Malwarebytes
www.malwarebytes.com
-Log Details-
Scan Date: 10/19/18
Scan Time: 10:51 PM
Log File: d15f5792-d3e0-11e8-8a71-002556c58733.json
-Software Information-
Version: 3.6.1.2711
Components Version: 1.0.463
Update Package Version: 1.0.7432
License: Trial
-System Information-
OS: Windows 10 (Build 10240.17443)
CPU: x86
File System: NTFS
User: Lightning\elbarck
-Scan Summary-
Scan Type: Threat Scan
Scan Initiated By: Manual
Result: Completed
Objects Scanned: 201726
Threats Detected: 0
Threats Quarantined: 0
Time Elapsed: 7 min, 8 sec
-Scan Options-
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Detect
PUM: Detect
-Scan Details-
Process: 0
(No malicious items detected)
Module: 0
(No malicious items detected)
Registry Key: 0
(No malicious items detected)
Registry Value: 0
(No malicious items detected)
Registry Data: 0
(No malicious items detected)
Data Stream: 0
(No malicious items detected)
Folder: 0
(No malicious items detected)
File: 0
(No malicious items detected)
Physical Sector: 0
(No malicious items detected)
WMI: 0
(No malicious items detected)
(end)
================================================
================================================
# -------------------------------
# Malwarebytes AdwCleaner 7.2.4.0
# -------------------------------
# Build: 09-25-2018
# Database: 2018-10-12.1 (Cloud)
# Support: https://www.malwarebytes.com/support
#
# -------------------------------
# Mode: Scan
# -------------------------------
# Start: 10-19-2018
# Duration: 00:00:52
# OS: Windows 10 Pro
# Scanned: 31969
# Detected: 2
***** [ Services ] *****
No malicious services found.
***** [ Folders ] *****
No malicious folders found.
***** [ Files ] *****
No malicious files found.
***** [ DLL ] *****
No malicious DLLs found.
***** [ WMI ] *****
No malicious WMI found.
***** [ Shortcuts ] *****
No malicious shortcuts found.
***** [ Tasks ] *****
No malicious tasks found.
***** [ Registry ] *****
No malicious registry entries found.
***** [ Chromium (and derivatives) ] *****
No malicious Chromium entries found.
***** [ Chromium URLs ] *****
PUP.Optional.Legacy Ask
PUP.Optional.Legacy AOL
***** [ Firefox (and derivatives) ] *****
No malicious Firefox entries found.
***** [ Firefox URLs ] *****
No malicious Firefox URLs found.
########## EOF - C:\AdwCleaner\Logs\AdwCleaner[S00].txt ##########
================================================
================================================
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 10.10.2018
Ran by elbarck (administrator) on LIGHTNING (19-10-2018 23:28:35)
Running from D:\Downloads\Software
Loaded Profiles: elbarck (Available Profiles: elbarck & Administrator)
Platform: Microsoft Windows 10 Pro 10240.17443 (X86) Language: English (United States)
Internet Explorer Version 11 (Default browser: Edge)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(Intel) C:\Program Files\Intel Driver and Support Assistant\DSAService.exe
() C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
(Acronis International GmbH) C:\Program Files\Common Files\Acronis\ActiveProtection\anti_ransomware_service.exe
() C:\Program Files\Common Files\Acronis\CDP\afcdpsrv.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe
(Acronis International GmbH) C:\Program Files\Common Files\Acronis\Infrastructure\mms_mini.exe
(TeamViewer GmbH) C:\Program Files\TeamViewer\TeamViewer_Service.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\NisSrv.exe
() C:\Program Files\Acronis\TrueImageHome\TrueImageMonitor.exe
() C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Acronis International GmbH) C:\Program Files\Common Files\Acronis\TibMounter\TibMounterMonitor.exe
(f.lux Software LLC) C:\Users\Mohamed\AppData\Local\FluxSoftware\Flux\flux.exe
(Eberhard Werle) C:\Program Files\Calibrize\CalibrizeResume.exe
(Microsoft Corporation) C:\Program Files\rempl\sedsvc.exe
() C:\Program Files\Common Files\Acronis\SyncAgent\syncagentsrv.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MpCmdRun.exe
(AnchorFree Inc.) C:\Program Files\Hotspot Shield\bin\cmw_srv.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Adobe Systems Incorporated) C:\Program Files\Adobe\Acrobat 11.0\Acrobat\Acrobat.exe
(Microsoft Corporation) C:\Windows\System32\NetworkUXBroker.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
(Microsoft Corporation) C:\Windows\splwow64.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Tonec Inc.) C:\Program Files\Internet Download Manager\IDMan.exe
==================== Registry (Whitelisted) ===========================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [508128 2016-01-08] (Adobe Systems Incorporated)
HKLM\...\Run: [] => [X]
HKLM\...\Run: [Acrobat Assistant 8.0] => C:\Program Files\Adobe\Acrobat 11.0\Acrobat\Acrotray.exe [3500056 2017-11-01] (Adobe Systems Inc.)
HKLM\...\Run: [ZaAntiRansomware] => "C:\Program Files\CheckPoint\Endpoint Security\TPCommon\Cipolla\ZAAR.exe"
HKLM\...\Run: [TrueImageMonitor.exe] => C:\Program Files\Acronis\TrueImageHome\TrueImageMonitor.exe [4575880 2018-09-20] ()
HKLM\...\Run: [Acronis Scheduler2 Service] => C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe [754416 2018-09-20] ()
HKLM\...\Run: [DSATray] => C:\Program Files\Intel Driver and Support Assistant\DsaTray.exe [137464 2018-07-30] (Intel)
HKLM\...\Run: [AcronisTibMounterMonitor] => C:\Program Files\Common Files\Acronis\TibMounter\TibMounterMonitor.exe [425864 2018-08-20] (Acronis International GmbH)
HKU\S-1-5-21-2712759016-4278684826-1360043078-1001\...\Run: [f.lux] => C:\Users\Mohamed\AppData\Local\FluxSoftware\Flux\flux.exe [1806344 2018-07-03] (f.lux Software LLC)
HKU\S-1-5-21-2712759016-4278684826-1360043078-1001\...\Run: [CGFLoader] => C:\Program Files\Calibrize\CalibrizeLoader.exe [1961984 2007-11-26] (Colorjinn)
HKU\S-1-5-21-2712759016-4278684826-1360043078-1001\...\Run: [CalibrizeResume] => C:\Program Files\Calibrize\CalibrizeResume.exe [413696 2007-11-26] (Eberhard Werle)
GroupPolicy: Restriction ? <==== ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Restriction <==== ATTENTION
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{e1594025-e069-4a8e-ba62-b806738defba}: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{f7e4f0b8-1a08-4b65-9cd1-3c4fbb95e59c}: [DhcpNameServer] 192.168.1.1
Internet Explorer:
==================
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <==== ATTENTION
BHO: IDM integration (IDMIEHlprObj Class) -> {0055C089-8582-441B-A0BF-17B458C2A3A8} -> C:\Program Files\Internet Download Manager\IDMIECC.dll [2018-06-20] (Internet Download Manager, Tonec Inc.)
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL [2010-03-25] (Microsoft Corporation)
BHO: Adobe Acrobat Create PDF Helper -> {AE7CD045-E861-484f-8273-0445EE161910} -> C:\Program Files\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll [2017-11-01] (Adobe Systems Incorporated)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2010-02-28] (Microsoft Corporation)
BHO: Adobe Acrobat Create PDF from Selection -> {F4971EE7-DAA0-4053-9964-665D8EE6A077} -> C:\Program Files\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll [2017-11-01] (Adobe Systems Incorporated)
Toolbar: HKLM - Adobe Acrobat Create PDF Toolbar - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll [2017-11-01] (Adobe Systems Incorporated)
Toolbar: HKU\S-1-5-21-2712759016-4278684826-1360043078-1001 -> Adobe Acrobat Create PDF Toolbar - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll [2017-11-01] (Adobe Systems Incorporated)
Edge:
======
Edge Session Restore: HKU\S-1-5-21-2712759016-4278684826-1360043078-1001 -> is enabled.
FireFox:
========
FF DefaultProfile: 4s9uw5ee.default
FF ProfilePath: C:\Users\Mohamed\AppData\Roaming\Mozilla\Firefox\Profiles\4s9uw5ee.default [2018-10-18]
FF HKLM\...\Firefox\Extensions: [web2pdfextension.17@acrobat.adobe.com] - C:\Program Files\Adobe\Acrobat 11.0\Acrobat\Browser\WCFirefoxExtn\WebExtn\signed_extn\adobe_acrobat-1.0-windows.xpi
FF Extension: (Adobe Acrobat) - C:\Program Files\Adobe\Acrobat 11.0\Acrobat\Browser\WCFirefoxExtn\WebExtn\signed_extn\adobe_acrobat-1.0-windows.xpi [2017-11-01]
FF HKU\S-1-5-21-2712759016-4278684826-1360043078-1001\...\SeaMonkey\Extensions: [mozilla_cc@internetdownloadmanager.com] - C:\Users\Mohamed\AppData\Roaming\IDM\idmmzcc5
FF Extension: (IDM CC) - C:\Users\Mohamed\AppData\Roaming\IDM\idmmzcc5 [2018-09-21] [Legacy] [not signed]
FF HKU\S-1-5-21-2712759016-4278684826-1360043078-1001\...\SeaMonkey\Extensions: [mozilla_cc2@internetdownloadmanager.com] - C:\Program Files\Internet Download Manager\idmmzcc2.xpi
FF Extension: (IDM integration) - C:\Program Files\Internet Download Manager\idmmzcc2.xpi [2017-12-20] [Legacy]
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-10] (Microsoft Corporation)
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~1\Office14\NPSPWRAP.DLL [2010-03-25] (Microsoft Corporation)
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.33.17\npGoogleUpdate3.dll [2018-10-19] (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.33.17\npGoogleUpdate3.dll [2018-10-19] (Google Inc.)
