Jump to content

Welcome to Geeks to Go - Register now for FREE

Geeks To Go is a helpful hub, where thousands of volunteer geeks quickly serve friendly answers and support. Check out the forums and get free advice from the experts. Register now to gain access to all of our features, it's FREE and only takes one minute. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more.

Create Account How it Works
Photo

Infected with malware [Solved]


  • This topic is locked This topic is locked

#1
very_metal

very_metal

    Member

  • Member
  • PipPip
  • 16 posts

Hello everyone-

 

I volunteered to help clean up my gf's computer. She said it's been running too slow to use for over a year now; she thinks some torrented files are to blame. 

 

In any event I ran some online and free virus scans but can't seem to get everything cleaned up. Here is the FARBAR log. Any help is greatly appreciated.

 

-------------------------------------

 

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 07-03-2015 01
Ran by Kate (administrator) on KATE-PC on 07-03-2015 12:59:00
Running from C:\Users\Kate\Downloads
Loaded Profiles: Kate (Available profiles: Kate)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: English (United States)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo...very-scan-tool/
 
==================== Processes (Whitelisted) =================
 
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
 
(IDT, Inc.) C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_afc3018f8cfedd20\stacsv64.exe
(Stardock Corporation) C:\Program Files\Dell\DellDock\DockLogin.exe
() C:\Program Files\Dell\Dell Wireless WLAN Card\WLTRYSVC.EXE
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Dell Inc.) C:\Program Files\Dell\Dell Wireless WLAN Card\BCMWLTRY.EXE
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(SoftThinks SAS) C:\Program Files (x86)\Dell DataSafe Local Backup\SftService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTmon.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\Apoint.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Dell Inc.) C:\Program Files\Dell\Dell Wireless WLAN Card\WLTRAY.EXE
(Dell Inc.) C:\Program Files\Dell\QuickSet\quickset.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\ApMsgFwd.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Google Inc.) C:\Users\Kate\AppData\Local\Google\Update\GoogleUpdate.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\hidfind.exe
() C:\Users\Kate\AppData\Local\Amazon Cloud Player\Amazon Music Helper.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\AppleIEDAV.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\ApntEx.exe
() C:\Program Files (x86)\Dell DataSafe Online\DataSafeOnline.exe
(CyberLink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD DX\PDVDDXSrv.exe
(Dropbox, Inc.) C:\Users\Kate\AppData\Roaming\Dropbox\bin\Dropbox.exe
(SupportSoft, Inc.) C:\Program Files (x86)\Dell Support Center\bin\sprtcmd.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
(Sun Microsystems, Inc.) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\APSDaemon.exe
(SupportSoft, Inc.) C:\Program Files (x86)\Dell Support Center\bin\sprtsvc.exe
(Microsoft Corporation) C:\Windows\System32\taskmgr.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\System32\msiexec.exe
 
 
==================== Registry (Whitelisted) ==================
 
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
 
HKLM\...\Run: [Apoint] => C:\Program Files\DellTPad\Apoint.exe [305664 2009-01-22] (Alps Electric Co., Ltd.)
HKLM\...\Run: [SysTrayApp] => C:\Program Files\IDT\WDM\sttray64.exe [444416 2009-06-28] (IDT, Inc.)
HKLM\...\Run: [Broadcom Wireless Manager UI] => C:\Program Files\Dell\Dell Wireless WLAN Card\WLTRAY.exe [4968960 2009-07-16] (Dell Inc.)
HKLM\...\Run: [QuickSet] => C:\Program Files\Dell\QuickSet\QuickSet.exe [3180624 2009-07-02] (Dell Inc.)
HKLM\...\Run: [IAAnotif] => C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe [186904 2009-06-04] (Intel Corporation)
HKLM-x32\...\Run: [Dell DataSafe Online] => C:\Program Files (x86)\Dell DataSafe Online\DataSafeOnline.exe [1807600 2009-11-13] ()
HKLM-x32\...\Run: [PDVDDXSrv] => C:\Program Files (x86)\CyberLink\PowerDVD DX\PDVDDXSrv.exe [140520 2009-06-24] (CyberLink Corp.)
HKLM-x32\...\Run: [DellSupportCenter] => C:\Program Files (x86)\Dell Support Center\bin\sprtcmd.exe [206064 2009-05-21] (SupportSoft, Inc.)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [43848 2014-01-20] (Apple Inc.)
HKLM-x32\...\Run: [Wondershare Helper Compact.exe] => C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [252848 2012-07-03] (Sun Microsystems, Inc.)
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2013-05-01] (Apple Inc.)
HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2013-11-02] (Apple Inc.)
Winlogon\Notify\GoToAssist: C:\Program Files (x86)\Citrix\GoToAssist\514\G2AWinLogon_x64.dll [X]
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-508726573-1264868468-1237469860-1001\...\Run: [Google Update] => C:\Users\Kate\AppData\Local\Google\Update\GoogleUpdate.exe [107848 2015-03-05] (Google Inc.)
HKU\S-1-5-21-508726573-1264868468-1237469860-1001\...\Run: [MobileDocuments] => C:\Program Files (x86)\Common Files\Apple\Internet Services\ubd.exe
HKU\S-1-5-21-508726573-1264868468-1237469860-1001\...\Run: [GoogleDriveSync] => C:\Program Files (x86)\Google\Drive\googledrivesync.exe [22415552 2014-04-25] (Google)
HKU\S-1-5-21-508726573-1264868468-1237469860-1001\...\Run: [Amazon Cloud Player] => C:\Users\Kate\AppData\Local\Amazon Cloud Player\Amazon Music Helper.exe [3113792 2013-05-29] ()
HKU\S-1-5-21-508726573-1264868468-1237469860-1001\...\Run: [iCloudServices] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe [59720 2013-11-20] (Apple Inc.)
HKU\S-1-5-21-508726573-1264868468-1237469860-1001\...\Run: [ApplePhotoStreams] => C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe [59720 2013-11-20] (Apple Inc.)
HKU\S-1-5-21-508726573-1264868468-1237469860-1001\...\Run: [AppleIEDAV] => C:\Program Files (x86)\Common Files\Apple\Internet Services\AppleIEDAV.exe [1326408 2013-11-15] (Apple Inc.)
HKU\S-1-5-21-508726573-1264868468-1237469860-1001\...\MountPoints2: E - E:\MotoCastSetup.exe -a
HKU\S-1-5-21-508726573-1264868468-1237469860-1001\...\MountPoints2: {4425e544-4e7e-11df-98ec-a4badba732b9} - E:\VZAccess_Manager.exe /z detect
HKU\S-1-5-21-508726573-1264868468-1237469860-1001\...\MountPoints2: {4a88244a-98d5-11e2-bcf3-a4badba732b9} - E:\MotoCastSetup.exe -a
HKU\S-1-5-18\...\Run: [SearchProtect] => \SearchProtect\bin\cltmng.exe
Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock First Run.lnk
ShortcutTarget: Dell Dock First Run.lnk -> C:\Program Files\Dell\DellDock\DellDock.exe (Stardock Corporation)
Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock First Run.lnk
ShortcutTarget: Dell Dock First Run.lnk -> C:\Program Files\Dell\DellDock\DellDock.exe (Stardock Corporation)
Startup: C:\Users\Kate\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Amazon Cloud Drive.lnk
ShortcutTarget: Amazon Cloud Drive.lnk -> C:\Users\Kate\AppData\Local\Apps\2.0\Z46QOOTJ.9ZG\9Z1R621Z.KKY\amaz..tion_f2fa081ea2183235_0002.0001_cb34a912a946f839\AmazonCloudDrive.exe (Amazon Digital Services, LLC.)
Startup: C:\Users\Kate\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\Kate\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Kate\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Kate\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Kate\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Kate\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Kate\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Kate\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
BootExecute: autocheck autochk * aswBoot.exe /M:124322191 /wow /dir:"C:\Program Files\AVAST Software\Avast"
 
==================== Internet (Whitelisted) ====================
 
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
 
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Local Page = 
HKU\S-1-5-21-508726573-1264868468-1237469860-1001\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft....om/?c=9001&t=03
HKU\S-1-5-21-508726573-1264868468-1237469860-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/USCON/1
HKU\S-1-5-21-508726573-1264868468-1237469860-1001\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.com/ie
HKU\S-1-5-21-508726573-1264868468-1237469860-1001\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com/ie
URLSearchHook: HKLM-x32 - MixiDJ V8 Toolbar - {e4c3a8b6-7724-45d1-a629-17b69118ebcd} - C:\Program Files (x86)\MixiDJ_V8\prxtbMixi.dll (Conduit Ltd.)
URLSearchHook: HKU\S-1-5-21-508726573-1264868468-1237469860-1001 - MixiDJ V8 Toolbar - {e4c3a8b6-7724-45d1-a629-17b69118ebcd} - C:\Program Files (x86)\MixiDJ_V8\prxtbMixi.dll (Conduit Ltd.)
SearchScopes: HKLM -> {E30C225B-6AC6-484D-92F1-13A365CED4FA} URL = http://www.bing.com/...rc=IE-SearchBox
SearchScopes: HKLM-x32 -> {1970984B-77F4-4E74-91E5-C7F43A6EC673} URL = http://www.bing.com/...rc=IE-SearchBox
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-508726573-1264868468-1237469860-1001 -> {1970984B-77F4-4E74-91E5-C7F43A6EC673} URL = 
BHO: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre6\bin\jp2ssv.dll [2010-02-24] (Sun Microsystems, Inc.)
BHO-x32: StumbleUpon Launcher -> {145B29F4-A56B-4b90-BBAC-45784EBEBBB7} -> C:\Program Files (x86)\StumbleUpon\StumbleUponIEBar.dll No File
BHO-x32: No Name -> {5C255C8A-E604-49b4-9D64-90988571CECB} ->  No File
BHO-x32: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll [2013-03-29] (Oracle Corporation)
BHO-x32: Windows Live Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-01-22] (Microsoft Corporation)
BHO-x32: No Name -> {96A25A24-2E87-4374-8A50-CC6F943FCE4D} ->  No File
BHO-x32: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll [2013-03-29] (Oracle Corporation)
BHO-x32: MixiDJ V8 Toolbar -> {e4c3a8b6-7724-45d1-a629-17b69118ebcd} -> C:\Program Files (x86)\MixiDJ_V8\prxtbMixi.dll [2013-03-05] (Conduit Ltd.)
Toolbar: HKLM-x32 - StumbleUpon Toolbar - {5093EB4C-3E93-40AB-9266-B607BA87BDC8} - C:\Program Files (x86)\StumbleUpon\StumbleUponIEBar.dll No File
Toolbar: HKLM-x32 - MixiDJ V8 Toolbar - {e4c3a8b6-7724-45d1-a629-17b69118ebcd} - C:\Program Files (x86)\MixiDJ_V8\prxtbMixi.dll [2013-03-05] (Conduit Ltd.)
Toolbar: HKLM-x32 - No Name - {96A25A24-2E87-4374-8A50-CC6F943FCE4D} -  No File
Toolbar: HKU\S-1-5-21-508726573-1264868468-1237469860-1001 -> No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} -  No File
Toolbar: HKU\S-1-5-21-508726573-1264868468-1237469860-1001 -> No Name - {E4C3A8B6-7724-45D1-A629-17B69118EBCD} -  No File
DPF: HKLM-x32 {3D3B42C2-11BF-4732-A304-A01384B70D68} http://picasaweb.goo...6/uploader2.cab
DPF: HKLM-x32 {4871A87A-BFDD-4106-8153-FFDE2BAC2967} http://dlm.tools.aka...vex-2.2.5.7.cab
DPF: HKLM-x32 {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset...lineScanner.cab
Handler-x32: cozi - {5356518D-FE9C-4E08-9C1F-1E872ECD367F} - c:\Program Files (x86)\Cozi Express\CoziProtocolHandler.dll [2009-07-23] (Cozi Group, Inc.)
Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll [2009-07-26] (Microsoft Corporation)
Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll [2009-07-26] (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 10.0.1.1
 
FireFox:
========
FF ProfilePath: C:\Users\Kate\AppData\Roaming\Mozilla\Firefox\Profiles\a9dlfrif.default
FF Keyword.URL: 
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_13_0_0_214.dll [2014-05-14] ()
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll [2014-02-13] ( Microsoft Corporation)
FF Plugin: @Musicnotes.com/Musicnotes Viewer -> C:\Program Files\Musicnotes\npmusicn64.dll [2011-12-01] (Musicnotes, Inc.)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_214.dll [2014-05-14] ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2013-10-01] ()
FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 -> C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll [2014-01-06] (Google, Inc.)
FF Plugin-x32: @java.com/JavaPlugin,version=10.21.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll [2013-04-04] (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll [2014-02-13] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8081.0709 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2009-07-10] (Microsoft Corporation)
FF Plugin-x32: @Musicnotes.com/Musicnotes Viewer -> C:\Program Files (x86)\Musicnotes\npmusicn.dll [2011-12-01] (Musicnotes, Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-03-05] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-03-05] (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll [2014-05-08] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-508726573-1264868468-1237469860-1001: @doubletwist.com/NPPodcast -> C:\Program Files (x86)\Common Files\doubleTwist\NPPodcast.dll No File
FF Plugin HKU\S-1-5-21-508726573-1264868468-1237469860-1001: @talk.google.com/GoogleTalkPlugin -> C:\Users\Kate\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll [2015-01-27] (Google)
FF Plugin HKU\S-1-5-21-508726573-1264868468-1237469860-1001: @talk.google.com/O1DPlugin -> C:\Users\Kate\AppData\Roaming\Mozilla\plugins\npo1d.dll [2015-01-27] (Google)
FF Plugin HKU\S-1-5-21-508726573-1264868468-1237469860-1001: @tools.google.com/Google Update;version=3 -> C:\Users\Kate\AppData\Local\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-03-05] (Google Inc.)
FF Plugin HKU\S-1-5-21-508726573-1264868468-1237469860-1001: @tools.google.com/Google Update;version=9 -> C:\Users\Kate\AppData\Local\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-03-05] (Google Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll [2014-05-08] (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin.dll [2013-06-11] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin2.dll [2013-06-11] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin3.dll [2013-06-11] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin4.dll [2013-06-11] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin5.dll [2013-06-11] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Users\Kate\AppData\Roaming\mozilla\plugins\npgoogletalk.dll [2015-01-27] (Google)
FF Plugin ProgramFiles/Appdata: C:\Users\Kate\AppData\Roaming\mozilla\plugins\npo1d.dll [2015-01-27] (Google)
FF Extension: CrossReader - C:\Users\Kate\AppData\Roaming\Mozilla\Firefox\Profiles\a9dlfrif.default\Extensions\[email protected]f0f261f92.com [2013-12-29]
FF Extension: GetSavin - C:\Users\Kate\AppData\Roaming\Mozilla\Firefox\Profiles\a9dlfrif.default\Extensions\[email protected] [2013-03-30]
FF Extension: AddThis - C:\Users\Kate\AppData\Roaming\Mozilla\Firefox\Profiles\a9dlfrif.default\Extensions\{3e0e7d2a-070f-4a47-b019-91fe5385ba79} [2013-03-29]
FF Extension: Vafmusic2  - C:\Users\Kate\AppData\Roaming\Mozilla\Firefox\Profiles\a9dlfrif.default\Extensions\{7f3f960e-a836-45ca-8911-0accb522246e} [2013-05-23]
FF Extension: Trustworthy  - C:\Users\Kate\AppData\Roaming\Mozilla\Firefox\Profiles\a9dlfrif.default\Extensions\{ad32743c-16ef-46ec-977b-dce0c3c85b20} [2013-03-30]
FF Extension: MixiDJ V8  - C:\Users\Kate\AppData\Roaming\Mozilla\Firefox\Profiles\a9dlfrif.default\Extensions\{e4c3a8b6-7724-45d1-a629-17b69118ebcd} [2013-03-30]
FF Extension: Gmail Notifier (restartless) - C:\Users\Kate\AppData\Roaming\Mozilla\Firefox\Profiles\a9dlfrif.default\Extensions\[email protected] [2013-03-29]
FF Extension: Add Google Search To New Tab Page - C:\Users\Kate\AppData\Roaming\Mozilla\Firefox\Profiles\a9dlfrif.default\Extensions\[email protected] [2013-03-29]
FF HKLM\...\Firefox\Extensions: [{C4CFC0DE-134F-4466-B2A2-FF7C59A8BFAD}] - C:\Program Files\Updater By SweetPacks\Firefox
FF HKLM-x32\...\Firefox\Extensions: [{C4CFC0DE-134F-4466-B2A2-FF7C59A8BFAD}] - C:\Program Files\Updater By SweetPacks\Firefox
 
Chrome: 
=======
CHR HomePage: Default -> hxxp://www.google.com/
CHR Profile: C:\Users\Kate\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Drive) - C:\Users\Kate\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-03-07]
CHR Extension: (Vafmusic2) - C:\Users\Kate\AppData\Local\Google\Chrome\User Data\Default\Extensions\cbjibcbpmbcabnfnohhgjjmkgkimajko [2015-03-07]
CHR Extension: (Chrome Hotword Shared Module) - C:\Users\Kate\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-03-07]
CHR Extension: (Google Wallet) - C:\Users\Kate\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-23]
CHR Extension: (MixiDJ V8) - C:\Users\Kate\AppData\Local\Google\Chrome\User Data\Default\Extensions\oajgghejjpgkmpgbchgjieahoefimdle [2013-04-01]
CHR HKU\S-1-5-21-508726573-1264868468-1237469860-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [apdfllckaahabafndbhieahigkjlhalf] - C:\Users\Kate\AppData\Local\Google\Drive\apdfllckaahabafndbhieahigkjlhalf_live.crx [2015-03-07]
CHR HKU\S-1-5-21-508726573-1264868468-1237469860-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [cbjibcbpmbcabnfnohhgjjmkgkimajko] - C:\Users\Kate\AppData\Local\CRE\cbjibcbpmbcabnfnohhgjjmkgkimajko.crx [2013-05-13]
CHR HKU\S-1-5-21-508726573-1264868468-1237469860-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [oajgghejjpgkmpgbchgjieahoefimdle] - C:\Users\Kate\AppData\Local\CRE\oajgghejjpgkmpgbchgjieahoefimdle.crx [2013-03-27]
CHR HKLM-x32\...\Chrome\Extension: [cbjibcbpmbcabnfnohhgjjmkgkimajko] - C:\Users\Kate\AppData\Local\CRE\cbjibcbpmbcabnfnohhgjjmkgkimajko.crx [2013-05-13]
CHR HKLM-x32\...\Chrome\Extension: [oajgghejjpgkmpgbchgjieahoefimdle] - C:\Users\Kate\AppData\Local\CRE\oajgghejjpgkmpgbchgjieahoefimdle.crx [2013-03-27]
 
==================== Services (Whitelisted) =================
 
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 
R2 DockLoginService; C:\Program Files\Dell\DellDock\DockLogin.exe [155648 2009-06-09] (Stardock Corporation) [File not signed]
R2 STacSV; C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_afc3018f8cfedd20\STacSV64.exe [240128 2009-06-28] (IDT, Inc.)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
R2 wltrysvc; C:\Program Files\Dell\Dell Wireless WLAN Card\bcmwltry.exe [3417088 2009-07-16] (Dell Inc.) [File not signed]
S2 MSCamSvc; "C:\Program Files\Microsoft LifeCam\MSCamS64.exe" [X]
S3 StumbleUponUpdateService; "C:\Program Files (x86)\StumbleUpon\StumbleUponUpdateService.exe" [X]
S2 vToolbarUpdater18.3.0; C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.3.0\ToolbarUpdater.exe [X]
 
==================== Drivers (Whitelisted) ====================
 
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 
S3 NWUSBModem; C:\Windows\System32\DRIVERS\nwusbmdm.sys [213120 2008-05-09] (Novatel Wireless Inc.)
S3 NWUSBPort; C:\Windows\System32\DRIVERS\nwusbser.sys [213120 2008-05-09] (Novatel Wireless Inc.)
S3 NWUSBPort2; C:\Windows\System32\DRIVERS\nwusbser2.sys [213120 2008-05-09] (Novatel Wireless Inc.)
S3 USBAAPL64; C:\Windows\System32\Drivers\usbaapl64.sys [54784 2012-12-13] (Apple, Inc.) [File not signed]
S3 VX6000; C:\Windows\System32\DRIVERS\VX6000Xp.sys [2143600 2010-05-20] (Microsoft Corporation
)
S2 iPodDrv; \??\C:\Windows\system32\drivers\iPodDrv.sys [X]
S0 Lbd; system32\DRIVERS\Lbd.sys [X]
S1 SBRE; \??\C:\Windows\system32\drivers\SBREdrv.sys [X]
 
