-4B89-B73F-E60FDC0F72E9}
    [-] Key Deleted : HKLM\SOFTWARE\GlobalUpdate
    [-] Key Deleted : HKLM\SOFTWARE\PIP
    [-] Key Deleted : HKLM\SOFTWARE\SupDp
    [-] Key Deleted : HKLM\SOFTWARE\{12A61307-94CD-4F8E-94BC-918E511FAA81}
    [-] Key Deleted : HKLM\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}
    [-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{AD11DADE-C597-45D9-D8C5-1D2EB0B89613}
    [!] Key Not Deleted : HKU\.DEFAULT\Software\AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}
    [!] Key Not Deleted : HKU\S-1-5-21-1983062108-2153825218-3807267094-1000\Software\AppDataLow\{4A0F38A9-FE55-4B89-B73F-E60FDC0F72E9}
    [!] Key Not Deleted : HKU\S-1-5-21-1983062108-2153825218-3807267094-1000\Software\AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}
    [!] Key Not Deleted : HKU\S-1-5-21-1983062108-2153825218-3807267094-1000\Software\AppDataLow\Software\WinToFlash Suggestor
    [!] Key Not Deleted : HKU\S-1-5-18\Software\AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}

    ***** [ Web browsers ] *****

    [-] [C:\Users\Mael\AppData\Local\Google\Chrome\User Data\Default\Web Data] [Search Provider] Deleted : photoscape.en.softonic.com
    [-] [C:\Users\Mael\AppData\Local\Google\Chrome\User Data\Default\Web Data] [Search Provider] Deleted : mystartsearch
    [-] [C:\Users\Mael\AppData\Local\Google\Chrome\User Data\Default\Web Data] [Search Provider] Deleted : jpg_to_icon_converter.en.softonic.com
    [-] [C:\Users\Mael\AppData\Local\Google\Chrome\User Data\Default\Web Data] [Search Provider] Deleted : websearch
    [-] [C:\Users\Mael\AppData\Local\Google\Chrome\User Data\Default\Web Data] [Search Provider] Deleted : keytweak.en.softonic.com
    [-] [C:\Users\Mael\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences] [Extension] Deleted : acaoakiamfeidcmgooclgeleejkbaecf
    [-] [C:\Users\Mael\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences] [Extension] Deleted : elggllhppljlljkgfeokjpehmdamkejk

    *************************

    :: Winsock settings cleared

    ########## EOF - C:\AdwCleaner\AdwCleaner[C1].txt - [4982 bytes] ##########

    • Last, content of JRT log:
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    Junkware Removal Tool (JRT) by Malwarebytes
    Version: 7.6.4 (09.28.2015:1)
    OS: Windows 7 Ultimate x86
    Ran by Mael on 21-Oct-15 at 0:03:05.66
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




    ~~~ Services

    Failed to delete: [Service] bprotectex
    Successfully deleted: [Service] bassvc [Reboot required]
    Successfully deleted: [Service] pcfapiutil [Reboot required]



    ~~~ Tasks



    ~~~ Registry Values



    ~~~ Registry Keys



    ~~~ Files

    Successfully deleted: [File] C:\Program Files\GUTC3CC.tmp
    Successfully deleted: [File] C:\Program Files\GUTCFDD.tmp
    Successfully deleted: [File] C:\Program Files\GUTE8AB.tmp
    Successfully deleted: [File] C:\Users\Mael\AppData\Roaming\appdataFr3.bin
    Successfully deleted: [File] C:\Users\Mael\Appdata\Local\google\chrome\user data\default\local storage\chrome-extension_klbibkeccnjlkjkiokjodocebajanakg_0.localstorage



    ~~~ Folders

    Failed to delete: [Folder] C:\Program Files\pc faster
    Successfully deleted: [Folder] C:\ProgramData\pc faster
    Successfully deleted: [Folder] C:\Users\Mael\AppData\Roaming\pc faster
    Successfully deleted: [Folder] C:\users\Public\Documents\pc faster



    ~~~ FireFox

    Successfully deleted: [Folder] C:\Users\Mael\AppData\Roaming\mozilla\firefox\profiles\hy8abqtf.default-1441901848138\extensions\staged



    ~~~ Chrome

    Successfully deleted: [Folder] C:\Users\Mael\Appdata\Local\Google\Chrome\User Data\Default\Extensions\klbibkeccnjlkjkiokjodocebajanakg

    [C:\Users\Mael\Appdata\Local\Google\Chrome\User Data\Default\Preferences] - default search provider reset

    [C:\Users\Mael\Appdata\Local\Google\Chrome\User Data\Default\Preferences] - Extensions Deleted:
    klbibkeccnjlkjkiokjodocebajanakg

    [C:\Users\Mael\Appdata\Local\Google\Chrome\User Data\Default\Secure Preferences] - default search provider reset

    [C:\Users\Mael\Appdata\Local\Google\Chrome\User Data\Default\Secure Preferences] - Extensions Deleted:
    [
    klbibkeccnjlkjkiokjodocebajanakg
    ]





    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    Scan was completed on 21-Oct-15 at 0:05:03.16
    End of JRT log
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     
  17. 2015/10/20
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Please download ComboFix from Here, Here or Here to your Desktop.

    **Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**
    • Never rename Combofix unless instructed.
    • Close any open browsers.
    • Very Important! Temporarily disable your anti-virus and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results ".
    • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
    • Close any open browsers.
    • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
    • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
    • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
      If the connection is not there use restore point you created prior to running Combofix.
    • Double click on combofix.exe & follow the prompts.

    • NOTE1. If Combofix asks you to install Recovery Console, please allow it.
      NOTE 2. If Combofix asks you to update the program, always do so.
    • When finished, it will produce a report for you.
    • Please post the "C:\ComboFix.txt"
    **Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall
    **Note 2 for AVG and CA Internet Security (Total Defense Internet Security) users: ComboFix will not run until AVG/CA Internet Security is uninstalled as a protective measure against the anti-virus. This is because AVG/CA Internet Security "falsely" detects ComboFix (or its embedded files) as a threat and may remove them resulting in the tool not working correctly which in turn can cause "unpredictable results ". Since AVG/CA Internet Security cannot be effectively disabled before running ComboFix, the author recommends you to uninstall AVG/CA Internet Security first.
    Use AppRemover to uninstall it: http://www.appremover.com/
    We can reinstall it when we're done with CF.
    **Note 3: If you receive an error Illegal operation attempted on a registery key that has been marked for deletion, restart computer to fix the issue.
    **Note 4: Some infections may take some significant time to be cured. As long as your computer clock is running Combofix is still working. Be patient.


    Make sure, you re-enable your security programs, when you're done with Combofix.

    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    NOTE.
    If, for some reason, Combofix refuses to run, try the following...

    Delete Combofix file, download fresh one, but rename combofix.exe to your_name.exe BEFORE saving it to your desktop.
    Do NOT run it yet.
    Download Rkill (courtesy of BleepingComputer.com) to your desktop.
    There are 2 different versions. If one of them won't run then download and try to run the other one.
    You only need to get one of these to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.

    rKill.exe: http://www.bleepingcomputer.com/download/rkill/dl/10/
    iExplore.exe (renamed rKill.exe): http://www.bleepingcomputer.com/download/rkill/dl/11/

    Restart computer in safe mode

    • Double-click on the Rkill desktop icon to run the tool.
    • If using Windows Vista, 7 or 8 right-click on it and choose Run As Administrator.
    • A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
    • If not, delete the file, then download and use the one provided in Link 2.
    • Do not reboot until instructed.
    • If the tool does not run from any of the links provided, please let me know.

    When the scan is done Notepad will open with rKill.txt log.
    NOTE. rKill.txt log will also be present on your desktop.

    Once you've gotten one of them to run, immediately run your_name.exe by double clicking on it.

    IF you had to run rKill post BOTH logs, rKill.txt and Combofix.txt.
     