FF Plugin: Adobe Acrobat -> C:\Program Files\Adobe\Acrobat 11.0\Acrobat\Air\nppdf32.dll [2017-11-01] (Adobe Systems Inc.)
FF Plugin: adobe.com/AdobeAAMDetect -> C:\Program Files\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect32.dll [2015-07-29] (Adobe Systems)
Chrome:
=======
CHR HomePage: Default -> hxxps://www.forexfactory.com/
CHR Session Restore: Default -> is enabled.
CHR Profile: C:\Users\Mohamed\AppData\Local\Google\Chrome\User Data\Default [2018-10-19]
CHR Extension: (Slides) - C:\Users\Mohamed\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2018-10-19]
CHR Extension: (Flash Video Downloader) - C:\Users\Mohamed\AppData\Local\Google\Chrome\User Data\Default\Extensions\aiimdkdngfcipjohbjenkahhlhccpdbc [2018-10-19]
CHR Extension: (The Flash Video Downloader) - C:\Users\Mohamed\AppData\Local\Google\Chrome\User Data\Default\Extensions\amjcoehkcacocffpmhnefgoeanepjfkf [2018-10-19]
CHR Extension: (Docs) - C:\Users\Mohamed\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2018-10-19]
CHR Extension: (Google Drive) - C:\Users\Mohamed\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2018-10-19]
CHR Extension: (Flash Video Downloader) - C:\Users\Mohamed\AppData\Local\Google\Chrome\User Data\Default\Extensions\babnbebdlabbfcmekadnndbppmkhflog [2018-10-19]
CHR Extension: (YouTube) - C:\Users\Mohamed\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2018-10-19]
CHR Extension: (Adblock Plus) - C:\Users\Mohamed\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2018-10-19]
CHR Extension: (OneTab) - C:\Users\Mohamed\AppData\Local\Google\Chrome\User Data\Default\Extensions\chphlpgkkbolifaimnlloiipkdnihall [2018-10-19]
CHR Extension: (Dark Mode) - C:\Users\Mohamed\AppData\Local\Google\Chrome\User Data\Default\Extensions\dmghijelimhndkbmpgbldicpogfkceaj [2018-10-19]
CHR Extension: (Adobe Acrobat) - C:\Users\Mohamed\AppData\Local\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj [2018-10-19]
CHR Extension: (Full Page Screen Capture) - C:\Users\Mohamed\AppData\Local\Google\Chrome\User Data\Default\Extensions\fdpohaocaechififmbbbbbknoalclacl [2018-10-19]
CHR Extension: (Sheets) - C:\Users\Mohamed\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2018-10-19]
CHR Extension: (Google Docs Offline) - C:\Users\Mohamed\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2018-10-19]
CHR Extension: (AdBlock) - C:\Users\Mohamed\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2018-10-19]
CHR Extension: (Video Adblocker for Youtube™ Extension) - C:\Users\Mohamed\AppData\Local\Google\Chrome\User Data\Default\Extensions\hflefjhkfeiaignkclmphmokmmbhbhik [2018-10-19]
CHR Extension: (eBook Viewer and Converter) - C:\Users\Mohamed\AppData\Local\Google\Chrome\User Data\Default\Extensions\iioehemmiobfpokcflaihhghfnlhiadb [2018-10-19]
CHR Extension: (Font Changer with Google Web Fonts™) - C:\Users\Mohamed\AppData\Local\Google\Chrome\User Data\Default\Extensions\jgjhhoglgjdklldfgoffdiaceffijeke [2018-10-19]
CHR Extension: (Flashcontrol) - C:\Users\Mohamed\AppData\Local\Google\Chrome\User Data\Default\Extensions\mfidmkgnfgnkihnjeklbekckimkipmoe [2018-10-19]
CHR Extension: (IDM Integration Module) - C:\Users\Mohamed\AppData\Local\Google\Chrome\User Data\Default\Extensions\ngpampappnmepgilojfohadhhmbhlaek [2018-10-19]
CHR Extension: (Chrome Web Store Payments) - C:\Users\Mohamed\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2018-10-19]
CHR Extension: (Tab Snooze) - C:\Users\Mohamed\AppData\Local\Google\Chrome\User Data\Default\Extensions\pdiebiamhaleloakpcgmpnenggpjbcbm [2018-10-19]
CHR Extension: (Gmail) - C:\Users\Mohamed\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2018-10-19]
CHR Extension: (Chrome Media Router) - C:\Users\Mohamed\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2018-10-19]
CHR HKLM\...\Chrome\Extension: [efaidnbmnnnibpcajpcglclefindmkaj] - C:\Program Files\Adobe\Acrobat 11.0\Acrobat\Browser\WCChromeExtn\WCChromeExtn.crx [2017-11-01]
CHR HKLM\...\Chrome\Extension: [ngpampappnmepgilojfohadhhmbhlaek] - C:\Program Files\Internet Download Manager\IDMGCExt.crx [2018-09-21]
==================== Services (Whitelisted) ====================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R2 AcronisActiveProtectionService; C:\Program Files\Common Files\Acronis\ActiveProtection\anti_ransomware_service.exe [3956952 2018-09-20] (Acronis International GmbH)
R2 AcrSch2Svc; C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe [1157592 2018-09-20] ()
R2 afcdpsrv; C:\Program Files\Common Files\Acronis\CDP\afcdpsrv.exe [6285616 2018-10-16] ()
R2 DSAService; C:\Program Files\Intel Driver and Support Assistant\DSAService.exe [23288 2018-07-30] (Intel)
R2 hshld; C:\Program Files\Hotspot Shield\bin\cmw_srv.exe [53632 2018-09-05] (AnchorFree Inc.)
S2 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe [5073376 2018-09-19] (Malwarebytes)
R2 mmsminisrv; C:\Program Files\Common Files\Acronis\Infrastructure\mms_mini.exe [4808088 2018-08-20] (Acronis International GmbH)
S3 mobile_backup_server; C:\Program Files\Common Files\Acronis\MobileBackupServer\mobile_backup_server.exe [3004128 2018-08-20] (Acronis International GmbH)
S3 mobile_backup_status_server; C:\Program Files\Acronis\TrueImageHome\mobile_backup_status_server.exe [1762456 2018-09-20] ()
R2 syncagentsrv; C:\Program Files\Common Files\Acronis\SyncAgent\syncagentsrv.exe [7003048 2018-08-20] ()
R2 TeamViewer; C:\Program Files\TeamViewer\TeamViewer_Service.exe [11644656 2018-09-10] (TeamViewer GmbH)
R3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [277760 2015-07-10] (Microsoft Corporation)
R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23264 2017-06-03] (Microsoft Corporation)
S3 rpcapd; "%ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini" [X]
===================== Drivers (Whitelisted) ======================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R3 ACPIVPC; C:\WINDOWS\System32\drivers\AcpiVpc.sys [36176 2018-09-15] (Lenovo Corporation)
R3 AFTrafMgr1.4; C:\Program Files\Hotspot Shield\bin\TrafMgr_1_4_32.sys [50136 2018-08-24] (AnchorFree Inc.)
R3 BCM43XX; C:\WINDOWS\System32\drivers\bcmwl63l.sys [4715008 2015-07-10] (Broadcom Corporation)
R2 file_protector; C:\WINDOWS\System32\DRIVERS\file_protector.sys [490472 2018-10-16] (Acronis International GmbH)
R0 file_tracker; C:\WINDOWS\System32\DRIVERS\file_tracker.sys [291264 2018-10-16] (Acronis International GmbH)
R1 MpKsl89fe95f2; C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{988C40C6-DB6B-44DB-BF08-7798BF02D41F}\MpKsl89fe95f2.sys [49504 2018-10-19] (Microsoft Corporation)
S3 NPF; C:\WINDOWS\System32\drivers\npf.sys [36600 2013-03-01] (Riverbed Technology, Inc.)
R3 tap0901; C:\WINDOWS\System32\drivers\tap0901.sys [23040 2016-04-21] (The OpenVPN Project)
R0 tib; C:\WINDOWS\System32\DRIVERS\tib.sys [828248 2018-10-16] (Acronis International GmbH)
R2 tib_mounter; C:\WINDOWS\system32\DRIVERS\tib_mounter.sys [166232 2018-10-16] (Acronis International GmbH)
S3 tnd; C:\WINDOWS\system32\DRIVERS\tnd.sys [472920 2018-10-16] (Acronis International GmbH)
S3 UdeCx; C:\WINDOWS\System32\drivers\udecx.sys [31744 2015-07-10] ()
S3 VBoxNetAdp; C:\WINDOWS\system32\DRIVERS\VBoxNetAdp6.sys [185464 2018-08-14] (Oracle Corporation)
R2 virtual_file; C:\WINDOWS\System32\DRIVERS\virtual_file.sys [251088 2018-10-16] (Acronis International GmbH)
R0 volume_tracker; C:\WINDOWS\System32\DRIVERS\volume_tracker.sys [176912 2018-10-16] (Acronis International GmbH)
S0 WdBoot; C:\WINDOWS\System32\drivers\WdBoot.sys [37400 2015-07-10] (Microsoft Corporation)
R0 WdFilter; C:\WINDOWS\System32\drivers\WdFilter.sys [245600 2015-07-10] (Microsoft Corporation)
R2 WdNisDrv; C:\WINDOWS\System32\Drivers\WdNisDrv.sys [97632 2015-07-10] (Microsoft Corporation)
R1 ZAM_Guard; C:\WINDOWS\System32\drivers\zamguard32.sys [181496 2018-10-18] (Zemana Ltd.)