========================== Drivers MD5 =======================
 
C:\Windows\system32\drivers\1394ohci.sys ==> MD5 is legit
C:\Windows\System32\drivers\ACPI.sys ==> MD5 is legit
C:\Windows\system32\drivers\acpipmi.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\adp94xx.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\adpahci.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\adpu320.sys ==> MD5 is legit
C:\Windows\system32\drivers\afd.sys 79059559E89D06E8B80CE2944BE20228
C:\Windows\system32\drivers\agp440.sys ==> MD5 is legit
C:\Windows\system32\drivers\aliide.sys ==> MD5 is legit
C:\Windows\system32\drivers\amdide.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\amdk8.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\amdppm.sys ==> MD5 is legit
C:\Windows\system32\drivers\amdsata.sys D4121AE6D0C0E7E13AA221AA57EF2D49
C:\Windows\system32\DRIVERS\amdsbs.sys ==> MD5 is legit
C:\Windows\System32\drivers\amdxata.sys 540DAF1CEA6094886D72126FD7C33048
C:\Windows\System32\DRIVERS\Apfiltr.sys ==> MD5 is legit
C:\Windows\system32\drivers\appid.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\arc.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\arcsas.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\asyncmac.sys ==> MD5 is legit
C:\Windows\system32\drivers\atapi.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\bxvbda.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\b57nd60a.sys ==> MD5 is legit
C:\Windows\System32\drivers\BCM42RLY.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\bcmwl664.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Beep.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\blbdrive.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\bowser.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\BrFiltLo.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\BrFiltUp.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Brserid.sys ==> MD5 is legit
C:\Windows\System32\Drivers\BrSerWdm.sys ==> MD5 is legit
C:\Windows\System32\Drivers\BrUsbMdm.sys ==> MD5 is legit
C:\Windows\System32\Drivers\BrUsbSer.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\bthmodem.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\cdfs.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\cdrom.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\circlass.sys ==> MD5 is legit
C:\Windows\System32\CLFS.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\CmBatt.sys ==> MD5 is legit
C:\Windows\system32\drivers\cmdide.sys ==> MD5 is legit
C:\Windows\System32\Drivers\cng.sys EBF28856F69CF094A902F884CF989706
C:\Windows\System32\DRIVERS\compbatt.sys ==> MD5 is legit
C:\Windows\system32\drivers\CompositeBus.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\crcdisk.sys ==> MD5 is legit
C:\Windows\System32\Drivers\dfsc.sys ==> MD5 is legit
C:\Windows\System32\drivers\discache.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\disk.sys ==> MD5 is legit
C:\Windows\system32\drivers\drmkaud.sys ==> MD5 is legit
C:\Windows\System32\drivers\dxgkrnl.sys 88612F1CE3BF42256913BF6E61C70D52
C:\Windows\system32\DRIVERS\evbda.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\elxstor.sys ==> MD5 is legit
C:\Windows\system32\drivers\errdev.sys ==> MD5 is legit
C:\Windows\System32\Drivers\exfat.sys ==> MD5 is legit
C:\Windows\System32\Drivers\fastfat.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\fdc.sys ==> MD5 is legit
C:\Windows\System32\drivers\fileinfo.sys ==> MD5 is legit
C:\Windows\System32\drivers\filetrace.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\flpydisk.sys ==> MD5 is legit
C:\Windows\System32\drivers\fltmgr.sys ==> MD5 is legit
C:\Windows\System32\drivers\FsDepends.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Fs_Rec.sys 6BD9295CC032DD3077C671FCCF579A7B
C:\Windows\System32\DRIVERS\fvevol.sys 8F6322049018354F45F05A2FD2D4E5E0
C:\Windows\system32\DRIVERS\gagp30kx.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\GEARAspiWDM.sys 8E98D21EE06192492A5671A6144D092F
C:\Windows\system32\drivers\hcw85cir.sys ==> MD5 is legit
C:\Windows\system32\drivers\HDAudBus.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\HidBatt.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\hidbth.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\hidir.sys ==> MD5 is legit
C:\Windows\system32\drivers\hidusb.sys ==> MD5 is legit
C:\Windows\system32\drivers\HpSAMD.sys ==> MD5 is legit
C:\Windows\System32\drivers\HTTP.sys ==> MD5 is legit
C:\Windows\System32\drivers\hwpolicy.sys ==> MD5 is legit
C:\Windows\system32\drivers\i8042prt.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\iaStor.sys ==> MD5 is legit
C:\Windows\system32\drivers\iaStorV.sys AAAF44DB3BD0B9D1FB6969B23ECC8366
C:\Windows\System32\DRIVERS\igdkmd64.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\iirsp.sys ==> MD5 is legit
C:\Windows\system32\drivers\intelide.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\intelppm.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ipfltdrv.sys ==> MD5 is legit
C:\Windows\system32\drivers\IPMIDrv.sys ==> MD5 is legit
C:\Windows\System32\drivers\ipnat.sys ==> MD5 is legit
C:\Windows\System32\drivers\irenum.sys ==> MD5 is legit
C:\Windows\system32\drivers\isapnp.sys ==> MD5 is legit
C:\Windows\system32\drivers\msiscsi.sys 96BB922A0981BC7432C8CF52B5410FE6
C:\Windows\system32\drivers\kbdclass.sys ==> MD5 is legit
C:\Windows\system32\drivers\kbdhid.sys ==> MD5 is legit
C:\Windows\System32\Drivers\ksecdd.sys 353009DEDF918B2A51414F330CF72DEC
C:\Windows\System32\Drivers\ksecpkg.sys 1C2D8E18AA8FD50CD04C15CC27F7F5AB
C:\Windows\system32\drivers\ksthunk.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\lltdio.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\lsi_fc.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\lsi_sas.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\lsi_sas2.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\lsi_scsi.sys ==> MD5 is legit
C:\Windows\system32\drivers\luafv.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\megasas.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\MegaSR.sys ==> MD5 is legit
C:\Windows\System32\drivers\modem.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\monitor.sys ==> MD5 is legit
C:\Windows\system32\drivers\mouclass.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\mouhid.sys ==> MD5 is legit
C:\Windows\System32\drivers\mountmgr.sys ==> MD5 is legit
C:\Windows\system32\drivers\mpio.sys ==> MD5 is legit
C:\Windows\System32\drivers\mpsdrv.sys ==> MD5 is legit
C:\Windows\system32\drivers\mrxdav.sys 1A4F75E63C9FB84B85DFFC6B63FD5404
C:\Windows\System32\DRIVERS\mrxsmb.sys A5D9106A73DC88564C825D317CAC68AC
C:\Windows\System32\DRIVERS\mrxsmb10.sys D711B3C1D5F42C0C2415687BE09FC163
C:\Windows\System32\DRIVERS\mrxsmb20.sys 9423E9D355C8D303E76B8CFBD8A5C30C
C:\Windows\system32\drivers\msahci.sys ==> MD5 is legit
C:\Windows\system32\drivers\msdsm.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Msfs.sys ==> MD5 is legit
C:\Windows\System32\drivers\mshidkmdf.sys ==> MD5 is legit
C:\Windows\System32\drivers\msisadrv.sys ==> MD5 is legit
C:\Windows\System32\drivers\MSKSSRV.sys ==> MD5 is legit
C:\Windows\System32\drivers\MSPCLOCK.sys ==> MD5 is legit
C:\Windows\System32\drivers\MSPQM.sys ==> MD5 is legit
C:\Windows\System32\Drivers\MsRPC.sys ==> MD5 is legit
C:\Windows\system32\drivers\mssmbios.sys ==> MD5 is legit
C:\Windows\System32\drivers\MSTEE.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\MTConfig.sys ==> MD5 is legit
C:\Windows\System32\Drivers\mup.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\nwifi.sys ==> MD5 is legit
C:\Windows\System32\drivers\ndis.sys 760E38053BF56E501D562B70AD796B88
C:\Windows\System32\DRIVERS\ndiscap.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ndistapi.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ndisuio.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ndiswan.sys ==> MD5 is legit
C:\Windows\System32\Drivers\NDProxy.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\netbios.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\netbt.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\nfrd960.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Npfs.sys ==> MD5 is legit
C:\Windows\System32\drivers\nsiproxy.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Ntfs.sys 1A29A59A4C5BA6F8C85062A613B7E2B2
C:\Windows\System32\Drivers\Null.sys ==> MD5 is legit
C:\Windows\system32\drivers\nvraid.sys 0A92CB65770442ED0DC44834632F66AD
C:\Windows\system32\drivers\nvstor.sys DAB0E87525C10052BF65F06152F37E4A
C:\Windows\system32\drivers\nv_agp.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\NWADIenum.sys 952AB3BDEF38A7391AA05BC8C6028F15
C:\Windows\System32\DRIVERS\NwUsbCdFil64.sys DE3ABD010D9734CD4AD4E0BA81F50B63
C:\Windows\System32\DRIVERS\nwusbmdm.sys 6AE72C04633788C3C3B71B5BEB17183C
C:\Windows\System32\DRIVERS\nwusbser.sys 6AE72C04633788C3C3B71B5BEB17183C
C:\Windows\System32\DRIVERS\nwusbser2.sys 6AE72C04633788C3C3B71B5BEB17183C
C:\Windows\system32\drivers\ohci1394.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\parport.sys ==> MD5 is legit
C:\Windows\System32\drivers\partmgr.sys E9766131EEADE40A27DC27D2D68FBA9C
C:\Windows\System32\drivers\pci.sys ==> MD5 is legit
C:\Windows\system32\drivers\pciide.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\pcmcia.sys ==> MD5 is legit
C:\Windows\System32\drivers\pcw.sys ==> MD5 is legit
C:\Windows\System32\drivers\peauth.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\raspptp.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\processr.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\pacer.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\ql2300.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\ql40xx.sys ==> MD5 is legit
C:\Windows\system32\drivers\qwavedrv.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rasacd.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\AgileVpn.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rasl2tp.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\raspppoe.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rassstp.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rdbss.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\rdpbus.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\RDPCDD.sys ==> MD5 is legit
C:\Windows\System32\drivers\rdpencdd.sys ==> MD5 is legit
C:\Windows\System32\drivers\rdprefmp.sys ==> MD5 is legit
C:\Windows\System32\Drivers\RDPWD.sys E61608AA35E98999AF9AAEEEA6114B0A
C:\Windows\System32\drivers\rdyboost.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rspndr.sys ==> MD5 is legit
C:\Windows\System32\Drivers\RtsUStor.sys ==> MD5 is legit
C:\Windows\system32\drivers\sbp2port.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\scfilter.sys ==> MD5 is legit
C:\Windows\System32\Drivers\secdrv.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\serenum.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\serial.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\sermouse.sys ==> MD5 is legit
C:\Windows\system32\drivers\sffdisk.sys ==> MD5 is legit
C:\Windows\system32\drivers\sffp_mmc.sys ==> MD5 is legit
C:\Windows\system32\drivers\sffp_sd.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\sfloppy.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\SiSRaid2.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\sisraid4.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\smb.sys ==> MD5 is legit
C:\Windows\System32\Drivers\spldr.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\srv.sys 441FBA48BFF01FDB9D5969EBC1838F0B
C:\Windows\System32\DRIVERS\srv2.sys B4ADEBBF5E3677CCE9651E0F01F7CC28
C:\Windows\System32\DRIVERS\srvnet.sys 27E461F0BE5BFF5FC737328F749538C3
C:\Windows\system32\DRIVERS\stexstor.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\stwrt64.sys ==> MD5 is legit
C:\Windows\system32\drivers\swenum.sys ==> MD5 is legit
C:\Windows\System32\drivers\tcpip.sys 40AF23633D197905F03AB5628C558C51
C:\Windows\System32\DRIVERS\tcpip.sys 40AF23633D197905F03AB5628C558C51
C:\Windows\System32\drivers\tcpipreg.sys 1B16D0BD9841794A6E0CDE0CEF744ABC
C:\Windows\System32\drivers\tdpipe.sys ==> MD5 is legit
C:\Windows\System32\drivers\tdtcp.sys 51C5ECEB1CDEE2468A1748BE550CFBC8
C:\Windows\System32\DRIVERS\tdx.sys ==> MD5 is legit
C:\Windows\system32\drivers\termdd.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\tssecsrv.sys 4CE278FC9671BA81A138D70823FCAA09
C:\Windows\System32\drivers\tsusbflt.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\tunnel.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\uagp35.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\udfs.sys ==> MD5 is legit
C:\Windows\system32\drivers\uliagpkx.sys ==> MD5 is legit
C:\Windows\system32\drivers\umbus.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\umpass.sys ==> MD5 is legit
C:\Windows\System32\Drivers\usbaapl64.sys C9E9D59C0099A9FF51697E9306A44240
C:\Windows\system32\drivers\usbaudio.sys B0435098C81D04CAFFF80DDB746CD3A2
C:\Windows\system32\drivers\usbccgp.sys DCA68B0943D6FA415F0C56C92158A83A
C:\Windows\system32\drivers\usbcir.sys 80B0F7D5CCF86CEB5D402EAAF61FEC31
C:\Windows\System32\DRIVERS\usbehci.sys 18A85013A3E0F7E1755365D287443965
C:\Windows\System32\DRIVERS\usbhub.sys 8D1196CFBB223621F2C67D45710F25BA
C:\Windows\system32\drivers\usbohci.sys 765A92D428A8DB88B960DA5A8D6089DC
C:\Windows\System32\DRIVERS\usbprint.sys ==> MD5 is legit
C:\Windows\system32\drivers\usbscan.sys 9661DA76B4531B2DA272ECCE25A8AF24
C:\Windows\System32\DRIVERS\USBSTOR.SYS FED648B01349A3C8395A5169DB5FB7D6
C:\Windows\System32\DRIVERS\usbuhci.sys DD253AFC3BC6CBA412342DE60C3647F3
C:\Windows\System32\drivers\vdrvroot.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\vgapnp.sys ==> MD5 is legit
C:\Windows\System32\drivers\vga.sys ==> MD5 is legit
C:\Windows\system32\drivers\vhdmp.sys ==> MD5 is legit
C:\Windows\system32\drivers\viaide.sys ==> MD5 is legit
C:\Windows\System32\drivers\volmgr.sys ==> MD5 is legit
C:\Windows\System32\drivers\volmgrx.sys ==> MD5 is legit
C:\Windows\System32\drivers\volsnap.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\vsmraid.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\vwifibus.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\vwififlt.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\VX6000Xp.sys 07E6731FF9399A3B72D64150D4C5F71A
C:\Windows\system32\DRIVERS\wacompen.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\wanarp.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\wanarp.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\wd.sys ==> MD5 is legit
C:\Windows\System32\drivers\Wdf01000.sys E2C933EDBC389386EBE6D2BA953F43D8
C:\Windows\System32\DRIVERS\wfplwf.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\wimfltr.sys ==> MD5 is legit
C:\Windows\System32\drivers\wimmount.sys ==> MD5 is legit
C:\Windows\SysWOW64\drivers\wimmount.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\WinUsb.sys FE88B288356E7B47B74B13372ADD906D
C:\Windows\system32\drivers\wmiacpi.sys ==> MD5 is legit
C:\Windows\system32\drivers\ws2ifsl.sys ==> MD5 is legit
C:\Windows\System32\drivers\WudfPf.sys AB886378EEB55C6C75B4F2D14B6C869F
C:\Windows\System32\DRIVERS\WUDFRd.sys DDA4CAF29D8C0A297F886BFE561E6659
C:\Windows\System32\DRIVERS\yk62x64.sys 79D9CE9614C955DD31AA2556B4014662
 
==================== NetSvcs (Whitelisted) ===================
 
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
 
 
==================== One Month Created Files and Folders ========
 
(If an entry is included in the fixlist, the file\folder will be moved.)
 
2015-03-07 12:41 - 2015-03-07 12:41 - 00047404 _____ () C:\Users\Kate\Downloads\Addition.txt
2015-03-07 12:38 - 2015-03-07 12:59 - 00039353 _____ () C:\Users\Kate\Downloads\FRST.txt
2015-03-07 12:38 - 2015-03-07 12:59 - 00000000 ____D () C:\FRST
2015-03-07 12:33 - 2015-03-07 12:33 - 00001386 _____ () C:\Windows\PFRO.log
2015-03-07 12:33 - 2015-03-07 12:33 - 00000056 _____ () C:\Windows\setupact.log
2015-03-07 12:33 - 2015-03-07 12:33 - 00000000 _____ () C:\Windows\setuperr.log
2015-03-07 12:26 - 2015-03-07 12:26 - 00000000 ____D () C:\ProgramData\GFI Software
2015-03-07 12:10 - 2015-03-07 12:30 - 00000000 ____D () C:\AdwCleaner
2015-03-07 12:09 - 2015-03-07 12:10 - 02094592 _____ (Farbar) C:\Users\Kate\Downloads\FRST64.exe
2015-03-07 12:08 - 2015-03-07 12:09 - 02126848 _____ () C:\Users\Kate\Downloads\adwcleaner_4.111.exe
2015-03-07 00:13 - 2015-03-07 00:13 - 00000000 ____D () C:\Program Files (x86)\ESET
2015-03-07 00:10 - 2015-03-07 00:10 - 00000000 ____D () C:\OETemp
2015-03-05 22:06 - 2015-03-07 00:06 - 00236080 _____ (Trend Micro Inc.) C:\Windows\RegBootClean64.exe
2015-03-05 22:05 - 2015-03-06 23:42 - 00473157 _____ () C:\Users\Kate\AppData\Local\census.cache
2015-03-05 22:04 - 2015-03-06 23:41 - 00174865 _____ () C:\Users\Kate\AppData\Local\ars.cache
2015-03-05 21:53 - 2015-03-05 21:53 - 00000036 _____ () C:\Users\Kate\AppData\Local\housecall.guid.cache
2015-03-05 21:52 - 2015-03-05 21:52 - 00104411 _____ () C:\ProgramData\1425610354.bdinstall.bin
2015-03-05 21:52 - 2015-03-05 21:52 - 00000000 ____D () C:\Users\Kate\AppData\Roaming\QuickScan
2015-03-05 17:44 - 2015-03-05 17:44 - 00000000 __SHD () C:\Users\Kate\AppData\Local\EmieUserList
2015-03-05 17:44 - 2015-03-05 17:44 - 00000000 __SHD () C:\Users\Kate\AppData\Local\EmieSiteList
 
==================== One Month Modified Files and Folders =======
 
(If an entry is included in the fixlist, the file\folder will be moved.)
 
2015-03-07 12:57 - 2013-12-29 19:27 - 00000000 ____D () C:\Program Files (x86)\BitZipper
2015-03-07 12:56 - 2010-09-20 20:52 - 00000000 ____D () C:\Users\Kate\AppData\Local\Google
2015-03-07 12:44 - 2012-09-23 13:51 - 00000898 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-03-07 12:42 - 2009-07-13 23:45 - 00014240 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-03-07 12:42 - 2009-07-13 23:45 - 00014240 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-03-07 12:41 - 2009-07-14 00:13 - 00782510 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-03-07 12:38 - 2009-07-14 00:10 - 01287125 _____ () C:\Windows\WindowsUpdate.log
2015-03-07 12:37 - 2010-08-25 12:22 - 00000000 ___RD () C:\Users\Kate\Documents\My Dropbox
2015-03-07 12:37 - 2010-08-25 12:21 - 00000000 ____D () C:\Users\Kate\AppData\Roaming\Dropbox
2015-03-07 12:36 - 2012-09-23 13:52 - 00000000 ___RD () C:\Users\Kate\Google Drive
2015-03-07 12:34 - 2012-09-23 13:51 - 00000894 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-03-07 12:33 - 2013-02-27 16:42 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-03-07 12:33 - 2009-07-14 00:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-03-07 12:30 - 2010-03-02 18:59 - 00000000 ____D () C:\Users\Kate
2015-03-07 12:30 - 2010-03-02 18:54 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-03-07 12:29 - 2009-07-13 21:34 - 00000580 _____ () C:\Windows\win.ini
2015-03-07 12:28 - 2013-12-29 19:34 - 00000000 ____D () C:\Program Files (x86)\Jump Flip
2015-03-07 12:26 - 2013-02-27 16:42 - 00701616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-03-07 12:26 - 2013-02-27 16:42 - 00003768 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-03-07 12:26 - 2011-06-08 02:59 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-03-07 12:18 - 2010-08-25 12:22 - 00001017 _____ () C:\Users\Kate\Desktop\Dropbox.lnk
2015-03-07 12:18 - 2010-08-25 12:21 - 00000000 ____D () C:\Users\Kate\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2015-03-07 12:14 - 2013-04-01 21:15 - 00002185 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2015-03-07 12:10 - 2010-03-09 02:55 - 00003918 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{B52518C1-7F78-4F24-BC21-A6B3F02EC35B}
2015-03-07 12:08 - 2010-03-02 18:54 - 00000000 ____D () C:\Users\Kate\AppData\Roaming\Mozilla
2015-03-06 19:04 - 2013-12-29 19:35 - 00000000 ____D () C:\Users\Kate\AppData\Local\cache
2015-03-06 18:41 - 2011-10-22 00:40 - 00000852 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-508726573-1264868468-1237469860-1001Core.job
2015-03-05 21:57 - 2010-09-21 17:04 - 01968640 ___SH () C:\Users\Kate\Documents\Thumbs.db
2015-03-05 20:25 - 2013-12-29 19:26 - 00000000 ____D () C:\Program Files (x86)\CrossReader
2015-03-05 17:41 - 2011-10-22 00:40 - 00003872 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-508726573-1264868468-1237469860-1001UA
2015-03-05 17:41 - 2011-10-22 00:40 - 00003476 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-508726573-1264868468-1237469860-1001Core
2015-03-05 17:41 - 2011-10-22 00:40 - 00000904 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-508726573-1264868468-1237469860-1001UA.job
2015-03-05 17:39 - 2012-09-23 13:51 - 00003894 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2015-03-05 17:39 - 2012-09-23 13:51 - 00003642 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
 
==================== Files in the root of some directories =======
 
2013-12-30 03:00 - 2013-12-30 03:00 - 0000032 _____ () C:\Users\Kate\AppData\Roaming\WB.CFG
2010-12-18 12:41 - 2010-12-18 12:41 - 0000000 _____ () C:\Users\Kate\AppData\Roaming\wklnhst.dat
2015-03-05 22:04 - 2015-03-06 23:41 - 0174865 _____ () C:\Users\Kate\AppData\Local\ars.cache
2015-03-05 22:05 - 2015-03-06 23:42 - 0473157 _____ () C:\Users\Kate\AppData\Local\census.cache
2015-03-05 21:53 - 2015-03-05 21:53 - 0000036 _____ () C:\Users\Kate\AppData\Local\housecall.guid.cache
2013-05-23 19:50 - 2013-05-23 19:50 - 0000017 _____ () C:\Users\Kate\AppData\Local\resmon.resmoncfg
2015-03-05 21:52 - 2015-03-05 21:52 - 0104411 _____ () C:\ProgramData\1425610354.bdinstall.bin
2010-09-13 18:24 - 2010-09-13 18:24 - 0000056 ____H () C:\ProgramData\ezsidmv.dat
 
Some content of TEMP:
====================
C:\Users\Kate\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmps8axn_.dll
C:\Users\Kate\AppData\Local\Temp\eject.exe
C:\Users\Kate\AppData\Local\Temp\nsg32C9.exe
C:\Users\Kate\AppData\Local\Temp\nsmB83D.exe
C:\Users\Kate\AppData\Local\Temp\nsmCE30.exe
C:\Users\Kate\AppData\Local\Temp\nsrA3B7.exe
C:\Users\Kate\AppData\Local\Temp\Quarantine.exe
C:\Users\Kate\AppData\Local\Temp\Runner.exe
C:\Users\Kate\AppData\Local\Temp\sqlite3.dll
C:\Users\Kate\AppData\Local\Temp\tbTrus.dll
C:\Users\Kate\AppData\Local\Temp\tbVafm.dll
C:\Users\Kate\AppData\Local\Temp\ToolbarHelper.exe
 
 
==================== Bamital & volsnap Check =================
 
(There is no automatic fix for files that do not pass verification.)
 
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
 
==================== BCD ================================
 
Windows Boot Manager
--------------------
identifier              {bootmgr}
device                  partition=\Device\HarddiskVolume2
description             Windows Boot Manager
locale                  en-US
inherit                 {globalsettings}
default                 {current}
resumeobject            {13745b40-21a5-11df-84d5-a4badba732b9}
displayorder            {current}
toolsdisplayorder       {memdiag}
timeout                 30
 
Windows Boot Loader
-------------------
identifier              {current}
device                  partition=C:
path                    \Windows\system32\winload.exe
description             Windows 7
locale                  en-US
inherit                 {bootloadersettings}
recoverysequence        {13745b42-21a5-11df-84d5-a4badba732b9}
recoveryenabled         Yes
osdevice                partition=C:
systemroot              \Windows
resumeobject            {13745b40-21a5-11df-84d5-a4badba732b9}
nx                      OptIn
 
Windows Boot Loader
-------------------
identifier              {13745b42-21a5-11df-84d5-a4badba732b9}
device                  ramdisk=[\Device\HarddiskVolume2]\Recovery\WindowsRE\Winre.wim,{13745b43-21a5-11df-84d5-a4badba732b9}
path                    \windows\system32\winload.exe
description             Windows Recovery Environment
inherit                 {bootloadersettings}
osdevice                ramdisk=[\Device\HarddiskVolume2]\Recovery\WindowsRE\Winre.wim,{13745b43-21a5-11df-84d5-a4badba732b9}
systemroot              \windows
nx                      OptIn
winpe                   Yes
 
Resume from Hibernate
---------------------
identifier              {13745b40-21a5-11df-84d5-a4badba732b9}
device                  partition=C:
path                    \Windows\system32\winresume.exe
description             Windows Resume Application
locale                  en-US
inherit                 {resumeloadersettings}
filedevice              partition=C:
filepath                \hiberfil.sys
debugoptionenabled      No
 
Windows Memory Tester
---------------------
identifier              {memdiag}
device                  partition=\Device\HarddiskVolume2
path                    \boot\memtest.exe
description             Windows Memory Diagnostic
locale                  en-US
inherit                 {globalsettings}
badmemoryaccess         Yes
 
EMS Settings
------------
identifier              {emssettings}
bootems                 Yes
 
Debugger Settings
-----------------
identifier              {dbgsettings}
debugtype               Serial
debugport               1
baudrate                115200
 
RAM Defects
-----------
identifier              {badmemory}
 
Global Settings
---------------
identifier              {globalsettings}
inherit                 {dbgsettings}
                        {emssettings}
                        {badmemory}
 
Boot Loader Settings
--------------------
identifier              {bootloadersettings}
inherit                 {globalsettings}
                        {hypervisorsettings}
 
Hypervisor Settings
-------------------
identifier              {hypervisorsettings}
hypervisordebugtype     Serial
hypervisordebugport     1
hypervisorbaudrate      115200
 
Resume Loader Settings
----------------------
identifier              {resumeloadersettings}
inherit                 {globalsettings}
 
Device options
--------------
identifier              {13745b43-21a5-11df-84d5-a4badba732b9}
description             Ramdisk Options
ramdisksdidevice        partition=\Device\HarddiskVolume2
ramdisksdipath          \Recovery\WindowsRE\boot.sdi
 
 
 
LastRegBack: 2012-02-01 11:31
 
==================== End Of Log ============================

  • 0

Advertisements


#2
pystryker

pystryker

    Trusted Helper

  • Malware Removal
  • 3,886 posts
Hello and welcome to Geeks To Go! My nickname is Pystryker :) , and I will be helping you with your issue today.


Before we get started, I have a few things I need to go over with you
  • If you are receiving help for this issue at another forum, please let me know so I can close this thread.
  • Please download to and run all requested tools from your Desktop.
  • Please do not install any new software during the cleaning process other than the tools I provide for you. This can hinder the cleaning process.
  • At the top of your post, please click on the "Follow this topic" button and make sure that the "Received notification" box is checked and set to "Instantly" This will send an email to you as soon as I reply to your topic, allowing us to solve your problem faster.
  • If any of your security programs give you a warning about any tool I ask you to use, please do not worry. All the links and tools I provide to you will be safe.
  • Please do not run any tools other than the ones I ask you to, when I ask you to. Some of these tools can be very dangerous if used improperly. Also, if you use a tool that I have not requested you use, it can cause false positives, thereby delaying the complete cleaning of your machine.
  • This is a complicated process. It requires several steps, patience, and careful following of my instructions in the order they are given to diagnose your problems to get your machine back in working order.
  • Please stay with me until the end of all steps and procedures and I declare your system clean. Just because there is a lack of symptoms does not indicate a clean machine. I promise to do the same for you.
  • It is impossible for me to know what interactions may happen between your computer's software and the tools we will use to clean your machine. Therefore, I highly recommend you backup any critical personal files on your machine before we start.
  • If you have any questions at all, please don't hesitate to ask. There's no such thing as a stupid question when dealing with malware.
  • If you are unsure of an instruction I give you, or if something unexepected occurs, Do NOT proceed! Stop and ask for clarification of the instruction or tell me what occurred.
  • Please remember, the fixes are for your machine and your machine ONLY! Do not use these fixes on any other machine, each fix is tailor made for your system only. Using a fix on another machine can and will cause serious damage.
  • Once we have cleaned your machine, we'll have some cleanup and prevention steps to go through. We will also provide you with some information about how to reduce your chances of infection and get some protections in place to help defend you against this in the future
  • Please be patient while I am analyzing your logs. I know you are probably scared and very frustrated with this problem, but I am a volunteer and sometimes life does get in the way. :)
Now, let's get started, shall we? :thumbsup:



Hi, let's run a couple of tools, and then a fresh set of logs with FRST.


Please disable your antivirus for the duration of my instructions. Don't forget to re-enable them after you have completed the steps.


Step 1: P2P/Torrent Warning


I cannot stress highly enough the danger in using these types of programs. P2P programs are one of the major avenues of infection these days. The files downloaded with these programs are more likely than not infected with trojans, malware, rootkits, etc.

You run the risk of getting an infection that can compromise your sensitive data, such as financial records, personal information, etc. That is just the infection aspect of using P2P programs. You also run the risk of possible arrest, fines, or in severe cases, jail time for illegal downloading of copyrighted material.

There are also new infections out there such as CryptoWall 3.0 and CryptoLocker. When infected with these, all of your personal files on any drive connected to your computer will be affected. These infections copy all your files, encrypt them, and then delete the originals, leaving you with the encrypted copies. You are then presented with a screen telling you you have a certain amount of time to pay the ransom for the decryption code to decrypt your files. Even if you pay the ransom, there decryption process usually results in corrupt and unusable files.

There is nothing we can do to decrypt the files, as they use very sophisticated encryption techniques. Please consider this when using P2P programs. Malware and ransomware writers use P2P to spread their infections.


Here are some information sources about the dangers of P2P programs:

FBI - Peer to Peer Scams

USA Today Artticle on P2P Programs

File Sharing Infects 500,000 Computers

I very much recommend you uninstall this program from your machine. If not, I can guarantee you will be back needing help with your machine again. The risks of infections from content downloaded with P2P programs far outweigh any benefit of using them.

It is, of course, your choice as to whether or not you remove the program from your machine. It is my duty though, to point out how dangerous it is to use these programs. However, I must request that you do not use it while we are cleaning your machine.