  18. 2015/10/21
    maelkaka

    maelkaka Inactive Thread Starter

    Joined:
    2015/10/18
    Messages:
    15
    Likes Received:
    0
    I had run combofix, and there's no problem when I'm running it.
    Here's the content of report Combofix.txt:
    ComboFix 15-10-15.01 - Mael 22-Oct-15 2:05.1.8 - x86
    Microsoft Windows 7 Ultimate 6.1.7601.1.1252.1.1033.18.3211.1786 [GMT 7:00]
    Running from: c:\users\Mael\Downloads\Programs\ComboFix.exe
    AV: Microsoft Security Essentials *Disabled/Updated* {9765EA51-0D3C-7DFB-6091-10E4E1F341F6}
    SP: Microsoft Security Essentials *Disabled/Updated* {2C040BB5-2B06-7275-5A21-2B969A740B4B}
    SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    * Created a new restore point
    .
    .
    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    c:\users\Mael\AppData\Local\assembly\tmp
    c:\windows\msvcr71.dll
    .
    .
    ((((((((((((((((((((((((( Files Created from 2015-09-21 to 2015-10-21 )))))))))))))))))))))))))))))))
    .
    .
    2015-10-21 19:14 . 2015-10-21 19:14 -------- d-----w- c:\users\Default\AppData\Local\temp
    2015-10-21 18:19 . 2015-10-21 18:19 39168 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{57BED9B1-A018-4D3A-A8C2-EF00E18739E5}\MpKsl82dae5fa.sys
    2015-10-21 17:08 . 2015-10-21 17:37 -------- d-----w- c:\program files\Recuva
    2015-10-21 17:02 . 2015-10-21 17:02 -------- d-----w- c:\users\Mael\AppData\Roaming\PC Faster
    2015-10-21 16:32 . 2015-10-21 16:32 39168 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{57BED9B1-A018-4D3A-A8C2-EF00E18739E5}\MpKsl86499def.sys
    2015-10-21 04:01 . 2015-10-21 04:08 -------- d-----w- c:\users\Mael\AppData\Local\LINE
    2015-10-21 04:00 . 2015-10-21 04:00 -------- d-----w- c:\program files\LINE
    2015-10-21 03:54 . 2015-10-13 09:30 8985080 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{57BED9B1-A018-4D3A-A8C2-EF00E18739E5}\mpengine.dll
    2015-10-20 17:27 . 2015-10-20 17:27 -------- d-----w- c:\programdata\PC Faster
    2015-10-20 17:11 . 2015-08-31 23:05 8884144 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
    2015-10-20 16:53 . 2015-10-20 16:57 -------- d-----w- C:\AdwCleaner
    2015-10-20 16:29 . 2015-10-20 16:50 170200 ----a-w- c:\windows\system32\drivers\MBAMSwissArmy.sys
    2015-10-20 16:29 . 2015-10-20 16:29 -------- d-----w- c:\program files\Malwarebytes Anti-Malware
    2015-10-20 16:29 . 2015-10-20 16:29 -------- d-----w- c:\programdata\Malwarebytes
    2015-10-20 16:29 . 2015-10-05 02:50 51928 ----a-w- c:\windows\system32\drivers\mwac.sys
    2015-10-20 16:29 . 2015-10-05 02:50 94936 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys
    2015-10-20 16:29 . 2015-10-05 02:50 23256 ----a-w- c:\windows\system32\drivers\mbam.sys
    2015-10-20 16:16 . 2015-10-20 16:16 35064 ----a-w- c:\windows\system32\drivers\TrueSight.sys
    2015-10-20 16:16 . 2015-10-20 16:28 -------- d-----w- c:\programdata\RogueKiller
    2015-10-19 14:03 . 2015-10-19 18:14 -------- d-----w- C:\FRST
    2015-10-12 22:13 . 2015-10-12 22:13 -------- d-----w- c:\users\Mael\Tracing
    2015-10-12 22:10 . 2015-10-12 22:10 -------- d-----w- c:\users\Mael\AppData\Local\Skype
    2015-10-12 22:10 . 2015-10-12 22:30 -------- d-----w- c:\users\Mael\AppData\Roaming\Skype
    2015-10-12 22:10 . 2015-10-12 22:10 -------- d-----w- c:\program files\Common Files\Skype
    2015-10-12 22:10 . 2015-10-21 05:27 -------- d-----r- c:\program files\Skype
    2015-10-12 22:10 . 2015-10-12 22:10 -------- d-----w- c:\programdata\Skype
    2015-10-12 21:47 . 2015-10-12 21:47 -------- d-----w- C:\SwSetup
    2015-10-11 16:48 . 2015-10-11 16:48 -------- d-----w- c:\users\Mael\AppData\Local\NFS Underground 2
    2015-10-07 10:58 . 2014-11-03 20:32 616768 ----a-w- c:\windows\system32\nvStreaming.exe
    2015-10-07 10:57 . 2015-10-07 10:57 -------- d-----w- c:\windows\system32\NV
    2015-10-07 10:56 . 2015-10-07 10:56 -------- d-----w- C:\temp
    2015-10-05 03:56 . 2015-10-05 05:53 -------- d-----w- c:\program files\Sistem Paya Pinang
    .
    .
    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2015-10-09 19:54 . 2015-06-25 10:39 119296 ----a-w- c:\windows\system32\zlib.dll
    .
    .
    ------- Sigcheck -------
    Note: Unsigned files aren't necessarily malware.
    .
    [-] 2014-11-07 . 7BD7F45FF37FA0669CD32CA0EF46E22C . 811520 . . [6.1.7601.17514] . . c:\windows\System32\user32.dll
    [7] 2010-11-20 . F1DD3ACAEE5E6B4BBC69BC6DF75CEF66 . 811520 . . [6.1.7601.17514] . . c:\windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_cf3fd62ccb9e983d\user32.dll
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\1TortoiseNormal]
    @= "{C5994560-53D9-4125-87C9-F193FC689CB2} "
    [HKEY_CLASSES_ROOT\CLSID\{C5994560-53D9-4125-87C9-F193FC689CB2}]
    2011-06-13 03:20 64792 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\2TortoiseModified]
    @= "{C5994561-53D9-4125-87C9-F193FC689CB2} "
    [HKEY_CLASSES_ROOT\CLSID\{C5994561-53D9-4125-87C9-F193FC689CB2}]
    2011-06-13 03:20 64792 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\3TortoiseConflict]
    @= "{C5994562-53D9-4125-87C9-F193FC689CB2} "
    [HKEY_CLASSES_ROOT\CLSID\{C5994562-53D9-4125-87C9-F193FC689CB2}]
    2011-06-13 03:20 64792 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\4TortoiseLocked]
    @= "{C5994563-53D9-4125-87C9-F193FC689CB2} "
    [HKEY_CLASSES_ROOT\CLSID\{C5994563-53D9-4125-87C9-F193FC689CB2}]
    2011-06-13 03:20 64792 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\5TortoiseReadOnly]
    @= "{C5994564-53D9-4125-87C9-F193FC689CB2} "
    [HKEY_CLASSES_ROOT\CLSID\{C5994564-53D9-4125-87C9-F193FC689CB2}]
    2011-06-13 03:20 64792 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\6TortoiseDeleted]
    @= "{C5994565-53D9-4125-87C9-F193FC689CB2} "
    [HKEY_CLASSES_ROOT\CLSID\{C5994565-53D9-4125-87C9-F193FC689CB2}]
    2011-06-13 03:20 64792 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\7TortoiseAdded]
    @= "{C5994566-53D9-4125-87C9-F193FC689CB2} "
    [HKEY_CLASSES_ROOT\CLSID\{C5994566-53D9-4125-87C9-F193FC689CB2}]
    2011-06-13 03:20 64792 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\8TortoiseIgnored]
    @= "{C5994567-53D9-4125-87C9-F193FC689CB2} "
    [HKEY_CLASSES_ROOT\CLSID\{C5994567-53D9-4125-87C9-F193FC689CB2}]
    2011-06-13 03:20 64792 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\9TortoiseUnversioned]
    @= "{C5994568-53D9-4125-87C9-F193FC689CB2} "
    [HKEY_CLASSES_ROOT\CLSID\{C5994568-53D9-4125-87C9-F193FC689CB2}]
    2011-06-13 03:20 64792 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\IDM Shell Extension]
    @= "{CDC95B92-E27C-4745-A8C5-64A52A78855D} "
    [HKEY_CLASSES_ROOT\CLSID\{CDC95B92-E27C-4745-A8C5-64A52A78855D}]
    2011-03-02 15:23 68216 ----a-w- c:\program files\Internet Download Manager\IDMShellExt.dll
    .
    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "IDMan "= "c:\program files\Internet Download Manager\IDMan.exe" [2011-04-05 3278232]
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "MSC "= "c:\program files\Microsoft Security Client\msseces.exe" [2012-03-26 931200]
    "ATKOSD2 "= "c:\program files\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe" [2013-09-09 406328]
    "ATKMEDIA "= "c:\program files\ASUS\ATK Package\ATK Media\DMedia.exe" [2013-05-30 205624]
    "HControlUser "= "c:\program files\ASUS\ATK Package\ATK Hotkey\HControlUser.exe" [2009-06-19 105016]
    "IAStorIcon "= "c:\program files\Intel\Intel(R) Rapid Storage Technology\IAStorIconLaunch.exe" [2013-08-07 36352]
    "USB3MON "= "c:\program files\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe" [2014-02-21 292848]
    "NvBackend "= "c:\program files\NVIDIA Corporation\Update Core\NvBackend.exe" [2014-11-06 2464072]
    "ShadowPlay "= "c:\windows\system32\nvspcap.dll" [2014-11-06 2197680]
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
    "ConsentPromptBehaviorAdmin "= 5 (0x5)
    "ConsentPromptBehaviorUser "= 3 (0x3)
    "EnableUIADesktopToggle "= 0 (0x0)
    "DisableCAD "= 1 (0x1)
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
    "AppInit_DLLs "=c:\windows\System32\nvinit.dll c:\windows\System32\nvinit.dll c:\windows\System32\nvinit.dll
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
    @= "Service "
    .
    [HKLM\~\startupfolder\C:^Users^Mael^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Download.lnk]
    path=c:\users\Mael\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Download.lnk
    backup=c:\windows\pss\Download.lnk.Startup
    backupExtension=.Startup
    .
    [HKLM\~\startupfolder\C:^Users^Mael^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Windows7LoaderExtremeEdition_3.503.lnk]
    path=c:\users\Mael\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows7LoaderExtremeEdition_3.503.lnk
    backup=c:\windows\pss\Windows7LoaderExtremeEdition_3.503.lnk.Startup
    backupExtension=.Startup
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
    2015-07-07 13:12 998104 ----a-w- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeAAMUpdater-1.0]
    2012-04-03 23:09 446392 ------w- c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\updaterstartuputility.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeCS6ServiceManager]
    2012-03-09 09:26 1073312 ----a-w- c:\program files\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CanonQuickMenu]
    2013-05-02 12:17 1282120 ----a-w- c:\program files\Canon\Quick Menu\CNQMMAIN.EXE
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Connectify Dispatch]
    2013-11-05 20:07 1656608 ----a-w- c:\program files\Connectify\DispatchUI.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Connectify Hotspot]
    2013-12-27 10:33 3816960 ----a-w- c:\program files\Connectify\Connectify.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
    2014-03-04 09:19 3696912 ----a-w- c:\program files\DAEMON Tools Lite\DTLite.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
    2006-10-26 17:47 31016 ----a-w- c:\program files\Microsoft Office\Office12\GrooveMonitor.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Messenger (Yahoo!)]
    2012-05-24 21:25 6595928 ----a-w- c:\program files\Yahoo!\Messenger\YahooMessenger.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sony PC Companion]
    2015-04-10 07:29 455392 ----a-w- c:\program files\Sony\Sony PC Companion\PCCompanion.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SwitchBoard]
    2010-02-19 06:37 517096 ----a-w- c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UMonit]
    2013-09-13 09:27 81986 ----a-r- c:\windows\System32\UMonit.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\uTorrent]
    2015-05-13 13:41 1680464 ----a-w- c:\users\Mael\AppData\Roaming\uTorrent\uTorrent.exe
    .
    R2 MBAMService;MBAMService;c:\program files\Malwarebytes Anti-Malware\mbamservice.exe [2015-10-05 1135416]
    R2 MouseWithoutBordersSvc;Mouse without Borders Service;c:\program files\Microsoft Garage\Mouse without Borders\MouseWithoutBordersSvc.exe [2012-12-28 27872]
    R2 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [2015-07-09 327296]
    R3 AthBTPort;Qualcomm Atheros Virtual Bluetooth Class;c:\windows\system32\DRIVERS\btath_flt.sys [2014-01-01 80680]
    R3 BTATH_A2DP;Bluetooth A2DP Audio Driver;c:\windows\system32\drivers\btath_a2dp.sys [2014-01-01 295208]
    R3 btath_avdt;Qualcomm Atheros Bluetooth AVDT Service;c:\windows\system32\drivers\btath_avdt.sys [2014-01-01 102184]
    R3 BTATH_HCRP;Bluetooth HCRP Server driver;c:\windows\system32\DRIVERS\btath_hcrp.sys [2014-01-01 158688]
    R3 BTATH_LWFLT;Bluetooth LWFLT Device;c:\windows\system32\DRIVERS\btath_lwflt.sys [2014-01-01 66448]
    R3 BTATH_RCP;Bluetooth AVRCP Device;c:\windows\system32\DRIVERS\btath_rcp.sys [2014-01-01 120616]
    R3 BtFilter;BtFilter;c:\windows\system32\DRIVERS\btfilter.sys [2014-01-01 506664]
    R3 Connectify;Connectify;c:\program files\Connectify\ConnectifyService.exe [2013-11-05 487936]
    R3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudbus.sys [2012-09-20 83168]
    R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys [2010-11-20 62464]
    R3 ewusbnet;HUAWEI USB-NDIS miniport;c:\windows\system32\DRIVERS\ewusbnet.sys [2009-02-17 112128]
    R3 hwusbfake;Huawei DataCard USB Fake;c:\windows\system32\DRIVERS\ewusbfake.sys [2008-12-30 103040]
    R3 IntcDAud;Intel(R) Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys [2014-03-31 364504]
    R3 Intel(R) Capability Licensing Service TCP IP Interface;Intel(R) Capability Licensing Service TCP IP Interface;c:\program files\Intel\iCLS Client\SocketHeciServer.exe [2013-05-11 637912]
    R3 MBAMWebAccessControl;MBAMWebAccessControl;c:\windows\system32\drivers\mwac.sys [2015-10-05 51928]
    R3 mvusbews;USB EWS Device;c:\windows\system32\Drivers\mvusbews.sys [2012-09-26 17408]
    R3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\NisSrv.exe [2012-03-26 214952]
    R3 pwdrvio;pwdrvio;c:\windows\system32\pwdrvio.sys [2013-09-30 15688]
    R3 pwdspio;pwdspio;c:\windows\system32\pwdspio.sys [2013-09-30 10320]
    R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2010-11-20 15872]
    R3 ssudmdm;SAMSUNG Mobile USB Modem Drivers (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudmdm.sys [2012-09-20 181344]
    R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys [2010-11-20 77184]
    R3 terminpt;Microsoft Remote Desktop Input Driver;c:\windows\system32\drivers\terminpt.sys [2010-11-20 25600]
    R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224]
    R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2010-11-20 27264]
    R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys [2010-11-20 112640]
    R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys [x]
    R3 VSPerfDrv100;Performance Tools Driver 10.0;c:\program files\Microsoft Visual Studio 10.0\Team Tools\Performance Tools\VSPerfDrv100.sys [2009-12-08 48128]
    R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2014-11-07 1343400]
    R4 MSSQLServerADHelper100;SQL Active Directory Helper Service;c:\program files\Microsoft SQL Server\100\Shared\SQLADHLP.EXE [2010-04-03 44896]
    R4 RsFx0103;RsFx0103 Driver;c:\windows\system32\DRIVERS\RsFx0103.sys [2009-03-29 239336]
    R4 RsFx0150;RsFx0150 Driver;c:\windows\system32\DRIVERS\RsFx0150.sys [2010-04-03 240608]
    R4 Sony PC Companion;Sony PC Companion;c:\program files\Sony\Sony PC Companion\PCCService.exe [2013-02-04 155824]
    R4 SQLAgent$SQLEXPRESS;SQL Server Agent (SQLEXPRESS);c:\program files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE [2009-03-29 366936]
    R4 SwitchBoard;Adobe SwitchBoard;c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
    S0 Bhbase;Baidu Hook Base;c:\windows\System32\drivers\Bhbase.sys [2015-04-10 46440]
    S0 iaStorA;iaStorA;c:\windows\system32\DRIVERS\iaStorA.sys [2013-08-07 505192]
    S0 iaStorF;iaStorF;c:\windows\system32\DRIVERS\iaStorF.sys [2013-08-07 25448]
    S0 iusb3hcs;Intel(R) USB 3.0 Host Controller Switch Driver;c:\windows\system32\DRIVERS\iusb3hcs.sys [2014-02-21 16880]
    S0 nvpciflt;nvpciflt;c:\windows\system32\DRIVERS\nvpciflt.sys [2014-11-04 25800]
    S1 ATKWMIACPIIO;ATKWMIACPI Driver;c:\program files\ASUS\ATK Package\ATK WMIACPI\atkwmiacpi.sys [2013-07-02 17720]
    S1 BprotectEx;Baidu ProtectEx;c:\windows\System32\drivers\BprotectEx.sys [2015-04-10 113992]
    S1 cnnctfy3;Connectify LightWeight Filter;c:\windows\system32\DRIVERS\cnnctfy3.sys [2015-01-05 29672]
    S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [2015-05-28 243128]
    S1 MpKsl82dae5fa;MpKsl82dae5fa;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{57BED9B1-A018-4D3A-A8C2-EF00E18739E5}\MpKsl82dae5fa.sys [2015-10-21 39168]
    S1 MpKsl86499def;MpKsl86499def;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{57BED9B1-A018-4D3A-A8C2-EF00E18739E5}\MpKsl86499def.sys [2015-10-21 39168]
    S2 AtherosSvc;AtherosSvc;c:\program files\Bluetooth Suite\adminservice.exe [2014-01-01 275072]
    S2 c2cautoupdatesvc;Skype Click to Call Updater;c:\program files\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [2015-10-12 1433216]
    S2 c2cpnrsvc;Skype Click to Call PNR Service;c:\program files\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [2015-10-12 1773696]
    S2 GfExperienceService;NVIDIA GeForce Experience Service;c:\program files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [2014-11-06 915784]
    S2 HPSIService;HP SI Service;c:\windows\system32\HPSIsvc.exe [2012-09-27 100256]
    S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [2013-08-07 15720]
    S2 IDMWFP;IDMWFP;c:\windows\system32\DRIVERS\idmwfp.sys [2011-03-28 86792]
    S2 igfxCUIService1.0.0.0;Intel(R) HD Graphics Control Panel Service;c:\windows\system32\igfxCUIService.exe [2014-04-09 261616]
    S2 Intel(R) Capability Licensing Service Interface;Intel(R) Capability Licensing Service Interface;c:\program files\Intel\iCLS Client\HeciServer.exe [2013-05-11 586240]
    S2 IntelHaxm;Intel HAXM Service;c:\windows\system32\DRIVERS\IntelHaxm.sys [2015-01-30 78848]
    S2 jhi_service;Intel(R) Dynamic Application Loader Host Interface Service;c:\program files\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [2013-11-06 169432]
    S2 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [2012-03-20 74112]
    S2 NvNetworkService;NVIDIA Network Service;c:\program files\NVIDIA Corporation\NetService\NvNetworkService.exe [2014-11-06 1795912]
    S2 NvStreamSvc;NVIDIA Streamer Service;c:\program files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [2014-11-06 18182984]
    S2 PCFasterSvc_{PCFaster_5.1.0.0};Baidu PC Faster Service 5.1.0.0;c:\program files\PC Faster\5.1.0.0\PCFasterSvc.exe [2015-05-13 1714448]
    S2 plctrl;plctrl;c:\program files\ASUS\P4G\plctrl.sys [2014-01-03 14136]
    S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2014-11-03 411968]
    S2 ZAtheros Bt and Wlan Coex Agent;ZAtheros Bt and Wlan Coex Agent;c:\program files\Bluetooth Suite\Ath_CoexAgent.exe [2014-01-01 323584]
    S3 AiCharger;ASUS Charger Driver;c:\windows\system32\DRIVERS\AiCharger.sys [2013-04-17 14720]
    S3 ATP;ASUS Input Device;c:\windows\system32\DRIVERS\AsusTP.sys [2013-12-12 60104]
    S3 BTATH_BUS;Qualcomm Atheros Bluetooth Bus;c:\windows\system32\DRIVERS\btath_bus.sys [2014-01-01 27976]
    S3 iusb3hub;Intel(R) USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\iusb3hub.sys [2014-02-21 364528]
    S3 iusb3xhc;Intel(R) USB 3.0 eXtensible Host Controller Driver;c:\windows\system32\DRIVERS\iusb3xhc.sys [2014-02-21 800240]
    S3 L1C;NDIS Miniport Driver for Qualcomm Atheros AR81xx PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\L1C62x86.sys [2013-07-18 110280]
    S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2015-10-05 23256]
    S3 MEI;Intel(R) Management Engine Interface ;c:\windows\system32\DRIVERS\TeeDriver.sys [2013-11-06 85464]
    S3 NvStreamKms;NvStreamKms;c:\program files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [2014-11-06 18760]
    S3 nvvad_WaveExtensible;NVIDIA Virtual Audio Device (Wave Extensible) (WDM);c:\windows\system32\drivers\nvvad32v.sys [2014-10-03 33096]
    S3 PCFApiUtil;PCFApiUtil;c:\program files\PC Faster\5.1.0.0\PCFApiUtil.sys [2015-04-10 118152]
    .
    .
    --- Other Services/Drivers In Memory ---
    .
    *NewlyCreated* - MPKSL82DAE5FA
    *Deregistered* - msahci
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
    2015-07-14 18:51 991048 ----a-w- c:\program files\Google\Chrome\Application\43.0.2357.134\Installer\chrmstp.exe
    .
    Contents of the 'Scheduled Tasks' folder
    .
    2015-07-30 c:\windows\Tasks\Adobe Flash Player Updater.job
    - c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2015-02-04 19:00]
    .
    2014-11-28 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
    - c:\program files\Google\Update\GoogleUpdate.exe [2014-11-27 19:37]
    .
    2014-11-28 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
    - c:\program files\Google\Update\GoogleUpdate.exe [2014-11-27 19:37]
    .
    .
    ------- Supplementary Scan -------
    .
    mSearch Bar = hxxp://www.google.com
    IE: Download all links with IDM - c:\program files\Internet Download Manager\IEGetAll.htm
    IE: Download with IDM - c:\program files\Internet Download Manager\IEExt.htm
    TCP: DhcpNameServer = 192.168.43.1
    FF - ProfilePath - c:\users\Mael\AppData\Roaming\Mozilla\Firefox\Profiles\hy8abqtf.default-1441901848138\
    .
    - - - - ORPHANS REMOVED - - - -
    .
    Toolbar-Locked - (no file)
    MSConfigStartUp-Adobe Reader Speed Launcher - c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe
    MSConfigStartUp-SunJavaUpdateSched - c:\program files\Java\jre8\bin\jusched.exe
    AddRemove-4F6D5E84-5826-4394-9F40-3A9A19165651_is1 - c:\program files\PANDORA.TV\PanService\unins000.exe
    .
    .
    .
    --------------------- LOCKED REGISTRY KEYS ---------------------
    .
    [HKEY_USERS\S-1-5-21-1983062108-2153825218-3807267094-1000_Classes\CLSID\{4b8159ec-d516-46e1-af07-ef31e1e0e811}]
    @Denied: (Full) (Everyone)
    @Allowed: (Read) (RestrictedCode)
    "Model "=dword:00000045
    "Therad "=dword:0000001e
    "MData "=hex(0):73,d5,cf,b8,a4,07,89,80,31,e4,35,6b,2a,ca,fe,43,b6,1f,81,1f,5a,
    1b,4d,36,46,8f,3c,f2,5c,68,ee,21,46,8f,3c,f2,5c,68,ee,21,46,8f,3c,f2,5c,68,\
    .
    [HKEY_USERS\S-1-5-21-1983062108-2153825218-3807267094-1000_Classes\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}]
    @Denied: (Full) (Everyone)
    "scansk "=hex(0):e3,f2,bc,65,5f,5a,cc,2e,29,23,c6,c7,4a,09,30,68,44,6b,ef,b0,33,
    b1,22,7a,d5,9e,98,e3,e4,e7,f4,d4,c3,d1,3d,a1,73,f5,bd,ad,00,00,00,00,00,00,\
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
    @Denied: (A) (Users)
    @Denied: (A) (Everyone)
    @Allowed: (B 1 2 3 4 5) (S-1-5-20)
    "BlindDial "=dword:00000000
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
    @Denied: (A) (Users)
    @Denied: (A) (Everyone)
    @Allowed: (B 1 2 3 4 5) (S-1-5-20)
    "BlindDial "=dword:00000000
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
    @Denied: (A) (Users)
    @Denied: (A) (Everyone)
    @Allowed: (B 1 2 3 4 5) (S-1-5-20)
    "BlindDial "=dword:00000000
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
    @Denied: (A) (Users)
    @Denied: (A) (Everyone)
    @Allowed: (B 1 2 3 4 5) (S-1-5-20)
    "BlindDial "=dword:00000000
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]
    @Denied: (A) (Users)
    @Denied: (A) (Everyone)
    @Allowed: (B 1 2 3 4 5) (S-1-5-20)
    "BlindDial "=dword:00000000
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0005\AllUserSettings]
    @Denied: (A) (Users)
    @Denied: (A) (Everyone)
    @Allowed: (B 1 2 3 4 5) (S-1-5-20)
    "BlindDial "=dword:00000000
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0006\AllUserSettings]
    @Denied: (A) (Users)
    @Denied: (A) (Everyone)
    @Allowed: (B 1 2 3 4 5) (S-1-5-20)
    "BlindDial "=dword:00000000
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0007\AllUserSettings]
    @Denied: (A) (Users)
    @Denied: (A) (Everyone)
    @Allowed: (B 1 2 3 4 5) (S-1-5-20)
    "BlindDial "=dword:00000000
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0008\AllUserSettings]
    @Denied: (A) (Users)
    @Denied: (A) (Everyone)
    @Allowed: (B 1 2 3 4 5) (S-1-5-20)
    "BlindDial "=dword:00000000
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0009\AllUserSettings]
    @Denied: (A) (Users)
    @Denied: (A) (Everyone)
    @Allowed: (B 1 2 3 4 5) (S-1-5-20)
    "BlindDial "=dword:00000000
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
    @Denied: (Full) (Everyone)
    .
    Completion time: 2015-10-22 02:16:30
    ComboFix-quarantined-files.txt 2015-10-21 19:16
    .
    Pre-Run: 78,466,850,816 bytes free
    Post-Run: 78,358,466,560 bytes free
    .
    - - End Of File - - B757E5F01BF52ADB0FCEAB5C5A91AF8D
    A36C5E4F47E84449FF07ED3517B43A31
     
  19. 2015/10/21
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Re-run Farbar Recovery Scan Tool (FRST/FRST64) you ran at the very beginning of this topic.