U3 iswSvc; no ImagePath
U0 Partizan; system32\drivers\Partizan.sys [X]
S3 wfpcapture; \SystemRoot\System32\drivers\wfpcapture.sys [X]
S1 ZAM; \??\C:\WINDOWS\System32\drivers\zam32.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
==================== One Month Created files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2018-10-19 23:22 - 2018-10-19 23:22 - 000016148 _____ C:\WINDOWS\system32\LIGHTNING_elbarck_HistoryPrediction.bin
2018-10-19 22:13 - 2018-10-19 22:13 - 000000000 ____D C:\Users\Mohamed\AppData\Local\mbam
2018-10-19 22:12 - 2018-10-19 22:12 - 000000000 ____D C:\Users\Mohamed\AppData\Local\mbamtray
2018-10-19 22:11 - 2018-10-19 22:11 - 000002097 _____ C:\Users\Public\Desktop\Malwarebytes.lnk
2018-10-19 22:11 - 2018-10-19 22:11 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes
2018-10-19 22:11 - 2018-09-11 13:18 - 000129248 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbae.sys
2018-10-19 18:23 - 2018-10-19 18:23 - 000000000 ____D C:\Users\Mohamed\AppData\Roaming\ThunderSoft
2018-10-19 18:23 - 2018-10-19 18:23 - 000000000 ____D C:\Users\Mohamed\AppData\Roaming\GiliSoft
2018-10-19 18:23 - 2018-10-19 18:23 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ThunderSoft
2018-10-19 18:22 - 2018-10-19 18:22 - 000000000 ____D C:\Program Files\ThunderSoft
2018-10-19 01:05 - 2018-10-19 01:05 - 000002323 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2018-10-19 01:05 - 2018-10-19 01:05 - 000002282 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2018-10-19 01:00 - 2018-10-19 01:00 - 000016148 _____ C:\WINDOWS\system32\LIGHTNING_Administrator_HistoryPrediction.bin
2018-10-19 00:45 - 2018-10-19 00:45 - 000000000 _____ C:\WINDOWS\cpepmon.mlf
2018-10-19 00:41 - 2018-10-19 00:41 - 000000000 ____D C:\Users\Administrator\AppData\Local\CrashDumps
2018-10-19 00:39 - 2018-10-19 00:39 - 000004077 _____ C:\WINDOWS\system32\Drivers\etc\hosts.txt
2018-10-19 00:23 - 2018-10-19 01:15 - 000000000 ____D C:\Users\Mohamed\AppData\Local\Google
2018-10-18 22:22 - 2018-10-18 22:34 - 000000000 ____D C:\AdwCleaner
2018-10-18 22:21 - 2018-10-19 23:28 - 000000000 ____D C:\FRST
2018-10-18 20:46 - 2018-10-19 22:11 - 000000000 ____D C:\ProgramData\Malwarebytes
2018-10-18 20:40 - 2018-10-18 20:40 - 000000000 ____D C:\Users\Mohamed\AppData\Roaming\Obsidium
2018-10-18 02:08 - 2018-10-19 00:55 - 000000000 ____D C:\Program Files\GridinSoft Anti-Malware
2018-10-18 01:28 - 2018-10-18 01:28 - 000000000 ____D C:\ProgramData\GridinSoft
2018-10-18 01:02 - 2018-10-18 01:18 - 000000000 ____D C:\WINDOWS\CryptoGuard
2018-10-18 01:02 - 2018-10-18 01:18 - 000000000 ____D C:\ProgramData\HitmanPro.Alert
2018-10-18 01:02 - 2018-10-18 01:05 - 000000000 ____D C:\ProgramData\HitmanPro
2018-10-18 00:54 - 2018-10-19 23:28 - 000207943 _____ C:\WINDOWS\ZAM_Guard.krnl.trace
2018-10-18 00:54 - 2018-10-18 01:01 - 000018452 _____ C:\WINDOWS\ZAM.krnl.trace
2018-10-18 00:54 - 2018-10-18 00:54 - 000181496 _____ (Zemana Ltd.) C:\WINDOWS\system32\Drivers\zamguard32.sys
2018-10-18 00:53 - 2018-10-18 01:36 - 000000000 ____D C:\Program Files\Zemana AntiMalware
2018-10-18 00:52 - 2018-10-18 00:52 - 000000000 ____D C:\Users\Mohamed\AppData\Local\Zemana
2018-10-18 00:16 - 2018-10-18 00:16 - 000000000 ____D C:\Users\Mohamed\AppData\Local\CEF
2018-10-17 23:54 - 2018-10-18 00:21 - 000000000 ____D C:\Program Files\UnHackMe
2018-10-17 23:17 - 2018-10-17 23:17 - 000000000 ____D C:\Program Files\Malwarebytes Anti-Malware
2018-10-17 23:15 - 2018-10-17 23:15 - 000000000 ____D C:\Program Files\Malwarebytes
2018-10-17 23:14 - 2018-10-17 23:14 - 000000000 ____D C:\WINDOWS\system32\Drivers\etc\BACKUP
2018-10-17 23:10 - 2018-10-17 23:10 - 000000000 ____D C:\WINDOWS\system32\appmgmt
2018-10-17 02:17 - 2018-10-17 02:17 - 000000000 ____D C:\Users\Mohamed\AppData\Local\Macromedia
2018-10-16 16:28 - 2018-10-16 16:28 - 000001232 _____ C:\Users\Public\Desktop\Acronis True Image.lnk
2018-10-16 00:34 - 2018-10-16 00:34 - 000000000 ____D C:\ProgramData\Xilisoft
2018-10-15 01:51 - 2018-10-15 01:51 - 000000000 ____D C:\Users\Mohamed\AppData\LocalLow\Temp
2018-10-14 21:16 - 2018-10-14 21:16 - 000000000 ____D C:\Users\Mohamed\AppData\Local\NetworkTiles
2018-10-13 23:31 - 2018-10-13 23:31 - 000000000 _____ C:\2d4bf36e44fce0617c8e1e50b770
2018-10-13 02:07 - 2018-10-18 01:36 - 000000000 ____D C:\Program Files\Unlocker
2018-10-13 01:47 - 2018-10-13 02:01 - 000223252 _____ C:\WINDOWS\ntbtlog.txt
2018-10-13 01:47 - 2018-10-13 01:47 - 000000214 _____ C:\WINDOWS\Tasks\CreateExplorerShellUnelevatedTask.job
2018-10-13 01:38 - 2018-10-13 01:38 - 000000000 ____D C:\ProgramData\LHService
2018-10-13 01:37 - 2018-10-13 01:37 - 000000000 ____D C:\ProgramData\LockHunter
2018-10-13 01:33 - 2018-10-13 01:33 - 000000000 ____D C:\Users\Mohamed\AppData\Roaming\LockHunter
2018-10-13 01:32 - 2018-10-13 01:50 - 000000000 ____D C:\Program Files\LockHunter
2018-10-13 01:24 - 2018-10-18 22:34 - 000000000 ____D C:\Users\Mohamed\AppData\Local\CrashDumps
2018-10-13 00:37 - 2018-10-13 00:42 - 000002387 _____ C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk
2018-10-13 00:37 - 2018-10-13 00:42 - 000000000 ___RD C:\Users\Administrator\OneDrive
2018-10-13 00:34 - 2018-10-13 00:34 - 000000000 ____D C:\Users\Administrator\AppData\Local\Publishers
2018-10-13 00:32 - 2018-10-17 23:36 - 000000000 ____D C:\Users\Administrator
2018-10-13 00:32 - 2018-10-13 00:56 - 000000000 ____D C:\Users\Administrator\AppData\Local\Packages
2018-10-13 00:32 - 2018-10-13 00:32 - 000002278 _____ C:\Users\Administrator\Desktop\Google Chrome.lnk
2018-10-13 00:32 - 2018-10-13 00:32 - 000000020 ___SH C:\Users\Administrator\ntuser.ini
2018-10-13 00:32 - 2018-10-13 00:32 - 000000000 ____D C:\Users\Administrator\AppData\Roaming\Adobe
2018-10-13 00:32 - 2018-10-13 00:32 - 000000000 ____D C:\Users\Administrator\AppData\Local\TileDataLayer
2018-10-13 00:32 - 2018-10-13 00:32 - 000000000 ____D C:\Users\Administrator\AppData\Local\Google
2018-10-09 20:45 - 2018-10-10 18:09 - 000000000 ____D C:\Users\Mohamed\AppData\Roaming\FileZilla
2018-10-09 20:45 - 2018-10-09 21:17 - 000000000 ____D C:\Users\Mohamed\AppData\Local\FileZilla
2018-10-09 20:44 - 2018-10-09 20:44 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FileZilla FTP Client
2018-10-09 20:44 - 2018-10-09 20:44 - 000000000 ____D C:\Program Files\FileZilla FTP Client
2018-10-01 20:20 - 2018-10-16 16:14 - 000000000 ____D C:\Users\Mohamed\AppData\Local\TeamViewer
2018-10-01 20:17 - 2018-10-10 22:26 - 000000998 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamViewer 13.lnk
2018-10-01 20:17 - 2018-10-01 20:17 - 000000000 ____D C:\Users\Mohamed\AppData\Roaming\TeamViewer
2018-10-01 20:16 - 2018-10-19 16:20 - 000000000 ____D C:\Program Files\TeamViewer
2018-09-28 21:19 - 2018-09-28 21:19 - 000000000 ____D C:\Users\Mohamed\AppData\Roaming\SolidDocuments
2018-09-25 14:17 - 2018-09-25 14:17 - 000001105 _____ C:\Users\Mohamed\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Visual Watermark.lnk
2018-09-25 14:17 - 2018-09-25 14:17 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Visual Watermark
2018-09-25 14:16 - 2018-09-25 14:20 - 000000000 ____D C:\Program Files\Visual Watermark