Step 2: Junkware Removal Tool


thisisujrt.gif Please download Junkware Removal Tool to your desktop.
  • Shut down your protection software now to avoid potential conflicts.
  • Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
  • The tool will open and start scanning your system.
  • Please be patient as this can take a while to complete depending on your system's specifications.
  • On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
  • Post the contents of JRT.txt into your next message.
Step 3: AdwCleaner


Download ADWcleaner by clicking here. Please save it to your Desktop


adwcleaner2_zps680e0e15.jpg
  • Double click (Vista and 7 Users)right click the adwcleaner.exe file and click Run as Adminstrator and accept the UAC prompt to run AdwCleaner
  • Close any open windows or browsers.
  • Pause your Anti-Virus program if it is running.
  • Once it starts, click on the Scan button.
  • Let the scan complete itself. This may take a few minutes.
  • Once the scan has finished, it will say "Pending, uncheck elements you don't want to remove.", don't worry about unchecking anything and then click the Cleaning button. When finished, it will ask to reboot. Please reboot.
  • When the machine has rebooted, a log will be produced. Please copy/paste that in your next reply. Here's how:
    • Click the Report button and the log will open. Copy and Paste the contents of the log file into your next reply.
    This report is also saved at C:\AdwCleaner[R0].txt
Step 4: Fresh FRST Scan

Note: Please move FRST64.exe from C:\Users\Kate\Downloads to your desktop before running this scan.
  • Start Farbar's Recovery Scan Tool and place a checkmark in the Addition box.
  • FRST will scan your system and then produce two logs, FRST.txt and Addition.txt. Please post both logs in your next reply.
Things I need to see in your next post:

Please post each of these logs as a separate reply in this thread.

Junkware Removal Tool Log

AdwCleaner Log

FRST.txt Log

Addition.txt Log

  • 0

#3
very_metal

very_metal

    Member

  • Topic Starter
  • Member
  • PipPip
  • 16 posts
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.4.3 (03.01.2015:1)
OS: Windows 7 Home Premium x64
Ran by Kate on Mon 03/09/2015 at 22:43:38.61
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
 
 
 
~~~ Services
 
 
 
~~~ Registry Values
 
Successfully repaired: [Registry Value] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\\Start Page
Successfully repaired: [Registry Value] HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Main\\Start Page
Successfully repaired: [Registry Value] HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\Main\\Start Page
Successfully repaired: [Registry Value] HKEY_USERS\S-1-5-19\Software\Microsoft\Internet Explorer\Main\\Start Page
Successfully repaired: [Registry Value] HKEY_USERS\S-1-5-20\Software\Microsoft\Internet Explorer\Main\\Start Page
Successfully repaired: [Registry Value] HKEY_USERS\S-1-5-21-508726573-1264868468-1237469860-1001\Software\Microsoft\Internet Explorer\Main\\Start Page
 
 
 
~~~ Registry Keys
 
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{e4c3a8b6-7724-45d1-a629-17b69118ebcd}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{e4c3a8b6-7724-45d1-a629-17b69118ebcd}
Successfully deleted: [Registry Key - Orphan] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}
Successfully deleted: [Registry Key - Orphan] HKEY_CLASSES_ROOT\CLSID\{5C255C8A-E604-49b4-9D64-90988571CECB}
Successfully deleted: [Registry Key - Orphan] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{96A25A24-2E87-4374-8A50-CC6F943FCE4D}
Successfully deleted: [Registry Key - Orphan] HKEY_CLASSES_ROOT\CLSID\{96A25A24-2E87-4374-8A50-CC6F943FCE4D}
Successfully deleted: [Registry Key - Orphan] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{e4c3a8b6-7724-45d1-a629-17b69118ebcd}
Successfully deleted: [Registry Key - Orphan] HKEY_CLASSES_ROOT\CLSID\{e4c3a8b6-7724-45d1-a629-17b69118ebcd}
Successfully deleted: [Registry Key - Orphan] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}
Successfully deleted: [Registry Key - Orphan] HKEY_CLASSES_ROOT\CLSID\{5C255C8A-E604-49b4-9D64-90988571CECB}
Successfully deleted: [Registry Key - Orphan] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{96A25A24-2E87-4374-8A50-CC6F943FCE4D}
Successfully deleted: [Registry Key - Orphan] HKEY_CLASSES_ROOT\CLSID\{96A25A24-2E87-4374-8A50-CC6F943FCE4D}
Successfully deleted: [Registry Key - Orphan] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{e4c3a8b6-7724-45d1-a629-17b69118ebcd}
Successfully deleted: [Registry Key - Orphan] HKEY_CLASSES_ROOT\CLSID\{e4c3a8b6-7724-45d1-a629-17b69118ebcd}
 
 
 
~~~ Files
 
Successfully deleted: [File] "C:\Users\Kate\appdata\local\google\chrome\user data\default\local storage\http_client.conduit-storage.com_0.localstorage"
Successfully deleted: [File] "C:\Users\Kate\appdata\locallow\skwconfig.bin"
 
 
 
~~~ Folders
 
Successfully deleted: [Folder] "C:\ProgramData\pcdr"
Successfully deleted: [Folder] "C:\ProgramData\strongvault online backup"
Successfully deleted: [Folder] "C:\Users\Kate\appdata\local\cre"
Successfully deleted: [Folder] "C:\Program Files (x86)\jump flip"
Successfully deleted: [Folder] "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\free window registry repair"
Successfully deleted: [Folder] "C:\Users\Kate\AppData\Roaming\microsoft\windows\start menu\programs\free window registry repair"
Successfully deleted: [Folder] "C:\ai_recyclebin"
Successfully deleted: [Folder] "C:\Windows\syswow64\ai_recyclebin"
 
 
 
~~~ Event Viewer Logs were cleared
 
 
 
 
 
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on Mon 03/09/2015 at 22:48:57.60
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Edited by very_metal, 10 March 2015 - 02:06 PM.

  • 0

#4
very_metal

very_metal

    Member

  • Topic Starter
  • Member
  • PipPip
  • 16 posts
# AdwCleaner v4.112 - Logfile created 09/03/2015 at 22:58:51
# Updated 09/03/2015 by Xplode
# Database : 2015-03-05.1 [Server]
# Operating system : Windows 7 Home Premium Service Pack 1 (x64)
# Username : Kate - KATE-PC
# Running from : C:\Users\Kate\Desktop\AdwCleaner.exe
# Option : Scan
 
***** [ Services ] *****
 
 
***** [ Files / Folders ] *****
 
 
***** [ Scheduled tasks ] *****
 
 
***** [ Shortcuts ] *****
 
 
***** [ Registry ] *****
 
Key Found : HKCU\Software\AppDataLow\Software\Conduit
Key Found : HKCU\Software\Bitberry
Key Found : [x64] HKCU\Software\Bitberry
 
***** [ Web browsers ] *****
 
-\\ Internet Explorer v11.0.9600.17041
 
 
-\\ Mozilla Firefox v19.0.2 (en-US)
 
 
-\\ Google Chrome v41.0.2272.76
 
[C:\Users\Kate\AppData\Local\Google\Chrome\User Data\Default\Web data] - Found [Search Provider] : hxxp://sweetlifealacarte.com/?s={searchTerms}
[C:\Users\Kate\AppData\Local\Google\Chrome\User Data\Default\Web data] - Found [Search Provider] : hxxp://www.sweetbikesonline.com/index.php?option=com_search&searchword={searchTerms}
[C:\Users\Kate\AppData\Local\Google\Chrome\User Data\Default\Web data] - Found [Search Provider] : hxxp://search.conduit.com/Results.aspx?q={searchTerms}&SearchSource=49&CUI=UN27622930361112316&ctid=CT3294791&UM=2
[C:\Users\Kate\AppData\Local\Google\Chrome\User Data\Default\Web data] - Found [Search Provider] : hxxp://search.conduit.com/Results.aspx?ctid=CT3300021&SearchSource=45&UM=2&q={searchTerms}
[C:\Users\Kate\AppData\Local\Google\Chrome\User Data\Default\Web data] - Found [Search Provider] : hxxp://start.sweetpacks.com/?src=6&q={searchTerms}&st=12&crg=3.5000006.10045&barid={36D6FF44-B788-11E2-A361-A4BADBA732B9}
[C:\Users\Kate\AppData\Local\Google\Chrome\User Data\Default\Web data] - Found [Search Provider] : hxxp://mysearch.sweetpacks.com?src=6&q={searchTerms}&barid=&
[C:\Users\Kate\AppData\Local\Google\Chrome\User Data\Default\Web data] - Found [Search Provider] : hxxp://search.aol.com/aol/search?q={searchTerms}
[C:\Users\Kate\AppData\Local\Google\Chrome\User Data\Default\Web data] - Found [Search Provider] : hxxp://www.ask.com/web?q={searchTerms}
[C:\Users\Kate\AppData\Local\Google\Chrome\User Data\Default\Web data] - Found [Search Provider] : hxxp://start.mysearchdial.com/results.php?f=4&q={searchTerms}&a=irmsd1202&cd=2XzuyEtN2Y1L1Qzu0AyE0B0A0D0B0AyBtAtB0BzytD0F0CtDtN0D0Tzu0CyBtBzytN1L2XzutBtFtBtFtCyEtFtCtAyBzytN1L1CzutCyD1B1P1R&cr=1043370825&ir=
*************************
 
AdwCleaner[R0].txt - [40407 bytes] - [07/03/2015 13:10:46]
AdwCleaner[R1].txt - [40551 bytes] - [07/03/2015 13:22:46]
AdwCleaner[R2].txt - [2610 bytes] - [09/03/2015 22:58:51]
AdwCleaner[S0].txt - [38851 bytes] - [07/03/2015 13:28:39]
 
########## EOF - C:\AdwCleaner\AdwCleaner[R2].txt - [2729 bytes] ##########

  • 0

#5
very_metal

very_metal

    Member

  • Topic Starter
  • Member
  • PipPip
  • 16 posts
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 09-03-2015 01
Ran by Kate (administrator) on KATE-PC on 09-03-2015 23:06:56
Running from C:\Users\Kate\Desktop
Loaded Profiles: Kate (Available profiles: Kate)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: English (United States)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo...very-scan-tool/
 
==================== Processes (Whitelisted) =================
 
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
 
(IDT, Inc.) C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_afc3018f8cfedd20\stacsv64.exe
(Stardock Corporation) C:\Program Files\Dell\DellDock\DockLogin.exe
() C:\Program Files\Dell\Dell Wireless WLAN Card\WLTRYSVC.EXE
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Dell Inc.) C:\Program Files\Dell\Dell Wireless WLAN Card\BCMWLTRY.EXE
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\Apoint.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Dell Inc.) C:\Program Files\Dell\Dell Wireless WLAN Card\WLTRAY.EXE
(Dell Inc.) C:\Program Files\Dell\QuickSet\quickset.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Google Inc.) C:\Users\Kate\AppData\Local\Google\Update\GoogleUpdate.exe
(Google) C:\Program Files (x86)\Google\Drive\googledrivesync.exe
() C:\Users\Kate\AppData\Local\Amazon Cloud Player\Amazon Music Helper.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\AppleIEDAV.exe
(Google) C:\Program Files (x86)\Google\Drive\googledrivesync.exe
(Dropbox, Inc.) C:\Users\Kate\AppData\Roaming\Dropbox\bin\Dropbox.exe
() C:\Program Files (x86)\Dell DataSafe Online\DataSafeOnline.exe
(CyberLink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD DX\PDVDDXSrv.exe
(SupportSoft, Inc.) C:\Program Files (x86)\Dell Support Center\bin\sprtcmd.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
(Sun Microsystems, Inc.) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\APSDaemon.exe
(SupportSoft, Inc.) C:\Program Files (x86)\Dell Support Center\gs_agent\dsc.exe
(SoftThinks SAS) C:\Program Files (x86)\Dell DataSafe Local Backup\SftService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTmon.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\ApMsgFwd.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\hidfind.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\ApntEx.exe
 
 
==================== Registry (Whitelisted) ==================
 
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
 
HKLM\...\Run: [Apoint] => C:\Program Files\DellTPad\Apoint.exe [305664 2009-01-22] (Alps Electric Co., Ltd.)
HKLM\...\Run: [SysTrayApp] => C:\Program Files\IDT\WDM\sttray64.exe [444416 2009-06-29] (IDT, Inc.)
HKLM\...\Run: [Broadcom Wireless Manager UI] => C:\Program Files\Dell\Dell Wireless WLAN Card\WLTRAY.exe [4968960 2009-07-16] (Dell Inc.)
HKLM\...\Run: [QuickSet] => C:\Program Files\Dell\QuickSet\QuickSet.exe [3180624 2009-07-02] (Dell Inc.)
HKLM\...\Run: [IAAnotif] => C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe [186904 2009-06-04] (Intel Corporation)
HKLM-x32\...\Run: [Dell DataSafe Online] => C:\Program Files (x86)\Dell DataSafe Online\DataSafeOnline.exe [1807600 2009-11-13] ()
HKLM-x32\...\Run: [PDVDDXSrv] => C:\Program Files (x86)\CyberLink\PowerDVD DX\PDVDDXSrv.exe [140520 2009-06-24] (CyberLink Corp.)
HKLM-x32\...\Run: [DellSupportCenter] => C:\Program Files (x86)\Dell Support Center\bin\sprtcmd.exe [206064 2009-05-21] (SupportSoft, Inc.)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [43848 2014-01-20] (Apple Inc.)
HKLM-x32\...\Run: [Wondershare Helper Compact.exe] => C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [252848 2012-07-03] (Sun Microsystems, Inc.)
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2013-05-01] (Apple Inc.)
HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2013-11-02] (Apple Inc.)
Winlogon\Notify\GoToAssist: C:\Program Files (x86)\Citrix\GoToAssist\514\G2AWinLogon_x64.dll [X]
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-508726573-1264868468-1237469860-1001\...\Run: [Google Update] => C:\Users\Kate\AppData\Local\Google\Update\GoogleUpdate.exe [107848 2015-03-05] (Google Inc.)
HKU\S-1-5-21-508726573-1264868468-1237469860-1001\...\Run: [MobileDocuments] => C:\Program Files (x86)\Common Files\Apple\Internet Services\ubd.exe
HKU\S-1-5-21-508726573-1264868468-1237469860-1001\...\Run: [GoogleDriveSync] => C:\Program Files (x86)\Google\Drive\googledrivesync.exe [23308256 2015-01-15] (Google)
HKU\S-1-5-21-508726573-1264868468-1237469860-1001\...\Run: [Amazon Cloud Player] => C:\Users\Kate\AppData\Local\Amazon Cloud Player\Amazon Music Helper.exe [3113792 2013-05-29] ()
HKU\S-1-5-21-508726573-1264868468-1237469860-1001\...\Run: [iCloudServices] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe [59720 2013-11-20] (Apple Inc.)
HKU\S-1-5-21-508726573-1264868468-1237469860-1001\...\Run: [ApplePhotoStreams] => C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe [59720 2013-11-20] (Apple Inc.)
HKU\S-1-5-21-508726573-1264868468-1237469860-1001\...\Run: [AppleIEDAV] => C:\Program Files (x86)\Common Files\Apple\Internet Services\AppleIEDAV.exe [1326408 2013-11-15] (Apple Inc.)
HKU\S-1-5-21-508726573-1264868468-1237469860-1001\...\MountPoints2: E - E:\MotoCastSetup.exe -a
HKU\S-1-5-21-508726573-1264868468-1237469860-1001\...\MountPoints2: {4425e544-4e7e-11df-98ec-a4badba732b9} - E:\VZAccess_Manager.exe /z detect
HKU\S-1-5-21-508726573-1264868468-1237469860-1001\...\MountPoints2: {4a88244a-98d5-11e2-bcf3-a4badba732b9} - E:\MotoCastSetup.exe -a
HKU\S-1-5-18\...\Run: [SearchProtect] => \SearchProtect\bin\cltmng.exe
Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock First Run.lnk
ShortcutTarget: Dell Dock First Run.lnk -> C:\Program Files\Dell\DellDock\DellDock.exe (Stardock Corporation)
Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock First Run.lnk
ShortcutTarget: Dell Dock First Run.lnk -> C:\Program Files\Dell\DellDock\DellDock.exe (Stardock Corporation)
Startup: C:\Users\Kate\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Amazon Cloud Drive.lnk
ShortcutTarget: Amazon Cloud Drive.lnk -> C:\Users\Kate\AppData\Local\Apps\2.0\Z46QOOTJ.9ZG\9Z1R621Z.KKY\amaz..tion_f2fa081ea2183235_0002.0001_cb34a912a946f839\AmazonCloudDrive.exe (Amazon Digital Services, LLC.)
Startup: C:\Users\Kate\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\Kate\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Kate\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Kate\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Kate\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Kate\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Kate\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Kate\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
BootExecute: autocheck autochk * aswBoot.exe /M:124322191 /wow /dir:"C:\Program Files\AVAST Software\Avast"
 
==================== Internet (Whitelisted) ====================
 
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
 
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Local Page = 
HKU\S-1-5-21-508726573-1264868468-1237469860-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/USCON/1
HKU\S-1-5-21-508726573-1264868468-1237469860-1001\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.com/ie
HKU\S-1-5-21-508726573-1264868468-1237469860-1001\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com/ie
URLSearchHook: HKLM-x32 - (No Name) - {e4c3a8b6-7724-45d1-a629-17b69118ebcd} - No File
URLSearchHook: HKU\S-1-5-21-508726573-1264868468-1237469860-1001 - (No Name) - {e4c3a8b6-7724-45d1-a629-17b69118ebcd} - No File
SearchScopes: HKLM -> {E30C225B-6AC6-484D-92F1-13A365CED4FA} URL = http://www.bing.com/...rc=IE-SearchBox
SearchScopes: HKLM-x32 -> {1970984B-77F4-4E74-91E5-C7F43A6EC673} URL = http://www.bing.com/...rc=IE-SearchBox
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-508726573-1264868468-1237469860-1001 -> {1970984B-77F4-4E74-91E5-C7F43A6EC673} URL = 
BHO: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre6\bin\jp2ssv.dll [2010-02-24] (Sun Microsystems, Inc.)
BHO-x32: StumbleUpon Launcher -> {145B29F4-A56B-4b90-BBAC-45784EBEBBB7} -> C:\Program Files (x86)\StumbleUpon\StumbleUponIEBar.dll No File
BHO-x32: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll [2013-03-29] (Oracle Corporation)
BHO-x32: Windows Live Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-01-22] (Microsoft Corporation)
BHO-x32: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll [2013-03-29] (Oracle Corporation)
Toolbar: HKLM-x32 - StumbleUpon Toolbar - {5093EB4C-3E93-40AB-9266-B607BA87BDC8} - C:\Program Files (x86)\StumbleUpon\StumbleUponIEBar.dll No File
Toolbar: HKLM-x32 - No Name - {e4c3a8b6-7724-45d1-a629-17b69118ebcd} -  No File
Toolbar: HKLM-x32 - No Name - {96A25A24-2E87-4374-8A50-CC6F943FCE4D} -  No File
Toolbar: HKU\S-1-5-21-508726573-1264868468-1237469860-1001 -> No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} -  No File
Toolbar: HKU\S-1-5-21-508726573-1264868468-1237469860-1001 -> No Name - {E4C3A8B6-7724-45D1-A629-17B69118EBCD} -  No File
DPF: HKLM-x32 {3D3B42C2-11BF-4732-A304-A01384B70D68} http://picasaweb.goo...6/uploader2.cab
DPF: HKLM-x32 {4871A87A-BFDD-4106-8153-FFDE2BAC2967} http://dlm.tools.aka...vex-2.2.5.7.cab
DPF: HKLM-x32 {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset...lineScanner.cab
Handler-x32: cozi - {5356518D-FE9C-4E08-9C1F-1E872ECD367F} - c:\Program Files (x86)\Cozi Express\CoziProtocolHandler.dll [2009-07-23] (Cozi Group, Inc.)
Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll [2009-07-26] (Microsoft Corporation)
Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll [2009-07-26] (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 10.0.1.1
 
FireFox:
========
FF ProfilePath: C:\Users\Kate\AppData\Roaming\Mozilla\Firefox\Profiles\a9dlfrif.default
FF Keyword.URL: 
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_16_0_0_305.dll [2015-03-09] ()
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll [2014-02-13] ( Microsoft Corporation)
FF Plugin: @Musicnotes.com/Musicnotes Viewer -> C:\Program Files\Musicnotes\npmusicn64.dll [2011-12-01] (Musicnotes, Inc.)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_305.dll [2015-03-09] ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2013-10-01] ()
FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 -> C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll [2014-01-06] (Google, Inc.)
FF Plugin-x32: @java.com/JavaPlugin,version=10.21.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll [2013-04-04] (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll [2014-02-13] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8081.0709 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2009-07-10] (Microsoft Corporation)
FF Plugin-x32: @Musicnotes.com/Musicnotes Viewer -> C:\Program Files (x86)\Musicnotes\npmusicn.dll [2011-12-01] (Musicnotes, Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-03-05] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-03-05] (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll [2014-05-08] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-508726573-1264868468-1237469860-1001: @doubletwist.com/NPPodcast -> C:\Program Files (x86)\Common Files\doubleTwist\NPPodcast.dll No File
FF Plugin HKU\S-1-5-21-508726573-1264868468-1237469860-1001: @talk.google.com/GoogleTalkPlugin -> C:\Users\Kate\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll [2015-01-27] (Google)
FF Plugin HKU\S-1-5-21-508726573-1264868468-1237469860-1001: @talk.google.com/O1DPlugin -> C:\Users\Kate\AppData\Roaming\Mozilla\plugins\npo1d.dll [2015-01-27] (Google)
FF Plugin HKU\S-1-5-21-508726573-1264868468-1237469860-1001: @tools.google.com/Google Update;version=3 -> C:\Users\Kate\AppData\Local\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-03-05] (Google Inc.)
FF Plugin HKU\S-1-5-21-508726573-1264868468-1237469860-1001: @tools.google.com/Google Update;version=9 -> C:\Users\Kate\AppData\Local\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-03-05] (Google Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll [2014-05-08] (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin.dll [2013-06-11] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin2.dll [2013-06-11] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin3.dll [2013-06-11] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin4.dll [2013-06-11] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin5.dll [2013-06-11] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Users\Kate\AppData\Roaming\mozilla\plugins\npgoogletalk.dll [2015-01-27] (Google)
FF Plugin ProgramFiles/Appdata: C:\Users\Kate\AppData\Roaming\mozilla\plugins\npo1d.dll [2015-01-27] (Google)
FF Extension: CrossReader - C:\Users\Kate\AppData\Roaming\Mozilla\Firefox\Profiles\a9dlfrif.default\Extensions\[email protected]f0f261f92.com [2013-12-29]
FF Extension: GetSavin - C:\Users\Kate\AppData\Roaming\Mozilla\Firefox\Profiles\a9dlfrif.default\Extensions\[email protected] [2013-03-30]
FF Extension: AddThis - C:\Users\Kate\AppData\Roaming\Mozilla\Firefox\Profiles\a9dlfrif.default\Extensions\{3e0e7d2a-070f-4a47-b019-91fe5385ba79} [2013-03-29]
FF Extension: Vafmusic2  - C:\Users\Kate\AppData\Roaming\Mozilla\Firefox\Profiles\a9dlfrif.default\Extensions\{7f3f960e-a836-45ca-8911-0accb522246e} [2013-05-23]
FF Extension: Trustworthy  - C:\Users\Kate\AppData\Roaming\Mozilla\Firefox\Profiles\a9dlfrif.default\Extensions\{ad32743c-16ef-46ec-977b-dce0c3c85b20} [2013-03-30]
FF Extension: MixiDJ V8  - C:\Users\Kate\AppData\Roaming\Mozilla\Firefox\Profiles\a9dlfrif.default\Extensions\{e4c3a8b6-7724-45d1-a629-17b69118ebcd} [2013-03-30]
FF Extension: Gmail Notifier (restartless) - C:\Users\Kate\AppData\Roaming\Mozilla\Firefox\Profiles\a9dlfrif.default\Extensions\[email protected] [2013-03-29]
FF Extension: Add Google Search To New Tab Page - C:\Users\Kate\AppData\Roaming\Mozilla\Firefox\Profiles\a9dlfrif.default\Extensions\[email protected] [2013-03-29]
FF HKLM\...\Firefox\Extensions: [{C4CFC0DE-134F-4466-B2A2-FF7C59A8BFAD}] - C:\Program Files\Updater By SweetPacks\Firefox
FF HKLM-x32\...\Firefox\Extensions: [{C4CFC0DE-134F-4466-B2A2-FF7C59A8BFAD}] - C:\Program Files\Updater By SweetPacks\Firefox
 
Chrome: 
=======
CHR HomePage: Default -> hxxp://www.google.com/
CHR Profile: C:\Users\Kate\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Drive) - C:\Users\Kate\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-03-07]
CHR Extension: (Chrome Hotword Shared Module) - C:\Users\Kate\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-03-07]
CHR Extension: (Application Launcher for Drive (by Google)) - C:\Users\Kate\AppData\Local\Google\Chrome\User Data\Default\Extensions\lmjegmlicamnimmfhcmpkclmigmmcbeh [2015-03-09]
CHR Extension: (Google Wallet) - C:\Users\Kate\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-23]
CHR HKU\S-1-5-21-508726573-1264868468-1237469860-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [apdfllckaahabafndbhieahigkjlhalf] - C:\Users\Kate\AppData\Local\Google\Drive\apdfllckaahabafndbhieahigkjlhalf_live.crx [2015-03-07]
CHR HKU\S-1-5-21-508726573-1264868468-1237469860-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [cbjibcbpmbcabnfnohhgjjmkgkimajko] - C:\Users\Kate\AppData\Local\CRE\cbjibcbpmbcabnfnohhgjjmkgkimajko.crx [Not Found]
CHR HKU\S-1-5-21-508726573-1264868468-1237469860-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [lmjegmlicamnimmfhcmpkclmigmmcbeh] - https://clients2.goo...ice/update2/crx
CHR HKU\S-1-5-21-508726573-1264868468-1237469860-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [oajgghejjpgkmpgbchgjieahoefimdle] - C:\Users\Kate\AppData\Local\CRE\oajgghejjpgkmpgbchgjieahoefimdle.crx [Not Found]
CHR HKLM-x32\...\Chrome\Extension: [cbjibcbpmbcabnfnohhgjjmkgkimajko] - C:\Users\Kate\AppData\Local\CRE\cbjibcbpmbcabnfnohhgjjmkgkimajko.crx [Not Found]
CHR HKLM-x32\...\Chrome\Extension: [oajgghejjpgkmpgbchgjieahoefimdle] - C:\Users\Kate\AppData\Local\CRE\oajgghejjpgkmpgbchgjieahoefimdle.crx [Not Found]
 
==================== Services (Whitelisted) =================
 
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 
R2 DockLoginService; C:\Program Files\Dell\DellDock\DockLogin.exe [155648 2009-06-09] (Stardock Corporation) [File not signed]
R2 STacSV; C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_afc3018f8cfedd20\STacSV64.exe [240128 2009-06-29] (IDT, Inc.)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
R2 wltrysvc; C:\Program Files\Dell\Dell Wireless WLAN Card\bcmwltry.exe [3417088 2009-07-16] (Dell Inc.) [File not signed]
S2 MSCamSvc; "C:\Program Files\Microsoft LifeCam\MSCamS64.exe" [X]
S3 StumbleUponUpdateService; "C:\Program Files (x86)\StumbleUpon\StumbleUponUpdateService.exe" [X]
S2 vToolbarUpdater18.3.0; C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.3.0\ToolbarUpdater.exe [X]
 
==================== Drivers (Whitelisted) ====================
 
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 
S3 NWUSBModem; C:\Windows\System32\DRIVERS\nwusbmdm.sys [213120 2008-05-09] (Novatel Wireless Inc.)
S3 NWUSBPort; C:\Windows\System32\DRIVERS\nwusbser.sys [213120 2008-05-09] (Novatel Wireless Inc.)
S3 NWUSBPort2; C:\Windows\System32\DRIVERS\nwusbser2.sys [213120 2008-05-09] (Novatel Wireless Inc.)
S3 USBAAPL64; C:\Windows\System32\Drivers\usbaapl64.sys [54784 2012-12-13] (Apple, Inc.) [File not signed]
S3 VX6000; C:\Windows\System32\DRIVERS\VX6000Xp.sys [2143600 2010-05-20] (Microsoft Corporation
)
S2 iPodDrv; \??\C:\Windows\system32\drivers\iPodDrv.sys [X]
S0 Lbd; system32\DRIVERS\Lbd.sys [X]
S1 SBRE; \??\C:\Windows\system32\drivers\SBREdrv.sys [X]
 
==================== NetSvcs (Whitelisted) ===================
 
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
 
 
==================== One Month Created Files and Folders ========
 
(If an entry is included in the fixlist, the file\folder will be moved.)
 