    • Double-click to run it. When the tool opens click Yes to disclaimer.
    • Make sure you checkmark Addition.txt box.
    • Press Scan button.
    • Scan will create two logs, FRST.txt and Addition.txt in the same directory the tool is run. Please copy and paste them to your reply.
     
  20. 2015/10/22
    maelkaka

    maelkaka Inactive Thread Starter

    Joined:
    2015/10/18
    Messages:
    15
    Likes Received:
    0
    Here's content of FRST.txt :
    Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:21-10-2015 01
    Ran by Mael (administrator) on MAEL-PC (22-10-2015 18:06:59)
    Running from C:\Users\Mael\Downloads\Programs
    Loaded Profiles: Mael (Available Profiles: Mael)
    Platform: Microsoft Windows 7 Ultimate Service Pack 1 (X86) Language: English (United States)
    Internet Explorer Version 8 (Default browser: Chrome)
    Boot Mode: Normal
    Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

    ==================== Processes (Whitelisted) =================

    (If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

    (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
    (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
    (Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
    (Intel Corporation) C:\Windows\System32\igfxCUIService.exe
    (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
    (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
    (ASUSTek Computer Inc.) C:\Program Files\ASUS\ATK Package\ATK Hotkey\AsLdrSrv.exe
    (ASUSTek Computer Inc.) C:\Program Files\ASUS\ATK Package\ATK Hotkey\HControl.exe
    (Windows (R) Win 7 DDK provider) C:\Program Files\Bluetooth Suite\AdminService.exe
    (ASUS) C:\Program Files\ASUS\P4G\BatteryLife.exe
    (ASUSTek Computer Inc.) C:\Program Files\ASUS\USBChargerPlus\USBChargerPlus.exe
    (Microsoft Corporation) C:\Program Files\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe
    (Microsoft Corporation) C:\Program Files\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe
    (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe
    (HP) C:\Windows\System32\HPSIsvc.exe
    (AsusTek) C:\Program Files\ASUS\ASUS Smart Gesture\AsTPCenter\x86\AsusTPLoader.exe
    (ASUSTeK Computer Inc.) C:\Program Files\ASUS\ASUS Smart Gesture\QuickGesture\x86\QuickGesture.exe
    (Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
    (Microsoft Corporation) C:\Program Files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe
    (Microsoft Corporation) C:\Program Files\Microsoft SQL Server\MSSQL10_50.MSSQLSERVER\MSSQL\Binn\sqlservr.exe
    (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NetService\NvNetworkService.exe
    (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
    (Baidu, Inc.) C:\Program Files\PC Faster\5.1.0.0\PCFasterSvc.exe
    (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
    (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
    (Atheros) C:\Program Files\Bluetooth Suite\Ath_CoexAgent.exe
    (ASUS) C:\Program Files\ASUS\ATK Package\ATK Hotkey\ATKOSD.exe
    (ASUS) C:\Program Files\ASUS\ATK Package\ATK Hotkey\WDC.exe
    (Microsoft) C:\Program Files\Microsoft Garage\Mouse without Borders\MouseWithoutBorders.exe
    (Microsoft) C:\Program Files\Microsoft Garage\Mouse without Borders\MouseWithoutBorders.exe
    (ASUSTek Computer Inc.) C:\Program Files\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe
    (AsusTek) C:\Program Files\ASUS\ASUS Smart Gesture\AsTPCenter\x86\AsusTPCenter.exe
    (Microsoft Corporation) C:\Windows\System32\rundll32.exe
    (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
    (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Update Core\NvBackend.exe
    (Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
    (Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
    (ASUSTek Computer Inc.) C:\Program Files\ASUS\ATK Package\ATK Media\DMedia.exe
    (ASUS) C:\Program Files\ASUS\ATK Package\ATK Hotkey\HControlUser.exe
    (Intel Corporation) C:\Program Files\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
    (Intel Corporation) C:\Windows\System32\igfxEM.exe
    (Intel Corporation) C:\Windows\System32\igfxHK.exe
    (Intel Corporation) C:\Windows\System32\igfxTray.exe
    (AsusTek) C:\Program Files\ASUS\ASUS Smart Gesture\AsTPCenter\x86\AsusTPHelper.exe
    (Tonec Inc.) C:\Program Files\Internet Download Manager\IDMan.exe
    (Tonec Inc.) C:\Program Files\Internet Download Manager\IEMonitor.exe
    (http://tortoisesvn.net) C:\Program Files\TortoiseSVN\bin\TSVNCache.exe
    (Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
    (Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
    (Intel Corporation) C:\Program Files\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
    (Baidu, Inc.) C:\Program Files\PC Faster\5.1.0.0\PCFasterSvc.exe
    (Adobe Systems Incorporated) C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
    (Microsoft Corporation) C:\Program Files\Microsoft Security Client\MpCmdRun.exe
    () C:\Program Files\Microsoft Garage\Mouse without Borders\MouseWithoutBordersHelper.exe


    ==================== Registry (Whitelisted) ===========================

    (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

    HKLM\...\Run: [MSC] => C:\Program Files\Microsoft Security Client\msseces.exe [931200 2012-03-26] (Microsoft Corporation)
    HKLM\...\Run: [ATKOSD2] => C:\Program Files\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe [406328 2013-09-09] (ASUSTek Computer Inc.)
    HKLM\...\Run: [ATKMEDIA] => C:\Program Files\ASUS\ATK Package\ATK Media\DMedia.exe [205624 2013-05-30] (ASUSTek Computer Inc.)
    HKLM\...\Run: [HControlUser] => C:\Program Files\ASUS\ATK Package\ATK Hotkey\HControlUser.exe [105016 2009-06-19] (ASUS)
    HKLM\...\Run: [IAStorIcon] => C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [287592 2013-08-07] (Intel Corporation)
    HKLM\...\Run: [USB3MON] => C:\Program Files\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [292848 2014-02-21] (Intel Corporation)
    HKLM\...\Run: [NvBackend] => C:\Program Files\NVIDIA Corporation\Update Core\NvBackend.exe [2464072 2014-11-07] (NVIDIA Corporation)
    HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap.dll,ShadowPlayOnSystemStart
    HKU\S-1-5-21-1983062108-2153825218-3807267094-1000\...\Run: [IDMan] => C:\Program Files\Internet Download Manager\IDMan.exe [3278232 2011-04-06] (Tonec Inc.)
    HKU\S-1-5-21-1983062108-2153825218-3807267094-1000\...\Policies\Explorer: [NoLowDiskSpaceChecks] 1
    HKU\S-1-5-21-1983062108-2153825218-3807267094-1000\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\Windows\system32\ssText3d.scr [293888 2010-11-21] (Microsoft Corporation)
    AppInit_DLLs: c:\Windows\System32\nvinit.dll => c:\Windows\System32\nvinit.dll [156840 2014-11-04] (NVIDIA Corporation)
    AppInit_DLLs: c:\Windows\System32\nvinit.dll => c:\Windows\System32\nvinit.dll [156840 2014-11-04] (NVIDIA Corporation)
    AppInit_DLLs: C:\Windows\System32\nvinit.dll => C:\Windows\System32\nvinit.dll [156840 2014-11-04] (NVIDIA Corporation)
    AppInit_DLLs: ,C:\Windows\system32\nvinit.dll => C:\Windows\system32\nvinit.dll [156840 2014-11-04] (NVIDIA Corporation)
    ShellIconOverlayIdentifiers: [1TortoiseNormal] -> {C5994560-53D9-4125-87C9-F193FC689CB2} => C:\Program Files\Common Files\TortoiseOverlays\TortoiseOverlays.dll [2011-06-13] (http://tortoisesvn.net)
    ShellIconOverlayIdentifiers: [2TortoiseModified] -> {C5994561-53D9-4125-87C9-F193FC689CB2} => C:\Program Files\Common Files\TortoiseOverlays\TortoiseOverlays.dll [2011-06-13] (http://tortoisesvn.net)
    ShellIconOverlayIdentifiers: [3TortoiseConflict] -> {C5994562-53D9-4125-87C9-F193FC689CB2} => C:\Program Files\Common Files\TortoiseOverlays\TortoiseOverlays.dll [2011-06-13] (http://tortoisesvn.net)
    ShellIconOverlayIdentifiers: [4TortoiseLocked] -> {C5994563-53D9-4125-87C9-F193FC689CB2} => C:\Program Files\Common Files\TortoiseOverlays\TortoiseOverlays.dll [2011-06-13] (http://tortoisesvn.net)
    ShellIconOverlayIdentifiers: [5TortoiseReadOnly] -> {C5994564-53D9-4125-87C9-F193FC689CB2} => C:\Program Files\Common Files\TortoiseOverlays\TortoiseOverlays.dll [2011-06-13] (http://tortoisesvn.net)
    ShellIconOverlayIdentifiers: [6TortoiseDeleted] -> {C5994565-53D9-4125-87C9-F193FC689CB2} => C:\Program Files\Common Files\TortoiseOverlays\TortoiseOverlays.dll [2011-06-13] (http://tortoisesvn.net)
    ShellIconOverlayIdentifiers: [7TortoiseAdded] -> {C5994566-53D9-4125-87C9-F193FC689CB2} => C:\Program Files\Common Files\TortoiseOverlays\TortoiseOverlays.dll [2011-06-13] (http://tortoisesvn.net)
    ShellIconOverlayIdentifiers: [8TortoiseIgnored] -> {C5994567-53D9-4125-87C9-F193FC689CB2} => C:\Program Files\Common Files\TortoiseOverlays\TortoiseOverlays.dll [2011-06-13] (http://tortoisesvn.net)
    ShellIconOverlayIdentifiers: [9TortoiseUnversioned] -> {C5994568-53D9-4125-87C9-F193FC689CB2} => C:\Program Files\Common Files\TortoiseOverlays\TortoiseOverlays.dll [2011-06-13] (http://tortoisesvn.net)
    ShellIconOverlayIdentifiers: [IDM Shell Extension] -> {CDC95B92-E27C-4745-A8C5-64A52A78855D} => C:\Program Files\Internet Download Manager\IDMShellExt.dll [2011-03-02] (Tonec Inc.)
    CHR HKLM\SOFTWARE\Policies\Google: Restriction <======= ATTENTION

    ==================== Internet (Whitelisted) ====================

    (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

    Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
    Tcpip\..\Interfaces\{5BC4A03C-E9D1-417A-A2BE-3D6DD16CC458}: [DhcpNameServer] 192.168.42.129
    Tcpip\..\Interfaces\{5E6BDC7F-9309-4BBD-B04A-946AAE52DEA2}: [DhcpNameServer] 192.168.42.129
    Tcpip\..\Interfaces\{A171099E-21CD-4883-8DB5-8D0F5B02C645}: [DhcpNameServer] 192.168.1.1

    Internet Explorer:
    ==================
    HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
    HKU\S-1-5-21-1983062108-2153825218-3807267094-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
    HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkID=617911&ResetID=130869898351672382&GUID=56D6CF4B-B0CB-4544-A7C8-EFD2FA9DD254
    HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
    HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
    HKU\S-1-5-21-1983062108-2153825218-3807267094-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
    SearchScopes: HKLM -> DefaultScope value is missing
    SearchScopes: HKLM -> {0b4d26f6-61a8-4463-99dd-5f2fe0400fa6} URL =
    SearchScopes: HKU\S-1-5-21-1983062108-2153825218-3807267094-1000 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
    SearchScopes: HKU\S-1-5-21-1983062108-2153825218-3807267094-1000 -> {67C334C0-408D-4E6D-B5A7-0ADD6AFFA252} URL =
    BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre8\bin\ssv.dll [2014-11-09] (Oracle Corporation)
    BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2015-10-12] (Microsoft Corporation)
    BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre8\bin\jp2ssv.dll [2014-11-09] (Oracle Corporation)
    DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
    DPF: {CAFEEFAC-0018-0000-0011-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.8.0/jinstall-1_8_0_11-windows-i586.cab
    DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
    Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll [2006-10-27] (Microsoft Corporation)
    Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2015-10-12] (Microsoft Corporation)

    FireFox:
    ========
    FF ProfilePath: C:\Users\Mael\AppData\Roaming\Mozilla\Firefox\Profiles\hy8abqtf.default-1441901848138
    FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_18_0_0_209.dll [2015-07-15] ()
    FF Plugin: @Google.com/GoogleEarthPlugin -> C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll [2013-10-08] (Google)
    FF Plugin: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5 -> C:\Program Files\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2013-11-06] (Intel Corporation)
    FF Plugin: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2013-11-06] (Intel Corporation)
    FF Plugin: @java.com/DTPlugin,version=11.11.2 -> C:\Program Files\Java\jre8\bin\dtplugin\npDeployJava1.dll [2014-11-09] (Oracle Corporation)
    FF Plugin: @java.com/JavaPlugin,version=11.11.2 -> C:\Program Files\Java\jre8\bin\plugin2\npjp2.dll [2014-11-09] (Oracle Corporation)
    FF Plugin: @messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.6 -> C:\Program Files\Yahoo!\Shared\npYState.dll [2012-05-25] (Yahoo! Inc.)
    FF Plugin: @microsoft.com/GENUINE -> disabled [No File]
    FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)
    FF Plugin: @nvidia.com/3DVision -> C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dv.dll [2014-11-04] (NVIDIA Corporation)
    FF Plugin: @nvidia.com/3DVisionStreaming -> C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll [2014-11-04] (NVIDIA Corporation)
    FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.25.11\npGoogleUpdate3.dll [2014-11-28] (Google Inc.)
    FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.25.11\npGoogleUpdate3.dll [2014-11-28] (Google Inc.)
    FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2015-06-29] (Adobe Systems Inc.)
    FF Plugin HKU\S-1-5-21-1983062108-2153825218-3807267094-1000: SkypePlugin -> C:\Users\Mael\AppData\Local\SkypePlugin\7.7.0.219\npGatewayNpapi.dll [2015-09-23] (Skype Technologies S.A.)
    FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\NPOFF12.DLL [2006-10-26] (Microsoft Corporation)
    FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppdf32.dll [2015-06-29] (Adobe Systems Inc.)
    FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npwachk.dll [2011-03-23] (Nullsoft, Inc.)
    FF Extension: Skype Click to Call - C:\Program Files\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi [2015-10-08]
    FF HKU\S-1-5-21-1983062108-2153825218-3807267094-1000\...\Firefox\Extensions: [mozilla_cc@internetdownloadmanager.com] - C:\Users\Mael\AppData\Roaming\IDM\idmmzcc3
    FF Extension: IDM CC - C:\Users\Mael\AppData\Roaming\IDM\idmmzcc3 [2014-11-08] [not signed]
    FF HKU\S-1-5-21-1983062108-2153825218-3807267094-1000\...\SeaMonkey\Extensions: [mozilla_cc@internetdownloadmanager.com] - C:\Users\Mael\AppData\Roaming\IDM\idmmzcc3