2018-09-25 14:16 - 2018-09-25 14:19 - 000000000 ____D C:\ProgramData\Visual Watermark
2018-09-22 14:11 - 2018-10-16 00:37 - 000000000 ____D C:\Users\Mohamed\AppData\Roaming\Xilisoft
2018-09-22 14:10 - 2018-10-19 00:25 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Xilisoft
2018-09-22 14:08 - 2018-10-19 00:25 - 000000000 ____D C:\Program Files\Xilisoft
2018-09-21 18:41 - 2018-10-19 19:20 - 000000000 ____D C:\Program Files\Intel Driver and Support Assistant
2018-09-21 18:41 - 2018-09-21 18:42 - 000000000 ____D C:\ProgramData\Intel
2018-09-21 18:41 - 2018-09-21 18:41 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Intel Driver and Support Assistant
2018-09-21 17:47 - 2009-11-06 13:48 - 000398848 _____ (Intel(R) Corporation) C:\WINDOWS\system32\TVWizudlg.exe
2018-09-21 17:47 - 2009-11-06 13:47 - 000140288 _____ () C:\WINDOWS\system32\igfxtvcx.dll
2018-09-21 17:47 - 2009-11-06 13:43 - 000121232 _____ C:\WINDOWS\system32\IScrNB.bmp
2018-09-21 17:46 - 2018-09-21 17:46 - 000000000 ____D C:\Program Files\Intel
2018-09-21 17:38 - 2018-09-21 17:47 - 000000000 ____D C:\WINDOWS\system32\Lang
2018-09-21 17:38 - 2009-11-17 10:38 - 001002008 _____ (Intel Corporation) C:\WINDOWS\system32\igxpun.exe
2018-09-21 17:36 - 2018-10-19 23:26 - 000000000 ____D C:\Users\Mohamed\AppData\Roaming\DMCache
2018-09-21 17:35 - 2018-10-05 18:50 - 000000000 ____D C:\Users\Mohamed\AppData\Roaming\IDM
2018-09-21 17:35 - 2018-09-21 17:35 - 000000000 ____D C:\ProgramData\IDM
2018-09-21 17:34 - 2018-09-21 17:34 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Internet Download Manager
2018-09-21 17:34 - 2018-09-21 17:34 - 000000000 ____D C:\Program Files\Internet Download Manager
2018-09-21 17:34 - 2018-03-01 17:36 - 000149688 _____ (Tonec Inc.) C:\WINDOWS\system32\Drivers\idmwfp.sys
2018-09-21 17:17 - 2018-10-19 22:44 - 000000000 ____D C:\Users\Mohamed\AppData\Roaming\uTorrent
2018-09-21 17:17 - 2018-09-21 17:17 - 000000878 _____ C:\Users\Mohamed\AppData\Roaming\Microsoft\Windows\Start Menu\µTorrent.lnk
2018-09-21 09:37 - 2018-09-21 09:37 - 000001059 _____ C:\Users\Mohamed\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Downloads.lnk
2018-09-20 16:53 - 2018-09-20 16:53 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Hotspot Shield
2018-09-19 08:11 - 2018-09-19 08:13 - 000000000 ____D C:\Program Files\The KMPlayer
2018-09-19 08:11 - 2018-09-19 08:11 - 000000000 ____D C:\Users\Mohamed\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\The KMPlayer
==================== One Month Modified files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2018-10-19 18:23 - 2018-09-13 22:16 - 000000000 ____D C:\Intel
2018-10-19 18:16 - 2018-09-15 14:28 - 000000000 ____D C:\Users\Mohamed
2018-10-19 16:20 - 2015-07-10 11:55 - 000000006 ____H C:\WINDOWS\Tasks\SA.DAT
2018-10-19 03:34 - 2015-07-10 08:59 - 000131072 ___SH C:\WINDOWS\system32\config\BBI
2018-10-19 01:04 - 2018-09-15 16:35 - 000000000 ____D C:\Program Files\Google
2018-10-19 00:47 - 2018-09-15 17:02 - 000000000 ____D C:\ProgramData\CheckPoint
2018-10-19 00:44 - 2015-07-10 08:59 - 000032768 ___SH C:\WINDOWS\system32\config\ELAM
2018-10-19 00:21 - 2018-09-18 12:54 - 000000000 ____D C:\Users\Mohamed\AppData\Roaming\Steganos
2018-10-18 02:40 - 2015-07-10 10:27 - 000000000 ____D C:\WINDOWS\INF
2018-10-17 23:13 - 2018-09-17 07:56 - 000000000 ____D C:\Users\Mohamed\.VirtualBox
2018-10-17 23:11 - 2018-09-17 07:56 - 000000000 ____D C:\Users\Mohamed\VirtualBox VMs
2018-10-17 23:11 - 2018-09-15 15:32 - 000000000 ____D C:\Users\Mohamed\AppData\Local\VirtualStore
2018-10-17 02:22 - 2018-09-16 01:07 - 000000000 ____D C:\Users\Mohamed\AppData\Roaming\Mozilla
2018-10-17 02:22 - 2018-09-16 01:07 - 000000000 ____D C:\Users\Mohamed\AppData\LocalLow\Mozilla
2018-10-16 16:30 - 2018-09-17 04:13 - 000490472 _____ (Acronis International GmbH) C:\WINDOWS\system32\Drivers\file_protector.sys
2018-10-16 16:30 - 2018-09-17 04:13 - 000291264 _____ (Acronis International GmbH) C:\WINDOWS\system32\Drivers\file_tracker.sys
2018-10-16 16:29 - 2018-09-17 04:12 - 000828248 _____ (Acronis International GmbH) C:\WINDOWS\system32\Drivers\tib.sys
2018-10-16 16:29 - 2018-09-17 04:12 - 000472920 _____ (Acronis International GmbH) C:\WINDOWS\system32\Drivers\tnd.sys
2018-10-16 16:29 - 2018-09-17 04:12 - 000251088 _____ (Acronis International GmbH) C:\WINDOWS\system32\Drivers\virtual_file.sys
2018-10-16 16:29 - 2018-09-17 04:12 - 000176912 _____ (Acronis International GmbH) C:\WINDOWS\system32\Drivers\volume_tracker.sys
2018-10-16 16:29 - 2018-09-17 04:12 - 000166232 _____ (Acronis International GmbH) C:\WINDOWS\system32\Drivers\tib_mounter.sys
2018-10-16 16:28 - 2018-09-17 04:12 - 000272440 _____ (Acronis International GmbH) C:\WINDOWS\system32\Drivers\snapman.sys
2018-10-16 16:28 - 2018-09-17 04:12 - 000001244 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acronis True Image.lnk
2018-10-16 00:33 - 2015-07-10 10:28 - 000000000 ____D C:\WINDOWS\AppReadiness
2018-10-15 23:48 - 2018-09-15 16:47 - 000479504 ____N (Microsoft Corporation) C:\WINDOWS\system32\MpSigStub.exe
2018-10-15 20:45 - 2018-09-17 04:09 - 000000000 ____D C:\ProgramData\Acronis
2018-10-14 18:26 - 2015-07-10 10:28 - 000000000 ____D C:\WINDOWS\system32\NDF
2018-10-13 15:47 - 2018-09-16 03:06 - 000428818 _____ C:\WINDOWS\system32\perfh001.dat
2018-10-13 15:47 - 2018-09-16 03:06 - 000064244 _____ C:\WINDOWS\system32\perfc001.dat
2018-10-13 15:47 - 2018-09-15 14:31 - 001355150 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2018-10-13 00:32 - 2018-09-15 15:33 - 000000000 __RHD C:\Users\Public\AccountPictures
2018-10-04 21:30 - 2018-09-16 01:41 - 000000000 ____D C:\Users\Mohamed\AppData\Roaming\Orbit
2018-10-02 11:27 - 2015-07-10 11:53 - 000359600 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2018-10-01 20:15 - 2015-07-10 10:28 - 000000000 ___HD C:\Program Files\WindowsApps
2018-09-22 13:19 - 2018-09-17 04:24 - 000000000 ____D C:\Users\Mohamed\AppData\Roaming\Acronis
2018-09-22 09:11 - 2015-07-10 10:20 - 000000000 ____D C:\WINDOWS\CbsTemp
2018-09-21 18:41 - 2018-09-15 18:53 - 000000000 ____D C:\ProgramData\Package Cache
2018-09-21 09:41 - 2018-09-15 15:33 - 000000000 ____D C:\Users\Mohamed\AppData\Roaming\Adobe
2018-09-20 16:54 - 2018-09-16 02:45 - 000000000 ____D C:\ProgramData\Hotspot Shield
2018-09-20 16:53 - 2018-09-16 02:46 - 000000000 ____D C:\Program Files\Hotspot Shield
==================== Files in the root of some directories =======
2018-09-17 05:02 - 2018-09-14 22:50 - 180071883 _____ () C:\Users\Mohamed\AppData\Roaming\MetaQuotes.rar
Some files in TEMP:
====================
2018-10-16 16:29 - 2018-10-16 16:29 - 000119512 _____ () C:\Users\Mohamed\AppData\Local\Temp\AcronisProductUpdateUtility.exe
2018-10-18 01:03 - 2018-10-18 01:06 - 010960168 _____ (SurfRight B.V.) C:\Users\Mohamed\AppData\Local\Temp\HitmanPro.exe
2018-10-18 20:41 - 2018-05-08 20:12 - 074288784 _____ (Malwarebytes ) C:\Users\Mohamed\AppData\Local\Temp\mb3-setup-consumer-3.5.1.2522-1.0.365-1.0.4968.exe
==================== Bamital & volsnap ======================
(There is no automatic fix for files that do not pass verification.)