2015-03-09 22:57 - 2015-03-09 22:57 - 02095104 _____ (Farbar) C:\Users\Kate\Desktop\FRST64.exe
2015-03-09 22:52 - 2015-03-09 22:53 - 02171392 _____ () C:\Users\Kate\Desktop\AdwCleaner.exe
2015-03-09 22:52 - 2015-03-09 22:52 - 00017937 _____ () C:\Users\Kate\Desktop\download.htm
2015-03-09 22:50 - 2015-03-09 22:50 - 01388333 _____ (Thisisu) C:\Users\Kate\Downloads\JRT.exe
2015-03-09 22:48 - 2015-03-09 22:48 - 00004262 _____ () C:\Users\Kate\Desktop\JRT.txt
2015-03-09 22:41 - 2015-03-09 22:41 - 01388333 _____ (Thisisu) C:\Users\Kate\Desktop\JRT.exe
2015-03-07 13:38 - 2015-03-09 23:08 - 00023211 _____ () C:\Users\Kate\Desktop\FRST.txt
2015-03-07 13:38 - 2015-03-09 23:07 - 00000000 ____D () C:\FRST
2015-03-07 13:33 - 2015-03-09 23:04 - 00000168 _____ () C:\Windows\setupact.log
2015-03-07 13:33 - 2015-03-09 18:36 - 00001950 _____ () C:\Windows\PFRO.log
2015-03-07 13:33 - 2015-03-07 13:33 - 00000000 _____ () C:\Windows\setuperr.log
2015-03-07 13:26 - 2015-03-07 13:26 - 00000000 ____D () C:\ProgramData\GFI Software
2015-03-07 13:10 - 2015-03-09 23:03 - 00000000 ____D () C:\AdwCleaner
2015-03-07 01:10 - 2015-03-07 01:10 - 00000000 ____D () C:\OETemp
2015-03-05 23:06 - 2015-03-07 01:06 - 00236080 _____ (Trend Micro Inc.) C:\Windows\RegBootClean64.exe
2015-03-05 23:05 - 2015-03-07 00:42 - 00473157 _____ () C:\Users\Kate\AppData\Local\census.cache
2015-03-05 23:04 - 2015-03-07 00:41 - 00174865 _____ () C:\Users\Kate\AppData\Local\ars.cache
2015-03-05 22:53 - 2015-03-05 22:53 - 00000036 _____ () C:\Users\Kate\AppData\Local\housecall.guid.cache
2015-03-05 22:52 - 2015-03-05 22:52 - 00104411 _____ () C:\ProgramData\1425610354.bdinstall.bin
2015-03-05 22:52 - 2015-03-05 22:52 - 00000000 ____D () C:\Users\Kate\AppData\Roaming\QuickScan
2015-03-05 18:44 - 2015-03-05 18:44 - 00000000 __SHD () C:\Users\Kate\AppData\Local\EmieUserList
2015-03-05 18:44 - 2015-03-05 18:44 - 00000000 __SHD () C:\Users\Kate\AppData\Local\EmieSiteList
 
==================== One Month Modified Files and Folders =======
 
(If an entry is included in the fixlist, the file\folder will be moved.)
 
2015-03-09 23:09 - 2010-09-21 18:04 - 01968640 ___SH () C:\Users\Kate\Documents\Thumbs.db
2015-03-09 23:07 - 2010-08-25 13:22 - 00000000 ___RD () C:\Users\Kate\Documents\My Dropbox
2015-03-09 23:07 - 2010-08-25 13:21 - 00000000 ____D () C:\Users\Kate\AppData\Roaming\Dropbox
2015-03-09 23:05 - 2012-09-23 14:52 - 00000000 ___RD () C:\Users\Kate\Google Drive
2015-03-09 23:04 - 2012-09-23 14:51 - 00000894 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-03-09 23:04 - 2009-07-14 01:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-03-09 23:03 - 2009-07-14 01:10 - 01318037 _____ () C:\Windows\WindowsUpdate.log
2015-03-09 22:44 - 2012-09-23 14:51 - 00000898 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-03-09 22:25 - 2013-02-27 17:42 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-03-09 19:25 - 2013-02-27 17:42 - 00701616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-03-09 19:25 - 2013-02-27 17:42 - 00003768 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-03-09 19:25 - 2011-06-08 03:59 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-03-09 18:47 - 2009-07-14 00:45 - 00014240 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-03-09 18:47 - 2009-07-14 00:45 - 00014240 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-03-09 18:46 - 2012-09-23 14:51 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Drive
2015-03-09 18:44 - 2009-07-14 01:13 - 00782510 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-03-09 18:43 - 2010-03-09 03:55 - 00003918 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{B52518C1-7F78-4F24-BC21-A6B3F02EC35B}
2015-03-07 13:57 - 2013-12-29 20:27 - 00000000 ____D () C:\Program Files (x86)\BitZipper
2015-03-07 13:56 - 2010-09-20 21:52 - 00000000 ____D () C:\Users\Kate\AppData\Local\Google
2015-03-07 13:30 - 2010-03-02 19:59 - 00000000 ____D () C:\Users\Kate
2015-03-07 13:30 - 2010-03-02 19:54 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-03-07 13:29 - 2009-07-13 22:34 - 00000580 _____ () C:\Windows\win.ini
2015-03-07 13:18 - 2010-08-25 13:22 - 00001017 _____ () C:\Users\Kate\Desktop\Dropbox.lnk
2015-03-07 13:18 - 2010-08-25 13:21 - 00000000 ____D () C:\Users\Kate\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2015-03-07 13:14 - 2013-04-01 22:15 - 00002185 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2015-03-07 13:08 - 2010-03-02 19:54 - 00000000 ____D () C:\Users\Kate\AppData\Roaming\Mozilla
2015-03-06 20:04 - 2013-12-29 20:35 - 00000000 ____D () C:\Users\Kate\AppData\Local\cache
2015-03-06 19:41 - 2011-10-22 01:40 - 00000852 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-508726573-1264868468-1237469860-1001Core.job
2015-03-05 21:25 - 2013-12-29 20:26 - 00000000 ____D () C:\Program Files (x86)\CrossReader
2015-03-05 18:41 - 2011-10-22 01:40 - 00003872 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-508726573-1264868468-1237469860-1001UA
2015-03-05 18:41 - 2011-10-22 01:40 - 00003476 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-508726573-1264868468-1237469860-1001Core
2015-03-05 18:41 - 2011-10-22 01:40 - 00000904 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-508726573-1264868468-1237469860-1001UA.job
2015-03-05 18:39 - 2012-09-23 14:51 - 00003894 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2015-03-05 18:39 - 2012-09-23 14:51 - 00003642 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
 
==================== Files in the root of some directories =======
 
2013-12-30 04:00 - 2013-12-30 04:00 - 0000032 _____ () C:\Users\Kate\AppData\Roaming\WB.CFG
2010-12-18 13:41 - 2010-12-18 13:41 - 0000000 _____ () C:\Users\Kate\AppData\Roaming\wklnhst.dat
2015-03-05 23:04 - 2015-03-07 00:41 - 0174865 _____ () C:\Users\Kate\AppData\Local\ars.cache
2015-03-05 23:05 - 2015-03-07 00:42 - 0473157 _____ () C:\Users\Kate\AppData\Local\census.cache
2015-03-05 22:53 - 2015-03-05 22:53 - 0000036 _____ () C:\Users\Kate\AppData\Local\housecall.guid.cache
2013-05-23 20:50 - 2013-05-23 20:50 - 0000017 _____ () C:\Users\Kate\AppData\Local\resmon.resmoncfg
2015-03-05 22:52 - 2015-03-05 22:52 - 0104411 _____ () C:\ProgramData\1425610354.bdinstall.bin
2010-09-13 19:24 - 2010-09-13 19:24 - 0000056 ____H () C:\ProgramData\ezsidmv.dat
 
Some content of TEMP:
====================
C:\Users\Kate\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpa3xfol.dll
C:\Users\Kate\AppData\Local\Temp\eject.exe
C:\Users\Kate\AppData\Local\Temp\nsg32C9.exe
C:\Users\Kate\AppData\Local\Temp\nsmB83D.exe
C:\Users\Kate\AppData\Local\Temp\nsmCE30.exe
C:\Users\Kate\AppData\Local\Temp\nsrA3B7.exe
C:\Users\Kate\AppData\Local\Temp\Quarantine.exe
C:\Users\Kate\AppData\Local\Temp\Runner.exe
C:\Users\Kate\AppData\Local\Temp\sqlite3.dll
C:\Users\Kate\AppData\Local\Temp\tbTrus.dll
C:\Users\Kate\AppData\Local\Temp\tbVafm.dll
C:\Users\Kate\AppData\Local\Temp\ToolbarHelper.exe
 
 
==================== Bamital & volsnap Check =================
 
(There is no automatic fix for files that do not pass verification.)
 
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
 
 
LastRegBack: 2012-02-01 12:31
 
==================== End Of Log ============================

  • 0

#6
very_metal

very_metal

    Member

  • Topic Starter
  • Member
  • PipPip
  • 16 posts
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 09-03-2015 01
Ran by Kate at 2015-03-09 23:09:29
Running from C:\Users\Kate\Desktop
Boot Mode: Normal
==========================================================
 
 
==================== Security Center ========================
 
(If an entry is included in the fixlist, it will be removed.)
 
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 
==================== Installed Programs ======================
 
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
 
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 2.5.1.17730 - Adobe Systems Inc.)
Adobe Flash Player 16 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 16.0.0.305 - Adobe Systems Incorporated)
Adobe Flash Player 16 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 16.0.0.305 - Adobe Systems Incorporated)
Adobe Reader X (10.1.10) (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AA1000000001}) (Version: 10.1.10 - Adobe Systems Incorporated)
Amazon Cloud Drive (HKU\S-1-5-21-508726573-1264868468-1237469860-1001\...\23ab716f18849b6f) (Version: 2.1.2013.1340 - Amazon)
Amazon Cloud Player (HKU\S-1-5-21-508726573-1264868468-1237469860-1001\...\Amazon Amazon Cloud Player) (Version: 1.0.3.316 - Amazon Services LLC)
Amazon MP3 Uploader (HKLM-x32\...\com.amazon.music.uploader) (Version: 1.0.7 - Amazon Services LLC)
Amazon MP3 Uploader (x32 Version: 1.0.7 - Amazon Services LLC) Hidden
Apple Application Support (HKLM-x32\...\{A922C4B7-50E0-4787-A94C-59DBF3C65DBE}) (Version: 3.0 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{2EF5D87E-B7BD-458F-8428-E4D0B8B4E65C}) (Version: 7.0.0.117 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Banctec Service Agreement (HKLM-x32\...\{42D68A86-DB1C-4256-B8C9-5D0D92919AF5}) (Version: 2.0.0 - Dell Inc.)
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
Cisco EAP-FAST Module (HKLM-x32\...\{64BF0187-F3D2-498B-99EA-163AF9AE6EC9}) (Version: 2.2.14 - Cisco Systems, Inc.)
Cisco LEAP Module (HKLM-x32\...\{51C7AD07-C3F6-4635-8E8A-231306D810FE}) (Version: 1.0.19 - Cisco Systems, Inc.)
Cisco PEAP Module (HKLM-x32\...\{ED5776D5-59B4-46B7-AF81-5F2D94D7C640}) (Version: 1.1.6 - Cisco Systems, Inc.)
Compatibility Pack for the 2007 Office system (HKLM-x32\...\{90120000-0020-0409-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
Cozi (HKLM-x32\...\{2DA5F129-11AC-4F11-8188-B2F07EAAC20A}) (Version: 1.0.4323.24051 - Cozi Group, Inc.)
CrossReader (HKLM-x32\...\CrossReader) (Version: 1.29.153.0 - CrossReader)
Dell DataSafe Local Backup - Support Software (HKLM-x32\...\{A9668246-FB70-4103-A1E3-66C9BC2EFB49}) (Version: 2.34 - Dell)
Dell DataSafe Local Backup (HKLM-x32\...\{0ED7EE95-6A97-47AA-AD73-152C08A15B04}) (Version: 9.4.45 - Dell)
Dell DataSafe Online (HKLM-x32\...\{13766F76-6C8C-4E57-A9F3-3212D1C6E0D1}) (Version: 1.2.0009 - Dell, Inc.)
Dell Dock (HKLM\...\{E60B7350-EA5F-41E0-9D6F-E508781E36D2}) (Version: 2.0.0 - Dell)
Dell Edoc Viewer (HKLM\...\{8EBA8727-ADC2-477B-9D9A-1A1836BE4E05}) (Version: 1.0.0 - Dell Inc)
Dell Getting Started Guide (HKLM-x32\...\{7DB9F1E5-9ACB-410D-A7DC-7A3D023CE045}) (Version: 1.00.0000 - Dell Inc.)
Dell Support Center (Support Software) (HKLM-x32\...\{E3BFEE55-39E2-4BE0-B966-89FE583822C1}) (Version: 2.5.09100 - Dell)
Dell Touchpad (HKLM\...\{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}) (Version: 7.104.115.102 - Alps Electric)
Dell Wireless WLAN Card Utility (HKLM\...\Dell Wireless WLAN Card Utility) (Version: 5.30.21.0 - Dell Inc.)
Dropbox (HKU\S-1-5-21-508726573-1264868468-1237469860-1001\...\Dropbox) (Version: 3.2.6 - Dropbox, Inc.)
FredV2Step3 (HKLM-x32\...\{944B3A84-C728-487E-8306-CD3B52092B34}) (Version: 1.00.0000 - USMLE)
Free Window Registry Repair (HKLM-x32\...\Free Window Registry Repair) (Version:  - )
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 41.0.2272.76 - Google Inc.)
Google Drive (HKLM-x32\...\{65EACBB4-B0B8-4A5B-AE46-22DBE15C70B5}) (Version: 1.19.8406.6504 - Google, Inc.)
Google Talk Plugin (HKLM-x32\...\{C77CC230-7417-3F01-B70D-52583DC9FEC9}) (Version: 5.40.2.0 - Google)
Google Update Helper (x32 Version: 1.3.24.7 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.26.9 - Google Inc.) Hidden
GoToAssist 8.0.0.514 (HKLM-x32\...\GoToAssist) (Version:  - )
iCloud (HKLM\...\{81E20D41-C277-4526-934D-F2380AF91B78}) (Version: 3.1.0.40 - Apple Inc.)
Intel® Graphics Media Accelerator Driver (HKLM\...\HDMI) (Version:  - Intel Corporation)
Intel® Matrix Storage Manager (HKLM\...\{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}) (Version:  - Intel Corporation)
iTunes (HKLM\...\{D601CEAD-2E4F-4BBB-85CC-C29A4CE6A3C0}) (Version: 11.1.3.8 - Apple Inc.)
Java 7 Update 21 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217017FF}) (Version: 7.0.210 - Oracle)
Java™ 6 Update 17 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86416017FF}) (Version: 6.0.170 - Sun Microsystems, Inc.)
Java™ 6 Update 22 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83216022F0}) (Version: 6.0.220 - Oracle)
JavaFX 2.1.1 (HKLM-x32\...\{1111706F-666A-4037-7777-211328764D10}) (Version: 2.1.1 - Oracle Corporation)
Junk Mail filter update (x32 Version: 14.0.8089.726 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{90120000-0012-0000-0000-0000000FF1CE}_STANDARD_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version:  - Microsoft)
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version:  - Microsoft)
Microsoft Office File Validation Add-In (HKLM-x32\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Home and Student 2007 (HKLM-x32\...\HOMESTUDENTR) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office PowerPoint Viewer 2007 (English) (HKLM-x32\...\{95120000-00AF-0409-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Standard 2007 (HKLM-x32\...\STANDARD) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Suite Activation Assistant (HKLM-x32\...\{67635FB6-2F63-4FFB-830B-D4C01597EBA4}) (Version: 1.2.1 - DELL)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30214.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Sync Framework Runtime Native v1.0 (x86) (HKLM-x32\...\{8A74E887-8F0F-4017-AF53-CBA42211AAA5}) (Version: 1.0.1215.0 - Microsoft Corporation)
Microsoft Sync Framework Services Native v1.0 (x86) (HKLM-x32\...\{BD64AF4A-8C80-4152-AD77-FCDDF05208AB}) (Version: 1.0.1215.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053 (HKLM\...\{B6E3757B-5E77-3915-866A-CCFC4B8D194C}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM-x32\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 ATL Update kb973924 - x64 9.0.30729.4148 (HKLM\...\{EE936C7A-EA40-31D5-9B65-8E3E089C3828}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Works (HKLM-x32\...\{15BC8CD0-A65B-47D0-A2DD-90A824590FA8}) (Version: 9.7.0621 - Microsoft Corporation)
MixiDJ V8 Toolbar (HKLM-x32\...\MixiDJ_V8 Toolbar) (Version: 6.11.2.6 - MixiDJ V8) <==== ATTENTION
Mobile Broadband Generic Drivers (HKLM-x32\...\{68CC54AC-EFE5-4CE4-81F8-BE0C834E2D86}) (Version: 2.02.07.002.14 - Novatel Wireless)
MobileMe Control Panel (HKLM\...\{41BC9E31-0D39-462E-8E4C-767B21A3B1C3}) (Version: 3.1.8.0 - Apple Inc.)
Mozilla Firefox 19.0.2 (x86 en-US) (HKLM-x32\...\Mozilla Firefox 19.0.2 (x86 en-US)) (Version: 19.0.2 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 19.0.2 - Mozilla)
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
Musicnotes Player V1.31.6 and Viewer V1.19.0 (HKLM-x32\...\Musicnotes Player_is1) (Version: 1.31.6 - Musicnotes Inc.)
Norton Security Scan (HKLM-x32\...\NSS) (Version: 2.7.3.34 - Symantec Corporation)
OpenOffice.org 3.3 (HKLM-x32\...\{3E171899-0175-47CC-84C4-562ACDD4C021}) (Version: 3.3.9567 - OpenOffice.org)
Picasa 3 (HKLM-x32\...\Picasa 3) (Version: 3.9 - Google, Inc.)
PowerDVD DX (HKLM-x32\...\{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}) (Version: 8.3.5424 - CyberLink Corp.)
Quickset64 (HKLM\...\{87CF757E-C1F1-4D22-865C-00C6950B5258}) (Version: 9.6.6 - Dell Inc.)
QuickTime (HKLM-x32\...\{B67BAFBA-4C9F-48FA-9496-933E3B255044}) (Version: 7.74.80.86 - Apple Inc.)
Registry Repair 4.1.0.388 (HKLM-x32\...\Registry Repair) (Version: 4.1.0.388 - Glarysoft Ltd)
Shape Collage (HKLM-x32\...\ShapeCollage) (Version:  - Shape Collage Inc.)
Shutterfly Express Uploader (HKLM-x32\...\com.Shutterfly.ExpressUploader) (Version: 1.1.0.0 - Shutterfly, Inc.)
Shutterfly Express Uploader (x32 Version: 1.1.0 - Shutterfly, Inc.) Hidden
Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\...\{90120000-0012-0000-0000-0000000FF1CE}_STANDARD_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version:  - Microsoft)
Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version:  - Microsoft)
Visual C++ 2008 x86 Runtime - v9.0.30729.01 (HKLM-x32\...\{F333A33D-125C-32A2-8DCE-5C5D14231E27}.vc_x86runtime_30729_01) (Version: 9.0.30729.01 - Microsoft Corporation)
VLC media player 1.0.5 (HKLM-x32\...\VLC media player) (Version: 1.0.5 - VideoLAN Team)
WildTangent Games (HKLM-x32\...\WildTangent dell Master Uninstall) (Version: 1.0.0.71 - WildTangent)
Windows Live Essentials (HKLM-x32\...\WinLiveSuite_Wave3) (Version: 14.0.8089.0726 - Microsoft Corporation)
Windows Live Sign-in Assistant (HKLM-x32\...\{45338B07-A236-4270-9A77-EBB4115517B5}) (Version: 5.000.818.5 - Microsoft Corporation)
Windows Live Sync (HKLM-x32\...\{84EBDF39-4B33-49D7-A0BD-EB6E2C4E81C1}) (Version: 14.0.8089.726 - Microsoft Corporation)
Windows Live Upload Tool (HKLM-x32\...\{205C6BDD-7B73-42DE-8505-9A093F35A238}) (Version: 14.0.8014.1029 - Microsoft Corporation)
WizTree v1.05 (HKLM-x32\...\WizTree_is1) (Version:  - Antibody Software)
 
==================== Custom CLSID (selected items): ==========================
 
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
 
CustomCLSID: HKU\S-1-5-21-508726573-1264868468-1237469860-1001_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\Kate\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-508726573-1264868468-1237469860-1001_Classes\CLSID\{039B2CA5-3B41-4D93-AD77-47D3293FC5CB}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-508726573-1264868468-1237469860-1001_Classes\CLSID\{355EC88A-02E2-4547-9DEE-F87426484BD1}\InprocServer32 -> C:\Users\Kate\AppData\Local\Google\Update\1.3.23.9\psuser_64.dll No File
CustomCLSID: HKU\S-1-5-21-508726573-1264868468-1237469860-1001_Classes\CLSID\{42481700-CF3C-4D05-8EC6-F9A1C57E8DC0}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-508726573-1264868468-1237469860-1001_Classes\CLSID\{BB6410D8-F879-4184-9C5C-6A02D16AE0B3}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-508726573-1264868468-1237469860-1001_Classes\CLSID\{C3BC25C0-FCD3-4F01-AFDD-41373F017C9A}\InprocServer32 -> C:\Users\Kate\AppData\Local\Google\Update\1.3.26.9\psuser_64.dll (Google Inc.)
CustomCLSID: HKU\S-1-5-21-508726573-1264868468-1237469860-1001_Classes\CLSID\{CA1073A2-5F3F-4445-8E5E-7109BDCEDDBE}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-508726573-1264868468-1237469860-1001_Classes\CLSID\{D0D38C6E-BF64-4C42-840D-3E0019D9F7A6}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-508726573-1264868468-1237469860-1001_Classes\CLSID\{D5A55D2D-C59D-42C3-A5BF-4C08EEE74339}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-508726573-1264868468-1237469860-1001_Classes\CLSID\{E8CF3E55-F919-49D9-ABC0-948E6CB34B9F}\InprocServer32 -> C:\Users\Kate\AppData\Local\Google\Update\1.3.26.9\psuser_64.dll (Google Inc.)
CustomCLSID: HKU\S-1-5-21-508726573-1264868468-1237469860-1001_Classes\CLSID\{ECD97DE5-3C8F-4ACB-AEEE-CCAB78F7711C}\InprocServer32 -> C:\Users\Kate\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-508726573-1264868468-1237469860-1001_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Kate\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-508726573-1264868468-1237469860-1001_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Kate\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-508726573-1264868468-1237469860-1001_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Kate\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-508726573-1264868468-1237469860-1001_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Kate\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-508726573-1264868468-1237469860-1001_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Kate\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-508726573-1264868468-1237469860-1001_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Kate\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-508726573-1264868468-1237469860-1001_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Kate\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-508726573-1264868468-1237469860-1001_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Kate\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-508726573-1264868468-1237469860-1001_Classes\CLSID\{FE498BAB-CB4C-4F88-AC3F-3641AAAF5E9E}\InprocServer32 -> C:\Users\Kate\AppData\Local\Google\Update\1.3.24.7\psuser_64.dll No File
 
==================== Restore Points  =========================
 
07-03-2015 13:20:40 Removed Ad-Aware Antivirus.
 