    Chrome:
    =======
    CHR HomePage: Default -> hxxp://www.google.com/
    CHR StartupUrls: Default -> "hxxp://www.google.com/ "
    CHR DefaultSearchURL: Default -> hxxp://www.google.com/search?q={searchTerms}&ie=utf-8&oe=utf-8&aq=t
    CHR DefaultSearchKeyword: Default -> google.com_
    CHR DefaultSuggestURL: Default -> hxxp://suggestqueries.google.com/complete/search?q={searchTerms}
    CHR Plugin: (Shockwave Flash) - C:\Program Files\Google\Chrome\Application\43.0.2357.134\PepperFlash\pepflashplayer.dll ()
    CHR Plugin: (Native Client) - C:\Program Files\Google\Chrome\Application\43.0.2357.134\ppGoogleNaClPluginChrome.dll => No File
    CHR Plugin: (Chrome PDF Viewer) - C:\Program Files\Google\Chrome\Application\43.0.2357.134\pdf.dll => No File
    CHR Plugin: (Adobe Acrobat) - C:\Program Files\Adobe\Reader 11.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
    CHR Plugin: (2007 Microsoft Office system) - C:\Program Files\Mozilla Firefox\plugins\NPOFF12.DLL (Microsoft Corporation)
    CHR Plugin: (Winamp Application Detector) - C:\Program Files\Mozilla Firefox\plugins\npwachk.dll (Nullsoft, Inc.)
    CHR Plugin: (Google Earth Plugin) - C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
    CHR Plugin: (Google Update) - C:\Program Files\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
    CHR Plugin: (Intel® Identity Protection Technology) - C:\Program Files\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
    CHR Plugin: (Intel® Identity Protection Technology) - C:\Program Files\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
    CHR Plugin: (Java Deployment Toolkit 8.0.110.12) - C:\Program Files\Java\jre8\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
    CHR Plugin: (Java(TM) Platform SE 8 U11) - C:\Program Files\Java\jre8\bin\plugin2\npjp2.dll (Oracle Corporation)
    CHR Plugin: (Silverlight Plug-In) - C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
    CHR Plugin: (Shockwave Flash) - C:\Windows\system32\Macromed\Flash\NPSWF32_17_0_0_169.dll => No File
    CHR Profile: C:\Users\Mael\AppData\Local\Google\Chrome\User Data\Default
    CHR Extension: (Skype Calling) - C:\Users\Mael\AppData\Local\Google\Chrome\User Data\Default\Extensions\blakpkgjpemejpbmfiglncklihnhjkij [2015-10-13]
    CHR Extension: (YouTube) - C:\Users\Mael\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-09-25]
    CHR Extension: (Google Search) - C:\Users\Mael\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-05-16]
    CHR Extension: (Tampermonkey) - C:\Users\Mael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dhdgffkkebhmkfjojejmpbldmpobfkfo [2015-10-20]
    CHR Extension: (The Great Suspender) - C:\Users\Mael\AppData\Local\Google\Chrome\User Data\Default\Extensions\klbibkeccnjlkjkiokjodocebajanakg [2015-10-21]
    CHR Extension: (Chrome Hotword Shared Module) - C:\Users\Mael\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-07-15]
    CHR Extension: (Skype Click to Call) - C:\Users\Mael\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl [2015-10-14]
    CHR Extension: (SaveFrom.net helper) - C:\Users\Mael\AppData\Local\Google\Chrome\User Data\Default\Extensions\mdpljndcmbeikfnlflcggaipgnhiedbl [2015-10-20] [UpdateUrl: hxxp://sf-addon.com/helper/chrome/updates-3.xml] <==== ATTENTION
    CHR Extension: (Chrome Web Store Payments) - C:\Users\Mael\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-07-25]
    CHR Extension: (Gmail) - C:\Users\Mael\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-05-16]
    CHR HKLM\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files\Skype\Toolbars\ChromeExtension\skype_chrome_extension.crx [2015-10-12]
    CHR HKLM\...\Chrome\Extension: [mdpljndcmbeikfnlflcggaipgnhiedbl] - hxxp://sf-addon.com/helper/chrome/updates-3.xml
    CHR HKU\S-1-5-21-1983062108-2153825218-3807267094-1000\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [dhdgffkkebhmkfjojejmpbldmpobfkfo] - hxxp://clients2.google.com/service/update2/crx

    Opera:
    =======
    OPR Extension: (SaveFrom.net helper) - C:\Users\Mael\AppData\Roaming\Opera Software\Opera Stable\Extensions\mdpljndcmbeikfnlflcggaipgnhiedbl [2015-05-16]
    OPR Extension: (SaveFrom.net helper) - C:\Users\Mael\AppData\Roaming\Opera Software\Opera Stable\Extensions\npdpplbicnmpoigidfdjadamgfkilaak [2015-10-20]

    ==================== Services (Whitelisted) ========================

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

    R2 ASLDRService; C:\Program Files\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe [111416 2013-09-09] (ASUSTek Computer Inc.)
    R2 AtherosSvc; C:\Program Files\Bluetooth Suite\adminservice.exe [275072 2014-01-02] (Windows (R) Win 7 DDK provider) [File not signed]
    S3 ATKGFNEXSrv; C:\Program Files\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe [96896 2011-11-21] (ASUS)
    S4 Bonjour Service; C:\Program Files\Xamarin\Bonjour\mDNSResponder.exe [384512 2015-05-20] (Apple Inc.) [File not signed]
    R2 c2cautoupdatesvc; C:\Program Files\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1433216 2015-10-12] (Microsoft Corporation)
    R2 c2cpnrsvc; C:\Program Files\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1773696 2015-10-12] (Microsoft Corporation)
    S3 Connectify; C:\Program Files\Connectify\ConnectifyService.exe [487936 2013-11-06] (Connectify) [File not signed]
    S3 cphs; C:\Windows\system32\IntelCpHeciSvc.exe [279024 2014-04-09] (Intel Corporation)
    R2 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [915784 2014-11-07] (NVIDIA Corporation)
    R2 igfxCUIService1.0.0.0; C:\Windows\system32\igfxCUIService.exe [261616 2014-04-09] (Intel Corporation)
    S3 IJPLMSVC; C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE [140936 2013-05-14] ()
    R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [586240 2013-05-11] (Intel(R) Corporation) [File not signed]
    S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [637912 2013-05-11] (Intel(R) Corporation)
    R2 jhi_service; C:\Program Files\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2013-11-06] (Intel Corporation)
    S2 MBAMService; C:\Program Files\Malwarebytes Anti-Malware\mbamservice.exe [1135416 2015-10-05] (Malwarebytes)
    S2 MouseWithoutBordersSvc; C:\Program Files\Microsoft Garage\Mouse without Borders\MouseWithoutBordersSvc.exe [27872 2012-12-28] (Microsoft)
    R2 MsMpSvc; C:\Program Files\Microsoft Security Client\MsMpEng.exe [11552 2012-03-26] (Microsoft Corporation)
    R2 MSSQLSERVER; C:\Program Files\Microsoft SQL Server\MSSQL10_50.MSSQLSERVER\MSSQL\Binn\sqlservr.exe [42884448 2010-04-04] (Microsoft Corporation)
    S3 NisSrv; C:\Program Files\Microsoft Security Client\NisSrv.exe [214952 2012-03-26] (Microsoft Corporation)
    R2 NvNetworkService; C:\Program Files\NVIDIA Corporation\NetService\NvNetworkService.exe [1795912 2014-11-07] (NVIDIA Corporation)
    R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [18182984 2014-11-07] (NVIDIA Corporation)
    R2 PCFasterSvc_{PCFaster_5.1.0.0}; C:\Program Files\PC Faster\5.1.0.0\PCFasterSvc.exe [1714448 2015-05-13] (Baidu, Inc.) [File not signed]
    S4 PinnacleUpdateSvc; C:\Program Files\PowerUp Software\Pinnacle Game Profiler\pinnacle_updater.exe [438272 2014-01-12] (PowerUp Software, LLC) [File not signed]
    S4 Sony PC Companion; C:\Program Files\Sony\Sony PC Companion\PCCService.exe [155824 2013-02-04] (Avanquest Software)
    S4 SQLSERVERAGENT; C:\Program Files\Microsoft SQL Server\MSSQL10_50.MSSQLSERVER\MSSQL\Binn\SQLAGENT.EXE [367456 2010-04-04] (Microsoft Corporation)
    S4 SwitchBoard; C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated) [File not signed]
    S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [680960 2009-07-14] (Microsoft Corporation)
    R2 ZAtheros Bt and Wlan Coex Agent; C:\Program Files\Bluetooth Suite\Ath_CoexAgent.exe [323584 2014-01-02] (Atheros) [File not signed]
    U0 msahci; system32\drivers\msahci.sys [X]

    ===================== Drivers (Whitelisted) ==========================

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

    R3 AiCharger; C:\Windows\System32\DRIVERS\AiCharger.sys [14720 2013-04-17] (ASUSTek Computer Inc.)
    R2 ASMMAP; C:\Program Files\ASUS\ATK Package\ATKGFNEX\ASMMAP.sys [13880 2009-07-02] (ASUS)
    S3 AthBTPort; C:\Windows\System32\DRIVERS\btath_flt.sys [80680 2014-01-02] (Qualcomm Atheros)
    R3 athr; C:\Windows\System32\DRIVERS\athr.sys [3244544 2013-12-23] (Qualcomm Atheros Communications, Inc.)
    R1 ATKWMIACPIIO; C:\Program Files\ASUS\ATK Package\ATK WMIACPI\atkwmiacpi.sys [17720 2013-07-02] (ASUSTek Computer Inc.)
    R3 ATP; C:\Windows\System32\DRIVERS\AsusTP.sys [60104 2013-12-12] (ASUS Corporation)
    R0 Bhbase; C:\Windows\System32\drivers\Bhbase.sys [46440 2015-04-11] (Baidu, Inc.)
    R1 BprotectEx; C:\Windows\System32\drivers\BprotectEx.sys [113992 2015-04-11] (Baidu, Inc.)
    S3 BTATH_A2DP; C:\Windows\System32\drivers\btath_a2dp.sys [295208 2014-01-02] (Qualcomm Atheros)
    S3 btath_avdt; C:\Windows\System32\drivers\btath_avdt.sys [102184 2014-01-02] (Qualcomm Atheros)
    R3 BTATH_BUS; C:\Windows\System32\DRIVERS\btath_bus.sys [27976 2014-01-02] (Qualcomm Atheros)
    S3 BTATH_HCRP; C:\Windows\System32\DRIVERS\btath_hcrp.sys [158688 2014-01-02] (Qualcomm Atheros)
    S3 BTATH_LWFLT; C:\Windows\System32\DRIVERS\btath_lwflt.sys [66448 2014-01-02] (Qualcomm Atheros)
    S3 BTATH_RCP; C:\Windows\System32\DRIVERS\btath_rcp.sys [120616 2014-01-02] (Qualcomm Atheros)
    S3 BtFilter; C:\Windows\System32\DRIVERS\btfilter.sys [506664 2014-01-02] (Qualcomm Atheros)
    R1 cnnctfy3; C:\Windows\System32\DRIVERS\cnnctfy3.sys [29672 2015-01-05] (Connectify)
    R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [243128 2015-05-28] (Disc Soft Ltd)
    S3 hwusbfake; C:\Windows\System32\DRIVERS\ewusbfake.sys [103040 2008-12-30] (Huawei Technologies Co., Ltd.)
    R0 iaStorA; C:\Windows\System32\DRIVERS\iaStorA.sys [505192 2013-08-07] (Intel Corporation)
    R0 iaStorF; C:\Windows\System32\DRIVERS\iaStorF.sys [25448 2013-08-07] (Intel Corporation)
    R2 IntelHaxm; C:\Windows\System32\DRIVERS\IntelHaxm.sys [78848 2015-01-30] (Intel Corporation)
    R0 iusb3hcs; C:\Windows\System32\DRIVERS\iusb3hcs.sys [16880 2014-02-21] (Intel Corporation)
    R3 iusb3hub; C:\Windows\System32\DRIVERS\iusb3hub.sys [364528 2014-02-21] (Intel Corporation)
    R3 iusb3xhc; C:\Windows\System32\DRIVERS\iusb3xhc.sys [800240 2014-02-21] (Intel Corporation)
    R3 L1C; C:\Windows\System32\DRIVERS\L1C62x86.sys [110280 2013-07-18] (Qualcomm Atheros Co., Ltd.)
    R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [23256 2015-10-05] (Malwarebytes)
    S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [51928 2015-10-05] (Malwarebytes Corporation)
    R3 MEI; C:\Windows\System32\DRIVERS\TeeDriver.sys [85464 2013-11-06] (Intel Corporation)
    R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [171064 2012-03-20] (Microsoft Corporation)
    R1 MpKsl5b977236; C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{83B08FE4-5107-4F4B-B588-CB6E321CF6AD}\MpKsl5b977236.sys [39168 2015-10-22] (Microsoft Corporation)
    R0 nvpciflt; C:\Windows\System32\DRIVERS\nvpciflt.sys [25800 2014-11-04] (NVIDIA Corporation)
    R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [18760 2014-11-07] (NVIDIA Corporation)
    R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad32v.sys [33096 2014-10-04] (NVIDIA Corporation)
    R3 PCFApiUtil; C:\Program Files\PC Faster\5.1.0.0\PCFApiUtil.sys [118152 2015-04-11] (Baidu, Inc.)
    R2 plctrl; C:\Program Files\ASUS\P4G\plctrl.sys [14136 2014-01-03] (Windows (R) Win 7 DDK provider)
    S3 pwdrvio; C:\Windows\system32\pwdrvio.sys [15688 2013-09-30] ()
    S3 pwdspio; C:\Windows\system32\pwdspio.sys [10320 2013-09-30] ()
    S4 RsFx0150; C:\Windows\System32\DRIVERS\RsFx0150.sys [240608 2010-04-03] (Microsoft Corporation)
    S3 VSPerfDrv100; C:\Program Files\Microsoft Visual Studio 10.0\Team Tools\Performance Tools\VSPerfDrv100.sys [48128 2009-12-08] (Microsoft Corporation) [File not signed]
    S3 catchme; \??\C:\Users\Mael\AppData\Local\Temp\catchme.sys [X]
    S3 VGPU; System32\drivers\rdvgkmd.sys [X]

    ==================== NetSvcs (Whitelisted) ===================

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


    ==================== One Month Created files and folders ========

    (If an entry is included in the fixlist, the file/folder will be moved.)