C:\WINDOWS\explorer.exe => File is digitally signed
C:\WINDOWS\system32\winlogon.exe => File is digitally signed
C:\WINDOWS\system32\wininit.exe => File is digitally signed
C:\WINDOWS\system32\svchost.exe => File is digitally signed
C:\WINDOWS\system32\services.exe => File is digitally signed
C:\WINDOWS\system32\User32.dll => File is digitally signed
C:\WINDOWS\system32\userinit.exe => File is digitally signed
C:\WINDOWS\system32\rpcss.dll => File is digitally signed
C:\WINDOWS\system32\dnsapi.dll => File is digitally signed
C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2018-10-12 16:44
==================== End of FRST.txt ============================
================================================
================================================
Additional scan result of Farbar Recovery Scan Tool (x86) Version: 10.10.2018
Ran by elbarck (19-10-2018 23:30:55)
Running from D:\Downloads\Software
Microsoft Windows 10 Pro 10240.17443 (X86) (2018-09-15 13:29:19)
Boot Mode: Normal
==========================================================
==================== Accounts: =============================
Administrator (S-1-5-21-2712759016-4278684826-1360043078-500 - Administrator - Enabled) => C:\Users\Administrator
DefaultAccount (S-1-5-21-2712759016-4278684826-1360043078-503 - Limited - Disabled)
elbarck (S-1-5-21-2712759016-4278684826-1360043078-1001 - Administrator - Enabled) => C:\Users\Mohamed
Guest (S-1-5-21-2712759016-4278684826-1360043078-501 - Limited - Disabled)
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
. . . (HKLM\...\{FD87084D-762B-4B64-B34E-95FEA079327A}) (Version: 3.5.0.3 - Intel) Hidden
µTorrent (HKU\S-1-5-21-2712759016-4278684826-1360043078-1001\...\uTorrent) (Version: 3.5.4.44632 - BitTorrent Inc.)
Acronis True Image (HKLM\...\{62528BBA-21CF-4023-84EC-BB529662D496}) (Version: 23.3.14110 - Acronis) Hidden
Acronis True Image (HKLM\...\{62528BBA-21CF-4023-84EC-BB529662D496}Visible) (Version: 23.3.14110 - Acronis)
Adobe Acrobat XI Pro (HKLM\...\{AC76BA86-1033-FFFF-7760-000000000006}) (Version: 11.0.23 - Adobe Systems)
Adobe Digital Editions 4.5 (HKLM\...\Adobe Digital Editions 4.5) (Version: 4.5.8 - Adobe Systems Incorporated)
AGEA (HKLM\...\AGEAStreamster) (Version: - )
Calibrize 2.0 (HKLM\...\Calibrize_is1) (Version: - Colorjinn)
f.lux (HKU\S-1-5-21-2712759016-4278684826-1360043078-1001\...\Flux) (Version: - f.lux Software LLC)
FBS MetaTrader 5 (HKLM\...\FBS MT5) (Version: 5.00 - MetaQuotes Software Corp.)
FBS Trader 4 (HKLM\...\FBS 02) (Version: 4.00 - MetaQuotes Software Corp.)
FBS Trader 4 MultiTerminal (HKLM\...\FBS 01) (Version: 4.00 - MetaQuotes Software Corp.)
FileZilla Client 3.37.4 (HKLM\...\FileZilla Client) (Version: 3.37.4 - Tim Kosse)
ForexChief MT4 (HKLM\...\ForexChief 01) (Version: 4.00 - MetaQuotes Software Corp.)
ForexChief MT4 (HKLM\...\ForexChief 02) (Version: 4.00 - MetaQuotes Software Corp.)
ForexChief MT5 (HKLM\...\ForexChief MT5) (Version: 5.00 - MetaQuotes Software Corp.)
Fort Financial Services MetaTrader 5 (HKLM\...\Fortfs MT5) (Version: 5.00 - MetaQuotes Software Corp.)
Fort MT4 Terminal (HKLM\...\Fortfs 01) (Version: 4.00 - MetaQuotes Software Corp.)
Fort MT4 Terminal (HKLM\...\Fortfs 02) (Version: 4.00 - MetaQuotes Software Corp.)
Fort MT4 Terminal (HKLM\...\Fortfs 03) (Version: 4.00 - MetaQuotes Software Corp.)
Free Screen Recorder 8.3.0 (HKLM\...\{2039a3a0-a6fd-44d6-9568-0b8cc92945c2}_is1) (Version: 8.3.0 - ThunderSoft Studio)
Google Chrome (HKLM\...\Google Chrome) (Version: 70.0.3538.67 - Google Inc.)
Google Update Helper (HKLM\...\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}) (Version: 1.3.33.17 - Google Inc.) Hidden
HotForex MetaTrader (HKLM\...\HotForex) (Version: 4.00 - MetaQuotes Software Corp.)
Hotspot Shield 7.12.1 (HKLM\...\{09f8e8f3-99c4-49a2-961c-30be45d6392b}) (Version: 7.12.1.11056 - AnchorFree Inc.)
Hotspot Shield 7.12.1 (HKLM\...\{AF599C42-A2E5-4251-B7EE-4925C1E7BE53}) (Version: 7.12.1.11056 - AnchorFree Inc.) Hidden
Hotspot Shield 7.12.1 (HKLM\...\HotspotShield) (Version: 7.12.1 - AnchorFree Inc.) Hidden
Intel(R) Graphics Media Accelerator Driver (HKLM\...\HDMI) (Version: 8.15.10.1994 - Intel Corporation)
Intel(R) TV Wizard (HKLM\...\TVWiz) (Version: - Intel Corporation)
Intel® Driver & Support Assistant (HKLM\...\{3252578f-e595-4827-a6ed-0a278bbbdae8}) (Version: 3.5.0.3 - Intel)
Internet Download Manager 6.31.5 (HKLM\...\Internet Download Manager_is1) (Version: 6.31.5 - lrepacks.ru)
K-Lite Codec Pack 14.4.5 Full (HKLM\...\KLiteCodecPack_is1) (Version: 14.4.5 - KLCP)
Malwarebytes version 3.6.1.2711 (HKLM\...\{35065F43-4BB2-439A-BFF7-0F1014F2E0CD}_is1) (Version: 3.6.1.2711 - Malwarebytes)
Mendeley Desktop 1.19.2 (HKLM\...\Mendeley Desktop) (Version: 1.19.2 - Mendeley Ltd.)
MetaTrader - FXOpen (HKLM\...\FXOpen 01) (Version: 6.00 - MetaQuotes Software Corp.)
MetaTrader - FXOpen (HKLM\...\FXOpen 02) (Version: 6.00 - MetaQuotes Software Corp.)
MetaTrader - FXOpen (HKLM\...\FXOpen 03) (Version: 6.00 - MetaQuotes Software Corp.)
MetaTrader - FXOpen (HKLM\...\FXOpen 04) (Version: 6.00 - MetaQuotes Software Corp.)
Microsoft Office Professional Plus 2010 (HKLM\...\Office14.PROPLUS) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Office Proofing Tools Kit Compilation 2010 (HKLM\...\Office14.PROOFKIT) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319 (HKLM\...\{196BB40D-1578-3D01-B289-BEFC77A11A1E}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM\...\{f65db027-aff3-4070-886a-0d87064aabb1}) (Version: 12.0.30501.0 - Microsoft Corporation)
MT4 - FXCL (HKLM\...\FXCL 01) (Version: 4.00 - MetaQuotes Software Corp.)
MT4 - FXCL (HKLM\...\FXCL 02) (Version: 4.00 - MetaQuotes Software Corp.)
MT4 - FXCL (HKLM\...\FXCL 03) (Version: 4.00 - MetaQuotes Software Corp.)
TAP-Windows 9.21.2 (HKLM\...\TAP-Windows) (Version: 9.21.2 - )
TeamViewer 13 (HKLM\...\TeamViewer) (Version: 13.2.26558 - TeamViewer)
The KMPlayer (remove only) (HKLM\...\The KMPlayer) (Version: - )
UpdateAssistant (HKLM\...\{D66FEADA-C0EB-446E-955B-77E60B1FD5A1}) (Version: 1.19.0.0 - Microsoft Corporation) Hidden
Visual Watermark 2.9.33 (HKLM\...\Visual Watermark_is1) (Version: - VisualWatermark.com)
Windows Setup Remediations (x86) (KB4023057) (HKLM\...\{49cd2afd-8679-48a5-90ab-e7044bee2465}.sdb) (Version: - )
WinPcap 4.1.3 (HKLM\...\WinPcapInst) (Version: 4.1.0.2980 - Riverbed Technology, Inc.)
WinRAR 5.40 (32-bit) (HKLM\...\WinRAR archiver) (Version: 5.40.0 - win.rar GmbH)
Xilisoft Video Converter Ultimate (HKLM\...\Xilisoft Video Converter Ultimate) (Version: 7.8.19.20170209 - Xilisoft)
==================== Custom CLSID (Whitelisted): ==========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
ShellIconOverlayIdentifiers: [ IDM Shell Extension] -> {CDC95B92-E27C-4745-A8C5-64A52A78855D} => C:\Program Files\Internet Download Manager\IDMShellExt.dll [2018-05-12] (Tonec Inc.)