==================== Hosts content: ==========================
 
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
 
2009-07-13 22:34 - 2009-06-10 17:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
 
==================== Scheduled Tasks (whitelisted) =============
 
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
 
Task: {05912691-AAFD-445A-95C4-6351A56A2079} - System32\Tasks\{30E3D3CF-33CE-4765-A274-AFCBAA44B254} => pcalua.exe -a C:\ProgramData\Uninstall\{B2E47DE7-800B-40BB-BD1F-9F221C3AEE87}\setup.exe -c /x {B2E47DE7-800B-40BB-BD1F-9F221C3AEE87}
Task: {0A1418EF-DBAA-4478-A26F-A153E6792E56} - System32\Tasks\Norton Security Scan for Kate => C:\Program Files (x86)\Norton Security Scan\Engine\2.7.3.34\Nss.exe [2010-08-24] (Symantec Corporation)
Task: {127B3DA8-9FC4-4AB6-82A5-E594D8BA2477} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-03-09] (Adobe Systems Incorporated)
Task: {1EA4738E-84D0-44D9-B30E-3D03DB4D67DF} - System32\Tasks\{4B6DC7E8-2400-437A-8692-5D70F433471F} => pcalua.exe -a C:\Users\Kate\Downloads\Ad-AwareInstall.exe -d C:\Users\Kate\Downloads
Task: {1EE514C7-3408-4858-A83B-0F03BCCE4CD1} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-508726573-1264868468-1237469860-1001Core => C:\Users\Kate\AppData\Local\Google\Update\GoogleUpdate.exe [2015-03-05] (Google Inc.)
Task: {1FFCA871-76C0-47A5-BCD1-3D30A96805EA} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-09-23] (Google Inc.)
Task: {2DB1EE8E-3A34-4875-BCCE-75C2BDD12F7C} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-09-23] (Google Inc.)
Task: {2E38BCC5-A4D2-489D-8030-D68A08CE9D86} - System32\Tasks\{31EDD572-BEE1-48F7-88D6-07072D3D796F} => pcalua.exe -a "C:\Users\Kate\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\OKRIHYXK\Firefox%20Setup%203.6[1].exe" -d C:\Users\Kate\Desktop
Task: {396D4DD3-17C8-4EB5-9D5C-B18073257104} - System32\Tasks\Ad-Aware Update (Weekly) => C:\Program Files (x86)\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe
Task: {98E65C7A-2602-4B0F-9623-9857F217745F} - System32\Tasks\{D6742CE6-015F-4C5B-89F3-136C77FD9073} => C:\Program Files (x86)\Skype\Phone\Skype.exe
Task: {AA4FB232-9CBE-4F98-B280-FCE31CFD225E} - System32\Tasks\DHGB59L1\Administrator - Start WLAN Tray Applet => C:\Program Files\Dell\Dell Wireless WLAN Card\WLTRAY.EXE [2009-07-16] (Dell Inc.)
Task: {CA7C3E25-054D-45D5-B562-4E72E6FF61C3} - System32\Tasks\{3086235C-D81E-41CB-BD41-1621C8511405} => pcalua.exe -a "C:\Program Files\AVAST Software\Avast\aswRunDll.exe" -c "C:\Program Files\AVAST Software\Avast\Setup\setiface.dll" RunSetup
Task: {D19C9EAA-C03E-4B81-864C-461D2C3E2AB0} - System32\Tasks\{821F7E52-EB87-4F98-972A-4CD0BC59DED5} => pcalua.exe -a C:\Windows\SysWOW64\igxpun.exe -c -uninstall
Task: {DE7217D0-81B6-4F63-9F0D-5C2DA862CDB6} - System32\Tasks\{5BA6BA2E-4878-46A1-9BF3-DBD3017EB594} => pcalua.exe -a "C:\Program Files (x86)\Vuze\uninstall.exe"
Task: {F69948B4-9A79-4B55-B347-801716FE029C} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-508726573-1264868468-1237469860-1001UA => C:\Users\Kate\AppData\Local\Google\Update\GoogleUpdate.exe [2015-03-05] (Google Inc.)
Task: {FC890890-EF0F-4D31-A886-0790656A58DB} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-508726573-1264868468-1237469860-1001Core.job => C:\Users\Kate\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-508726573-1264868468-1237469860-1001UA.job => C:\Users\Kate\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\Norton Security Scan for Kate.job => C:\Program Files (x86)\Norton Security Scan\Engine\2.7.3.34\Nss.exe
 
==================== Loaded Modules (whitelisted) ==============
 
2010-02-24 19:00 - 2009-07-16 21:06 - 00033280 _____ () C:\Program Files\Dell\Dell Wireless WLAN Card\WLTRYSVC.EXE
2010-02-24 19:00 - 2009-07-16 21:06 - 00058368 _____ () C:\Program Files\Dell\Dell Wireless WLAN Card\bcmwlrmt.dll
2013-06-16 23:48 - 2013-05-29 15:10 - 03113792 _____ () C:\Users\Kate\AppData\Local\Amazon Cloud Player\Amazon Music Helper.exe
2009-11-13 18:15 - 2009-11-13 18:15 - 01807600 _____ () C:\Program Files (x86)\Dell DataSafe Online\DataSafeOnline.exe
2014-01-20 14:17 - 2014-01-20 14:17 - 00073544 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2014-01-20 14:16 - 2014-01-20 14:16 - 01044808 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2013-09-14 02:51 - 2013-09-14 02:51 - 00087952 _____ () C:\Program Files (x86)\Common Files\Apple\Internet Services\zlib1.dll
2013-09-14 02:50 - 2013-09-14 02:50 - 01242952 _____ () C:\Program Files (x86)\Common Files\Apple\Internet Services\libxml2.dll
2015-03-09 23:04 - 2015-03-09 23:04 - 00098816 _____ () C:\Users\Kate\AppData\Local\Temp\_MEI22282\win32api.pyd
2015-03-09 23:04 - 2015-03-09 23:04 - 00110080 _____ () C:\Users\Kate\AppData\Local\Temp\_MEI22282\pywintypes27.dll
2015-03-09 23:04 - 2015-03-09 23:04 - 00364544 _____ () C:\Users\Kate\AppData\Local\Temp\_MEI22282\pythoncom27.dll
2015-03-09 23:04 - 2015-03-09 23:04 - 00045568 _____ () C:\Users\Kate\AppData\Local\Temp\_MEI22282\_socket.pyd
2015-03-09 23:04 - 2015-03-09 23:04 - 01160704 _____ () C:\Users\Kate\AppData\Local\Temp\_MEI22282\_ssl.pyd
2015-03-09 23:04 - 2015-03-09 23:04 - 00320512 _____ () C:\Users\Kate\AppData\Local\Temp\_MEI22282\win32com.shell.shell.pyd
2015-03-09 23:04 - 2015-03-09 23:04 - 00713216 _____ () C:\Users\Kate\AppData\Local\Temp\_MEI22282\_hashlib.pyd
2015-03-09 23:04 - 2015-03-09 23:04 - 01175040 _____ () C:\Users\Kate\AppData\Local\Temp\_MEI22282\wx._core_.pyd
2015-03-09 23:04 - 2015-03-09 23:04 - 00805888 _____ () C:\Users\Kate\AppData\Local\Temp\_MEI22282\wx._gdi_.pyd
2015-03-09 23:04 - 2015-03-09 23:04 - 00811008 _____ () C:\Users\Kate\AppData\Local\Temp\_MEI22282\wx._windows_.pyd
2015-03-09 23:04 - 2015-03-09 23:04 - 01062400 _____ () C:\Users\Kate\AppData\Local\Temp\_MEI22282\wx._controls_.pyd
2015-03-09 23:04 - 2015-03-09 23:04 - 00735232 _____ () C:\Users\Kate\AppData\Local\Temp\_MEI22282\wx._misc_.pyd
2015-03-09 23:04 - 2015-03-09 23:04 - 00557056 _____ () C:\Users\Kate\AppData\Local\Temp\_MEI22282\pysqlite2._sqlite.pyd
2015-03-09 23:04 - 2015-03-09 23:04 - 00128512 _____ () C:\Users\Kate\AppData\Local\Temp\_MEI22282\_elementtree.pyd
2015-03-09 23:04 - 2015-03-09 23:04 - 00127488 _____ () C:\Users\Kate\AppData\Local\Temp\_MEI22282\pyexpat.pyd
2015-03-09 23:04 - 2015-03-09 23:04 - 00087552 _____ () C:\Users\Kate\AppData\Local\Temp\_MEI22282\_ctypes.pyd
2015-03-09 23:04 - 2015-03-09 23:04 - 00119808 _____ () C:\Users\Kate\AppData\Local\Temp\_MEI22282\win32file.pyd
2015-03-09 23:04 - 2015-03-09 23:04 - 00108544 _____ () C:\Users\Kate\AppData\Local\Temp\_MEI22282\win32security.pyd
2015-03-09 23:04 - 2015-03-09 23:04 - 00007168 _____ () C:\Users\Kate\AppData\Local\Temp\_MEI22282\hashobjs_ext.pyd
2015-03-09 23:04 - 2015-03-09 23:04 - 00167936 _____ () C:\Users\Kate\AppData\Local\Temp\_MEI22282\win32gui.pyd
2015-03-09 23:04 - 2015-03-09 23:04 - 00018432 _____ () C:\Users\Kate\AppData\Local\Temp\_MEI22282\win32event.pyd
2015-03-09 23:04 - 2015-03-09 23:04 - 00038912 _____ () C:\Users\Kate\AppData\Local\Temp\_MEI22282\win32inet.pyd
2015-03-09 23:04 - 2015-03-09 23:04 - 00011264 _____ () C:\Users\Kate\AppData\Local\Temp\_MEI22282\win32crypt.pyd
2015-03-09 23:04 - 2015-03-09 23:04 - 00070656 _____ () C:\Users\Kate\AppData\Local\Temp\_MEI22282\wx._html2.pyd
2015-03-09 23:04 - 2015-03-09 23:04 - 00027136 _____ () C:\Users\Kate\AppData\Local\Temp\_MEI22282\_multiprocessing.pyd
2015-03-09 23:04 - 2015-03-09 23:04 - 00035840 _____ () C:\Users\Kate\AppData\Local\Temp\_MEI22282\win32process.pyd
2015-03-09 23:04 - 2015-03-09 23:04 - 00686080 _____ () C:\Users\Kate\AppData\Local\Temp\_MEI22282\unicodedata.pyd
2015-03-09 23:04 - 2015-03-09 23:04 - 00122368 _____ () C:\Users\Kate\AppData\Local\Temp\_MEI22282\wx._wizard.pyd
2015-03-09 23:04 - 2015-03-09 23:04 - 00024064 _____ () C:\Users\Kate\AppData\Local\Temp\_MEI22282\win32pipe.pyd
2015-03-09 23:04 - 2015-03-09 23:04 - 00025600 _____ () C:\Users\Kate\AppData\Local\Temp\_MEI22282\win32pdh.pyd
2015-03-09 23:04 - 2015-03-09 23:04 - 00525640 _____ () C:\Users\Kate\AppData\Local\Temp\_MEI22282\windows._lib_cacheinvalidation.pyd
2015-03-09 23:04 - 2015-03-09 23:04 - 00010240 _____ () C:\Users\Kate\AppData\Local\Temp\_MEI22282\select.pyd
2015-03-09 23:04 - 2015-03-09 23:04 - 00017408 _____ () C:\Users\Kate\AppData\Local\Temp\_MEI22282\win32profile.pyd
2015-03-09 23:04 - 2015-03-09 23:04 - 00022528 _____ () C:\Users\Kate\AppData\Local\Temp\_MEI22282\win32ts.pyd
2015-03-09 23:04 - 2015-03-09 23:04 - 00078336 _____ () C:\Users\Kate\AppData\Local\Temp\_MEI22282\wx._animate.pyd
2015-02-10 17:00 - 2015-02-10 17:00 - 00750080 _____ () C:\Users\Kate\AppData\Roaming\Dropbox\bin\libGLESv2.dll
2015-03-09 23:06 - 2015-03-09 23:06 - 00043008 _____ () c:\users\kate\appdata\local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpa3xfol.dll
2015-02-10 17:00 - 2015-02-10 17:00 - 00047616 _____ () C:\Users\Kate\AppData\Roaming\Dropbox\bin\libEGL.dll
2015-02-10 17:00 - 2015-02-10 17:00 - 00865280 _____ () C:\Users\Kate\AppData\Roaming\Dropbox\bin\plugins\platforms\qwindows.dll
2015-02-10 17:00 - 2015-02-10 17:00 - 00200704 _____ () C:\Users\Kate\AppData\Roaming\Dropbox\bin\plugins\imageformats\qjpeg.dll
2009-11-13 18:15 - 2009-11-13 18:15 - 00275696 _____ () C:\Program Files (x86)\Dell DataSafe Online\SdbShared.dll
2009-11-13 18:15 - 2009-11-13 18:15 - 00058608 _____ () C:\Program Files (x86)\Dell DataSafe Online\BalloonWindow.dll
2009-11-13 18:15 - 2009-11-13 18:15 - 00095472 _____ () C:\Program Files (x86)\Dell DataSafe Online\SdbUI.dll
2009-11-13 18:15 - 2009-11-13 18:15 - 00152816 _____ () C:\Program Files (x86)\Dell DataSafe Online\SdbShared.XmlSerializers.dll
2009-11-13 18:15 - 2009-11-13 18:15 - 00017648 _____ () C:\Program Files (x86)\Dell DataSafe Online\cpputils.dll
2010-02-24 19:10 - 2010-07-21 11:33 - 00058688 _____ () C:\Program Files (x86)\Dell DataSafe Local Backup\STCoreXml.dll
2010-02-24 19:10 - 2010-07-21 11:33 - 00116032 _____ () C:\Program Files (x86)\Dell DataSafe Local Backup\PSTVdsDisk.dll
2010-02-24 19:10 - 2010-07-21 11:33 - 00128320 _____ () C:\Program Files (x86)\Dell DataSafe Local Backup\STLog.dll
 
==================== Alternate Data Streams (whitelisted) =========
 
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
 
 
==================== Safe Mode (whitelisted) ===================
 
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
 
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\GoToAssist => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcmscsvc => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MCODS => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MpfService => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Wdf01000.sys => ""="Driver"
 
==================== EXE Association (whitelisted) ===============
 
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
 
 
==================== Other Areas ============================
 
(Currently there is no automatic fix for this section.)
 
HKU\S-1-5-21-508726573-1264868468-1237469860-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\Kate\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 10.0.1.1
 
==================== MSCONFIG/TASK MANAGER disabled items ==
 
(Currently there is no automatic fix for this section.)
 
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^McAfee Security Scan Plus.lnk => C:\Windows\pss\McAfee Security Scan Plus.lnk.CommonStartup
MSCONFIG\startupfolder: C:^Users^Kate^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OpenOffice.org 3.3.lnk => C:\Windows\pss\OpenOffice.org 3.3.lnk.Startup
MSCONFIG\startupfolder: C:^Users^Kate^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^StrongVaultApp.lnk => C:\Windows\pss\StrongVaultApp.lnk.Startup
MSCONFIG\startupreg: Ad-Aware Antivirus => "C:\Program Files (x86)\Ad-Aware Antivirus\AdAwareLauncher" --windows-run
MSCONFIG\startupreg: Ad-Aware Browsing Protection => "C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.exe"
MSCONFIG\startupreg: AppleSyncNotifier => C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe
MSCONFIG\startupreg: BackupAgent => C:\Program Files (x86)\Strongvault Online Backup\BackupAgent.exe
MSCONFIG\startupreg: Desktop Disc Tool => "c:\Program Files (x86)\Roxio\Roxio Burn\RoxioBurnLauncher.exe"
MSCONFIG\startupreg: iTunesHelper => "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
MSCONFIG\startupreg: msnmsgr => "C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe" /background
MSCONFIG\startupreg: SearchProtect => C:\Users\Kate\AppData\Roaming\SearchProtect\bin\cltmng.exe
MSCONFIG\startupreg: SearchProtectAll => C:\Program Files (x86)\SearchProtect\bin\cltmng.exe
MSCONFIG\startupreg: SMessaging => "C:\Users\Kate\AppData\Local\Strongvault Online Backup\SMessaging.exe"
MSCONFIG\startupreg: VX6000 => C:\Windows\vVX6000.exe
 
==================== Accounts: =============================
 
Administrator (S-1-5-21-508726573-1264868468-1237469860-500 - Administrator - Disabled)
Guest (S-1-5-21-508726573-1264868468-1237469860-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-508726573-1264868468-1237469860-1003 - Limited - Enabled)
Kate (S-1-5-21-508726573-1264868468-1237469860-1001 - Administrator - Enabled) => C:\Users\Kate
 
==================== Faulty Device Manager Devices =============
 
Name: iPodDrv
Description: iPodDrv
Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Manufacturer: 
Service: iPodDrv
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.
 
Name: SBRE
Description: SBRE
Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Manufacturer: 
Service: SBRE
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.
 
Name: Teredo Tunneling Pseudo-Interface
Description: Microsoft Teredo Tunneling Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.
 
 
==================== Event log errors: =========================
 
Application errors:
==================
 
System errors:
=============
Error: (03/09/2015 11:05:54 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: The following boot-start or system-start driver(s) failed to load: 
Lbd
SBRE
 
Error: (03/09/2015 11:05:49 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The vToolbarUpdater18.3.0 service failed to start due to the following error: 
%%2
 
Error: (03/09/2015 11:04:37 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The MSCamSvc service failed to start due to the following error: 
%%2
 
Error: (03/09/2015 11:04:37 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The iPodDrv service failed to start due to the following error: 
%%2
 
Error: (03/09/2015 11:03:36 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The Windows Media Player Network Sharing Service service failed to start due to the following error: 
%%1069
 
Error: (03/09/2015 11:03:36 PM) (Source: Service Control Manager) (EventID: 7038) (User: )
Description: The WMPNetworkSvc service was unable to log on as NT AUTHORITY\NetworkService with the currently configured password due to the following error: 
%%50
 
To ensure that the service is configured properly, use the Services snap-in in Microsoft Management Console (MMC).
 
Error: (03/09/2015 11:03:35 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The Windows Search service failed to start due to the following error: 
%%1069
 
Error: (03/09/2015 11:03:35 PM) (Source: Service Control Manager) (EventID: 7038) (User: )
Description: The WSearch service was unable to log on as NT AUTHORITY\SYSTEM with the currently configured password due to the following error: 
%%50
 
To ensure that the service is configured properly, use the Services snap-in in Microsoft Management Console (MMC).
 
Error: (03/09/2015 11:03:32 PM) (Source: Microsoft-Windows-WLAN-AutoConfig) (EventID: 10003) (User: NT AUTHORITY)
Description: WLAN Extensibility Module has stopped unexpectedly.
 
Module Path: C:\Windows\System32\bcmihvsrv64.dll
 
Error: (03/09/2015 11:03:32 PM) (Source: Microsoft-Windows-WLAN-AutoConfig) (EventID: 10003) (User: NT AUTHORITY)
Description: WLAN Extensibility Module has stopped unexpectedly.
 
Module Path: C:\Windows\System32\bcmihvsrv64.dll
 
 
Microsoft Office Sessions:
=========================
 
==================== Memory info =========================== 
 
Processor: Pentium® Dual-Core CPU T4400 @ 2.20GHz
Percentage of memory in use: 44%
Total physical RAM: 3032.36 MB
Available physical RAM: 1685.03 MB
Total Pagefile: 6062.91 MB
Available Pagefile: 4526.99 MB
Total Virtual: 8192 MB
Available Virtual: 8191.85 MB
 
==================== Drives ================================
 
Drive c: (OS) (Fixed) (Total:134.36 GB) (Free:18.67 GB) NTFS
Drive e: (TED) (Removable) (Total:29.06 GB) (Free:24.91 GB) FAT32
 
==================== MBR & Partition Table ==================
 
========================================================
Disk: 0 (Size: 149.1 GB) (Disk ID: BB4F8998)
Partition 1: (Not Active) - (Size=39 MB) - (Type=DE)
Partition 2: (Active) - (Size=14.6 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=134.4 GB) - (Type=07 NTFS)
 
========================================================
Disk: 1 (MBR Code: Windows XP) (Size: 29.1 GB) (Disk ID: C3072E18)
Partition 1: (Active) - (Size=29.1 GB) - (Type=0C)
 
==================== End Of Log ============================

  • 0

#7
pystryker

pystryker

    Trusted Helper

  • Malware Removal
  • 3,886 posts
Hello :)

Thank you for the logs, let's proceed. When you post the requested logs, please let me know how the machine is running. We still have steps to go and this will help me plan them. :thumbsup:

One thing I see from the logs is there is no anti-virus program installed on this machine. An anti-virus program is absolutely vital to protecting the machine from infections. We'll need to install one when the cleaning is complete.

!! Registry Cleaner Warning

There were signs of multiple programs that are either currently or have been previously installed on your computer that contain registry cleaners.A registry cleaner will not increase your system's speed or performance, and has the potential to break your registry to the point that your PC is no longer bootable. At Geeks to Go we strongly advise that people stay away from any of the registry cleaners out there. Go here to get more information about why registry cleaners aren't needed. Technet blog also discusses this issue as well as Ed Bott.



Step 1: Re-Run AdwCleaner


Please re-run AdwCleaner and upon completion of the scan, select the Cleaning button on the control panel.

Once AdwCleaner has cleaned the items it has found, it will produce a log. Please post it in your next reply.


Step 2: Program Uninstalls

Please uninstall the following programs from your machine as they are adware/malware related or can harm your machine:
  • CrossReader
  • Registry Repair 4.1.0.388
  • Free Window Registry Repair
  • MixiDJ V8 Toolbar
Step 3: Fix with FRST
  • Open notepad (Start =>All Programs => Accessories => Notepad). Please copy the entire contents of the code box below. (To do this highlight the contents of the box, right click on it and select copy.
  • Right-click in the open notepad and select Paste).
  • Save it on the desktop as fixlist.txt

Start
CreateRestorePoint:
CloseProcesses:
HKU\S-1-5-21-508726573-1264868468-1237469860-1001\...\MountPoints2: E - E:\MotoCastSetup.exe -a
HKU\S-1-5-21-508726573-1264868468-1237469860-1001\...\MountPoints2: {4425e544-4e7e-11df-98ec-a4badba732b9} - E:\VZAccess_Manager.exe /z detect
HKU\S-1-5-21-508726573-1264868468-1237469860-1001\...\MountPoints2: {4a88244a-98d5-11e2-bcf3-a4badba732b9} - E:\MotoCastSetup.exe -a
HKU\S-1-5-18\...\Run: [SearchProtect] => \SearchProtect\bin\cltmng.exe
URLSearchHook: HKLM-x32 - (No Name) - {e4c3a8b6-7724-45d1-a629-17b69118ebcd} - No File
URLSearchHook: HKU\S-1-5-21-508726573-1264868468-1237469860-1001 - (No Name) - {e4c3a8b6-7724-45d1-a629-17b69118ebcd} - No File
SearchScopes: HKU\S-1-5-21-508726573-1264868468-1237469860-1001 -> {1970984B-77F4-4E74-91E5-C7F43A6EC673} URL =
BHO-x32: StumbleUpon Launcher -> {145B29F4-A56B-4b90-BBAC-45784EBEBBB7} -> C:\Program Files (x86)\StumbleUpon\StumbleUponIEBar.dll No File
Toolbar: HKLM-x32 - StumbleUpon Toolbar - {5093EB4C-3E93-40AB-9266-B607BA87BDC8} - C:\Program Files (x86)\StumbleUpon\StumbleUponIEBar.dll No File
Toolbar: HKLM-x32 - No Name - {e4c3a8b6-7724-45d1-a629-17b69118ebcd} - No File
Toolbar: HKLM-x32 - No Name - {96A25A24-2E87-4374-8A50-CC6F943FCE4D} - No File
Toolbar: HKU\S-1-5-21-508726573-1264868468-1237469860-1001 -> No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File
Toolbar: HKU\S-1-5-21-508726573-1264868468-1237469860-1001 -> No Name - {E4C3A8B6-7724-45D1-A629-17B69118EBCD} - No File
FF Plugin HKU\S-1-5-21-508726573-1264868468-1237469860-1001: @doubletwist.com/NPPodcast -> C:\Program Files (x86)\Common Files\doubleTwist\NPPodcast.dll No File
FF Extension: CrossReader - C:\Users\Kate\AppData\Roaming\Mozilla\Firefox\Profiles\a9dlfrif.default\Extensions\[email protected]f0f261f92.com [2013-12-29]
FF Extension: GetSavin - C:\Users\Kate\AppData\Roaming\Mozilla\Firefox\Profiles\a9dlfrif.default\Extensions\[email protected] [2013-03-30]
FF Extension: AddThis - C:\Users\Kate\AppData\Roaming\Mozilla\Firefox\Profiles\a9dlfrif.default\Extensions\{3e0e7d2a-070f-4a47-b019-91fe5385ba79} [2013-03-29]
FF Extension: Vafmusic2 - C:\Users\Kate\AppData\Roaming\Mozilla\Firefox\Profiles\a9dlfrif.default\Extensions\{7f3f960e-a836-45ca-8911-0accb522246e} [2013-05-23]
FF Extension: Trustworthy - C:\Users\Kate\AppData\Roaming\Mozilla\Firefox\Profiles\a9dlfrif.default\Extensions\{ad32743c-16ef-46ec-977b-dce0c3c85b20} [2013-03-30]
FF Extension: MixiDJ V8 - C:\Users\Kate\AppData\Roaming\Mozilla\Firefox\Profiles\a9dlfrif.default\Extensions\{e4c3a8b6-7724-45d1-a629-17b69118ebcd} [2013-03-30]
FF HKLM\...\Firefox\Extensions: [{C4CFC0DE-134F-4466-B2A2-FF7C59A8BFAD}] - C:\Program Files\Updater By SweetPacks\Firefox
FF HKLM-x32\...\Firefox\Extensions: [{C4CFC0DE-134F-4466-B2A2-FF7C59A8BFAD}] - C:\Program Files\Updater By SweetPacks\Firefox
C:\Program Files\Updater By SweetPacks
CHR HKU\S-1-5-21-508726573-1264868468-1237469860-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [cbjibcbpmbcabnfnohhgjjmkgkimajko] - C:\Users\Kate\AppData\Local\CRE\cbjibcbpmbcabnfnohhgjjmkgkimajko.crx [Not Found]
CHR HKU\S-1-5-21-508726573-1264868468-1237469860-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [oajgghejjpgkmpgbchgjieahoefimdle] - C:\Users\Kate\AppData\Local\CRE\oajgghejjpgkmpgbchgjieahoefimdle.crx [Not Found]
CHR HKLM-x32\...\Chrome\Extension: [cbjibcbpmbcabnfnohhgjjmkgkimajko] - C:\Users\Kate\AppData\Local\CRE\cbjibcbpmbcabnfnohhgjjmkgkimajko.crx [Not Found]
CHR HKLM-x32\...\Chrome\Extension: [oajgghejjpgkmpgbchgjieahoefimdle] - C:\Users\Kate\AppData\Local\CRE\oajgghejjpgkmpgbchgjieahoefimdle.crx [Not Found]
S3 StumbleUponUpdateService; "C:\Program Files (x86)\StumbleUpon\StumbleUponUpdateService.exe" [X]
S2 vToolbarUpdater18.3.0; C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.3.0\ToolbarUpdater.exe [X]
C:\Program Files (x86)\Common Files\AVG Secure Search
2015-03-07 13:57 - 2013-12-29 20:27 - 00000000 ____D () C:\Program Files (x86)\BitZipper
2015-03-05 21:25 - 2013-12-29 20:26 - 00000000 ____D () C:\Program Files (x86)\CrossReader
CustomCLSID: HKU\S-1-5-21-508726573-1264868468-1237469860-1001_Classes\CLSID\{355EC88A-02E2-4547-9DEE-F87426484BD1}\InprocServer32 -> C:\Users\Kate\AppData\Local\Google\Update\1.3.23.9\psuser_64.dll No File
CustomCLSID: HKU\S-1-5-21-508726573-1264868468-1237469860-1001_Classes\CLSID\{FE498BAB-CB4C-4F88-AC3F-3641AAAF5E9E}\InprocServer32 -> C:\Users\Kate\AppData\Local\Google\Update\1.3.24.7\psuser_64.dll No File
cmd: bitsadmin /reset /allusers
CMD: netsh advfirewall reset
CMD: netsh advfirewall set allprofiles state on
CMD: ipconfig /flushdns
Emptytemp:
Hosts:
End


NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system.