    2015-10-22 02:03 - 2011-06-26 13:45 - 00256000 _____ C:\Windows\PEV.exe
    2015-10-22 02:03 - 2010-11-08 00:20 - 00208896 _____ C:\Windows\MBR.exe
    2015-10-22 02:03 - 2009-04-20 11:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
    2015-10-22 02:03 - 2000-08-31 07:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
    2015-10-22 02:03 - 2000-08-31 07:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
    2015-10-22 02:03 - 2000-08-31 07:00 - 00098816 _____ C:\Windows\sed.exe
    2015-10-22 02:03 - 2000-08-31 07:00 - 00080412 _____ C:\Windows\grep.exe
    2015-10-22 02:03 - 2000-08-31 07:00 - 00068096 _____ C:\Windows\zip.exe
    2015-10-22 02:02 - 2015-10-22 02:16 - 00000000 ____D C:\Qoobox
    2015-10-22 02:02 - 2015-10-22 02:15 - 00000000 ____D C:\Windows\erdnt
    2015-10-22 00:08 - 2015-10-22 00:37 - 00000000 ____D C:\Program Files\Recuva
    2015-10-22 00:08 - 2015-10-22 00:08 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Recuva
    2015-10-22 00:02 - 2015-10-22 00:02 - 00000000 ____D C:\Users\Mael\AppData\Roaming\PC Faster
    2015-10-21 16:51 - 2015-10-22 00:54 - 00000000 ____D C:\Users\Mael\Documents\Migrasi Data 2
    2015-10-21 12:24 - 2015-10-21 12:24 - 00000440 __RSH C:\Users\Mael\ntuser.pol
    2015-10-21 11:01 - 2015-10-21 11:24 - 00000921 _____ C:\ProgramData\Microsoft\Windows\Start Menu\LINE.lnk
    2015-10-21 11:01 - 2015-10-21 11:24 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LINE
    2015-10-21 11:01 - 2015-10-21 11:08 - 00000000 ____D C:\Users\Mael\AppData\Local\LINE
    2015-10-21 11:01 - 2015-10-21 11:01 - 00000915 _____ C:\Users\Public\Desktop\LINE.lnk
    2015-10-21 11:00 - 2015-10-21 11:00 - 00000000 ____D C:\Program Files\LINE
    2015-10-21 00:27 - 2015-10-21 00:27 - 00000000 ____D C:\ProgramData\PC Faster
    2015-10-21 00:04 - 2015-10-21 00:04 - 00000000 ____D C:\Users\Public\Documents\PC Faster
    2015-10-20 23:53 - 2015-10-20 23:57 - 00000000 ____D C:\AdwCleaner
    2015-10-20 23:47 - 2015-10-22 02:44 - 00014848 _____ C:\Windows\PFRO.log
    2015-10-20 23:29 - 2015-10-20 23:50 - 00170200 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
    2015-10-20 23:29 - 2015-10-20 23:29 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
    2015-10-20 23:29 - 2015-10-20 23:29 - 00000000 ____D C:\ProgramData\Malwarebytes
    2015-10-20 23:29 - 2015-10-20 23:29 - 00000000 ____D C:\Program Files\Malwarebytes Anti-Malware
    2015-10-20 23:29 - 2015-10-05 09:50 - 00094936 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbamchameleon.sys
    2015-10-20 23:29 - 2015-10-05 09:50 - 00051928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
    2015-10-20 23:29 - 2015-10-05 09:50 - 00023256 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbam.sys
    2015-10-20 23:27 - 2015-10-22 02:18 - 00000000 ____D C:\Users\Mael\Documents\Scan
    2015-10-20 23:16 - 2015-10-20 23:28 - 00000000 ____D C:\ProgramData\RogueKiller
    2015-10-20 23:16 - 2015-10-20 23:16 - 00035064 _____ C:\Windows\system32\Drivers\TrueSight.sys
    2015-10-20 23:13 - 2015-10-20 23:13 - 00000000 ____D C:\Users\Mael\Documents\WinBBS
    2015-10-20 12:36 - 2015-10-20 12:37 - 00000228 _____ C:\Users\Mael\Documents\payapinang2.txt
    2015-10-20 01:14 - 2015-10-20 01:14 - 00000000 ____D C:\Windows\system32\config\HiveBackup
    2015-10-19 21:03 - 2015-10-22 18:07 - 00000000 ____D C:\FRST
    2015-10-19 16:56 - 2015-10-19 16:56 - 00028672 _____ C:\BCD_Backup
    2015-10-19 16:56 - 2015-10-19 16:56 - 00025600 ___SH C:\BCD_Backup.LOG
    2015-10-13 05:13 - 2015-10-13 05:13 - 00000000 ____D C:\Users\Mael\Tracing
    2015-10-13 05:10 - 2015-10-21 12:27 - 00000000 ___RD C:\Program Files\Skype
    2015-10-13 05:10 - 2015-10-13 05:30 - 00000000 ____D C:\Users\Mael\AppData\Roaming\Skype
    2015-10-13 05:10 - 2015-10-13 05:10 - 00000000 ____D C:\Users\Mael\AppData\Local\Skype
    2015-10-13 05:10 - 2015-10-13 05:10 - 00000000 ____D C:\ProgramData\Skype
    2015-10-13 05:10 - 2015-10-13 05:10 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
    2015-10-13 05:10 - 2015-10-13 05:10 - 00000000 ____D C:\Program Files\Common Files\Skype
    2015-10-13 05:06 - 2015-10-13 05:06 - 12623872 _____ C:\Users\Mael\Downloads\SkypeWebPlugin.msi
    2015-10-13 05:06 - 2015-10-13 05:06 - 00000000 ____D C:\Users\Mael\AppData\Local\SkypePlugin
    2015-10-13 03:27 - 2015-10-13 03:27 - 00011344 _____ C:\Users\Mael\Documents\teredo.reg
    2015-10-11 23:48 - 2015-10-11 23:48 - 00000000 ____D C:\Users\Mael\AppData\Local\NFS Underground 2
    2015-10-07 17:58 - 2014-11-04 03:32 - 00616768 _____ (NVIDIA Corporation) C:\Windows\system32\nvStreaming.exe
    2015-10-07 17:57 - 2015-10-07 17:57 - 00000000 ____D C:\Windows\system32\NV
    2015-10-07 17:56 - 2015-10-07 17:56 - 00000000 ____D C:\temp
    2015-10-05 12:54 - 2015-10-05 15:45 - 00000700 _____ C:\Users\Mael\Documents\payapinang.txt
    2015-10-05 10:56 - 2015-10-05 12:53 - 00000000 ____D C:\Program Files\Sistem Paya Pinang
    2015-10-02 16:05 - 2015-10-02 16:05 - 00038615 _____ C:\Users\Mael\Downloads\ToolTipTest.rar
    2015-10-01 16:26 - 2015-10-01 16:27 - 00059602 _____ C:\Users\Mael\Documents\properti_rumah.sql
    2015-10-01 02:08 - 2015-10-01 02:08 - 00040535 _____ C:\Windows\system32\energy-report.html

    ==================== One Month Modified files and folders ========

    (If an entry is included in the fixlist, the file/folder will be moved.)

    2015-10-22 18:07 - 2014-11-08 03:58 - 01177891 _____ C:\Windows\WindowsUpdate.log
    2015-10-22 17:19 - 2009-07-14 11:34 - 00020832 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
    2015-10-22 17:19 - 2009-07-14 11:34 - 00020832 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
    2015-10-22 17:10 - 2015-02-07 17:38 - 00001998 ____H C:\Users\Mael\Documents\Default.rdp
    2015-10-22 16:38 - 2009-07-14 11:52 - 00000000 ____D C:\Windows\system32\FxsTmp
    2015-10-22 16:28 - 2015-03-05 17:17 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Baidu PC Faster
    2015-10-22 16:25 - 2014-11-09 02:53 - 00000000 ____D C:\Users\Mael\AppData\Local\Eclipse
    2015-10-22 16:23 - 2010-11-21 04:01 - 00970638 _____ C:\Windows\system32\PerfStringBackup.INI
    2015-10-22 16:18 - 2015-07-30 12:43 - 00029289 _____ C:\Windows\setupact.log
    2015-10-22 16:18 - 2014-11-10 14:00 - 00000000 ____D C:\ProgramData\NVIDIA
    2015-10-22 16:18 - 2009-07-14 11:53 - 00000006 ____H C:\Windows\Tasks\SA.DAT
    2015-10-22 16:16 - 2014-11-08 04:26 - 00000000 ____D C:\Users\Mael\AppData\Roaming\DMCache
    2015-10-22 15:54 - 2014-12-12 03:12 - 00000000 ____D C:\Users\Mael\AppData\Local\CrashDumps
    2015-10-22 03:16 - 2014-11-08 04:26 - 00000000 ____D C:\Users\Mael\Downloads\Video
    2015-10-22 02:16 - 2009-07-14 09:37 - 00000000 __RHD C:\Users\Default
    2015-10-22 02:16 - 2009-07-14 09:37 - 00000000 ___RD C:\Users\Public
    2015-10-22 02:14 - 2009-07-14 09:04 - 00000215 _____ C:\Windows\system.ini
    2015-10-21 12:24 - 2014-11-08 03:59 - 00000000 ____D C:\Users\Mael
    2015-10-21 12:24 - 2009-07-14 09:37 - 00000000 ___HD C:\Windows\system32\GroupPolicy
    2015-10-21 10:41 - 2014-11-09 02:58 - 00000000 ____D C:\Users\Mael\Documents\Visual Studio 2010
    2015-10-21 10:39 - 2014-11-09 04:00 - 00000000 ____D C:\Users\Mael\AppData\Local\TSVNCache
    2015-10-20 23:47 - 2009-07-14 11:52 - 00000000 ____D C:\Windows\twain_32
    2015-10-20 23:46 - 2015-06-04 18:39 - 00000921 _____ C:\Users\Mael\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\NSIS.lnk
    2015-10-20 23:46 - 2015-05-27 18:39 - 00000993 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinSCP.lnk
    2015-10-20 23:46 - 2015-05-26 15:10 - 00002975 _____ C:\Users\Mael\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Xamarin Studio.lnk
    2015-10-20 23:46 - 2015-05-19 18:35 - 00002539 _____ C:\Users\Public\Desktop\Mouse without Borders.lnk
    2015-10-20 23:46 - 2015-05-16 17:28 - 00001075 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Opera.lnk
    2015-10-20 23:46 - 2015-01-15 02:01 - 00001159 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Photoshop CS6.lnk
    2015-10-20 23:46 - 2015-01-15 02:01 - 00001121 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Bridge CS6.lnk
    2015-10-20 23:46 - 2015-01-15 01:59 - 00001471 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe ExtendScript Toolkit CS6.lnk
    2015-10-20 23:46 - 2015-01-15 01:59 - 00001305 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Extension Manager CS6.lnk
    2015-10-20 23:46 - 2015-01-05 22:14 - 00001122 _____ C:\Users\Public\Desktop\Connectify Hotspot.lnk
    2015-10-20 23:46 - 2014-12-12 02:24 - 00002429 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
    2015-10-20 23:46 - 2014-11-28 02:25 - 00001111 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
    2015-10-20 23:46 - 2014-11-28 02:25 - 00001105 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
    2015-10-20 23:46 - 2014-11-09 03:30 - 00001159 _____ C:\Users\Public\Desktop\Navicat Premium.lnk
    2015-10-20 23:46 - 2014-11-09 02:19 - 00001037 _____ C:\Users\Public\Desktop\Mobile Partner.lnk
    2015-10-20 23:46 - 2014-11-08 18:55 - 00001333 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Media Center.lnk
    2015-10-20 23:46 - 2014-11-08 18:55 - 00001314 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows DVD Maker.lnk
    2015-10-20 23:46 - 2014-11-08 04:40 - 00000965 _____ C:\Users\Public\Desktop\CCleaner.lnk
    2015-10-20 23:46 - 2014-11-08 04:17 - 00001905 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Security Essentials.lnk
    2015-10-20 23:46 - 2014-11-08 04:16 - 00000937 _____ C:\Users\Public\Desktop\Winamp.lnk
    2015-10-20 23:46 - 2014-11-08 04:00 - 00001395 _____ C:\Users\Mael\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
    2015-10-20 23:46 - 2009-07-14 11:46 - 00001479 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk
    2015-10-20 23:46 - 2009-07-14 11:42 - 00001292 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sidebar.lnk
    2015-10-20 23:46 - 2009-07-14 11:42 - 00001234 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\XPS Viewer.lnk
    2015-10-20 23:46 - 2009-07-14 11:42 - 00001198 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Fax and Scan.lnk
    2015-10-20 23:45 - 2015-06-25 15:04 - 00000000 ____D C:\Users\Mael\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games
    2015-10-20 23:45 - 2015-05-22 17:19 - 00001450 _____ C:\Users\Mael\Desktop\XAMPP Control Panel.lnk
    2015-10-20 23:45 - 2015-05-16 16:55 - 00002197 _____ C:\Users\Mael\Desktop\Google Chrome.lnk
    2015-10-20 23:45 - 2015-03-19 15:33 - 00003035 _____ C:\Users\Mael\Desktop\Sistem Properti Rumah.lnk
    2015-10-20 23:45 - 2015-02-09 00:17 - 00001293 _____ C:\Users\Mael\Desktop\MMD X.lnk
    2015-10-20 23:45 - 2015-01-15 04:23 - 00001159 _____ C:\Users\Mael\Desktop\Adobe Photoshop CS6.lnk
    2015-10-20 23:45 - 2014-11-29 17:42 - 00001825 _____ C:\Users\Mael\Desktop\Super Encryption.lnk
    2015-10-20 23:45 - 2014-11-27 19:14 - 00000971 _____ C:\Users\Mael\Desktop\RazorSQL.lnk
    2015-10-20 23:45 - 2014-11-27 16:50 - 00000794 _____ C:\Users\Mael\AppData\Roaming\Microsoft\Windows\Start Menu\µTorrent.lnk
    2015-10-20 23:45 - 2014-11-09 03:26 - 00001320 _____ C:\Users\Mael\Desktop\Microsoft Visual Studio 2010.lnk
    2015-10-20 23:45 - 2014-11-09 02:42 - 00000955 _____ C:\Users\Mael\Desktop\eclipse.lnk
    2015-10-20 23:45 - 2014-11-08 05:20 - 00002675 _____ C:\Users\Mael\Desktop\Microsoft Office Word 2007.lnk
    2015-10-20 23:45 - 2014-11-08 04:37 - 00000999 _____ C:\Users\Mael\Desktop\KMPlayer.lnk
    2015-10-20 23:45 - 2009-07-14 11:46 - 00001218 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Default Programs.lnk
    2015-10-20 23:45 - 2009-07-14 11:37 - 00001246 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Windows Update.lnk
    2015-10-20 23:24 - 2014-11-27 16:51 - 00000000 ____D C:\Program Files\RazorSQL
    2015-10-19 16:04 - 2009-07-14 09:37 - 00000000 ____D C:\Windows\system32\LogFiles
    2015-10-16 02:42 - 2014-11-08 04:26 - 00000000 ____D C:\Users\Mael\Downloads\Compressed
    2015-10-13 05:26 - 2014-11-08 03:59 - 00000000 ____D C:\Users\Mael\AppData\Local\VirtualStore
    2015-10-13 04:57 - 2014-11-08 04:46 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ASUS
    2015-10-13 04:57 - 2014-11-08 04:29 - 00000000 ____D C:\Program Files\ASUS
    2015-10-13 04:55 - 2014-12-31 05:31 - 00000000 ____D C:\ProgramData\ASUS
    2015-10-10 06:31 - 2015-01-02 14:44 - 00003584 _____ C:\Users\Mael\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
    2015-10-10 02:59 - 2015-05-16 17:23 - 00000000 ____D C:\Program Files\Opera
    2015-10-10 02:54 - 2015-06-25 17:39 - 00119296 _____ C:\Windows\system32\zlib.dll
    2015-10-07 17:59 - 2014-11-10 13:55 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation
    2015-10-07 17:59 - 2014-11-10 13:53 - 00000000 ____D C:\ProgramData\NVIDIA Corporation
    2015-10-07 17:58 - 2014-11-10 13:50 - 00000000 ____D C:\Program Files\NVIDIA Corporation
    2015-10-07 17:12 - 2014-11-11 13:10 - 00000000 ____D C:\Windows\Minidump
    2015-10-07 17:11 - 2014-11-08 04:16 - 00000000 ____D C:\Users\Mael\AppData\Roaming\Winamp
    2015-10-02 16:08 - 2009-07-14 09:37 - 00000000 ____D C:\Windows\system32\NDF
    2015-09-28 02:01 - 2009-07-14 11:53 - 00032636 _____ C:\Windows\Tasks\SCHEDLGU.TXT
    2015-09-25 17:35 - 2014-11-08 05:07 - 00000000 ____D C:\Users\Mael\AppData\Roaming\Adobe

    ==================== Files in the root of some directories =======

    2015-05-27 18:04 - 2015-05-27 18:38 - 0000473 _____ () C:\Users\Mael\AppData\Roaming\burnaware.ini
    2015-02-22 21:14 - 2015-05-14 22:47 - 0000129 _____ () C:\Users\Mael\AppData\Roaming\WB.CFG
    2015-05-27 19:01 - 2015-05-27 19:01 - 0000600 _____ () C:\Users\Mael\AppData\Roaming\winscp.rnd
    2015-05-27 18:38 - 2015-05-27 18:38 - 0000031 _____ () C:\Users\Mael\AppData\Local\burnaware.ini
    2015-01-02 14:44 - 2015-10-10 06:31 - 0003584 _____ () C:\Users\Mael\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
    2014-11-08 05:10 - 2014-11-15 02:58 - 0007605 _____ () C:\Users\Mael\AppData\Local\resmon.resmoncfg
    2015-04-30 15:03 - 2015-04-30 15:03 - 0000782 _____ () C:\Users\Mael\AppData\Local\Temp-log.txt

    ==================== Bamital & volsnap =================

    (There is no automatic fix for files that do not pass verification.)

    C:\Windows\explorer.exe => File is digitally signed
    C:\Windows\system32\winlogon.exe => File is digitally signed
    C:\Windows\system32\wininit.exe => File is digitally signed
    C:\Windows\system32\svchost.exe => File is digitally signed
    C:\Windows\system32\services.exe => File is digitally signed
    C:\Windows\system32\User32.dll => MD5 is legit
    C:\Windows\system32\userinit.exe => File is digitally signed
    C:\Windows\system32\rpcss.dll => File is digitally signed
    C:\Windows\system32\dnsapi.dll => File is digitally signed
    C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


    LastRegBack: 2015-10-21 13:59

    ==================== End of FRST.txt ============================
     
  21. 2015/10/22
    maelkaka

    maelkaka Inactive Thread Starter

    Joined:
    2015/10/18
    Messages:
    15
    Likes Received:
    0
    And here's content of Addition.txt:
    Additional scan result of Farbar Recovery Scan Tool (x86) Version:21-10-2015 01
    Ran by Mael (2015-10-22 18:07:51)
    Running from C:\Users\Mael\Downloads\Programs
    Microsoft Windows 7 Ultimate Service Pack 1 (X86) (2014-11-07 20:58:53)
    Boot Mode: Normal
    ==========================================================


    ==================== Accounts: =============================

    Administrator (S-1-5-21-1983062108-2153825218-3807267094-500 - Administrator - Disabled)
    Guest (S-1-5-21-1983062108-2153825218-3807267094-501 - Limited - Disabled)
    Mael (S-1-5-21-1983062108-2153825218-3807267094-1000 - Administrator - Enabled) => C:\Users\Mael
    Shared (S-1-5-21-1983062108-2153825218-3807267094-1015 - Limited - Enabled)

    ==================== Security Center ========================

    (If an entry is included in the fixlist, it will be removed.)