ShellIconOverlayIdentifiers: [ AcronisDrive] -> {5D74FD4B-4EFB-4586-8022-8637BBE40970} => C:\Program Files\Acronis\TrueImageHome\tishell.dll [2018-08-20] ()
ShellIconOverlayIdentifiers: [ AcronisSyncError] -> {934BC6C0-FEC2-4df5-A100-961DE2C8A0ED} => C:\Program Files\Acronis\TrueImageHome\tishell.dll [2018-08-20] ()
ShellIconOverlayIdentifiers: [ AcronisSyncInProgress] -> {00F848DC-B1D4-4892-9C25-CAADC86A215D} => C:\Program Files\Acronis\TrueImageHome\tishell.dll [2018-08-20] ()
ShellIconOverlayIdentifiers: [ AcronisSyncOk] -> {71573297-552E-46fc-BE3D-3DFAF88D47B7} => C:\Program Files\Acronis\TrueImageHome\tishell.dll [2018-08-20] ()
ContextMenuHandlers1: [Adobe.Acrobat.ContextMenu] -> {A6595CD1-BF77-430A-A452-18696685F7C7} => C:\Program Files\Adobe\Acrobat 11.0\Acrobat Elements\ContextMenuShim.dll [2012-09-24] (Adobe Systems Inc.)
ContextMenuHandlers1: [WinRAR] -> {B41DB860-8EE4-11D2-9906-E49FADC173CA} => C:\Program Files\WinRAR\rarext.dll [2016-08-15] (Alexander Roshal)
ContextMenuHandlers3: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2018-09-19] (Malwarebytes)
ContextMenuHandlers5: [igfxcui] -> {3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4} => C:\WINDOWS\system32\igfxpph.dll [2009-11-06] (Intel Corporation)
ContextMenuHandlers6: [Adobe.Acrobat.ContextMenu] -> {A6595CD1-BF77-430A-A452-18696685F7C7} => C:\Program Files\Adobe\Acrobat 11.0\Acrobat Elements\ContextMenuShim.dll [2012-09-24] (Adobe Systems Inc.)
ContextMenuHandlers6: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2018-09-19] (Malwarebytes)
ContextMenuHandlers6: [WinRAR] -> {B41DB860-8EE4-11D2-9906-E49FADC173CA} => C:\Program Files\WinRAR\rarext.dll [2016-08-15] (Alexander Roshal)
==================== Scheduled Tasks (Whitelisted) =============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
Task: {0E469903-3E2A-47FB-A23A-E5630B8263D1} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2018-08-14] (Adobe Systems Incorporated)
Task: {35F3C243-6ED2-4E63-873A-EDD151EB2FBB} - System32\Tasks\OneDrive Standalone Update Task-S-1-5-21-2712759016-4278684826-1360043078-500 => C:\Users\Mohamed\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe
Task: {A9F705F9-8AE3-4941-BDBB-3375C92D0385} - System32\Tasks\Microsoft\Windows\Setup\EOSNotify => C:\WINDOWS\system32\EOSNotify.exe [2018-04-07] (Microsoft Corporation)
Task: {C664322A-E069-4220-A474-E6FBDEF9B8D9} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2018-10-19] (Google Inc.)
Task: {C81734B7-19A5-481B-8AFE-AAAF7D718B48} - System32\Tasks\AdobeGCInvoker-1.0-Lightning-elbarck => C:\Program Files\Common Files\Adobe\AdobeGCClient\AGCInvokerUtility.exe [2018-05-11] (Adobe Systems, Incorporated)
Task: {E6109CD1-5074-42AA-B9DC-55C70345A1DA} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2018-10-19] (Google Inc.)
Task: {F95EB5BB-2F2B-4384-A5D0-DBCFA2DC6A27} - System32\Tasks\klcp_update => CodecTweakTool.exe
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
Task: C:\WINDOWS\Tasks\CreateExplorerShellUnelevatedTask.job => C:\WINDOWS\explorer.exe
==================== Shortcuts & WMI ========================
(The entries could be listed to be restored or removed.)
==================== Loaded Modules (Whitelisted) ==============
2018-09-16 08:01 - 2015-07-15 04:41 - 000025088 _____ () C:\WINDOWS\SYSTEM32\licensemanagerapi.dll
2018-09-16 08:02 - 2016-10-25 08:17 - 000301056 _____ () C:\WINDOWS\System32\diagtrack_wininternal.dll
2018-09-20 20:10 - 2018-09-20 20:10 - 001157592 _____ () C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
2018-09-20 20:58 - 2018-09-20 20:58 - 000102272 _____ () C:\Program Files\Common Files\Acronis\Schedule2\schdevid.dll
2018-09-20 20:55 - 2018-09-20 20:55 - 022984336 _____ () C:\Program Files\Acronis\TrueImageHome\ti_managers.dll
2018-09-20 20:20 - 2018-09-20 20:20 - 000415448 _____ () C:\Program Files\Common Files\Acronis\Home\resource.dll
2018-08-20 21:42 - 2018-08-20 21:42 - 000277538 _____ () C:\Program Files\Common Files\Acronis\ActiveProtection\LIBMAGIC.dll
2018-08-20 21:48 - 2018-08-20 21:48 - 002386352 _____ () C:\Program Files\Common Files\Acronis\ActiveProtection\xerces_c.dll
2018-08-20 21:42 - 2018-08-20 21:42 - 000160168 _____ () C:\Program Files\Common Files\Acronis\Home\libevent.dll
2018-08-20 21:58 - 2018-08-20 21:58 - 000685488 _____ () C:\Program Files\Common Files\Acronis\Home\sqlite3.dll
2018-10-16 16:30 - 2018-10-16 16:30 - 006285616 _____ () C:\Program Files\Common Files\Acronis\CDP\afcdpsrv.exe
2018-09-20 20:58 - 2018-09-20 20:58 - 003511960 _____ () C:\Program Files\Common Files\Acronis\Infrastructure\atih_mms_addon.dll
2018-09-20 21:00 - 2018-09-20 21:00 - 001169432 _____ () C:\Program Files\Common Files\Acronis\Infrastructure\services_mms_addon.dll
2018-09-20 20:22 - 2018-09-20 20:22 - 000178376 _____ () C:\Program Files\Common Files\Acronis\Home\archive3_adapter.dll
2018-08-20 21:45 - 2018-08-20 21:45 - 000271392 _____ () C:\Program Files\Common Files\Acronis\Home\pcs_io.dll
2018-08-20 21:48 - 2018-08-20 21:48 - 000042928 _____ () C:\Program Files\Common Files\Acronis\Home\winpthreads4.dll
2018-08-20 21:49 - 2018-08-20 21:49 - 000225312 _____ () C:\Program Files\Common Files\Acronis\Home\zstd.dll
2018-09-20 20:10 - 2018-09-20 20:10 - 001087272 _____ () C:\Program Files\Common Files\Acronis\Home\schedule.dll
2018-08-20 21:35 - 2018-08-20 21:35 - 000143904 _____ () C:\Program Files\Acronis\TrueImageHome\afcdpapi.dll
2018-08-20 21:47 - 2018-08-20 21:47 - 000255008 _____ () C:\Program Files\Common Files\Acronis\Home\sync_agent_api.dll
2018-09-16 08:02 - 2017-06-03 14:52 - 001766488 _____ () C:\WINDOWS\system32\CoreUIComponents.dll
2018-08-20 21:47 - 2018-08-20 21:47 - 005269128 _____ () C:\Program Files\Acronis\TrueImageHome\tishell.dll
2010-01-30 11:41 - 2010-01-30 11:41 - 004254560 _____ () C:\Program Files\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF
2010-03-25 06:17 - 2010-03-25 06:17 - 008794464 _____ () C:\Program Files\Microsoft Office\Office14\1033\GrooveIntlResource.dll
2018-10-04 16:58 - 2018-10-04 16:58 - 000049320 _____ () C:\Program Files\FileZilla FTP Client\fzshellext.dll
2018-09-16 08:02 - 2016-09-07 06:01 - 000288768 _____ () C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\QuickActions.dll
2015-07-10 10:24 - 2015-07-10 10:24 - 000111104 _____ () C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\XamlTileRendering.dll
2018-09-16 08:01 - 2017-03-28 08:47 - 000405504 _____ () C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\MtcUvc.dll
2018-09-16 08:03 - 2016-11-19 07:29 - 004317696 _____ () C:\WINDOWS\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CortanaApi.dll
2018-09-16 08:02 - 2016-11-19 07:26 - 000377856 _____ () C:\WINDOWS\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Core.dll
2018-09-16 08:02 - 2017-06-03 11:28 - 001183232 _____ () C:\WINDOWS\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.BackgroundTask.dll
2018-09-16 08:03 - 2016-09-07 05:51 - 001425920 _____ () C:\WINDOWS\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersUI.dll
2015-07-10 10:25 - 2015-07-10 12:49 - 000107520 _____ () C:\WINDOWS\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CortanaApi.ProxyStub.dll
2018-09-20 21:01 - 2018-09-20 21:01 - 004575880 _____ () C:\Program Files\Acronis\TrueImageHome\TrueImageMonitor.exe
2018-09-20 20:20 - 2018-09-20 20:20 - 010683096 _____ () C:\Program Files\Acronis\TrueImageHome\qt_resources.dll
2018-08-20 21:45 - 2018-08-20 21:45 - 000804264 _____ () C:\Program Files\Acronis\TrueImageHome\qt_supp.dll
2018-09-20 20:26 - 2018-09-20 20:26 - 001485080 _____ () C:\Program Files\Acronis\TrueImageHome\qt_supp_ex.dll
2018-09-20 20:20 - 2018-09-20 20:20 - 000057048 _____ () C:\Program Files\Common Files\Acronis\Home\rpc_client.dll
2018-08-20 21:48 - 2018-08-20 21:48 - 000444336 _____ () C:\Program Files\Common Files\Acronis\Home\ulxmlrpcpp.dll
2018-08-20 21:36 - 2018-08-20 21:36 - 000115632 _____ () C:\Program Files\Common Files\Acronis\Home\expat.dll
2018-08-20 21:35 - 2018-08-20 21:35 - 000680480 _____ () C:\Program Files\Common Files\Acronis\Home\archive3.dll
2018-09-20 20:10 - 2018-09-20 20:10 - 000754416 _____ () C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe
2018-08-20 21:47 - 2018-08-20 21:47 - 007003048 _____ () C:\Program Files\Common Files\Acronis\SyncAgent\syncagentsrv.exe
2018-10-19 01:05 - 2018-10-16 02:23 - 004238168 _____ () C:\Program Files\Google\Chrome\Application\70.0.3538.67\libglesv2.dll
2018-10-19 01:05 - 2018-10-16 02:23 - 000096600 _____ () C:\Program Files\Google\Chrome\Application\70.0.3538.67\libegl.dll
2018-09-05 16:06 - 2018-09-05 16:06 - 000161152 _____ () C:\Program Files\Hotspot Shield\bin\CrashRpt1403.dll
2012-09-24 05:43 - 2012-09-24 05:43 - 000313992 _____ () C:\Program Files\Adobe\Acrobat 11.0\Acrobat\sqlite.dll
==================== Alternate Data Streams (Whitelisted) =========
(If an entry is included in the fixlist, only the ADS will be removed.)