Run FRST and press the Fix button just once and wait. The tool will make a log on the desktop (Fixlog.txt) please post it in your next reply.


Things I need to see in your next post:

Please post each of these logs as a separate reply in this thread.

AdwCleaner Log

Fixlog.txt Log

  • 0

#8
very_metal

very_metal

    Member

  • Topic Starter
  • Member
  • PipPip
  • 16 posts
# AdwCleaner v4.112 - Logfile created 11/03/2015 at 10:12:25
# Updated 09/03/2015 by Xplode
# Database : 2015-03-05.1 [Server]
# Operating system : Windows 7 Home Premium Service Pack 1 (x64)
# Username : Kate - KATE-PC
# Running from : C:\Users\Kate\Desktop\AdwCleaner.exe
# Option : Cleaning
 
***** [ Services ] *****
 
 
***** [ Files / Folders ] *****
 
 
***** [ Scheduled tasks ] *****
 
 
***** [ Shortcuts ] *****
 
 
***** [ Registry ] *****
 
 
***** [ Web browsers ] *****
 
-\\ Internet Explorer v11.0.9600.17041
 
 
-\\ Mozilla Firefox v19.0.2 (en-US)
 
 
-\\ Google Chrome v41.0.2272.76
 
 
*************************
 
AdwCleaner[R0].txt - [40407 bytes] - [07/03/2015 13:10:46]
AdwCleaner[R1].txt - [40551 bytes] - [07/03/2015 13:22:46]
AdwCleaner[R2].txt - [2812 bytes] - [09/03/2015 22:58:51]
AdwCleaner[R3].txt - [1080 bytes] - [11/03/2015 10:10:15]
AdwCleaner[S0].txt - [38851 bytes] - [07/03/2015 13:28:39]
AdwCleaner[S1].txt - [2858 bytes] - [09/03/2015 23:03:04]
AdwCleaner[S2].txt - [1008 bytes] - [11/03/2015 10:12:25]
 
########## EOF - C:\AdwCleaner\AdwCleaner[S2].txt - [1067  bytes] ##########

  • 0

#9
very_metal

very_metal

    Member

  • Topic Starter
  • Member
  • PipPip
  • 16 posts
Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 11-03-2015
Ran by Kate at 2015-03-11 10:24:48 Run:1
Running from C:\Users\Kate\Desktop
Loaded Profiles: Kate (Available profiles: Kate)
Boot Mode: Normal
==============================================
 
Content of fixlist:
*****************
Start
CreateRestorePoint:
CloseProcesses:
HKU\S-1-5-21-508726573-1264868468-1237469860-1001\...\MountPoints2: E - E:\MotoCastSetup.exe -a
HKU\S-1-5-21-508726573-1264868468-1237469860-1001\...\MountPoints2: {4425e544-4e7e-11df-98ec-a4badba732b9} - E:\VZAccess_Manager.exe /z detect
HKU\S-1-5-21-508726573-1264868468-1237469860-1001\...\MountPoints2: {4a88244a-98d5-11e2-bcf3-a4badba732b9} - E:\MotoCastSetup.exe -a
HKU\S-1-5-18\...\Run: [SearchProtect] => \SearchProtect\bin\cltmng.exe
URLSearchHook: HKLM-x32 - (No Name) - {e4c3a8b6-7724-45d1-a629-17b69118ebcd} - No File
URLSearchHook: HKU\S-1-5-21-508726573-1264868468-1237469860-1001 - (No Name) - {e4c3a8b6-7724-45d1-a629-17b69118ebcd} - No File
SearchScopes: HKU\S-1-5-21-508726573-1264868468-1237469860-1001 -> {1970984B-77F4-4E74-91E5-C7F43A6EC673} URL =
BHO-x32: StumbleUpon Launcher -> {145B29F4-A56B-4b90-BBAC-45784EBEBBB7} -> C:\Program Files (x86)\StumbleUpon\StumbleUponIEBar.dll No File
Toolbar: HKLM-x32 - StumbleUpon Toolbar - {5093EB4C-3E93-40AB-9266-B607BA87BDC8} - C:\Program Files (x86)\StumbleUpon\StumbleUponIEBar.dll No File
Toolbar: HKLM-x32 - No Name - {e4c3a8b6-7724-45d1-a629-17b69118ebcd} - No File
Toolbar: HKLM-x32 - No Name - {96A25A24-2E87-4374-8A50-CC6F943FCE4D} - No File
Toolbar: HKU\S-1-5-21-508726573-1264868468-1237469860-1001 -> No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File
Toolbar: HKU\S-1-5-21-508726573-1264868468-1237469860-1001 -> No Name - {E4C3A8B6-7724-45D1-A629-17B69118EBCD} - No File
FF Plugin HKU\S-1-5-21-508726573-1264868468-1237469860-1001: @doubletwist.com/NPPodcast -> C:\Program Files (x86)\Common Files\doubleTwist\NPPodcast.dll No File
FF Extension: CrossReader - C:\Users\Kate\AppData\Roaming\Mozilla\Firefox\Profiles\a9dlfrif.default\Extensions\[email protected]f0f261f92.com [2013-12-29]
FF Extension: GetSavin - C:\Users\Kate\AppData\Roaming\Mozilla\Firefox\Profiles\a9dlfrif.default\Extensions\[email protected] [2013-03-30]
FF Extension: AddThis - C:\Users\Kate\AppData\Roaming\Mozilla\Firefox\Profiles\a9dlfrif.default\Extensions\{3e0e7d2a-070f-4a47-b019-91fe5385ba79} [2013-03-29]
FF Extension: Vafmusic2 - C:\Users\Kate\AppData\Roaming\Mozilla\Firefox\Profiles\a9dlfrif.default\Extensions\{7f3f960e-a836-45ca-8911-0accb522246e} [2013-05-23]
FF Extension: Trustworthy - C:\Users\Kate\AppData\Roaming\Mozilla\Firefox\Profiles\a9dlfrif.default\Extensions\{ad32743c-16ef-46ec-977b-dce0c3c85b20} [2013-03-30]
FF Extension: MixiDJ V8 - C:\Users\Kate\AppData\Roaming\Mozilla\Firefox\Profiles\a9dlfrif.default\Extensions\{e4c3a8b6-7724-45d1-a629-17b69118ebcd} [2013-03-30]
FF HKLM\...\Firefox\Extensions: [{C4CFC0DE-134F-4466-B2A2-FF7C59A8BFAD}] - C:\Program Files\Updater By SweetPacks\Firefox
FF HKLM-x32\...\Firefox\Extensions: [{C4CFC0DE-134F-4466-B2A2-FF7C59A8BFAD}] - C:\Program Files\Updater By SweetPacks\Firefox
C:\Program Files\Updater By SweetPacks
CHR HKU\S-1-5-21-508726573-1264868468-1237469860-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [cbjibcbpmbcabnfnohhgjjmkgkimajko] - C:\Users\Kate\AppData\Local\CRE\cbjibcbpmbcabnfnohhgjjmkgkimajko.crx [Not Found]
CHR HKU\S-1-5-21-508726573-1264868468-1237469860-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [oajgghejjpgkmpgbchgjieahoefimdle] - C:\Users\Kate\AppData\Local\CRE\oajgghejjpgkmpgbchgjieahoefimdle.crx [Not Found]
CHR HKLM-x32\...\Chrome\Extension: [cbjibcbpmbcabnfnohhgjjmkgkimajko] - C:\Users\Kate\AppData\Local\CRE\cbjibcbpmbcabnfnohhgjjmkgkimajko.crx [Not Found]
CHR HKLM-x32\...\Chrome\Extension: [oajgghejjpgkmpgbchgjieahoefimdle] - C:\Users\Kate\AppData\Local\CRE\oajgghejjpgkmpgbchgjieahoefimdle.crx [Not Found]
S3 StumbleUponUpdateService; "C:\Program Files (x86)\StumbleUpon\StumbleUponUpdateService.exe" [X]
S2 vToolbarUpdater18.3.0; C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.3.0\ToolbarUpdater.exe [X]
C:\Program Files (x86)\Common Files\AVG Secure Search
2015-03-07 13:57 - 2013-12-29 20:27 - 00000000 ____D () C:\Program Files (x86)\BitZipper
2015-03-05 21:25 - 2013-12-29 20:26 - 00000000 ____D () C:\Program Files (x86)\CrossReader
CustomCLSID: HKU\S-1-5-21-508726573-1264868468-1237469860-1001_Classes\CLSID\{355EC88A-02E2-4547-9DEE-F87426484BD1}\InprocServer32 -> C:\Users\Kate\AppData\Local\Google\Update\1.3.23.9\psuser_64.dll No File
CustomCLSID: HKU\S-1-5-21-508726573-1264868468-1237469860-1001_Classes\CLSID\{FE498BAB-CB4C-4F88-AC3F-3641AAAF5E9E}\InprocServer32 -> C:\Users\Kate\AppData\Local\Google\Update\1.3.24.7\psuser_64.dll No File
cmd: bitsadmin /reset /allusers
CMD: netsh advfirewall reset
CMD: netsh advfirewall set allprofiles state on
CMD: ipconfig /flushdns
Emptytemp:
Hosts:
End
*****************
 
Restore point was successfully created.
Processes closed successfully.
"HKU\S-1-5-21-508726573-1264868468-1237469860-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\E" => Key deleted successfully.
"HKU\S-1-5-21-508726573-1264868468-1237469860-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{4425e544-4e7e-11df-98ec-a4badba732b9}" => Key deleted successfully.
HKCR\CLSID\{4425e544-4e7e-11df-98ec-a4badba732b9} => Key not found. 
"HKU\S-1-5-21-508726573-1264868468-1237469860-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{4a88244a-98d5-11e2-bcf3-a4badba732b9}" => Key deleted successfully.
HKCR\CLSID\{4a88244a-98d5-11e2-bcf3-a4badba732b9} => Key not found. 
HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Run\\SearchProtect => value deleted successfully.
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\URLSearchHooks\\{e4c3a8b6-7724-45d1-a629-17b69118ebcd} => value deleted successfully.
HKU\S-1-5-21-508726573-1264868468-1237469860-1001\Software\Microsoft\Internet Explorer\URLSearchHooks\\{e4c3a8b6-7724-45d1-a629-17b69118ebcd} => value deleted successfully.
"HKU\S-1-5-21-508726573-1264868468-1237469860-1001\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{1970984B-77F4-4E74-91E5-C7F43A6EC673}" => Key deleted successfully.
HKCR\CLSID\{1970984B-77F4-4E74-91E5-C7F43A6EC673} => Key not found. 
"HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{145B29F4-A56B-4b90-BBAC-45784EBEBBB7}" => Key deleted successfully.
"HKCR\Wow6432Node\CLSID\{145B29F4-A56B-4b90-BBAC-45784EBEBBB7}" => Key deleted successfully.
HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar\\{5093EB4C-3E93-40AB-9266-B607BA87BDC8} => value deleted successfully.
"HKCR\Wow6432Node\CLSID\{5093EB4C-3E93-40AB-9266-B607BA87BDC8}" => Key deleted successfully.
HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar\\{e4c3a8b6-7724-45d1-a629-17b69118ebcd} => value deleted successfully.
HKCR\Wow6432Node\CLSID\{e4c3a8b6-7724-45d1-a629-17b69118ebcd} => Key not found. 
HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar\\{96A25A24-2E87-4374-8A50-CC6F943FCE4D} => value deleted successfully.
HKCR\Wow6432Node\CLSID\{96A25A24-2E87-4374-8A50-CC6F943FCE4D} => Key not found. 
HKU\S-1-5-21-508726573-1264868468-1237469860-1001\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{21FA44EF-376D-4D53-9B0F-8A89D3229068} => value deleted successfully.
HKCR\CLSID\{21FA44EF-376D-4D53-9B0F-8A89D3229068} => Key not found. 
HKU\S-1-5-21-508726573-1264868468-1237469860-1001\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{E4C3A8B6-7724-45D1-A629-17B69118EBCD} => value deleted successfully.
HKCR\CLSID\{E4C3A8B6-7724-45D1-A629-17B69118EBCD} => Key not found. 
"HKU\S-1-5-21-508726573-1264868468-1237469860-1001\Software\MozillaPlugins\@doubletwist.com/NPPodcast" => Key deleted successfully.
C:\Program Files (x86)\Common Files\doubleTwist\NPPodcast.dll not found.
C:\Users\Kate\AppData\Roaming\Mozilla\Firefox\Profiles\a9dlfrif.default\Extensions\[email protected]f0f261f92.com => Moved successfully.
C:\Users\Kate\AppData\Roaming\Mozilla\Firefox\Profiles\a9dlfrif.default\Extensions\[email protected] => Moved successfully.
C:\Users\Kate\AppData\Roaming\Mozilla\Firefox\Profiles\a9dlfrif.default\Extensions\{3e0e7d2a-070f-4a47-b019-91fe5385ba79} => Moved successfully.
C:\Users\Kate\AppData\Roaming\Mozilla\Firefox\Profiles\a9dlfrif.default\Extensions\{7f3f960e-a836-45ca-8911-0accb522246e} => Moved successfully.
C:\Users\Kate\AppData\Roaming\Mozilla\Firefox\Profiles\a9dlfrif.default\Extensions\{ad32743c-16ef-46ec-977b-dce0c3c85b20} => Moved successfully.
C:\Users\Kate\AppData\Roaming\Mozilla\Firefox\Profiles\a9dlfrif.default\Extensions\{e4c3a8b6-7724-45d1-a629-17b69118ebcd} => Moved successfully.
HKLM\Software\Mozilla\Firefox\Extensions\\{C4CFC0DE-134F-4466-B2A2-FF7C59A8BFAD} => value deleted successfully.
HKLM\Software\Wow6432Node\Mozilla\Firefox\Extensions\\{C4CFC0DE-134F-4466-B2A2-FF7C59A8BFAD} => value deleted successfully.
"C:\Program Files\Updater By SweetPacks" => File/Directory not found.
"HKU\S-1-5-21-508726573-1264868468-1237469860-1001\SOFTWARE\Google\Chrome\Extensions\cbjibcbpmbcabnfnohhgjjmkgkimajko" => Key deleted successfully.
"HKU\S-1-5-21-508726573-1264868468-1237469860-1001\SOFTWARE\Google\Chrome\Extensions\oajgghejjpgkmpgbchgjieahoefimdle" => Key deleted successfully.
"HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\cbjibcbpmbcabnfnohhgjjmkgkimajko" => Key deleted successfully.
"HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\oajgghejjpgkmpgbchgjieahoefimdle" => Key deleted successfully.
StumbleUponUpdateService => Service deleted successfully.
vToolbarUpdater18.3.0 => Service deleted successfully.
"C:\Program Files (x86)\Common Files\AVG Secure Search" => File/Directory not found.
C:\Program Files (x86)\BitZipper => Moved successfully.
"C:\Program Files (x86)\CrossReader" => File/Directory not found.
"HKU\S-1-5-21-508726573-1264868468-1237469860-1001_Classes\CLSID\{355EC88A-02E2-4547-9DEE-F87426484BD1}" => Key deleted successfully.
"HKU\S-1-5-21-508726573-1264868468-1237469860-1001_Classes\CLSID\{FE498BAB-CB4C-4F88-AC3F-3641AAAF5E9E}" => Key deleted successfully.
 
=========  bitsadmin /reset /allusers =========

  • 0

#10
very_metal

very_metal

    Member

  • Topic Starter
  • Member
  • PipPip
  • 16 posts

Just a note, I am unable to uninstall MixiDJ V8 Toolbar


  • 0

Advertisements


#11
pystryker

pystryker

    Trusted Helper

  • Malware Removal
  • 3,886 posts

Just a note, I am unable to uninstall MixiDJ V8 Toolbar


Ok, no worries there, the fixes have taken care of it. :) How is the machine running?

Let's run a scan for remnants and orphans.


Step 1: Scan with Malwarebytes


Please download Malwarebytes Anti-Malware to your desktop
Install the progamme and select update
Once it has updated select Settings > Detection and Protection
Tick Scan for rootkits

MBAMsettings_zpsb6b9ada0.jpg

Go back to the Dashboard and select Scan Now

MBAMScan_zps8ba7d192.jpg

If threats are detected, click the Apply Actions button, MBAM will ask for a reboot.

MBAMReboot_zps9089ab30.jpg

MBAMLog_zpsade07f42.jpg

On completion of the scan (or after the reboot), start MBAM,

Click History, then Application Logs, then check the Select box by the first Scan Log in the list.

Click View, then click Export, select text file and save to the desktop as MBAM.txt and post in your next reply.



Step 2: Scan with ESET Online Scanner


Please note: You can use Internet Explorer or Firefox for this step. Either browser used will have to be ran in admin mode.

Right click on either the Internet Explorer icon or the Firefox icon in the Start Menu or Quick Launch Bar on the Task bar and select Run as Administrator from the menu.

If you use Firefox, you will be prompted to download esetsmartinstaller_enu.exe. Please do so, then double click it to install it.

Please click on this link and then click the ESET Online Scanner bar ---->esetbar_zps93905f48.jpg
  • Select the option YES, I accept the Terms of Use then click on Start
  • When prompted allow the Add-On/Active X to install.
  • Make sure that the option Remove found threats is NOT checked.
  • Make sure that the option Scan archives is checked.
  • Now click on Advanced Settings and select the following:
  • Scan for potentially unwanted applications
  • Scan for potentially unsafe applications
  • Enable Anti-Stealth Technology
  • Now click on Start
  • The virus signature database will begin to download. Be patient this make take some time depending on the speed of your Internet Connection.
  • When completed the Online Scan will begin automatically. The scan may take several hours.
  • Do not touch either the Mouse or keyboard during the scan otherwise it may stall.
  • Now click on Finish
  • Use notepad to open the logfile located at C:\Program Files(x86)\ESET\EsetOnlineScanner\log.txt.
  • Copy and paste that log as a reply to this topic.
Step 3: SecurityCheck Scan


Download Security Checksecuritycheck_zpsb7736812.jpg by screen317 from here or here.
  • Save it to your Desktop.
  • Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
  • NOTE: If SecurityCheck aborts and you get the following message: UNSUPPORTED OPERATING SYSTEM! ABORTED! try rebooting the system and then run SecurityCheck again.
  • A Notepad document should open automatically called checkup.txt; please post the contents of that document.
Things I need to see in your next post:
  • ESET Scan Log
  • MBAM Log
  • SecurityCheck Log

  • 0

#12
very_metal

very_metal

    Member

  • Topic Starter
  • Member
  • PipPip
  • 16 posts
Malwarebytes Anti-Malware
www.malwarebytes.org
 
Scan Date: 3/11/2015
Scan Time: 8:57:39 PM
Logfile: malwarebytesscan1.txt
Administrator: Yes
 
Version: 2.00.4.1028
Malware Database: v2015.03.12.01
Rootkit Database: v2015.02.25.01
License: Free
Malware Protection: Disabled
Malicious Website Protection: Disabled
Self-protection: Disabled
 
OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: Kate
 
Scan Type: Threat Scan
Result: Completed
Objects Scanned: 372894
Time Elapsed: 22 min, 31 sec
 
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Enabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled
 
Processes: 0
(No malicious items detected)
 
Modules: 0
(No malicious items detected)
 
Registry Keys: 23
PUP.Optional.DefaultTab.A, HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{7F6AFBF1-E065-4627-A2FD-810366367D01}, Quarantined, [832676ac4842dd59ebd37ea644bf817f], 
PUP.Optional.DefaultTab.A, HKU\S-1-5-21-508726573-1264868468-1237469860-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{7F6AFBF1-E065-4627-A2FD-810366367D01}, Quarantined, [832676ac4842dd59ebd37ea644bf817f], 
PUP.Optional.RelatedSearchs.A, HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{96A25A24-2E87-4374-8A50-CC6F943FCE4D}, Quarantined, [b3f69191e8a2df570d9976ac28db1de3], 
PUP.Optional.RelatedSearchs.A, HKLM\SOFTWARE\CLASSES\DefaultTabToolbarBHO.DefaultTabToolbar, Quarantined, [b3f69191e8a2df570d9976ac28db1de3], 
PUP.Optional.RelatedSearchs.A, HKLM\SOFTWARE\CLASSES\DefaultTabToolbarBHO.DefaultTabToolbar.1, Quarantined, [b3f69191e8a2df570d9976ac28db1de3], 
PUP.Optional.RelatedSearchs.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\DefaultTabToolbarBHO.DefaultTabToolbar, Quarantined, [b3f69191e8a2df570d9976ac28db1de3], 
PUP.Optional.RelatedSearchs.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\DefaultTabToolbarBHO.DefaultTabToolbar.1, Quarantined, [b3f69191e8a2df570d9976ac28db1de3], 
PUP.Optional.RelatedSearchs.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\PREAPPROVED\{96A25A24-2E87-4374-8A50-CC6F943FCE4D}, Quarantined, [b3f69191e8a2df570d9976ac28db1de3], 
PUP.Optional.MixiDJ.A, HKLM\SOFTWARE\WOW6432NODE\MixiDJ_V8, Quarantined, [dacfd84a6624a195b21f32029075f60a], 
PUP.Optional.PCFixSpeed, HKLM\SOFTWARE\WOW6432NODE\PCFixSpeed, Quarantined, [9f0ac35f216955e1a0df1df322e30ff1], 
PUP.Optional.DefaultTab.A, HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\Default tab, Quarantined, [6a3f2bf7f99121150aca0aae966da45c], 
PUP.Optional.DefaultTab.A, HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\DefaultTab, Quarantined, [6f3a4ad8f8924de938f1ecce659e26da], 
PUP.Optional.SweetIM.A, HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\SweetIM, Quarantined, [7039150d2d5d3ef8187a6a4cf90a2fd1], 
PUP.Optional.DefaultTab.A, HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\DefaultTab, Quarantined, [5950968c87033cfadb0f15e54ab91ae6], 
PUP.Optional.InstallBrain.A, HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\WNLT, Quarantined, [06a3d74b414979bda63433e1dc2914ec], 
PUP.Optional.Getsavin.A, HKU\S-1-5-21-508726573-1264868468-1237469860-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\GetSavin, Quarantined, [22870c164b3f96a020bb86387a894ab6], 
PUP.Optional.PCFixSpeed, HKU\S-1-5-21-508726573-1264868468-1237469860-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\PCFixSpeed, Quarantined, [a5049f8391f92d09433956ba966fbf41], 
PUP.Optional.Getsavin.A, HKU\S-1-5-21-508726573-1264868468-1237469860-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\GetSavin, Quarantined, [e8c1aa78ee9c50e6c01c9826c24112ee], 
PUP.Optional.MixiDJToolbar.A, HKU\S-1-5-21-508726573-1264868468-1237469860-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\MixiDJ_V8, Quarantined, [d6d340e21f6b7fb76d7fa64cea19e11f], 
PUP.Optional.MixiDJToolbar.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{85318F7B-ACB8-4719-A35C-14BF9F7EFBD7}, Quarantined, [703981a1fd8dae88ffe08be17f84cd33], 
PUP.Optional.MixiDJToolbar.A, HKU\S-1-5-21-508726573-1264868468-1237469860-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{85318F7B-ACB8-4719-A35C-14BF9F7EFBD7}, Quarantined, [703981a1fd8dae88ffe08be17f84cd33], 
PUP.Optional.MixiDJToolbar.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\PREAPPROVED\{85318F7B-ACB8-4719-A35C-14BF9F7EFBD7}, Quarantined, [703981a1fd8dae88ffe08be17f84cd33], 
PUP.Optional.MixiDJToolbar.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\MixiDJ_V8 Toolbar, Quarantined, [703981a1fd8dae88ffe08be17f84cd33], 
 
Registry Values: 1
PUP.Optional.InstallBrain.A, HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\WNLT|URL, MYSTART, Quarantined, [06a3d74b414979bda63433e1dc2914ec]
 
Registry Data: 0
(No malicious items detected)
 