    AV: Microsoft Security Essentials (Enabled - Up to date) {9765EA51-0D3C-7DFB-6091-10E4E1F341F6}
    AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    AS: Microsoft Security Essentials (Enabled - Up to date) {2C040BB5-2B06-7275-5A21-2B969A740B4B}

    ==================== Installed Programs ======================

    (Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

    µTorrent (HKU\S-1-5-21-1983062108-2153825218-3807267094-1000\...\uTorrent) (Version: 3.4.2.36615 - BitTorrent Inc.)
    4K Video Downloader 3.4 (HKLM\...\4K Video Downloader_is1) (Version: 3.4.5.1525 - Open Media LLC)
    Adobe Flash Player 18 NPAPI (HKLM\...\Adobe Flash Player NPAPI) (Version: 18.0.0.209 - Adobe Systems Incorporated)
    Adobe Photoshop CS6 (HKLM\...\{74EB3499-8B95-4B5C-96EB-7B342F3FD0C6}) (Version: 13.0 - Adobe Systems Incorporated)
    Adobe Reader XI (11.0.12) (HKLM\...\{AC76BA86-7AD7-1033-7B44-AB0000000001}) (Version: 11.0.12 - Adobe Systems Incorporated)
    Android SDK Tools (HKLM\...\Android SDK Tools) (Version: 1.16 - Google Inc.)
    ASUS LifeFrame3 (HKLM\...\{1DBD1F12-ED93-49C0-A7CC-56CBDE488158}) (Version: 3.1.9 - ASUS)
    ASUS Power4Gear Hybrid (HKLM\...\{9B6239BF-4E85-4590-8D72-51E30DB1A9AA}) (Version: 3.0.7 - ASUS)
    ASUS Smart Gesture (HKLM\...\{4D3286A6-F6AB-498A-82A4-E4F040529F3D}) (Version: 2.2.8 - ASUS)
    ASUS Virtual Camera (HKLM\...\{EC8BD21F-0CA0-4BBF-97D9-4A52B30041A1}) (Version: 1.0.28 - ASUS)
    Baidu PC Faster (HKLM\...\Baidu PC Faster 5.1.0.0) (Version: 5.1.3.126764 - Baidu, Inc.) <==== ATTENTION
    BurnAware Free 8.1 (HKLM\...\BurnAware Free_is1) (Version: - Burnaware)
    Canon IJ Scan Utility (HKLM\...\Canon_IJ_Scan_Utility) (Version: - Canon Inc.)
    Canon Inkjet Printer/Scanner/Fax Extended Survey Program (HKLM\...\CANONIJPLM100) (Version: 4.1.0 - Canon Inc.)
    Canon MG2500 series MP Drivers (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MG2500_series) (Version: 1.00 - Canon Inc.)
    Canon My Printer (HKLM\...\CanonMyPrinter) (Version: 3.1.0 - Canon Inc.)
    Canon Quick Menu (HKLM\...\CanonQuickMenu) (Version: 2.2.1 - Canon Inc.)
    CCleaner (HKLM\...\CCleaner) (Version: 3.19 - Piriform)
    Connectify (HKLM\...\Connectify) (Version: 7.1.0.29279 - Connectify)
    Crystal Reports for Visual Studio (Version: 12.51.0.240 - SAP) Hidden
    DAEMON Tools Lite (HKLM\...\DAEMON Tools Lite) (Version: 4.49.1.0356 - Disc Soft Ltd)
    DbVisualizer (HKLM\...\8973-4025-0853-7287) (Version: 9.1.10 - DbVis Software AB)
    Dotfuscator Software Services - Community Edition (HKLM\...\{41B31ABE-5A6E-498A-8F28-3BA3B8779A41}) (Version: 5.0.2300.0 - PreEmptive Solutions)
    EPSON LQ-2190 ESC/P2 Printer Utility Uninstall (HKLM\...\EPSON LQ-2190 ESC/P2) (Version: - SEIKO EPSON Corporation)
    Football Manager 2015 version 15.3.2 (HKLM\...\{BD2F10CE-5561-4A0A-BD82-EB56E87D4FFB}_is1) (Version: 15.3.2 - SEGA)
    Google Chrome (HKLM\...\Google Chrome) (Version: 43.0.2357.134 - Google Inc.)
    Google Earth Plug-in (HKLM\...\{4AB54F11-2F8C-11E3-B09F-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)
    Governor of Poker 2 Premium Edition v1.0 Multi (HKLM\...\{8BF806C4-2D77-4F67-8435-D4BDCEB665A8}_is1) (Version: - My Company, Inc.)
    Gtk# for .Net 2.12.25 (HKLM\...\{889E7D77-2A98-4020-83B1-0296FA1BDE8A}) (Version: 2.12.25 - Xamarin, Inc.)
    HP LaserJet Professional P1100-P1560-P1600 Series (HKLM\...\HP LaserJet Professional P1100-P1560-P1600 Series) (Version: - )
    Intel(R) Management Engine Components (HKLM\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 9.5.14.1724 - Intel Corporation)
    Intel(R) Processor Graphics (HKLM\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.3540 - Intel Corporation)
    Intel(R) Rapid Storage Technology (HKLM\...\{409CB30E-E457-4008-9B1A-ED1B9EA21140}) (Version: 12.8.0.1016 - Intel Corporation)
    Intel(R) USB 3.0 eXtensible Host Controller Driver (HKLM\...\{240C3DDD-C5E9-4029-9DF7-95650D040CF2}) (Version: 3.0.0.16 - Intel Corporation)
    Intel® Hardware Accelerated Execution Manager (HKLM\...\{ECCB31F5-435D-4F37-A98D-5854D3C62718}) (Version: 1.1.1 - Intel Corporation)
    Internet Download Manager (HKLM\...\Internet Download Manager) (Version: - )
    Java 7 Update 79 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F03217079FF}) (Version: 7.0.790 - Oracle)
    Java DB 10.4.2.1 (HKLM\...\{926C96FB-9D0A-4504-8000-C6D3A4A3118E}) (Version: 10.4.2.1 - Sun Microsystems, Inc)
    Java SE Development Kit 7 Update 71 (HKLM\...\{32A3A4F4-B792-11D6-A78A-00B0D0170710}) (Version: 1.7.0.710 - Oracle)
    Java(TM) 6 Update 24 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83216024FF}) (Version: 6.0.240 - Oracle)
    KeyTweak - Keyboard Remapper (remove only) (HKLM\...\KeyTweak) (Version: - )
    K-Lite Codec Pack 8.7.0 (Full) (HKLM\...\KLiteCodecPack_is1) (Version: 8.7.0 - )
    KMPlayer (remove only) (HKLM\...\The KMPlayer) (Version: 3.9.1.130 - PandoraTV)
    LINE (HKLM\...\LINE) (Version: 4.1.3.586 - LINE Corporation)
    Machinarium (HKLM\...\Machinarium) (Version: 11.10.09 - Amanita Design, s.r.o.)
    Malwarebytes Anti-Malware version 2.2.0.1024 (HKLM\...\Malwarebytes Anti-Malware_is1) (Version: 2.2.0.1024 - Malwarebytes)
    Microsoft .NET Framework 4 Multi-Targeting Pack (HKLM\...\{CFEF48A8-BFB8-3EAC-8BA5-DE4F8AA267CE}) (Version: 4.0.30319 - Microsoft Corporation)
    Microsoft ASP.NET MVC 2 - Visual Studio 2010 Tools (HKLM\...\{40416836-56CC-4C0E-A6AF-5C34BADCE483}) (Version: 2.0.50217.0 - Microsoft Corporation)
    Microsoft ASP.NET MVC 2 (HKLM\...\{1803A630-3C38-4D2B-9B9A-0CB37243539C}) (Version: 2.0.50217.0 - Microsoft Corporation)
    Microsoft Garage Mouse without Borders (HKLM\...\{D3BC954F-D661-474C-B367-30EB6E56542E}) (Version: 2.1.2.1212 - Microsoft Garage)
    Microsoft Help Viewer 1.0 (HKLM\...\Microsoft Help Viewer 1.0) (Version: 1.0.30319 - Microsoft Corporation)
    Microsoft Office Enterprise 2007 (HKLM\...\ENTERPRISE) (Version: 12.0.4518.1014 - Microsoft Corporation)
    Microsoft Office Visio Professional 2007 (HKLM\...\VISPRO) (Version: 12.0.4518.1014 - Microsoft Corporation)
    Microsoft ReportViewer 2010 Redistributable (HKLM\...\{C19B3EB6-B54C-3204-A4DF-88432E0C79F7}) (Version: 10.0.30319 - Microsoft Corporation)
    Microsoft Security Essentials (HKLM\...\Microsoft Security Client) (Version: 4.0.1526.0 - Microsoft Corporation)
    Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
    Microsoft Silverlight 3 SDK (HKLM\...\{2012098D-EEE9-4769-8DD3-B038050854D4}) (Version: 3.0.40818.0 - Microsoft Corporation)
    Microsoft SQL Server 2008 (HKLM\...\Microsoft SQL Server 10 Release) (Version: - Microsoft Corporation)
    Microsoft SQL Server 2008 Policies (HKLM\...\{01C5A10F-AD9B-405B-853A-6659841A1242}) (Version: 10.0.1600.22 - Microsoft Corporation)
    Microsoft SQL Server 2008 R2 (HKLM\...\Microsoft SQL Server 2008 R2) (Version: - Microsoft Corporation)
    Microsoft SQL Server 2008 R2 Data-Tier Application Framework (HKLM\...\{0DDCEC37-369C-484B-B16D-B4413FD42FB9}) (Version: 10.50.1447.4 - Microsoft Corporation)
    Microsoft SQL Server 2008 R2 Data-Tier Application Project (HKLM\...\{E5AE9031-79A5-4627-9641-BEFA82819B08}) (Version: 10.50.1447.4 - Microsoft Corporation)
    Microsoft SQL Server 2008 R2 Management Objects (HKLM\...\{4E968D9C-21A7-4915-B698-F7AEB913541D}) (Version: 10.50.1447.4 - Microsoft Corporation)
    Microsoft SQL Server 2008 R2 Native Client (HKLM\...\{4AB6A079-178B-4144-B21F-4D1AE71666A2}) (Version: 10.50.1600.1 - Microsoft Corporation)
    Microsoft SQL Server 2008 R2 Setup (English) (HKLM\...\{7419AE1A-D1A5-4B24-BD78-C7ABCC26016F}) (Version: 10.52.4000.0 - Microsoft Corporation)
    Microsoft SQL Server 2008 R2 Transact-SQL Language Service (HKLM\...\{78C3657E-742C-40B1-9F53-E5A921D40F17}) (Version: 10.50.1447.4 - Microsoft Corporation)
    Microsoft SQL Server 2008 Setup Support Files (HKLM\...\{D441BD04-E548-4F8E-97A4-1B66135BAAA8}) (Version: 10.1.2731.0 - Microsoft Corporation)
    Microsoft SQL Server Browser (HKLM\...\{BF9BF038-FE03-429D-9B26-2FA0FD756052}) (Version: 10.50.1600.1 - Microsoft Corporation)
    Microsoft SQL Server Compact 3.5 SP1 Query Tools English (HKLM\...\{64CDE8F2-3791-46F5-BAD2-72FFF5252FAB}) (Version: 3.5.5692.0 - Microsoft Corporation)
    Microsoft SQL Server Database Publishing Wizard 1.4 (HKLM\...\{ACE28263-76A4-4BF5-B6F4-8BD719595969}) (Version: 10.1.2512.8 - Microsoft Corporation)
    Microsoft SQL Server System CLR Types (HKLM\...\{2A2F3AE8-246A-4252-BB26-1BEB45627074}) (Version: 10.50.1447.4 - Microsoft Corporation)
    Microsoft SQL Server VSS Writer (HKLM\...\{47BE41E6-2F0F-4D17-9C2D-3850FFD9D405}) (Version: 10.50.1600.1 - Microsoft Corporation)
    Microsoft Sync Framework Runtime v1.0 SP1 (x86) (HKLM\...\{C6DD625F-4B61-4561-8286-87CA0275CEA1}) (Version: 1.0.3010.0 - Microsoft Corporation)
    Microsoft Sync Framework SDK v1.0 SP1 (HKLM\...\{97CE8B73-AA5A-4987-A1BE-50DD1A187478}) (Version: 1.0.3010.0 - Microsoft Corporation)
    Microsoft Sync Framework Services v1.0 SP1 (x86) (HKLM\...\{F990B526-8F7C-46E0-B1F1-6C893A8B478F}) (Version: 1.0.3010.0 - Microsoft Corporation)
    Microsoft Sync Services for ADO.NET v2.0 SP1 (x86) (HKLM\...\{DC3D6AFB-78B4-489F-81D7-30B66E0C2417}) (Version: 2.0.3010.0 - Microsoft Corporation)
    Microsoft Team Foundation Server 2010 Object Model - ENU (HKLM\...\Microsoft Team Foundation Server 2010 Object Model - ENU) (Version: 10.0.30319 - Microsoft Corporation)
    Microsoft Visual Basic 6.0 Enterprise Edition (HKLM\...\Visual Basic 6.0 Enterprise Edition) (Version: - )
    Microsoft Visual C++ 2005 Redistributable (HKLM\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4974 (HKLM\...\{B7E38540-E355-3503-AFD7-635B2F2F76E1}) (Version: 9.0.30729.4974 - Microsoft Corporation)
    Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
    Microsoft Visual C++ 2010 x86 Runtime - 10.0.30319 (HKLM\...\{6A86554B-8928-30E4-A53C-D7337689134D}) (Version: 10.0.30319 - Microsoft Corporation)
    Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM\...\{ce085a78-074e-4823-8dc1-8a721b94b76d}) (Version: 12.0.21005.1 - Microsoft Corporation)
    Microsoft Visual F# 2.0 Runtime (HKLM\...\{729A3000-BC8A-3B74-BA5D-5068FE12D70C}) (Version: 10.0.30319 - Microsoft Corporation)
    Microsoft Visual Studio 2010 ADO.NET Entity Framework Tools (HKLM\...\{14DD7530-CCD2-3798-B37D-3839ED6A441C}) (Version: 10.0.30319 - Microsoft Corporation)
    Microsoft Visual Studio 2010 Tools for Office Runtime (x86) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x86)) (Version: 10.0.30319 - Microsoft Corporation)
    Microsoft Visual Studio 2010 Ultimate - ENU (HKLM\...\Microsoft Visual Studio 2010 Ultimate - ENU) (Version: 10.0.30319 - Microsoft Corporation)
    Microsoft Visual Studio Tools for Applications 2.0 - ENU (HKLM\...\{AA4A4B2C-0465-3CF8-BA76-27A027D8ACAB}) (Version: 9.0.30729 - Microsoft Corporation)
    Microsoft Web Publishing Wizard 1.53 (HKLM\...\WebPost) (Version: - )
    MiniTool Partition Wizard Home Edition 8.1.1 (HKLM\...\{05D996FA-ADCB-4D23-BA3C-A7C184A8FAC6}_is1) (Version: - MiniTool Solution Ltd.)
    Mobile Partner (HKLM\...\Mobile Partner) (Version: 11.002.03.23.03 - Huawei Technologies Co.,Ltd)
    Mozilla Firefox 34.0.5 (x86 en-US) (HKLM\...\Mozilla Firefox 34.0.5 (x86 en-US)) (Version: 34.0.5 - Mozilla)
    Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 33.1.1 - Mozilla)
    mp3schneiden (HKLM\...\mp3schneiden_is1) (Version: 1.1 - Abelssoft)
    MySQL Connector Net 6.1.6 (HKLM\...\{5FD88490-011C-4DF1-B886-F298D955171B}) (Version: 6.1.6 - Oracle)
    MySQL Workbench 6.2 CE (HKLM\...\{DBE945CB-948B-4A68-9465-FC15BF286625}) (Version: 6.2.4 - Oracle Corporation)
    Notepad++ (HKLM\...\Notepad++) (Version: 6.6.9 - Notepad++ Team)
    Nullsoft Install System (HKLM\...\NSIS) (Version: 2.46 - )
    NVIDIA 3D Vision Controller Driver 344.65 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 344.65 - NVIDIA Corporation)
    NVIDIA 3D Vision Driver 344.65 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 344.65 - NVIDIA Corporation)
    NVIDIA GeForce Experience 2.1.4 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 2.1.4 - NVIDIA Corporation)
    NVIDIA Graphics Driver 344.65 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 344.65 - NVIDIA Corporation)
    NVIDIA PhysX System Software 9.14.0702 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.14.0702 - NVIDIA Corporation)
    Opera Stable 32.0.1948.69 (HKLM\...\Opera 32.0.1948.69) (Version: 32.0.1948.69 - Opera Software)
    PCSX2 - Playstation 2 Emulator (HKLM\...\pcsx2-r5350) (Version: - )
    PDF Settings CS6 (Version: 11.0 - Adobe Systems Incorporated) Hidden
    PremiumSoft Navicat Premium 9.0 (HKLM\...\PremiumSoft Navicat Premium_is1) (Version: - PremiumSoft CyberTech Ltd.)
    Qualcomm Atheros Client Installation Program (HKLM\...\{28006915-2739-4EBE-B5E8-49B25D32EB33}) (Version: 10.0 - Qualcomm Atheros)
    Qualcomm Atheros Inc.(R) AR81Family Gigabit/Fast Ethernet Driver (HKLM\...\{3108C217-BE83-42E4-AE9E-A56A2A92E549}) (Version: 2.1.0.21 - Qualcomm Atheros Inc.)
    RAR Password Unlocker 4.2.0.0 (HKLM\...\{B789FA51-6A71-408F-92DE-EDE4A517B8F9}_is1) (Version: - Password Unlocker Studio)
    RazorSQL 5.6.1 (HKLM\...\RazorSQL 5.6.1_is1) (Version: - Richardson Software, LLC)
    Recuva (HKLM\...\Recuva) (Version: 1.52 - Piriform)
    Service Pack 1 for SQL Server 2008 (KB968369) (HKLM\...\KB968369) (Version: 10.1.2531.0 - Microsoft Corporation)
    SHIELD Streaming (Version: 3.1.2000 - NVIDIA Corporation) Hidden
    SHIELD Wireless Controller Driver (Version: 16.13.65 - NVIDIA Corporation) Hidden
    Sistem Properti Rumah (HKLM\...\{B9800D24-5A2C-4602-99D2-9FA321D24411}) (Version: 1.0.0 - Mataniari)
    Skype Click to Call (HKLM\...\{6D1221A9-17BF-4EC0-81F2-27D30EC30701}) (Version: 7.5.0.9082 - Microsoft Corporation)
    Skype Web Plugin (HKLM\...\{0F7D4832-16AE-4857-A6FA-2B141D75A59B}) (Version: 7.7.0.219 - Skype Technologies S.A.)
    Skype™ 7.12 (HKLM\...\{6A0549A9-1B96-498C-ACBC-3943001FEB19}) (Version: 7.12.101 - Skype Technologies S.A.)
    Sony PC Companion 2.10.259 (HKLM\...\{F09EF8F2-0976-42C1-8D9D-8DF78337C6E3}) (Version: 2.10.259 - Sony)
    SQL Server 2008 R2 Common Files (Version: 10.50.1600.1 - Microsoft Corporation) Hidden
    SQL Server 2008 R2 Database Engine Services (Version: 10.50.1600.1 - Microsoft Corporation) Hidden
    SQL Server 2008 R2 Database Engine Shared (Version: 10.50.1600.1 - Microsoft Corporation) Hidden
    Sql Server Customer Experience Improvement Program (Version: 10.50.1600.1 - Microsoft Corporation) Hidden
    TortoiseSVN 1.8.4.24972 (32 bit) (HKLM\...\{F4E3A752-5AF9-4204-8416-8E58B9041A37}) (Version: 1.8.24972 - TortoiseSVN)
    True Crime - Streets of LA (HKLM\...\InstallShield_{1A1FE271-EA21-40E5-90FC-51A8EFBC0A30}) (Version: 1.00.0000 - Activision)
    True Crime - Streets of LA (Version: 1.00.0000 - Activision) Hidden
    UnLock Root Pro 4.12 (HKLM\...\UnLock Root Pro) (Version: 4.12 - Unlcokroot)
    Visual Studio 2010 Tools for SQL Server Compact 3.5 SP2 ENU (HKLM\...\{112C23F2-C036-4D40-BED4-0CB47BF5555C}) (Version: 4.0.8080.0 - Microsoft Corporation)
    VisualSVN 4.0.2 (HKLM\...\{2EC6A5BC-5082-4B76-AF75-13BABC4FAF90}) (Version: 4.0.2.0 - VisualSVN Ltd.)
    Web Deployment Tool (HKLM\...\{0F37D969-1260-419E-B308-EF7D29ABDE20}) (Version: 1.1.0618 - Microsoft Corporation)
    Winamp (HKLM\...\Winamp) (Version: 5.61 - Nullsoft, Inc)
    Winamp Detector Plug-in (HKU\S-1-5-21-1983062108-2153825218-3807267094-1000\...\Winamp Detect) (Version: 1.0.0.1 - Nullsoft, Inc)
    Windows Driver Package - ASUS (ATP) Mouse (11/19/2013 6.0.0.26) (HKLM\...\E4815FF09BCD52BF23B499131D530A91E50CA299) (Version: 11/19/2013 6.0.0.26 - ASUS)
    WinRAR 4.00 beta 1 (32-bit) (HKLM\...\WinRAR archiver) (Version: 4.00.1 - win.rar GmbH)
    WinSCP 5.7.3 (HKLM\...\winscp3_is1) (Version: 5.7.3 - Martin Prikryl)
    Xamarin (HKLM\...\{ABF21D8B-8388-45B4-A2F3-3FF63F50F515}) (Version: 3.11.458.0 - Xamarin)
    Xamarin Studio 5.9 (HKLM\...\{4E55F3D2-407F-4332-82E5-116E9FDAF9BD}) (Version: 5.9.0.431 - Xamarin)
    Xamarin Universal Installer (HKLM\...\{e2170c24-4ed1-4aca-8a8f-defa79cb4dae}) (Version: 3.5.0.0 - Xamarin, Inc)
    Yahoo! Messenger (HKLM\...\Yahoo! Messenger) (Version: - Yahoo! Inc.)

    ==================== Custom CLSID (Whitelisted): ==========================

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

    CustomCLSID: HKU\S-1-5-21-1983062108-2153825218-3807267094-1000_Classes\CLSID\{000c0114-0000-0000-c000-000000000046}\InprocServer32 -> C:\Program Files\Common Files\Microsoft Shared\VBA\MSO97RT.DLL ()
    CustomCLSID: HKU\S-1-5-21-1983062108-2153825218-3807267094-1000_Classes\CLSID\{3D75B06D-3610-4C5C-8C2A-B5DC8B5A3CAF}\localserver32 -> C:\Users\Mael\AppData\Local\SkypePlugin\7.7.0.219\PluginHost.exe (Skype Technologies S.A.)
    CustomCLSID: HKU\S-1-5-21-1983062108-2153825218-3807267094-1000_Classes\CLSID\{7253b364-18c5-555a-4b07-26abb39c9f99}\InprocServer32 -> C:\Users\Mael\AppData\Local\SkypePlugin\7.7.0.219\EdgeBrokerPS.dll (Skype Technologies S.A.)
    CustomCLSID: HKU\S-1-5-21-1983062108-2153825218-3807267094-1000_Classes\CLSID\{81CD4B70-A8AB-48FC-826C-8F76A1A06829}\InprocServer32 -> C:\Users\Mael\AppData\Local\SkypePlugin\7.7.0.219\GatewayActiveX.dll (Skype Technologies S.A.)
    CustomCLSID: HKU\S-1-5-21-1983062108-2153825218-3807267094-1000_Classes\CLSID\{820D63D5-8CFF-46DE-86AF-4997DEDD6DB5}\localserver32 -> C:\Windows\system32\igfxEM.exe (Intel Corporation)
    CustomCLSID: HKU\S-1-5-21-1983062108-2153825218-3807267094-1000_Classes\CLSID\{CBF9CD8C-2714-4F36-B76A-43E6C7547BC2}\localserver32 -> C:\Users\Mael\AppData\Local\SkypePlugin\7.7.0.219\EdgeCalling.exe (Skype Technologies S.A.)
    CustomCLSID: HKU\S-1-5-21-1983062108-2153825218-3807267094-1000_Classes\CLSID\{D779CCB8-300C-4160-B101-D6A5FD73294E}\localserver32 -> C:\Users\Mael\AppData\Local\SkypePlugin\7.7.0.219\GatewayVersion.exe (Skype Technologies S.A.)

    ==================== Restore Points =========================

    07-10-2015 18:00:01 Installed DirectX
    13-10-2015 00:57:35 Windows Update
    13-10-2015 03:58:12 Removed ASUS LifeFrame3
    13-10-2015 04:00:15 Installed ASUS LifeFrame3
    13-10-2015 04:47:51 Installed YouCam
    13-10-2015 04:54:08 Removed ASUS LifeFrame3
    13-10-2015 04:54:45 Installed LifeFrame2
    13-10-2015 04:56:05 Removed LifeFrame2
    13-10-2015 04:57:28 Installed ASUS LifeFrame3
    16-10-2015 02:47:44 Windows Update
    20-10-2015 02:30:39 Windows Update
    21-10-2015 00:03:08 JRT Pre-Junkware Removal
    22-10-2015 02:03:56 ComboFix created restore point

    ==================== Hosts content: ===============================

    (If needed Hosts: directive could be included in the fixlist to reset Hosts.)

    2015-10-22 02:14 - 2015-10-22 02:14 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts

    127.0.0.1 localhost

    ==================== Scheduled Tasks (Whitelisted) =============

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

    Task: {2D5B36E9-1A8E-4111-85C9-A57F806EDD66} - System32\Tasks\{435160A3-7972-49D0-8463-5354A3760732} => Chrome.exe hxxp://ui.skype.com/ui/0/7.12.0.101/en/abandoninstall?source=lightinstaller&amp;page=tsBing
    Task: {5F056519-20E4-44CC-8FFE-10EF1449BB68} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2014-11-28] (Google Inc.)
    Task: {60AAA9D4-AAA2-43C7-9E51-CD76CD8781C1} - System32\Tasks\060184C3-9766-46a0-B258-F4518A0B2633 => Cscript.exe "C:\ProgramData\Duplicaterecord.js" <==== ATTENTION
    Task: {742A87DF-4835-4B0C-8506-B8A551CEB129} - System32\Tasks\ASUS Smart Gesture Launcher => C:\Program Files\ASUS\ASUS Smart Gesture\AsTPCenter\x86\AsusTPLauncher.exe [2013-12-12] (AsusTek)
    Task: {87FDF15C-DAC9-439E-91E4-1665A3CBCA5B} - System32\Tasks\ATKOSD2 => C:\Program Files\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe [2013-09-09] (ASUSTek Computer Inc.)
    Task: {8C41C00B-EB97-490B-86BE-B31F9CF5D867} - System32\Tasks\ASUS P4G => C:\Program Files\ASUS\P4G\BatteryLife.exe [2014-01-03] (ASUS)
    Task: {8C5B5521-3180-4E9A-A98F-B4B6CA4513C7} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2015-07-15] (Adobe Systems Incorporated)
    Task: {A8462D98-61AA-48BA-A488-1F496CAF4F0C} - System32\Tasks\ASUS USB Charger Plus => C:\Program Files\ASUS\USBChargerPlus\USBChargerPlus.exe [2013-08-29] (ASUSTek Computer Inc.)
    Task: {A97C1DBB-CC77-4A08-87E7-EBAF1028C09F} - System32\Tasks\Baidu PC Faster Update => C:\Program Files\PC Faster\5.1.0.0\Updater.exe [2015-05-13] (Baidu, Inc.)
    Task: {AACBC37D-7404-4A1C-9F3C-9A1CD6A27983} - System32\Tasks\Opera scheduled Autoupdate 1431772110 => C:\Program Files\Opera\launcher.exe [2015-09-25] (Opera Software)
    Task: {C7825A25-AE06-41CB-8627-8D68B26DFCAE} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2014-11-28] (Google Inc.)
    Task: {E06236F8-43D9-4326-922C-628D547F9190} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2015-07-07] (Adobe Systems Incorporated)

    (If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

    Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
    Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe
    Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe

    ==================== Loaded Modules (Whitelisted) ==============

    2014-11-10 13:54 - 2014-11-04 05:04 - 00107840 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax.dll
    2015-03-31 19:28 - 2012-08-31 15:01 - 00151552 _____ () C:\Windows\System32\HP1100LM.DLL
    2015-03-31 19:29 - 2012-08-31 15:01 - 00069632 _____ () C:\Windows\system32\spool\PRTPROCS\W32X86\HP1100PP.DLL
    2015-03-31 19:28 - 2012-08-31 15:02 - 02306048 _____ () C:\Windows\system32\spool\DRIVERS\W32X86\3\hp1100su.dll
    2015-03-31 19:28 - 2012-08-31 15:01 - 00794624 _____ () C:\Windows\system32\spool\DRIVERS\W32X86\3\HP1100GC.dll
    2014-01-03 17:26 - 2014-01-03 17:26 - 00021120 _____ () C:\Program Files\ASUS\P4G\DevMng.dll
    2014-11-10 13:47 - 2014-03-31 12:26 - 00072072 _____ () C:\Windows\system32\igfxexps.dll
    2013-11-24 12:48 - 2013-11-24 12:48 - 00065264 _____ () C:\Program Files\TortoiseSVN\bin\TortoiseStub32.dll
    2013-11-24 12:48 - 2013-11-24 12:48 - 00071408 _____ () C:\Program Files\TortoiseSVN\bin\libsasl32.dll
    2014-04-15 16:51 - 2015-04-11 00:54 - 00595824 _____ () C:\Program Files\PC Faster\5.1.0.0\sqlite.dll
    2012-12-28 10:44 - 2012-12-28 10:44 - 00039648 _____ () C:\Program Files\Microsoft Garage\Mouse without Borders\MousewithoutBordersHelper.exe

    ==================== Alternate Data Streams (Whitelisted) =========

    (If an entry is included in the fixlist, only the ADS will be removed.)

    AlternateDataStreams: C:\Windows\system32\zlib.dll:DocumentSummaryInformation
    AlternateDataStreams: C:\Windows\system32\zlib.dll:SummaryInformation
    AlternateDataStreams: C:\Windows\system32\zlib.dll:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}

    ==================== Safe Mode (Whitelisted) ===================

    (If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" value will be restored.)


    ==================== EXE Association (Whitelisted) ===============

    (If an entry is included in the fixlist, the registry item will be restored to default or removed.)


    ==================== Internet Explorer trusted/restricted ===============

    (If an entry is included in the fixlist, it will be removed from the registry.)


    ==================== Other Areas ============================

    (Currently there is no automatic fix for this section.)

    HKU\S-1-5-21-1983062108-2153825218-3807267094-1000\Control Panel\Desktop\\Wallpaper ->
    DNS Servers: Media is not connected to internet.
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
    Windows Firewall is enabled.

    ==================== MSCONFIG/TASK MANAGER disabled items ==

    (Currently there is no automatic fix for this section.)

    MSCONFIG\Services: AdobeARMservice => 3
    MSCONFIG\Services: BASSVC => 2
    MSCONFIG\Services: Bonjour Service => 3
    MSCONFIG\Services: gupdate => 3
    MSCONFIG\Services: gupdatem => 3
    MSCONFIG\Services: MozillaMaintenance => 3
    MSCONFIG\Services: PanService => 3
    MSCONFIG\Services: PinnacleUpdateSvc => 2
    MSCONFIG\Services: Sony PC Companion => 3
    MSCONFIG\Services: SwitchBoard => 3
    MSCONFIG\startupfolder: C:^Users^Mael^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Download.lnk => C:\Windows\pss\Download.lnk.Startup
    MSCONFIG\startupfolder: C:^Users^Mael^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Windows7LoaderExtremeEdition_3.503.lnk => C:\Windows\pss\Windows7LoaderExtremeEdition_3.503.lnk.Startup
    MSCONFIG\startupreg: Adobe ARM => "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe "
    MSCONFIG\startupreg: AdobeAAMUpdater-1.0 => "C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe "
    MSCONFIG\startupreg: AdobeCS6ServiceManager => "C:\Program Files\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe" -launchedbylogin
    MSCONFIG\startupreg: CanonQuickMenu => C:\Program Files\Canon\Quick Menu\CNQMMAIN.EXE /logon
    MSCONFIG\startupreg: Connectify Dispatch => C:\Program Files\Connectify\DispatchUI.exe autorun
    MSCONFIG\startupreg: Connectify Hotspot => C:\Program Files\Connectify\Connectify.exe autorun
    MSCONFIG\startupreg: DAEMON Tools Lite => "C:\Program Files\DAEMON Tools Lite\DTLite.exe" -autorun
    MSCONFIG\startupreg: GrooveMonitor => "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe "
    MSCONFIG\startupreg: Messenger (Yahoo!) => "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
    MSCONFIG\startupreg: Sony PC Companion => "C:\Program Files\Sony\Sony PC Companion\PCCompanion.exe" /Background
    MSCONFIG\startupreg: SwitchBoard => C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
    MSCONFIG\startupreg: UMonit => C:\Windows\system32\UMonit.exe
    MSCONFIG\startupreg: uTorrent => "C:\Users\Mael\AppData\Roaming\uTorrent\uTorrent.exe" /MINIMIZED