==================== Safe Mode (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" value will be restored.)
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMService => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MBAMService => ""="Service"
==================== Association (Whitelisted) ===============
(If an entry is included in the fixlist, the registry item will be restored to default or removed.)
==================== Internet Explorer trusted/restricted ===============
(If an entry is included in the fixlist, it will be removed from the registry.)
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2015-07-10 10:28 - 2018-10-19 00:59 - 000004077 ____R C:\WINDOWS\system32\Drivers\etc\hosts
127.0.0.1 localhost
==================== Other Areas ============================
(Currently there is no automatic fix for this section.)
HKU\S-1-5-21-2712759016-4278684826-1360043078-1001\Control Panel\Desktop\\Wallpaper -> c:\windows\web\wallpaper\windows\img0.jpg
DNS Servers: 192.168.1.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 0) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer => (SmartScreenEnabled: Off)
Windows Firewall is enabled.
==================== MSCONFIG/TASK MANAGER disabled items ==
If an entry is included in the fixlist, it will be removed.
HKLM\...\StartupApproved\Run: => "Acrobat Assistant 8.0"
HKLM\...\StartupApproved\Run: => "AdobeAAMUpdater-1.0"
HKLM\...\StartupApproved\Run: => "ZaAntiRansomware"
HKLM\...\StartupApproved\Run: => "SAFE17 File Redirection Starter"
HKLM\...\StartupApproved\Run: => "Steganos HotKeys"
HKLM\...\StartupApproved\Run: => "SAFE17 Notifier"
HKLM\...\StartupApproved\Run: => "SAFE17 Browser Monitor"
HKLM\...\StartupApproved\Run: => "DSATray"
HKU\S-1-5-21-2712759016-4278684826-1360043078-1001\...\StartupApproved\Run: => "CGFLoader"
==================== FirewallRules (Whitelisted) ===============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
FirewallRules: [TCP Query User{30952606-9049-4EFF-B65C-504982C3F631}C:\program files\orbitdownloader\orbitnet.exe] => (Allow) C:\program files\orbitdownloader\orbitnet.exe
FirewallRules: [UDP Query User{C3CB9896-0C3C-466E-85DC-942E99F8AC8F}C:\program files\orbitdownloader\orbitnet.exe] => (Allow) C:\program files\orbitdownloader\orbitnet.exe
FirewallRules: [{ED48FC4E-79E6-40BC-AFA0-EAD85823A545}] => (Allow) C:\Program Files\Forex\ForexChief MT5\metatester.exe
FirewallRules: [TCP Query User{DD676AFA-D650-4E18-9C49-2F003DA6F391}F:\all\mozilla master\apps\firefox\app\firefox\firefox.exe] => (Allow) F:\all\mozilla master\apps\firefox\app\firefox\firefox.exe
FirewallRules: [UDP Query User{DA43D6B5-C700-48B2-ABC1-DB5943169177}F:\all\mozilla master\apps\firefox\app\firefox\firefox.exe] => (Allow) F:\all\mozilla master\apps\firefox\app\firefox\firefox.exe
FirewallRules: [{8EEB7CA4-5249-4251-8821-426F122BACF7}] => (Allow) C:\Users\Mohamed\AppData\Roaming\uTorrent\uTorrent.exe
FirewallRules: [{A7684CB5-D720-453C-B221-196E3BB719B3}] => (Allow) C:\Users\Mohamed\AppData\Roaming\uTorrent\uTorrent.exe
FirewallRules: [{6B315E3E-EB10-45B8-949A-391AB6046F42}] => (Allow) C:\Program Files\Xilisoft\Video Converter Ultimate 6\Xilisoft Video Converter Ultimate 6 Update.exe
FirewallRules: [{A44A5971-8E2F-49CE-9E2E-D31E9B99F4C0}] => (Allow) C:\Program Files\Xilisoft\Video Converter Ultimate 6\Xilisoft Video Converter Ultimate 6 Update.exe
FirewallRules: [{20325AB2-120F-4F6B-8006-67CBFB7362F8}] => (Allow) C:\Program Files\Xilisoft\Video Converter Ultimate 6\Xilisoft Video Converter Ultimate 6 Update.exe
FirewallRules: [{233F6DDD-FA7D-48A5-BA34-1D3F26A00F04}] => (Allow) C:\Program Files\Xilisoft\Video Converter Ultimate 6\Xilisoft Video Converter Ultimate 6 Update.exe
FirewallRules: [{C69E4C77-1DF8-41A1-86B6-F3E8DDDEB078}] => (Allow) C:\Program Files\TeamViewer\TeamViewer.exe
FirewallRules: [{BE0AEBD5-097C-4325-8168-7B313C74C48E}] => (Allow) C:\Program Files\TeamViewer\TeamViewer.exe
FirewallRules: [{E2C3DF93-A480-4796-BF51-51A01410E42E}] => (Allow) C:\Program Files\TeamViewer\TeamViewer_Service.exe
FirewallRules: [{C1B72D69-8CD5-4724-8957-115E37F13F26}] => (Allow) C:\Program Files\TeamViewer\TeamViewer_Service.exe
FirewallRules: [{6D61C71A-DA59-4243-B78A-2939FAE16265}] => (Allow) C:\Program Files\Common Files\Acronis\SyncAgent\syncagentsrv.exe
FirewallRules: [{F18F5D0F-186B-49E4-8035-FA61F5327AF4}] => (Allow) C:\Program Files\Common Files\Acronis\Infrastructure\mms_mini.exe
FirewallRules: [{CCE4A29B-FAF7-4ED1-AA4C-6ECDBB66548C}] => (Allow) C:\Program Files\Acronis\TrueImageHome\TrueImage.exe
FirewallRules: [{C531FAC2-A6F7-4C55-A355-496C8C03EA13}] => (Allow) C:\Program Files\Acronis\TrueImageHome\TrueImageMonitor.exe
FirewallRules: [{D82C55A9-4BC3-4AF9-ACBA-96D1ABE9AA28}] => (Allow) C:\Program Files\Acronis\TrueImageHome\TrueImageTools.exe
FirewallRules: [{E6D1FC8D-0BAD-47CD-8B53-0B70EE054094}] => (Allow) C:\Program Files\Common Files\Acronis\TrueImageHome\TrueImageHomeService.exe
FirewallRules: [{9553D2D3-EF29-4E1C-B8CE-307527544F7A}] => (Allow) C:\Program Files\Acronis\TrueImageHome\MediaBuilder.exe
FirewallRules: [{82FB2123-3E39-4A3B-9835-9A26CAA71EAA}] => (Allow) C:\Program Files\Acronis\TrueImageHome\SystemReport.exe
FirewallRules: [{C79577D3-EEDF-4705-839B-E4F4D2F4CEC6}] => (Allow) C:\Program Files\Acronis\TrueImageHome\acronis_drive.exe
FirewallRules: [{4740BECD-448A-4E38-81F2-DB3599846209}] => (Allow) C:\Program Files\Common Files\Acronis\MobileBackupServer\mobile_backup_server.exe
FirewallRules: [{3B36325E-212A-4C27-A90A-B767BBF293B4}] => (Allow) C:\Program Files\Acronis\TrueImageHome\mobile_backup_status_server.exe
FirewallRules: [{F64D1835-DB9C-41EF-98D0-C1B199155151}] => (Allow) C:\Program Files\Acronis\TrueImageHome\ga_service.exe
FirewallRules: [{EAE719D6-6BE5-4F81-948B-D71A955C2150}] => (Allow) C:\Program Files\Acronis\TrueImageHome\LicenseActivator.exe
FirewallRules: [{95C96C34-7E80-416A-A134-0EE812056892}] => (Allow) C:\Program Files\Common Files\Acronis\ActiveProtection\anti_ransomware_service.exe
FirewallRules: [{A8E777B6-2A3C-46FD-9D75-B217422D62C0}] => (Allow) C:\Program Files\CheckPoint\ZoneAlarm\vsmon.exe
FirewallRules: [{443426AF-4B37-43A7-BDB6-C8A38E9D1784}] => (Allow) C:\Program Files\CheckPoint\ZoneAlarm\vsmon.exe
FirewallRules: [{22184A9A-AB5C-4009-9D5E-7273EAD2770B}] => (Allow) C:\Program Files\CheckPoint\ZoneAlarm\vsmon.exe
FirewallRules: [{9073585A-DBE1-40AC-9A64-6C63AA46763C}] => (Allow) C:\Program Files\CheckPoint\ZoneAlarm\vsmon.exe
FirewallRules: [{1787407F-F6C3-4C05-A8D1-9BBB0B73ACB6}] => (Allow) C:\Program Files\Google\Chrome\Application\chrome.exe
StandardProfile\AuthorizedApplications: [C:\Program Files\Orbitdownloader\orbitdm.exe] => Enabled:Orbit
StandardProfile\AuthorizedApplications: [C:\Program Files\Orbitdownloader\orbitnet.exe] => Enabled:Orbit
==================== Restore Points =========================
17-10-2018 15:59:37 Scheduled Checkpoint
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (10/19/2018 10:01:49 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: Cryptographic Services failed while processing the OnIdentity() call in the System Writer Object.