Folders: 45
PUP.Optional.MixiDJToolbar.A, C:\Program Files (x86)\MixiDJ_V8, Quarantined, [703981a1fd8dae88ffe08be17f84cd33], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\CacheIcons, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\Dialogs, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\Dialogs\AddedAppDialog, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\Dialogs\DefualtImages, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\Dialogs\DetectedAppDialog, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\Dialogs\EngineFirstTimeDialog, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\Dialogs\NewSearchProtectorDialog, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\Dialogs\NewSearchProtectorDialog\images, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\Dialogs\SearchProtectorBubbleDialog, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\Dialogs\SearchProtectorBubbleDialog\images, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\Dialogs\SearchProtectorDialog, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\Dialogs\SearchProtectorDialog\Images, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\Dialogs\SearchProtectorRetakeoverDialog, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\Dialogs\SearchProtectorRetakeoverDialog\Images, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\Dialogs\ToolbarFirstTimeDialog, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\Dialogs\ToolbarFirstTimeDialog\images, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\Dialogs\ToolbarUntrustedAppsApprovalDialog, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\Dialogs\UninstallDialog, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\Dialogs\UntrustedAddedAppDialog, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\Dialogs\UntrustedAppApprovalDialog, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\Dialogs\UntrustedAppPendingDialog, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\EmailNotifier, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\ExternalComponent, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\Logs, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\MyStuffApps, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\plugins, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\plugins\{5E1360DC-8FA8-40df-A8CD-FC3831B3634B}, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\plugins\{5E1360DC-8FA8-40df-A8CD-FC3831B3634B}\3.6.12, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\plugins\{5E1360DC-8FA8-40df-A8CD-FC3831B3634B}\3.6.12\bin, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\plugins\{5E1360DC-8FA8-40df-A8CD-FC3831B3634B}\3.6.8, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\plugins\{5E1360DC-8FA8-40df-A8CD-FC3831B3634B}\3.6.8\bin, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\RadioPlayer, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\Repository, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\Repository\conduit_CT3287822_CT3287822, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\Repository\conduit_CT3287822_CT3287822\AppsMetaData, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\Repository\conduit_CT3287822_CT3287822\DynamicDialogs, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\Repository\conduit_CT3287822_CT3287822\ToolbarLogin, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\Repository\conduit_CT3287822_CT3287822\ToolbarSettings, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\Repository\conduit_CT3287822_en, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\Repository\conduit_CT3287822_en\ToolbarTranslation, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\SearchInNewTab, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.Conduit.A, C:\Users\Kate\AppData\Roaming\Mozilla\Firefox\Profiles\a9dlfrif.default\CT3294791, Quarantined, [4366f62c345605317c47b1bf17ecbb45], 
PUP.Optional.CrossRider.A, C:\Users\Kate\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcpjilkdemipdgbehgnmanclcphkfclo, Quarantined, [09a04cd6d1b959dd4d57354ed52e1ae6], 
 
Files: 172
PUP.Optional.Inbox, C:\Users\Kate\Documents\MapsSetup.exe, Quarantined, [66434dd53c4ef244c973250fdb2625db], 
PUP.Optional.Ibryte, C:\Users\Kate\Downloads\FlashVideoPlayer.exe, Quarantined, [5752b9692d5d24126684a88bc041db25], 
PUP.Optional.PCPowerSpeed, C:\Users\Public\Desktop\Optimize Your PC.lnk, Quarantined, [8b1e6fb35c2ef442d63149826d9658a8], 
PUP.Optional.MixiDJToolbar.A, C:\Program Files (x86)\MixiDJ_V8\GottenAppsContextMenu.xml, Quarantined, [703981a1fd8dae88ffe08be17f84cd33], 
PUP.Optional.MixiDJToolbar.A, C:\Program Files (x86)\MixiDJ_V8\hk64tbMixi.dll, Quarantined, [703981a1fd8dae88ffe08be17f84cd33], 
PUP.Optional.MixiDJToolbar.A, C:\Program Files (x86)\MixiDJ_V8\hktbMixi.dll, Quarantined, [703981a1fd8dae88ffe08be17f84cd33], 
PUP.Optional.MixiDJToolbar.A, C:\Program Files (x86)\MixiDJ_V8\ldrtbMixi.dll, Quarantined, [703981a1fd8dae88ffe08be17f84cd33], 
PUP.Optional.MixiDJToolbar.A, C:\Program Files (x86)\MixiDJ_V8\MixiDJ_V8ToolbarHelper.exe, Quarantined, [703981a1fd8dae88ffe08be17f84cd33], 
PUP.Optional.MixiDJToolbar.A, C:\Program Files (x86)\MixiDJ_V8\OtherAppsContextMenu.xml, Quarantined, [703981a1fd8dae88ffe08be17f84cd33], 
PUP.Optional.MixiDJToolbar.A, C:\Program Files (x86)\MixiDJ_V8\prxtbMixi.dll, Quarantined, [703981a1fd8dae88ffe08be17f84cd33], 
PUP.Optional.MixiDJToolbar.A, C:\Program Files (x86)\MixiDJ_V8\SharedAppsContextMenu.xml, Quarantined, [703981a1fd8dae88ffe08be17f84cd33], 
PUP.Optional.MixiDJToolbar.A, C:\Program Files (x86)\MixiDJ_V8\tbMixi.dll, Quarantined, [703981a1fd8dae88ffe08be17f84cd33], 
PUP.Optional.MixiDJToolbar.A, C:\Program Files (x86)\MixiDJ_V8\toolbar.cfg, Quarantined, [703981a1fd8dae88ffe08be17f84cd33], 
PUP.Optional.MixiDJToolbar.A, C:\Program Files (x86)\MixiDJ_V8\ToolbarContextMenu.xml, Quarantined, [703981a1fd8dae88ffe08be17f84cd33], 
PUP.Optional.MixiDJToolbar.A, C:\Program Files (x86)\MixiDJ_V8\uninstall.exe, Quarantined, [703981a1fd8dae88ffe08be17f84cd33], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\hk64tbMix0.dll, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\hk64tbMix2.dll, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\hk64tbMixi.dll, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\hktbMix0.dll, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\hktbMix2.dll, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\hktbMixi.dll, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\ldrtbMix0.dll, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\ldrtbMix2.dll, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\ldrtbMixi.dll, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\tbMix0.dll, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\tbMix1.dll, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\tbMix2.dll, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\tbMixi.dll, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\ThirdPartyComponents.xml, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\toolbar.cfg, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\CacheIcons\http___storage_conduit_com_MarketPlace_71_92f_71422c68-106e-4efa-a402-2c5d0c3ab92f_Appearance_634374241008412502_png.png, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\CacheIcons\http___storage_conduit_com_MarketPlace_78_f1b_789d74ff-86a2-4fb9-9903-16e7b2641f1b_Appearance_634825030599553405_png.png, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\CacheIcons\http___storage_conduit_com_MarketPlace_93_ce3_93951332-f9a7-4af7-af02-17ec3d749ce3_Appearance_634159521796627506_24x24_png.png, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\CacheIcons\http___storage_conduit_com_MarketPlace_97_5e6_9739aadc-99e3-4b66-8c1e-bc6ae6cd55e6_Appearance_634165981520378434_24x24_png.png, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\CacheIcons\http___weather_conduit_com_images_weather_Default_cloudy_gif.gif, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\CacheIcons\http___weather_conduit_com_images_weather_Default_partly_cloudy_gif.gif, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\CacheIcons\http___weather_conduit_com_images_weather_Default_sunny_gif.gif, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\CacheIcons\http___weather_conduit_com_images_weather_Default_sunny_night_gif.gif, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\CacheIcons\http___storage_Conduit_com_bankImages_ConduitEngine_ContextMenu_About_png.png, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\CacheIcons\http___storage_Conduit_com_bankImages_ConduitEngine_ContextMenu_Browse_png.png, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\CacheIcons\http___storage_Conduit_com_bankImages_ConduitEngine_ContextMenu_Contact_png.png, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\CacheIcons\http___storage_Conduit_com_bankImages_ConduitEngine_ContextMenu_Hide_png.png, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\CacheIcons\http___storage_conduit_com_bankImages_ConduitEngine_ContextMenu_LikeIcon_png.png, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\CacheIcons\http___storage_Conduit_com_bankImages_ConduitEngine_ContextMenu_MoreFromPublisher_png.png, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\CacheIcons\http___storage_Conduit_com_bankImages_ConduitEngine_ContextMenu_More_png.png, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\CacheIcons\http___storage_conduit_com_bankimages_commandcomps_block_gif.gif, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\CacheIcons\http___storage_Conduit_com_bankImages_ConduitEngine_ContextMenu_Options_png.png, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\CacheIcons\http___storage_conduit_com_images_main_menu_options_gif.gif, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\CacheIcons\http___storage_conduit_com_MarketPlace_1a_2dc_1af6a81c-86ff-4937-bd94-7bdb646af2dc_Appearance_634473642776763064_png.png, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\CacheIcons\http___storage_conduit_com_images_main_menu_privacy_gif.gif, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\CacheIcons\http___storage_conduit_com_images_main_menu_refresh_gif.gif, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\CacheIcons\http___storage_conduit_com_images_main_menu_shrink_gif.gif, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\CacheIcons\http___storage_conduit_com_images_main_menu_upgrade_gif.gif, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\CacheIcons\http___storage_conduit_com_images_Menu_uninstall-icon_png.png, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\CacheIcons\http___storage_conduit_com_images_SearchEngines_images_search_gif.gif, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\CacheIcons\http___storage_conduit_com_images_SearchEngines_news_icon_gif.gif, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\CacheIcons\http___storage_conduit_com_images_searchengines_search_icon_gif.gif, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\CacheIcons\http___storage_conduit_com_images_SearchEngines_tfd_gif.gif, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\CacheIcons\http___storage_conduit_com_images_SearchEngines_video_gif.gif, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\CacheIcons\http___storage_Conduit_com_bankImages_ConduitEngine_ContextMenu_Privacy_png.png, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\CacheIcons\http___storage_Conduit_com_bankImages_ConduitEngine_ContextMenu_Refresh_png.png, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\CacheIcons\http___storage_Conduit_com_bankImages_ConduitEngine_ContextMenu_Upgrade_png.png, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\CacheIcons\http___storage_conduit_com_images_ClientImages_radio_gif.gif, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\CacheIcons\http___storage_conduit_com_images_eula_png.png, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\CacheIcons\http___storage_conduit_com_images_main_menu_about_gif.gif, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\CacheIcons\http___storage_conduit_com_images_main_menu_clear_history_gif.gif, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\CacheIcons\http___storage_conduit_com_images_main_menu_contact_gif.gif, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\CacheIcons\http___storage_conduit_com_images_main_menu_help_gif.gif, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\CacheIcons\http___storage_conduit_com_images_main_menu_home_page_gif.gif, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\CacheIcons\http___storage_conduit_com_6_325_CT3255406_Images_634865922899792583_png.png, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\CacheIcons\http___storage_conduit_com_6_325_CT3255406_images_634865923226984272_24PX_png.png, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\CacheIcons\http___storage_conduit_com_6_325_CT3255406_Skins_634865921557431652_28px_png.png, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\Dialogs\RoundedCornersIE9.css, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\Dialogs\DialogsAPI.js, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\Dialogs\excanvas.js, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\Dialogs\generalDialogStyle.css, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\Dialogs\PIE.htc, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\Dialogs\RoundedCorners.css, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\Dialogs\settings.js, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\Dialogs\version.txt, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\Dialogs\AddedAppDialog\app-added.js, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\Dialogs\AddedAppDialog\main.html, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\Dialogs\DefualtImages\icon.png, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\Dialogs\DetectedAppDialog\app-2go.js, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\Dialogs\DetectedAppDialog\main.html, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\Dialogs\EngineFirstTimeDialog\EngineFirstTimeDialog.js, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\Dialogs\EngineFirstTimeDialog\main.html, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\Dialogs\EngineFirstTimeDialog\right-click.gif, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\Dialogs\NewSearchProtectorDialog\main.html, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\Dialogs\NewSearchProtectorDialog\SearchProtector.css, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\Dialogs\NewSearchProtectorDialog\SearchProtector.js, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\Dialogs\NewSearchProtectorDialog\images\ok-button.png, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\Dialogs\NewSearchProtectorDialog\images\separation-line.png, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\Dialogs\NewSearchProtectorDialog\images\warning.png, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\Dialogs\SearchProtectorBubbleDialog\bubble.css, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\Dialogs\SearchProtectorBubbleDialog\bubble.js, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\Dialogs\SearchProtectorBubbleDialog\main.html, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\Dialogs\SearchProtectorBubbleDialog\images\information.png, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\Dialogs\SearchProtectorBubbleDialog\images\x-default-LTR.png, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\Dialogs\SearchProtectorBubbleDialog\images\x-default-RTL.png, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\Dialogs\SearchProtectorBubbleDialog\images\x-mouseover-LTR.png, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\Dialogs\SearchProtectorBubbleDialog\images\x-mouseover-RTL.png, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\Dialogs\SearchProtectorDialog\main.html, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\Dialogs\SearchProtectorDialog\SearchProtector.css, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\Dialogs\SearchProtectorDialog\SearchProtector.js, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\Dialogs\SearchProtectorDialog\Images\info.png, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\Dialogs\SearchProtectorDialog\Images\ok-on.png, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\Dialogs\SearchProtectorDialog\Images\ok.png, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\Dialogs\SearchProtectorRetakeoverDialog\main.html, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\Dialogs\SearchProtectorRetakeoverDialog\SearchProtectorRetakeover.css, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\Dialogs\SearchProtectorRetakeoverDialog\SearchProtectorRetakeover.js, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\Dialogs\SearchProtectorRetakeoverDialog\Images\Icon.jpg, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\Dialogs\SearchProtectorRetakeoverDialog\Images\Icon.png, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\Dialogs\SearchProtectorRetakeoverDialog\Images\info.png, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\Dialogs\SearchProtectorRetakeoverDialog\Images\ok-on.png, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\Dialogs\SearchProtectorRetakeoverDialog\Images\ok.png, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\Dialogs\ToolbarFirstTimeDialog\main.html, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\Dialogs\ToolbarFirstTimeDialog\ToolbarFirstTimeDialog.css, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\Dialogs\ToolbarFirstTimeDialog\ToolbarFirstTimeDialog.js, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\Dialogs\ToolbarFirstTimeDialog\images\app-store-icon.png, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\Dialogs\ToolbarFirstTimeDialog\images\arrow.png, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\Dialogs\ToolbarFirstTimeDialog\images\divider.png, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\Dialogs\ToolbarFirstTimeDialog\images\emailNotifier.gif, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\Dialogs\ToolbarFirstTimeDialog\images\facebook.png, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\Dialogs\ToolbarFirstTimeDialog\images\radio.GIF, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\Dialogs\ToolbarFirstTimeDialog\images\Thumbs.db, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\Dialogs\ToolbarFirstTimeDialog\images\truste_welcome.GIF, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\Dialogs\ToolbarFirstTimeDialog\images\weather.GIF, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\Dialogs\ToolbarUntrustedAppsApprovalDialog\main.html, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\Dialogs\ToolbarUntrustedAppsApprovalDialog\ToolbarUntrustedAppsApprovalDialog.js, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\Dialogs\UntrustedAddedAppDialog\main.html, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\Dialogs\UntrustedAddedAppDialog\UT-app-dialog-added.js, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\Dialogs\UntrustedAppApprovalDialog\main.html, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\Dialogs\UntrustedAppApprovalDialog\UT-app-dialog-needs-your-approval.js, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\Dialogs\UntrustedAppPendingDialog\main.html, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\Dialogs\UntrustedAppPendingDialog\UT-app-dialog-is-waiting.js, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\ExternalComponent\http___contextmenu_toolbar_conduit-services_com__name=OtherApps&locale=en.xml, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\ExternalComponent\http___contextmenu_toolbar_conduit-services_com__name=GottenApps&locale=en&ctid=CT3287822.xml, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\ExternalComponent\http___contextmenu_toolbar_conduit-services_com__name=GottenApps&locale=en.xml, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\ExternalComponent\http___contextmenu_toolbar_conduit-services_com__name=OtherApps&locale=en&ctid=CT3287822.xml, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\ExternalComponent\http___contextmenu_toolbar_conduit-services_com__name=SharedApps&locale=en&ctid=CT3287822.xml, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\ExternalComponent\http___contextmenu_toolbar_conduit-services_com__name=SharedApps&locale=en.xml, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\ExternalComponent\http___contextmenu_toolbar_conduit-services_com__name=Toolbar&locale=en&ctid=CT3287822&UM=UM_UNINSTALL_ID.xml, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\ExternalComponent\http___contextmenu_toolbar_conduit-services_com__name=Toolbar&locale=en&ctid=CT3287822.xml, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\ExternalComponent\http___contextmenu_toolbar_conduit-services_com__name=Toolbar&locale=en.xml, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\plugins\{5E1360DC-8FA8-40df-A8CD-FC3831B3634B}\manifest.xml, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\plugins\{5E1360DC-8FA8-40df-A8CD-FC3831B3634B}\3.6.12\bin\PriceGongIE.dll, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\plugins\{5E1360DC-8FA8-40df-A8CD-FC3831B3634B}\3.6.12\bin\PriceGong_16.png, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\plugins\{5E1360DC-8FA8-40df-A8CD-FC3831B3634B}\3.6.8\bin\PriceGong_16.png, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\RadioPlayer\IP_Stations_Media_List.xml, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\RadioPlayer\Predefined_Media_List.xml, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\Repository\conduit_CT3287822_CT3287822\AppsMetaData\data.bck.txt, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\Repository\conduit_CT3287822_CT3287822\AppsMetaData\data.txt, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\Repository\conduit_CT3287822_CT3287822\DynamicDialogs\data.bck.txt, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\Repository\conduit_CT3287822_CT3287822\DynamicDialogs\data.txt, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\Repository\conduit_CT3287822_CT3287822\ToolbarLogin\data.bck.txt, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\Repository\conduit_CT3287822_CT3287822\ToolbarLogin\data.txt, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\Repository\conduit_CT3287822_CT3287822\ToolbarSettings\data.bck.txt, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\Repository\conduit_CT3287822_CT3287822\ToolbarSettings\data.txt, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\Repository\conduit_CT3287822_en\ToolbarTranslation\data.bck.txt, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\Repository\conduit_CT3287822_en\ToolbarTranslation\data.txt, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.MixiDJToolbar.A, C:\Users\Kate\AppData\LocalLow\MixiDJ_V8\SearchInNewTab\SearchInNewTabContent.xml, Quarantined, [8a1faf735238a98d218f600e6b9852ae], 
PUP.Optional.Conduit.A, C:\Users\Kate\AppData\Roaming\Mozilla\Firefox\Profiles\a9dlfrif.default\CT3294791\originalSearchEngine.xml, Quarantined, [4366f62c345605317c47b1bf17ecbb45], 
PUP.Optional.CrossRider.A, C:\Users\Kate\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcpjilkdemipdgbehgnmanclcphkfclo\000005.ldb, Quarantined, [09a04cd6d1b959dd4d57354ed52e1ae6], 
PUP.Optional.CrossRider.A, C:\Users\Kate\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcpjilkdemipdgbehgnmanclcphkfclo\000008.ldb, Quarantined, [09a04cd6d1b959dd4d57354ed52e1ae6], 
PUP.Optional.CrossRider.A, C:\Users\Kate\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcpjilkdemipdgbehgnmanclcphkfclo\000013.ldb, Quarantined, [09a04cd6d1b959dd4d57354ed52e1ae6], 
PUP.Optional.CrossRider.A, C:\Users\Kate\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcpjilkdemipdgbehgnmanclcphkfclo\000014.log, Quarantined, [09a04cd6d1b959dd4d57354ed52e1ae6], 
PUP.Optional.CrossRider.A, C:\Users\Kate\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcpjilkdemipdgbehgnmanclcphkfclo\CURRENT, Quarantined, [09a04cd6d1b959dd4d57354ed52e1ae6], 
PUP.Optional.CrossRider.A, C:\Users\Kate\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcpjilkdemipdgbehgnmanclcphkfclo\LOCK, Quarantined, [09a04cd6d1b959dd4d57354ed52e1ae6], 
PUP.Optional.CrossRider.A, C:\Users\Kate\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcpjilkdemipdgbehgnmanclcphkfclo\LOG, Quarantined, [09a04cd6d1b959dd4d57354ed52e1ae6], 
PUP.Optional.CrossRider.A, C:\Users\Kate\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcpjilkdemipdgbehgnmanclcphkfclo\LOG.old, Quarantined, [09a04cd6d1b959dd4d57354ed52e1ae6], 
PUP.Optional.CrossRider.A, C:\Users\Kate\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcpjilkdemipdgbehgnmanclcphkfclo\MANIFEST-000012, Quarantined, [09a04cd6d1b959dd4d57354ed52e1ae6], 
 
Physical Sectors: 0
(No malicious items detected)
 
 
(end)