    ==================== FirewallRules (Whitelisted) ===============

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

    FirewallRules: [TCP Query User{4BF5A56D-EB04-498C-813F-3583EB0C7B58}C:\program files\winamp\winamp.exe] => (Allow) C:\program files\winamp\winamp.exe
    FirewallRules: [UDP Query User{4DA216CE-0649-4567-B497-4A0454E66E4F}C:\program files\winamp\winamp.exe] => (Allow) C:\program files\winamp\winamp.exe
    FirewallRules: [{35511ED0-40E6-458E-A6DE-ABF8C8CBAF9E}] => (Allow) C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe
    FirewallRules: [TCP Query User{877F725E-9D2E-4C9A-9B7C-456C19B9405B}C:\xampp\mysql\bin\mysqld.exe] => (Allow) C:\xampp\mysql\bin\mysqld.exe
    FirewallRules: [UDP Query User{0A61EBB2-4BAE-4067-91BC-8BB4FEF8285F}C:\xampp\mysql\bin\mysqld.exe] => (Allow) C:\xampp\mysql\bin\mysqld.exe
    FirewallRules: [TCP Query User{83F734CF-747F-40BE-921B-72B0F4D83A9A}C:\xampp\apache\bin\httpd.exe] => (Allow) C:\xampp\apache\bin\httpd.exe
    FirewallRules: [UDP Query User{C70553D2-217E-4B1A-BB49-B40FA532046E}C:\xampp\apache\bin\httpd.exe] => (Allow) C:\xampp\apache\bin\httpd.exe
    FirewallRules: [TCP Query User{5E09308F-57E0-4348-9C40-B65D5D525E4B}C:\program files\winamp\winamp.exe] => (Allow) C:\program files\winamp\winamp.exe
    FirewallRules: [UDP Query User{E6035EFD-3C0A-4E89-BB36-DA0DBDEBA265}C:\program files\winamp\winamp.exe] => (Allow) C:\program files\winamp\winamp.exe
    FirewallRules: [{F8C1F7D7-BA1D-4AF7-A6DF-16DFDF375EE8}] => (Allow) C:\Program Files\NVIDIA Corporation\NetService\NvNetworkService.exe
    FirewallRules: [{4E1879A2-6902-4468-B69B-EA2FEF43AAEC}] => (Allow) C:\Program Files\NVIDIA Corporation\NetService\NvNetworkService.exe
    FirewallRules: [{BD476759-BBC4-49BB-A06B-B7E653C65566}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
    FirewallRules: [{4C3435B4-3C0A-4BCD-AA19-C73D5DD98CAC}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
    FirewallRules: [{A429CD7B-2CE5-42E5-B799-04DAE9983B25}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
    FirewallRules: [{B071A24D-26E9-4C46-8F04-8843B998F147}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
    FirewallRules: [{82AB3E4E-6C98-492A-B766-F71925ADF9BA}] => (Allow) C:\Users\Mael\AppData\Roaming\uTorrent\uTorrent.exe
    FirewallRules: [{3D33542A-01FA-447B-8683-59D048639994}] => (Allow) C:\Users\Mael\AppData\Roaming\uTorrent\uTorrent.exe
    FirewallRules: [TCP Query User{3AF8B14A-CBA5-4D85-A7C9-D323CBA27410}C:\program files\eclipse\eclipse.exe] => (Allow) C:\program files\eclipse\eclipse.exe
    FirewallRules: [UDP Query User{9A53F18F-BA37-48A1-BEA1-D67939432023}C:\program files\eclipse\eclipse.exe] => (Allow) C:\program files\eclipse\eclipse.exe
    FirewallRules: [TCP Query User{739D4234-5D53-4666-AEFC-87CBAE0C6D4D}C:\windows\system32\java.exe] => (Allow) C:\windows\system32\java.exe
    FirewallRules: [UDP Query User{F83CE7BD-86E0-4068-8AEC-536E11E83B7C}C:\windows\system32\java.exe] => (Allow) C:\windows\system32\java.exe
    FirewallRules: [TCP Query User{21D252FB-8589-4D38-B1DC-C23E94818BF9}C:\xampp\filezillaftp\filezilla server.exe] => (Allow) C:\xampp\filezillaftp\filezilla server.exe
    FirewallRules: [UDP Query User{5CB16CB5-4CE1-47F2-8046-B9C92BAD33B3}C:\xampp\filezillaftp\filezilla server.exe] => (Allow) C:\xampp\filezillaftp\filezilla server.exe
    FirewallRules: [TCP Query User{01BFD555-4EFD-4BF5-B4BC-7EBAC271743E}C:\users\mael\downloads\programs\utorrent.exe] => (Allow) C:\users\mael\downloads\programs\utorrent.exe
    FirewallRules: [UDP Query User{04D05FE9-B241-44B8-9A02-9B595EDF6CA6}C:\users\mael\downloads\programs\utorrent.exe] => (Allow) C:\users\mael\downloads\programs\utorrent.exe
    FirewallRules: [TCP Query User{EB11DBCD-3B4E-4839-BBFB-854A064A0D65}C:\xampp\apache\bin\httpd.exe] => (Allow) C:\xampp\apache\bin\httpd.exe
    FirewallRules: [UDP Query User{1B15EB94-C236-401A-AD77-4577085F2CE2}C:\xampp\apache\bin\httpd.exe] => (Allow) C:\xampp\apache\bin\httpd.exe
    FirewallRules: [TCP Query User{6722498B-7D5D-4247-A733-F1044F10D88E}C:\xampp\mysql\bin\mysqld.exe] => (Allow) C:\xampp\mysql\bin\mysqld.exe
    FirewallRules: [UDP Query User{14B62829-C150-4DEE-BF2E-B0682DBA5CAF}C:\xampp\mysql\bin\mysqld.exe] => (Allow) C:\xampp\mysql\bin\mysqld.exe
    FirewallRules: [TCP Query User{6AD598FC-98C8-4CF7-9E6F-15497809E25A}C:\program files\eclipse\eclipse.exe] => (Allow) C:\program files\eclipse\eclipse.exe
    FirewallRules: [UDP Query User{015CC26E-3C50-4505-9139-5438333C781C}C:\program files\eclipse\eclipse.exe] => (Allow) C:\program files\eclipse\eclipse.exe
    FirewallRules: [TCP Query User{116A1B02-8211-443D-A796-0B987C2F7DEC}C:\program files\connectify\connectify.exe] => (Allow) C:\program files\connectify\connectify.exe
    FirewallRules: [UDP Query User{911600FC-A5F5-4D36-8F65-60B893803AD4}C:\program files\connectify\connectify.exe] => (Allow) C:\program files\connectify\connectify.exe
    FirewallRules: [{E623C4DB-57B2-4BA2-8A8A-DD6F52B4AD62}] => (Allow) C:\Program Files\Connectify\Connectify.exe
    FirewallRules: [{4B393BED-43E0-4758-AF64-02C323AB5070}] => (Allow) C:\Program Files\Connectify\ConnectifyNetServices.exe
    FirewallRules: [{9822EBD0-8DDA-4484-B493-4DCA1A140DCE}] => (Allow) C:\Program Files\Connectify\ConnectifyNetServices.exe
    FirewallRules: [{BB0C416B-51B1-495D-BEF5-467706F92FF0}] => (Allow) C:\Program Files\Connectify\ConnectifyNetServices.exe
    FirewallRules: [{FAB45C6B-8BED-4247-B03D-AC8613B070E0}] => (Allow) C:\Program Files\Connectify\ConnectifyNetServices.exe
    FirewallRules: [{F374AE9F-66AF-464F-B26E-F1BAD08B5B48}] => (Allow) C:\Program Files\Connectify\ConnectifyNetServices.exe
    FirewallRules: [{98EBD2A8-9D39-48F0-B4D8-642A54E66F34}] => (Allow) C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
    FirewallRules: [{3EAEE7AF-9BB1-48EC-8481-86EDF4DC5A64}] => (Allow) C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
    FirewallRules: [TCP Query User{557DB544-2EDC-4D83-A6A0-508EC2194C88}C:\program files\java\jre8\bin\javaw.exe] => (Allow) C:\program files\java\jre8\bin\javaw.exe
    FirewallRules: [UDP Query User{27D7A0E9-9105-4212-B9FD-E4D726E5B0B4}C:\program files\java\jre8\bin\javaw.exe] => (Allow) C:\program files\java\jre8\bin\javaw.exe
    FirewallRules: [TCP Query User{738B5B6F-E450-41BA-9B07-59A28E69D738}C:\program files\java\jre6\bin\javaw.exe] => (Allow) C:\program files\java\jre6\bin\javaw.exe
    FirewallRules: [UDP Query User{E1DE539C-6AE5-437B-B0CC-D94CBCAA61A5}C:\program files\java\jre6\bin\javaw.exe] => (Allow) C:\program files\java\jre6\bin\javaw.exe
    FirewallRules: [{FE1623DB-4A5C-4967-848E-5F6B32D2049A}] => (Allow) C:\Program Files\Microsoft Garage\Mouse without Borders\MouseWithoutBorders.exe
    FirewallRules: [TCP Query User{65467E07-E78C-4FC0-8817-FD9F3B5FE9D1}C:\users\mael\downloads\programs\utorrent.exe] => (Allow) C:\users\mael\downloads\programs\utorrent.exe
    FirewallRules: [UDP Query User{8EF43804-C994-4341-A4DB-D1A912053095}C:\users\mael\downloads\programs\utorrent.exe] => (Allow) C:\users\mael\downloads\programs\utorrent.exe
    FirewallRules: [{6B7A03E8-747A-4BED-AFAB-911A534178DA}] => (Allow) C:\Program Files\Xamarin\Bonjour\mDNSResponder.exe
    FirewallRules: [{F0180F30-1487-4A31-8E21-D2B0F8925BF3}] => (Allow) C:\Program Files\PANDORA.TV\PanService\PanProcess.exe
    FirewallRules: [{0E62FC32-F187-41FA-BA31-A05678CD3653}] => (Allow) C:\Program Files\PANDORA.TV\PanService\PanProcess.exe
    FirewallRules: [{234F2562-CB5B-4576-9A2A-9EB3D51C5B4A}] => (Allow) C:\Program Files\PANDORA.TV\PanService\PandoraService.exe
    FirewallRules: [{8BC03A13-0472-42CF-BBF8-CAFAF51A834C}] => (Allow) C:\Program Files\PANDORA.TV\PanService\PandoraService.exe
    FirewallRules: [{29636CB9-AD49-41F4-B178-2D1A2D18D5CA}] => (Allow) C:\Program Files\Google\Chrome\Application\chrome.exe
    FirewallRules: [{4357CAE1-AE62-49CB-BE5A-65059C218B86}] => (Allow) C:\Program Files\PANDORA.TV\PanService\PanProcess.exe
    FirewallRules: [{842F725C-1BDB-467F-BA17-F43B55FC008D}] => (Allow) C:\Program Files\PANDORA.TV\PanService\PanProcess.exe
    FirewallRules: [{A9B99592-5224-4BE3-94B9-90CB2FAD3BC4}] => (Allow) C:\Program Files\PANDORA.TV\PanService\PandoraService.exe
    FirewallRules: [{0C758CD8-6198-44A3-BB61-F83DD1EB2765}] => (Allow) C:\Program Files\PANDORA.TV\PanService\PandoraService.exe
    FirewallRules: [{2AA87795-EBD7-4DC4-A95C-81A16A441BCF}] => (Allow) C:\Program Files\Skype\Phone\Skype.exe
    FirewallRules: [{D1A91986-48FB-4725-B0AE-B6BFCCE68722}] => (Allow) C:\Program Files\LINE\LINE.exe
    FirewallRules: [{9CB439D5-4B95-4E6E-82E9-4D549804E710}] => (Allow) C:\Program Files\LINE\LINE.exe

    ==================== Faulty Device Manager Devices =============


    ==================== Event log errors: =========================

    Application errors:
    ==================
    Error: (10/22/2015 04:18:55 PM) (Source: WinMgmt) (EventID: 10) (User: )
    Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

    Error: (10/22/2015 03:54:47 PM) (Source: Application Error) (EventID: 1000) (User: )
    Description: Faulting application name: notepad++.exe, version: 6.6.9.0, time stamp: 0x540cd326
    Faulting module name: notepad++.exe, version: 6.6.9.0, time stamp: 0x540cd326
    Exception code: 0xc0000005
    Fault offset: 0x0000e355
    Faulting process id: 0x1c4c
    Faulting application start time: 0xnotepad++.exe0
    Faulting application path: notepad++.exe1
    Faulting module path: notepad++.exe2
    Report Id: notepad++.exe3

    Error: (10/22/2015 02:29:19 PM) (Source: WinMgmt) (EventID: 10) (User: )
    Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

    Error: (10/22/2015 02:46:01 AM) (Source: Application Error) (EventID: 1000) (User: )
    Description: Faulting application name: igfxTray.exe, version: 6.15.10.3540, time stamp: 0x5338fa37
    Faulting module name: ole32.dll, version: 6.1.7601.17514, time stamp: 0x4ce7b96f
    Exception code: 0xc0000005
    Fault offset: 0x0003aa0e
    Faulting process id: 0x1640
    Faulting application start time: 0xigfxTray.exe0
    Faulting application path: igfxTray.exe1
    Faulting module path: igfxTray.exe2
    Report Id: igfxTray.exe3

    Error: (10/22/2015 02:45:21 AM) (Source: WinMgmt) (EventID: 10) (User: )
    Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

    Error: (10/22/2015 01:19:53 AM) (Source: WinMgmt) (EventID: 10) (User: )
    Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

    Error: (10/22/2015 01:10:41 AM) (Source: MySQL) (EventID: 100) (User: )
    Description: Invalid (old?) table or database name 'properti lama'

    Error: (10/22/2015 12:57:02 AM) (Source: MySQL) (EventID: 100) (User: )
    Description: Invalid (old?) table or database name 'properti lama'

    Error: (10/22/2015 12:56:26 AM) (Source: MySQL) (EventID: 100) (User: )
    Description: Invalid (old?) table or database name 'properti lama'

    Error: (10/22/2015 12:30:22 AM) (Source: MySQL) (EventID: 100) (User: )
    Description: Invalid (old?) table or database name 'properti lama'


    System errors:
    =============
    Error: (10/22/2015 04:18:40 PM) (Source: IntelHaxm) (EventID: 11) (User: )
    Description: HAXM can't work on system with NX disabled

    Error: (10/22/2015 02:29:08 PM) (Source: IntelHaxm) (EventID: 11) (User: )
    Description: HAXM can't work on system with NX disabled

    Error: (10/22/2015 02:45:07 AM) (Source: IntelHaxm) (EventID: 11) (User: )
    Description: HAXM can't work on system with NX disabled

    Error: (10/22/2015 02:14:48 AM) (Source: Service Control Manager) (EventID: 7030) (User: )
    Description: The PEVSystemStart service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.

    Error: (10/22/2015 02:12:40 AM) (Source: Service Control Manager) (EventID: 7030) (User: )
    Description: The PEVSystemStart service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.

    Error: (10/22/2015 02:05:49 AM) (Source: Service Control Manager) (EventID: 7030) (User: )
    Description: The PEVSystemStart service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.

    Error: (10/22/2015 02:01:56 AM) (Source: Microsoft-Windows-DNS-Client) (EventID: 1012) (User: NT AUTHORITY)
    Description: There was an error while attempting to read the local hosts file.

    Error: (10/22/2015 01:19:53 AM) (Source: Microsoft-Windows-DNS-Client) (EventID: 1012) (User: NT AUTHORITY)
    Description: There was an error while attempting to read the local hosts file.

    Error: (10/22/2015 01:19:39 AM) (Source: IntelHaxm) (EventID: 11) (User: )
    Description: HAXM can't work on system with NX disabled

    Error: (10/22/2015 12:04:43 AM) (Source: Microsoft-Windows-DNS-Client) (EventID: 1012) (User: NT AUTHORITY)
    Description: There was an error while attempting to read the local hosts file.


    ==================== Memory info ===========================

    Processor: Intel(R) Core(TM) i7-4710HQ CPU @ 2.50GHz
    Percentage of memory in use: 35%
    Total physical RAM: 3210.96 MB
    Available physical RAM: 2086.16 MB
    Total Virtual: 6420.21 MB
    Available Virtual: 4886.77 MB

    ==================== Drives ================================

    Drive c: (OS) (Fixed) (Total:156.15 GB) (Free:73.11 GB) NTFS
    Drive d: (Part I) (Fixed) (Total:400 GB) (Free:96.66 GB) NTFS
    Drive e: (Part II) (Fixed) (Total:375.26 GB) (Free:327.14 GB) NTFS

    ==================== MBR & Partition Table ==================

    ========================================================
    Disk: 0 (MBR Code: Windows 7 or 8) (Size: 931.5 GB) (Disk ID: 741D2ACD)
    Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
    Partition 2: (Not Active) - (Size=156.2 GB) - (Type=07 NTFS)
    Partition 3: (Not Active) - (Size=400 GB) - (Type=07 NTFS)
    Partition 4: (Not Active) - (Size=375.3 GB) - (Type=07 NTFS)

    ==================== End of Addition.txt ============================
     

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.