Details:
AddLegacyDriverFiles: Unable to back up image of binary Microsoft Link-Layer Discovery Protocol.
System Error:
Access is denied.
.
Error: (10/19/2018 10:00:41 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: Cryptographic Services failed while processing the OnIdentity() call in the System Writer Object.
Details:
AddLegacyDriverFiles: Unable to back up image of binary Microsoft Link-Layer Discovery Protocol.
System Error:
Access is denied.
.
Error: (10/19/2018 07:17:44 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: The program hsscp.exe version 7.12.1.11056 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Security and Maintenance control panel.
Process ID: 14c8
Start Time: 01d467cf920523fb
Termination Time: 4294967295
Application Path: C:\Program Files\Hotspot Shield\bin\hsscp.exe
Report Id: e258e2ba-d3c2-11e8-9418-002556c58733
Faulting package full name:
Faulting package-relative application ID:
Error: (10/19/2018 04:31:55 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: Cryptographic Services failed while processing the OnIdentity() call in the System Writer Object.
Details:
AddLegacyDriverFiles: Unable to back up image of binary Microsoft Link-Layer Discovery Protocol.
System Error:
Access is denied.
.
Error: (10/19/2018 04:31:50 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: Cryptographic Services failed while processing the OnIdentity() call in the System Writer Object.
Details:
AddLegacyDriverFiles: Unable to back up image of binary Microsoft Link-Layer Discovery Protocol.
System Error:
Access is denied.
.
Error: (10/19/2018 04:30:43 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: Cryptographic Services failed while processing the OnIdentity() call in the System Writer Object.
Details:
AddLegacyDriverFiles: Unable to back up image of binary Microsoft Link-Layer Discovery Protocol.
System Error:
Access is denied.
.
Error: (10/19/2018 04:30:35 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: Cryptographic Services failed while processing the OnIdentity() call in the System Writer Object.
Details:
AddLegacyDriverFiles: Unable to back up image of binary Microsoft Link-Layer Discovery Protocol.
System Error:
Access is denied.
.
Error: (10/19/2018 04:27:14 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: Cryptographic Services failed while processing the OnIdentity() call in the System Writer Object.
Details:
AddLegacyDriverFiles: Unable to back up image of binary Microsoft Link-Layer Discovery Protocol.
System Error:
Access is denied.
.
System errors:
=============
Error: (10/19/2018 04:20:49 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The Hotspot Shield Service service failed to start due to the following error:
The service did not respond to the start or control request in a timely fashion.
Error: (10/19/2018 04:20:49 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: A timeout was reached (30000 milliseconds) while waiting for the Hotspot Shield Service service to connect.
Error: (10/19/2018 03:34:28 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The Group Policy Client service failed to start due to the following error:
The service did not respond to the start or control request in a timely fashion.
Error: (10/19/2018 03:34:28 AM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: A timeout (30000 milliseconds) was reached while waiting for a transaction response from the gpsvc service.
Error: (10/19/2018 03:34:01 AM) (Source: Service Control Manager) (EventID: 7043) (User: )
Description: The Acronis Nonstop Backup Service service did not shut down properly after receiving a preshutdown control.
Error: (10/19/2018 03:33:58 AM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: A timeout (30000 milliseconds) was reached while waiting for a transaction response from the Appinfo service.
Error: (10/19/2018 03:33:25 AM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: The User Data Access_Session1 service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 10000 milliseconds: Restart the service.
Error: (10/19/2018 03:33:25 AM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: The User Data Storage_Session1 service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 10000 milliseconds: Restart the service.
Windows Defender:
===================================
Date: 2018-10-19 19:19:08.377
Description:
Windows Defender has detected a suspicious behavior.
Name: Informational:Behavior/ModifiedKernel
ID: 4044057327
Severity: Low
Category: Suspicious Behavior
Path Found: process:_0
Detection Origin: Unknown
Detection Type: Suspicious
Detection Source: Real-Time Protection
Status: Executing
Process Name: Unknown
Signature ID: 717259538435
Signature Version: AV: 1.279.102.0, AS: 1.279.102.0
Engine Version: 1.1.15400.4
Fidelity Label: Low
Target File Name:
Date: 2018-10-19 03:29:09.928
Description:
Windows Defender scan has been stopped before completion.
Scan ID: {918FC8A4-EB2C-4A1D-9106-BAC0DA688884}
Scan Type: Antimalware
Scan Parameters: Quick Scan
Date: 2018-10-16 15:36:58.910
Description:
Windows Defender scan has been stopped before completion.
Scan ID: {A47A9463-54BE-4098-BC44-C76B6209D31D}
Scan Type: Antimalware
Scan Parameters: Quick Scan
Date: 2018-10-15 18:07:02.510
Description:
Windows Defender scan has been stopped before completion.
Scan ID: {323C067F-7396-46A4-815F-70C279385C27}
Scan Type: Antimalware
Scan Parameters: Quick Scan
Date: 2018-10-10 15:18:02.428
Description:
Windows Defender scan has been stopped before completion.
Scan ID: {2E7480EF-A2F6-4B4F-9B89-9300B0F4139A}
Scan Type: Antimalware
Scan Parameters: Quick Scan
Date: 2018-10-13 01:47:11.843
Description:
Windows Defender Real-Time Protection feature has encountered an error and failed.
Feature: On Access
Error Code: 0x8007043c
Error description: This service cannot be started in Safe Mode
Reason: Antimalware protection has stopped functioning for an unknown reason. In some instances, restarting the service may resolve the problem.
Date: 2018-10-09 14:19:29.152
Description:
Windows Defender has encountered an error trying to update signatures.
New Signature Version:
Previous Signature Version: 1.277.724.0
Update Source: Microsoft Malware Protection Center
Signature Type: AntiSpyware
Update Type: Full
Current Engine Version:
Previous Engine Version: 1.1.15300.6
Error code: 0x80072ee2
Error description: The operation timed out
Date: 2018-10-09 14:19:29.151
Description:
Windows Defender has encountered an error trying to update signatures.
New Signature Version:
Previous Signature Version: 1.277.724.0
Update Source: Microsoft Malware Protection Center
Signature Type: AntiVirus
Update Type: Full
Current Engine Version:
Previous Engine Version: 1.1.15300.6
Error code: 0x80072ee2
Error description: The operation timed out
Date: 2018-10-09 14:05:14.788
Description:
Windows Defender has encountered an error trying to update signatures.
New Signature Version:
Previous Signature Version: 1.277.724.0
Update Source: Microsoft Update Server
Signature Type: AntiVirus
Update Type: Full
Current Engine Version:
Previous Engine Version: 1.1.15300.6
Error code: 0x8024402f
Error description: An unexpected problem occurred while checking for updates. For information on installing or troubleshooting updates, see Help and Support.
Date: 2018-10-04 17:49:35.661
Description:
Windows Defender has encountered an error trying to update signatures.
New Signature Version:
Previous Signature Version: 119.0.0.0
Update Source: Microsoft Malware Protection Center
Signature Type: Network Inspection System
Update Type: Full
Current Engine Version:
Previous Engine Version: 2.1.14600.4
Error code: 0x80072ee2
Error description: The operation timed out
CodeIntegrity:
===================================
Date: 2018-10-19 03:28:09.675
Description:
Code Integrity determined that a process (\Device\HarddiskVolume1\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume1\Program Files\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2018-10-18 18:21:21.188
Description:
Code Integrity determined that a process (\Device\HarddiskVolume1\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume1\Program Files\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2018-10-17 15:53:03.477
Description:
Code Integrity determined that a process (\Device\HarddiskVolume1\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume1\Program Files\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2018-10-15 18:02:32.787
Description:
Code Integrity determined that a process (\Device\HarddiskVolume1\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume1\Program Files\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2018-10-14 15:36:02.815
Description:
Code Integrity determined that a process (\Device\HarddiskVolume1\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume1\Program Files\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2018-10-13 19:58:30.930
Description:
Code Integrity determined that a process (\Device\HarddiskVolume1\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume1\Program Files\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2018-10-12 16:45:42.964
Description:
Code Integrity determined that a process (\Device\HarddiskVolume1\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume1\Program Files\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2018-10-11 13:39:34.177
Description:
Code Integrity determined that a process (\Device\HarddiskVolume1\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume1\Program Files\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.
==================== Memory info ===========================
Processor: Pentium(R) Dual-Core CPU T4300 @ 2.10GHz
Percentage of memory in use: 63%
Total physical RAM: 3032.6 MB
Available physical RAM: 1096.79 MB
Total Virtual: 6032.6 MB
Available Virtual: 3647.86 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:84.89 GB) (Free:37.12 GB) NTFS ==>[drive with boot components (obtained from BCD)]
Drive d: (Lightning01) (Fixed) (Total:126.96 GB) (Free:57.91 GB) NTFS
Drive e: (Lightning02) (Fixed) (Total:126.96 GB) (Free:23.76 GB) NTFS
Drive f: (Lightning03) (Fixed) (Total:126.95 GB) (Free:29.83 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (Size: 465.8 GB) (Disk ID: 24FA24FA)
Partition 1: (Active) - (Size=84.9 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=380.9 GB) - (Type=05)
==================== End of Addition.txt ============================