  • 0

#13
very_metal

very_metal

    Member

  • Topic Starter
  • Member
  • PipPip
  • 16 posts
[email protected] as CAB hook log:
OnlineScanner64.ocx - registred OK
OnlineScanner.ocx - registred OK
# product=EOS
# version=8
# IEXPLORE.EXE=11.00.9600.16428 (winblue_gdr.131013-1700)
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=9f278f06a9fa4644b621b0e1f34339ae
# engine=22866
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2015-03-12 05:05:10
# local_time=2015-03-12 01:05:10 (-0500, Eastern Daylight Time)
# country="United States"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 0 177680160 0 0
# scanned=326675
# found=95
# cleaned=0
# scan_time=11399
sh=E9E73ECBDFBD0BDE5773B5DBD7E8688E9EE2F470 ft=0 fh=0000000000000000 vn="Win32/Toolbar.Perion.K potentially unwanted application" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\IB Updater\source.crx.vir"
sh=C1AB75485262A83F5FC6615BAB1CEA74CADB75C9 ft=0 fh=0000000000000000 vn="Win32/Toolbar.Perion.K potentially unwanted application" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\Updater By SweetPacks\source.crx.vir"
sh=C2BFE5B0049514B034969D144289BD233B4B60A5 ft=0 fh=0000000000000000 vn="Win32/Toolbar.Perion.K potentially unwanted application" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\Updater By SweetPacks\Firefox\chrome\content\main.js.bak.vir"
sh=4F6A504DAE2929C4B753AD772D96BBFAC3F8CA53 ft=1 fh=6a48d7e397d98671 vn="a variant of Win32/FileTypeAssistant.A potentially unwanted application" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\File Type Assistant\temp\~tmp.exe.vir"
sh=9E602DB0FDBE78BC9C932F5EBBABA8FDDE3B426F ft=1 fh=19d9d5e677b74a7a vn="Win32/BrowseFox.C potentially unwanted application" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Jump Flip\JumpFlipUninstall.exe.vir"
sh=A4836DD7F69858354FABF4AD63EDFE2E93DB1CB1 ft=1 fh=da8a6d667e049978 vn="a variant of Win32/BrowseFox.H potentially unwanted application" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Jump Flip\updateJumpFlip.exe.vir"
sh=A241353231A4154413F258C29FC93436B6284D76 ft=1 fh=56f180e2f062ab39 vn="a variant of Win32/BrowseFox.I potentially unwanted application" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Jump Flip\bin\JumpFlip.BrowserAdapter.exe.vir"
sh=12854915C5391A987ED2D1ADE2BD0DC5F7A76D58 ft=1 fh=5c5a382e8c23634d vn="a variant of Win64/BrowseFox.A potentially unwanted application" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Jump Flip\bin\JumpFlip.PurBrowse64.exe.vir"
sh=DB8D09D9DF2D2B9683D5B7411AB43D3C397E4142 ft=1 fh=0ba2206bc6edc757 vn="a variant of Win32/BrowseFox.N potentially unwanted application" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Jump Flip\bin\JumpFlipBAApp.dll.vir"
sh=A4836DD7F69858354FABF4AD63EDFE2E93DB1CB1 ft=1 fh=da8a6d667e049978 vn="a variant of Win32/BrowseFox.H potentially unwanted application" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Jump Flip\bin\utilJumpFlip.exe.vir"
sh=AD4476F3E7A9016724B75B1C8609A68725EE6EB0 ft=1 fh=b486ca477535c677 vn="a variant of Win32/BrowseFox.M potentially unwanted application" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Jump Flip\bin\{cc30460f-753f-44d9-b58c-13dae1321968}.dll.vir"
sh=CBCFE74CA7CCC96CA551D896E28651AE07F3C44F ft=1 fh=6409d7f5167e7a2a vn="a variant of MSIL/BrowseFox.G potentially unwanted application" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Jump Flip\bin\plugins\JumpFlip.Bromon.dll.vir"
sh=262EAB523BB8E1458C0C287EF7B22BBD99093E5C ft=1 fh=b12270ecd9a40891 vn="a variant of MSIL/BrowseFox.G potentially unwanted application" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Jump Flip\bin\plugins\JumpFlip.BrowserAdapter.dll.vir"
sh=960C2212068649590B943903E3A618F3D624E210 ft=1 fh=30dac1da0bf66d0f vn="a variant of MSIL/BrowseFox.G potentially unwanted application" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Jump Flip\bin\plugins\JumpFlip.BrowserAdapterS.dll.vir"
sh=8D2FCD7C23A952E6219539D1054AE8D920779E9D ft=1 fh=76e466207f18a107 vn="a variant of MSIL/BrowseFox.G potentially unwanted application" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Jump Flip\bin\plugins\JumpFlip.CompatibilityChecker.dll.vir"
sh=9D2613D7D9B0B4680F599DA63005A05DC63DDA49 ft=1 fh=15376de6a4ff571e vn="a variant of MSIL/BrowseFox.G potentially unwanted application" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Jump Flip\bin\plugins\JumpFlip.FFUpdate.dll.vir"
sh=21E02168CD3BEA45F8C5BF00ED0CB6C3FF82349D ft=1 fh=48eb69751ae6676a vn="a variant of MSIL/BrowseFox.E potentially unwanted application" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Jump Flip\bin\plugins\JumpFlip.GCUpdate.dll.vir"
sh=810BAF982929120D1B06ADC34845BB9EFC56AF69 ft=1 fh=4f5fc97b41cbe839 vn="a variant of MSIL/BrowseFox.G potentially unwanted application" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Jump Flip\bin\plugins\JumpFlip.IEUpdate.dll.vir"
sh=A28134A9FF3E08A756E88273ECCE64E7E6A35BA2 ft=1 fh=26ce39ee9a422a28 vn="a variant of MSIL/BrowseFox.G potentially unwanted application" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Jump Flip\bin\plugins\JumpFlip.PurBrowse.dll.vir"
sh=9BFBFB3C5AD195FB7D98AE04BD8F893152F0B76D ft=1 fh=b9fa7667e1b0a72c vn="a variant of Win32/Mobogenie.A potentially unwanted application" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Mobogenie\DaemonProcess.exe.vir"
sh=D9F8CA0CC19FCCAD8FEB96185D0A963339930579 ft=1 fh=8858d5899216b75f vn="a variant of Win32/Mobogenie.A potentially unwanted application" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Mobogenie\Mobogenie.exe.vir"
sh=A0DB53EFBACD59768F19F6112E92663D0227E3BC ft=0 fh=0000000000000000 vn="a variant of Android/Mobserv.A potentially unwanted application" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Mobogenie\MUServer.apk.vir"
sh=8E6A6992A3C7FEC4000FA1A4D764DD597109E0B5 ft=1 fh=c71c0011cd00713e vn="Win32/NextLive.A potentially unwanted application" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Mobogenie\nengine.dll.vir"
sh=82F978FFA4B602EDD29C5708D0418340FE6D419B ft=1 fh=7e9f45d711ca4a76 vn="a variant of Win32/Mobogenie.A potentially unwanted application" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Mobogenie\New_UpdateMoboGenie.exe.vir"
sh=930F6C24088B7CB47481D4EDD64A873A817E73FC ft=1 fh=44fb5a4b02bb1a4e vn="a variant of Win32/Mobogenie.A potentially unwanted application" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Mobogenie\UpdateMoboGenie.exe.vir"
sh=93510E07EBD463BE51052EC8114EC16C5423103E ft=0 fh=0000000000000000 vn="Win32/Conduit.SearchProtect.A potentially unwanted application" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Mozilla Firefox\nsprotector.js.vir"
sh=8F070D36BA757747527BDF3736EFCBBE1D051B0A ft=1 fh=92aee2bc5570ebe1 vn="a variant of Win32/Toolbar.Montiera.A potentially unwanted application" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Mysearchdial\1.8.21.0\mysearchdialApp.dll.vir"
sh=B67DF0C86BF6403B0AC8E1DC26A078C678EFC74C ft=1 fh=b945d4e158c45c12 vn="a variant of Win32/Toolbar.Montiera.U potentially unwanted application" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Mysearchdial\1.8.21.0\mysearchdialEng.dll.vir"
sh=E869D3646D89D4514F947304703F0483029F6CAF ft=1 fh=9691cee157383ff8 vn="a variant of Win32/Toolbar.Montiera.A potentially unwanted application" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Mysearchdial\1.8.21.0\mysearchdialsrv.exe.vir"
sh=2AB2AFE12628E7FE87FC3E8ED97529C80EF0DBCC ft=1 fh=113582d466788309 vn="a variant of Win32/ExFriendAlert.B potentially unwanted application" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchDonkey\Uninstall.exe.vir"
sh=8135C9DEBA478072848121C978BAF10B5FC81443 ft=0 fh=0000000000000000 vn="Win32/ExFriendAlert.A potentially unwanted application" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchDonkey\Chrome\common.crx.vir"
sh=74D356D79C9D275B80B3D5CDCBBF6D83FEE464AD ft=1 fh=e2f50d36ca69f678 vn="Win32/ExFriendAlert.A potentially unwanted application" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchDonkey\Chrome\unzip\plugin\gc_getcid.dll.vir"
sh=84B4F902F4DF4D81EB9FBDE2B1A0A9E9E65FE5F2 ft=1 fh=1fb3d725118d9dbb vn="a variant of Win32/ExFriendAlert.B potentially unwanted application" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchDonkey\IE\common.dll.vir"
sh=77801D0E0DC02E8C50CDC73562F4D7F13FC1C18B ft=0 fh=0000000000000000 vn="Win32/Conduit.SearchProtect.A potentially unwanted application" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\ffprotect\application.js.vir"
sh=170ACC25B35BA845064591DF61F2D52142823738 ft=0 fh=0000000000000000 vn="Win32/Conduit.SearchProtect.A potentially unwanted application" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\ffprotect\nsprotector.js.vir"
sh=D86451022DDD8348105C1D52FBFD2ADB1E2DCC30 ft=1 fh=d3e706a6307522ba vn="Win32/Toolbar.Conduit.Y potentially unwanted application" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Kate\AppData\Local\Conduit\BackgroundContainer\BackgroundContainer.dll.vir"
sh=314F703F0F190BF70F0386509C10998D4E2BD10B ft=1 fh=2f9f46df1834d950 vn="Win32/Toolbar.Conduit.Y potentially unwanted application" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Kate\AppData\Local\Conduit\BackgroundContainer\TBUpdaterLogic_1.0.0.1.dll.vir"
sh=D3CBDD7C6ED2C9D81DA4FCF9AF57CDD5D3711ED3 ft=1 fh=86dbe26399c3d0fa vn="Win32/Toolbar.Conduit.Y potentially unwanted application" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Kate\AppData\Local\Conduit\BackgroundContainer\TBUpdaterLogic_1.0.0.2.dll.vir"
sh=F38577114270712615FAE9C47D11CE758CD9FBBD ft=1 fh=f539bf1ff66a28fb vn="a variant of Win32/Conduit.SearchProtect.N potentially unwanted application" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Kate\AppData\Local\Conduit\BackgroundContainer\TBUpdaterLogic_3.0.0.11.dll.vir"
sh=3EFCE8E60D9AEA8666F5A04990DB0451DBB8CCA1 ft=1 fh=9fcd97622c9e2cff vn="a variant of Win32/Conduit.SearchProtect.N potentially unwanted application" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Kate\AppData\Local\Conduit\CT3287822\MixiDJ_V8AutoUpdateHelper.exe.vir"
sh=8E6A6992A3C7FEC4000FA1A4D764DD597109E0B5 ft=1 fh=c71c0011cd00713e vn="Win32/NextLive.A potentially unwanted application" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Kate\AppData\Local\genienext\nengine.dll.vir"
sh=FC1D4D0CB36E4C0259A1CD3B60D1EF6EF48C0BB5 ft=1 fh=32d1c175243ad0eb vn="a variant of Win32/Toolbar.Conduit.AH potentially unwanted application" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Kate\AppData\Local\Google\Chrome\User Data\Default\Extensions\kheelobnibmchifldedamogdmhemfjio\10.15.0.62_0\plugins\ConduitChromeApiPlugin.dll.vir"
sh=2B9A1340BEC2FE2694C333ACD77F0E12EF9550D1 ft=1 fh=fcbeb3ad261a92d1 vn="a variant of Win32/Conduit.SearchProtect.P potentially unwanted application" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Kate\AppData\Local\Google\Chrome\User Data\Default\Extensions\kheelobnibmchifldedamogdmhemfjio\10.31.4.510_0\APISupport\APISupport.dll.vir"
sh=675526C1B3CB27C6635233B62EDB8ECEEBFE1556 ft=1 fh=8382eeac10eb278f vn="a variant of Win32/Toolbar.Conduit.AH potentially unwanted application" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Kate\AppData\Local\Google\Chrome\User Data\Default\Extensions\kheelobnibmchifldedamogdmhemfjio\10.31.4.510_0\nativeMessaging\TBMessagingHost.exe.vir"
sh=C0114483C9E2C1271B0D594AB6A6BF1E4F383D63 ft=1 fh=e2607344a0894545 vn="a variant of Win32/Conduit.SearchProtect.N potentially unwanted application" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Kate\AppData\Local\Google\Chrome\User Data\Default\Extensions\kheelobnibmchifldedamogdmhemfjio\10.31.4.510_0\plugins\ChromeApiPlugin.dll.vir"
sh=D4290B72810DBCDDFE49B3A887C32B8210448F23 ft=0 fh=0000000000000000 vn="Win32/SweetIM.J potentially unwanted application" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Kate\AppData\Local\Google\Chrome\User Data\Default\Extensions\ogccgbmabaphcakpiclgcnmcnimhokcj\1.4.0.4_2\flavour.js.vir"
sh=368DBEFD4A7A058B8A499A7D63B8D0928AC85F41 ft=0 fh=0000000000000000 vn="Win32/SweetIM.J potentially unwanted application" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Kate\AppData\Local\Google\Chrome\User Data\Default\Extensions\ogccgbmabaphcakpiclgcnmcnimhokcj\1.4.0.4_2\newtab.js.vir"
sh=356A4A0EBE1B2BA1D5B2D0DECE9E1E434641F57D ft=0 fh=0000000000000000 vn="Win32/SweetIM.J potentially unwanted application" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Kate\AppData\Local\Google\Chrome\User Data\Default\Extensions\ogccgbmabaphcakpiclgcnmcnimhokcj\1.4.0.4_2\toolbar.js.vir"
sh=6016E7163836BE52ECA661EADDB44FCA30B54815 ft=1 fh=c307da2984cfc001 vn="a variant of Win32/Toolbar.Conduit.AH potentially unwanted application" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Kate\AppData\Local\Google\Chrome\User Data\Default\Extensions\ojpijjmpahflnipadmlpgbjmagmjchkk\10.20.101.5_0\plugins\ConduitChromeApiPlugin.dll.vir"
sh=AA54DD585E1284C04EE920AF1B2853E442DA1D61 ft=1 fh=3d1c2013eb4dc7b6 vn="Win32/Toolbar.Conduit.AC potentially unwanted application" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Kate\AppData\Local\Google\Chrome\User Data\Default\Extensions\ojpijjmpahflnipadmlpgbjmagmjchkk\10.20.101.5_0\plugins\TBVerifier.dll.vir"
sh=A068BB4DF78CF294B9E7363B83A7DE0D106E8DC9 ft=0 fh=0000000000000000 vn="a variant of Win32/Mobogenie.A potentially unwanted application" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Kate\AppData\Local\Mobogenie\Version\OldVersion\Mobogenie2.2.8.zip.vir"
sh=9BFBFB3C5AD195FB7D98AE04BD8F893152F0B76D ft=1 fh=b9fa7667e1b0a72c vn="a variant of Win32/Mobogenie.A potentially unwanted application" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Kate\AppData\Local\Mobogenie\Version\OldVersion\Mobogenie\DaemonProcess.exe.vir"
sh=D9F8CA0CC19FCCAD8FEB96185D0A963339930579 ft=1 fh=8858d5899216b75f vn="a variant of Win32/Mobogenie.A potentially unwanted application" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Kate\AppData\Local\Mobogenie\Version\OldVersion\Mobogenie\Mobogenie.exe.vir"
sh=A0DB53EFBACD59768F19F6112E92663D0227E3BC ft=0 fh=0000000000000000 vn="a variant of Android/Mobserv.A potentially unwanted application" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Kate\AppData\Local\Mobogenie\Version\OldVersion\Mobogenie\MUServer.apk.vir"
sh=82F978FFA4B602EDD29C5708D0418340FE6D419B ft=1 fh=7e9f45d711ca4a76 vn="a variant of Win32/Mobogenie.A potentially unwanted application" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Kate\AppData\Local\Mobogenie\Version\OldVersion\Mobogenie\New_UpdateMoboGenie.exe.vir"
sh=3F431282D99DB621648A5A7233DA8D3B5D8B9C8E ft=1 fh=8565943e8a67032d vn="a variant of Win32/Toolbar.DefaultTab.B potentially unwanted application" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Kate\AppData\Roaming\defaulttab\DefaultTab\DefaultTabBHO.dll.vir"
sh=4DB0E7009E249E80E4B4839CB6674EA167212489 ft=1 fh=144e737ff98ba772 vn="Win32/Toolbar.DefaultTab.E potentially unwanted application" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Kate\AppData\Roaming\defaulttab\DefaultTab\DefaultTabSetup.exe.vir"
sh=871436D989FAA10657A94F269805738BAC849A0C ft=1 fh=5f1416dd45662080 vn="a variant of Win32/Toolbar.DefaultTab.B potentially unwanted application" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Kate\AppData\Roaming\defaulttab\DefaultTab\DefaultTabStart.exe.vir"
sh=057F4B810EF6586445CE6B42D75175E1F0E78D5B ft=1 fh=dbd67640972199f0 vn="Win64/Toolbar.DefaultTab.B potentially unwanted application" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Kate\AppData\Roaming\defaulttab\DefaultTab\DefaultTabStart64.exe.vir"
sh=A66441EA33B541895F23B3A4F8EB408B616A94BA ft=1 fh=02e58446c958c5ff vn="Win32/Toolbar.DefaultTab.E potentially unwanted application" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Kate\AppData\Roaming\defaulttab\DefaultTab\DefaultTabUninstaller.exe.vir"
sh=A61118F2C09D657D07FECB5902C838E19E2508EE ft=1 fh=4d996849e11f2906 vn="a variant of Win32/Toolbar.DefaultTab.B potentially unwanted application" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Kate\AppData\Roaming\defaulttab\DefaultTab\DefaultTabWrap.dll.vir"
sh=0FFD93EF92A6A07C04F82DD86C0EE6202BA5C25F ft=1 fh=db9d232416587d77 vn="a variant of Win64/Toolbar.DefaultTab.B potentially unwanted application" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Kate\AppData\Roaming\defaulttab\DefaultTab\DefaultTabWrap64.dll.vir"
sh=EA111903F48C1CB7FE5056509351A88EFE85114F ft=1 fh=0f73ddfd31d1def0 vn="Win32/Toolbar.DefaultTab.A potentially unwanted application" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Kate\AppData\Roaming\defaulttab\DefaultTab\DTUpdate.exe.vir"
sh=0BC4F3C61ABD05D74F77917DE4A13A1213DED98E ft=1 fh=55c2d2c5b8b0e5b4 vn="a variant of Win32/Toolbar.DefaultTab.E potentially unwanted application" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Kate\AppData\Roaming\defaulttab\DefaultTab\uninstalldt.exe.vir"
sh=D65001845A29261DBFBE4757915D4D8981A351CD ft=1 fh=1aadf523a8d9a6e7 vn="a variant of Win32/Toolbar.DefaultTab.F potentially unwanted application" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Kate\AppData\Roaming\defaulttab\DefaultTab\update.exe.vir"
sh=8E6A6992A3C7FEC4000FA1A4D764DD597109E0B5 ft=1 fh=c71c0011cd00713e vn="Win32/NextLive.A potentially unwanted application" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Kate\AppData\Roaming\newnext.me\nengine.dll.vir"
sh=77801D0E0DC02E8C50CDC73562F4D7F13FC1C18B ft=0 fh=0000000000000000 vn="Win32/Conduit.SearchProtect.A potentially unwanted application" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Kate\AppData\Roaming\SearchProtect\ffprotect\application.js.vir"
sh=170ACC25B35BA845064591DF61F2D52142823738 ft=0 fh=0000000000000000 vn="Win32/Conduit.SearchProtect.A potentially unwanted application" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Kate\AppData\Roaming\SearchProtect\ffprotect\nsprotector.js.vir"
sh=25117F8A564F6032CF0CF4556F510B1D76109A1B ft=1 fh=e5bac0081a99abfe vn="a variant of Win64/Systweak.A potentially unwanted application" ac=I fn="C:\AdwCleaner\Quarantine\C\Windows\System32\roboot64.exe.vir"
sh=948C948F9C0B9C3BCF6C9DF320D0C1E24F38E6AF ft=1 fh=682adb85168e3fc0 vn="a variant of Win64/NetFilter.A potentially unsafe application" ac=I fn="C:\AdwCleaner\Quarantine\C\Windows\System32\drivers\{cc30460f-753f-44d9-b58c-13dae1321968}w64.sys.vir"
sh=75C10B1113FA63C46C6CCAB697D8BCBE578DEEEE ft=1 fh=93233c561bd5fad8 vn="a variant of Win32/Toolbar.Perion.H potentially unwanted application" ac=I fn="C:\AdwCleaner\Quarantine\C\Windows\SysWOW64\ARFC\wrtc.exe.vir"
sh=24016DEC443904E847F3A1AD39B6D5C657AB36CD ft=1 fh=d5a2e8ceee190a09 vn="a variant of Win32/Toolbar.DefaultTab.B potentially unwanted application" ac=I fn="C:\AdwCleaner\Quarantine\C\Windows\SysWOW64\config\systemprofile\AppData\Roaming\defaulttab\defaulttab\DefaultTabBHO.dll.vir"
sh=4DB0E7009E249E80E4B4839CB6674EA167212489 ft=1 fh=144e737ff98ba772 vn="Win32/Toolbar.DefaultTab.E potentially unwanted application" ac=I fn="C:\AdwCleaner\Quarantine\C\Windows\SysWOW64\config\systemprofile\AppData\Roaming\defaulttab\defaulttab\DefaultTabSetup.exe.vir"
sh=7F664E4CA2AEDD2CD54ABC2951DD1A174F818A34 ft=1 fh=5397d6de87619a09 vn="a variant of Win32/Toolbar.DefaultTab.B potentially unwanted application" ac=I fn="C:\AdwCleaner\Quarantine\C\Windows\SysWOW64\config\systemprofile\AppData\Roaming\defaulttab\defaulttab\DefaultTabStart.exe.vir"
sh=807BB8FB1B51C7937E7F21886D61BD27EFEB06D8 ft=1 fh=57e5261fee1062cf vn="Win64/Toolbar.DefaultTab.B potentially unwanted application" ac=I fn="C:\AdwCleaner\Quarantine\C\Windows\SysWOW64\config\systemprofile\AppData\Roaming\defaulttab\defaulttab\DefaultTabStart64.exe.vir"
sh=A66441EA33B541895F23B3A4F8EB408B616A94BA ft=1 fh=02e58446c958c5ff vn="Win32/Toolbar.DefaultTab.E potentially unwanted application" ac=I fn="C:\AdwCleaner\Quarantine\C\Windows\SysWOW64\config\systemprofile\AppData\Roaming\defaulttab\defaulttab\DefaultTabUninstaller.exe.vir"
sh=32B7634720114676AD29802481EB87824BD095B6 ft=1 fh=2516e6583af14921 vn="a variant of Win32/Toolbar.DefaultTab.B potentially unwanted application" ac=I fn="C:\AdwCleaner\Quarantine\C\Windows\SysWOW64\config\systemprofile\AppData\Roaming\defaulttab\defaulttab\DefaultTabWrap.dll.vir"
sh=23528D4027F8F3AA10A6E2006D6CDD532750FEDF ft=1 fh=added2cc9fdb45e9 vn="Win64/Toolbar.DefaultTab.B potentially unwanted application" ac=I fn="C:\AdwCleaner\Quarantine\C\Windows\SysWOW64\config\systemprofile\AppData\Roaming\defaulttab\defaulttab\DefaultTabWrap64.dll.vir"
sh=8DED5FC8FF56BDD3FCA1FB2970C5E296BCCF989A ft=1 fh=9067f97ee6fa45c2 vn="Win32/Toolbar.DefaultTab.E potentially unwanted application" ac=I fn="C:\AdwCleaner\Quarantine\C\Windows\SysWOW64\config\systemprofile\AppData\Roaming\defaulttab\defaulttab\uninstalldt.exe.vir"
sh=32EEE1864E49A4FA06A68005D78A42202771D551 ft=1 fh=d4756073afcc2186 vn="a variant of Win32/Toolbar.Perion.H potentially unwanted application" ac=I fn="C:\AdwCleaner\Quarantine\C\Windows\SysWOW64\jmdp\lmrn.dll.vir"
sh=1F4C2E6BCF89CECF7E57FCA218A3ED10A5879828 ft=1 fh=ecb34756e46ac693 vn="a variant of Win32/Toolbar.Perion.H potentially unwanted application" ac=I fn="C:\AdwCleaner\Quarantine\C\Windows\SysWOW64\jmdp\stij.exe.vir"
sh=E5E55F157C1CC8F09FD2FDE4D943CFA502A8E636 ft=0 fh=0000000000000000 vn="Win32/SweetIM.J potentially unwanted application" ac=I fn="C:\AdwCleaner\Quarantine\C\Windows\SysWOW64\jmdp\SweetNT.crx.vir"
sh=CE47F240CC1C5A555FFAE600A5CB9CF1CBC585B0 ft=1 fh=9abcd543df642ed2 vn="Win32/Toolbar.Perion.I potentially unwanted application" ac=I fn="C:\AdwCleaner\Quarantine\C\Windows\SysWOW64\WNLT\Installation\HSChromeRegSetup.exe.vir"
sh=16751F1DC732740BD60703CFCB9818813E31966E ft=1 fh=c0a392e299985a3c vn="Win32/SweetIM.J potentially unwanted application" ac=I fn="C:\AdwCleaner\Quarantine\C\Windows\SysWOW64\WNLT\Installation\NTSetup.exe.vir"
sh=3D4C6F1D551DD7D687FC99B6C12E684C64DA6F07 ft=1 fh=82b6f2f3276cd17c vn="a variant of Win32/Toolbar.Perion.H potentially unwanted application" ac=I fn="C:\AdwCleaner\Quarantine\C\Windows\SysWOW64\WNLT\Installation\SKSetup.exe.vir"
sh=1824CFBB24861E0953082C9DB55CC549F9571FE6 ft=1 fh=5345ab72387b0575 vn="a variant of Win32/Toolbar.Perion.H potentially unwanted application" ac=I fn="C:\AdwCleaner\Quarantine\C\Windows\SysWOW64\WNLT\Installation\WSSetup.exe.vir"
sh=13D4D95B639E1879C40A384A178987A3A159330A ft=1 fh=8580574a11020f17 vn="a variant of Win32/Conduit.SearchProtect.N potentially unwanted application" ac=I fn="C:\FRST\Quarantine\C\Users\Kate\AppData\Roaming\Mozilla\Firefox\Profiles\a9dlfrif.default\Extensions\{7f3f960e-a836-45ca-8911-0accb522246e}\Plugins\npConduitFirefoxPlugin.dll"
sh=C1DE4C06DAA5D20FC15F43FA7A066A033AC349D9 ft=1 fh=dab3b4c93fb94bb8 vn="a variant of Win32/Conduit.SearchProtect.N potentially unwanted application" ac=I fn="C:\FRST\Quarantine\C\Users\Kate\AppData\Roaming\Mozilla\Firefox\Profiles\a9dlfrif.default\Extensions\{ad32743c-16ef-46ec-977b-dce0c3c85b20}\Plugins\npConduitFirefoxPlugin.dll"
sh=C1DE4C06DAA5D20FC15F43FA7A066A033AC349D9 ft=1 fh=dab3b4c93fb94bb8 vn="a variant of Win32/Conduit.SearchProtect.N potentially unwanted application" ac=I fn="C:\FRST\Quarantine\C\Users\Kate\AppData\Roaming\Mozilla\Firefox\Profiles\a9dlfrif.default\Extensions\{e4c3a8b6-7724-45d1-a629-17b69118ebcd}\Plugins\npConduitFirefoxPlugin.dll"
sh=962D0F4206392565C0C2B2DFC7104F3CDC197641 ft=1 fh=1ff89a1bbbec4bf2 vn="a variant of Win32/HiddenStart.A potentially unsafe application" ac=I fn="C:\Program Files (x86)\Dell DataSafe Local Backup\hstart.exe"
sh=6934335239B34885403720699DA5EE97B4CE8A48 ft=1 fh=1c9eac9f7d08a7aa vn="a variant of Win32/HiddenStart.A potentially unsafe application" ac=I fn="C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\hstart.exe"
sh=3921B3425C5C561B5478A3ABBBD49C11775A0882 ft=0 fh=0000000000000000 vn="a variant of Win32/SweetIM.L potentially unwanted application" ac=I fn="C:\Users\Kate\AppData\Local\Google\Chrome\User Data\Default\External Extensions\{EEE6C373-6118-11DC-9C72-001320C79847}\SweetNT.crx"
sh=B6D1E1DADA630856C642C415F8802A3525479D7C ft=1 fh=bf08c5a7fc96b65c vn="a variant of Win32/BundleInstaller.D potentially unwanted application" ac=I fn="C:\Users\Kate\Downloads\api_Downloader (1).exe"
sh=B6D1E1DADA630856C642C415F8802A3525479D7C ft=1 fh=bf08c5a7fc96b65c vn="a variant of Win32/BundleInstaller.D potentially unwanted application" ac=I fn="C:\Users\Kate\Downloads\api_Downloader.exe"
sh=8E5D59287565FD653B41EC28BECF86CE814037C9 ft=1 fh=ad4dd2d4fc824dd5 vn="a variant of Win32/Toolbar.DefaultTab.F potentially unwanted application" ac=I fn="C:\Users\Public\Util\DTChk.exe"

  • 0

#14
very_metal

very_metal

    Member

  • Topic Starter
  • Member
  • PipPip
  • 16 posts
 Results of screen317's Security Check version 0.99.97  
 Windows 7 Service Pack 1 x64 (UAC is enabled)  
 Internet Explorer 11  
``````````````Antivirus/Firewall Check:`````````````` 
 Windows Firewall Enabled!  
 WMI entry may not exist for antivirus; attempting automatic update. 
`````````Anti-malware/Other Utilities Check:````````` 
 JavaFX 2.1.1    
 Java™ 6 Update 22  
 Java 7 Update 21  
 Java version 32-bit out of Date! 
  Java 64-bit 8 Update 31  
 Adobe Flash Player 16.0.0.305  
 Adobe Reader 10.1.10 Adobe Reader out of Date!  
 Mozilla Firefox 19.0.2 Firefox out of Date!  
 Google Chrome (41.0.2272.76) 
 Google Chrome (41.0.2272.89) 
````````Process Check: objlist.exe by Laurent````````  
 windows defender MpCmdRun.exe   
`````````````````System Health check````````````````` 
 Total Fragmentation on Drive C: 7% 
````````````````````End of Log`````````````````````` 

  • 0

#15
very_metal

very_metal

    Member

  • Topic Starter
  • Member
  • PipPip
  • 16 posts

The computer seems to running pretty well. It's not my computer so I unfortunately I don't have much of a first hand baseline to compare it with. Based on the symptoms described to me, it seems to be doing better. I notices about a ~40% increase in usable memory, which was the primary original complaint. In its worst state the computer was using 95-99% of its memory at any given time.


  • 0






Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP