Jump to content

Welcome to Geeks to Go - Register now for FREE

Need help with your computer or device? Want to learn new tech skills? You're in the right place!
Geeks to Go is a friendly community of tech experts who can solve any problem you have. Just create a free account and post your question. Our volunteers will reply quickly and guide you through the steps. Don't let tech troubles stop you. Join Geeks to Go now and get the support you need!

How it Works Create Account
Photo

reopted web forgery in firefox


  • Please log in to reply

#1
maulik10

maulik10

    Member

  • Member
  • PipPip
  • 13 posts

hello , suddenly i got redited to the reported web forgery website in firefox and i have followed steps that was given here so i want to know that my computer is clean or it is still infected i am posting my log files below please reply thanks.

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 18-04-2015 01
Ran by Maulik (administrator) on MAULIK-PC on 18-04-2015 11:52:42
Running from C:\Users\Maulik\Desktop
Loaded Profiles: Maulik (Available profiles: Maulik)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: English (United States)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo...very-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\stacsv64.exe
(Microsoft Corporation) C:\WINDOWS\System32\wlanext.exe
(Microsoft Corporation) C:\WINDOWS\System32\rundll32.exe
(Microsoft Corporation) C:\WINDOWS\SysWOW64\rundll32.exe
(Andrea Electronics Corporation) C:\Program Files\IDT\WDM\AESTSr64.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Broadcom Corporation.) C:\WINDOWS\System32\BtwRSupportService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe
(Cisco Systems, Inc.) C:\Program Files (x86)\Cisco Systems\VPN Client\cvpnd.exe
( ) C:\WINDOWS\System32\lxblcoms.exe
(Dell, Inc.) C:\Program Files (x86)\Dell\Dell Datasafe Online\NOBuAgent.exe
(SoftThinks SAS) C:\Program Files (x86)\Dell DataSafe Local Backup\SftService.exe
(DEVGURU Co., LTD.) C:\Program Files (x86)\Samsung\USB Drivers\25_escape\conn\ss_conn_service.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe
(OpenAFS Project) C:\Program Files\OpenAFS\Client\Program\afsd_service.exe
() C:\Program Files\Reliance Netconnect+\bin\MonServiceUDisk.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.26.9\GoogleCrashHandler.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.26.9\GoogleCrashHandler64.exe
(SoftThinks - Dell) C:\Program Files (x86)\Dell DataSafe Local Backup\Toaster.exe
() C:\Program Files (x86)\Dell DataSafe Local Backup\Components\Scheduler\STService.exe
(SoftThinks - Dell) C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpd.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer.exe
(Intel Corporation) C:\WINDOWS\System32\igfxtray.exe
(Intel Corporation) C:\WINDOWS\System32\hkcmd.exe
(Intel Corporation) C:\WINDOWS\System32\igfxpers.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\Apoint.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe
(Dell Inc.) C:\Program Files\Dell\QuickSet\quickset.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\tv_w32.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\tv_x64.exe
() C:\Program Files (x86)\Dell\Stage Remote\StageRemote.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\ApMsgFwd.exe
(Facebook Inc.) C:\Users\Maulik\AppData\Local\Facebook\Update\FacebookUpdate.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(Microsoft Corporation) C:\WINDOWS\System32\StikyNot.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\ApntEx.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\hidfind.exe
() C:\Users\Maulik\AppData\Roaming\Search Protection\SP.exe
(OpenAFS Project) C:\Program Files\OpenAFS\Client\Program\afscreds.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
() C:\Program Files (x86)\Dell\Stage Remote\StageRemoteService.exe
(Creative Technology Ltd) C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe
(Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe
(Microsoft Corporation) C:\WINDOWS\SysWOW64\rundll32.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTStackServer.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BluetoothHeadsetProxy.exe
(Microsoft Corporation) C:\WINDOWS\System32\dllhost.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [Apoint] => C:\Program Files\DellTPad\Apoint.exe [608112 2011-03-29] (Alps Electric Co., Ltd.)
HKLM\...\Run: [SysTrayApp] => C:\Program Files\IDT\WDM\sttray64.exe [1128448 2011-05-27] (IDT, Inc.)
HKLM\...\Run: [QuickSet] => C:\Program Files\Dell\QuickSet\QuickSet.exe [3668336 2011-03-24] (Dell Inc.)
HKLM\...\Run: [Stage Remote] => C:\Program Files (x86)\Dell\Stage Remote\StageRemote.exe [2022976 2011-06-27] ()
HKLM\...\Run: [DellStage] => C:\Program Files (x86)\Dell Stage\Dell Stage\stage_primary.exe [2195824 2012-02-01] ()
HKLM\...\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [1331288 2014-08-22] (Microsoft Corporation)
HKLM-x32\...\Run: [Dell Webcam Central] => C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe [577024 2012-03-06] (Creative Technology Ltd)
HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe [283160 2011-01-12] (Intel Corporation)
HKLM-x32\...\Run: [Dell Registration] => C:\Program Files (x86)\System Registration\prodreg.exe [4165440 2011-08-04] (Dell, Inc.)
HKLM-x32\...\Run: [Dell DataSafe Online] => C:\Program Files (x86)\Dell\Dell Datasafe Online\NOBuClient.exe [1117528 2010-08-25] (Dell, Inc.)
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] => C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe [40336 2014-12-03] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1021128 2014-11-20] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [AccuWeatherWidget] => C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\accuweather.exe [968048 2012-02-01] ()
HKLM-x32\...\Run: [BCSSync] => C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation)
HKLM-x32\...\Run: [KiesTrayAgent] => C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe [311616 2015-01-14] (Samsung Electronics Co., Ltd.)
HKLM-x32\...\RunOnce: [AvgUninstallURL] => cmd.exe /c start http://www.avg.com/w...KzEtQ0lEMTIxVFQ(the data entry has 78 more characters).
Winlogon\Notify\AfsLogon: C:\Program Files\OpenAFS\Client\Program\afslogon.dll (OpenAFS Project)
Winlogon\Notify\igfxcui: igfxdev.dll [X]
HKU\S-1-5-19\Control Panel\Desktop\\SCRNSAVE.EXE ->
HKU\S-1-5-20\Control Panel\Desktop\\SCRNSAVE.EXE ->
HKU\S-1-5-21-891173389-2658835656-2395992767-1000\...\Run: [Facebook Update] => C:\Users\Maulik\AppData\Local\Facebook\Update\FacebookUpdate.exe [138096 2013-09-25] (Facebook Inc.)
HKU\S-1-5-21-891173389-2658835656-2395992767-1000\...\Run: [Google Update] => C:\Users\Maulik\AppData\Local\Google\Update\GoogleUpdate.exe [116648 2014-02-11] (Google Inc.)
HKU\S-1-5-21-891173389-2658835656-2395992767-1000\...\Run: [GoogleChromeAutoLaunch_12929EB806E3D5CF579B3BC67D2FEB82] => C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [812872 2015-04-13] (Google Inc.)
HKU\S-1-5-21-891173389-2658835656-2395992767-1000\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [31344744 2015-02-26] (Skype Technologies S.A.)
HKU\S-1-5-21-891173389-2658835656-2395992767-1000\...\Run: [RESTART_STICKY_NOTES] => C:\WINDOWS\System32\StikyNot.exe [427520 2009-07-13] (Microsoft Corporation)
HKU\S-1-5-21-891173389-2658835656-2395992767-1000\...\Run: [Search Protection] => C:\Users\Maulik\AppData\Roaming\Search Protection\SP.EXE [913520 2015-04-07] ()
HKU\S-1-5-21-891173389-2658835656-2395992767-1000\...\RunOnce: [Application Restart #5] => C:\Users\Maulik\AppData\Local\Pokki\Engine\pokki.exe  --disable-internal-flash --noerrdialogs --no-message-box --disable-extensions --disable-web-security --disable-web-resources --disable-client-side (the data entry has 542 more characters).
HKU\S-1-5-21-891173389-2658835656-2395992767-1000\...\RunOnce: [Adobe Speed Launcher] => 1429369749
HKU\S-1-5-21-891173389-2658835656-2395992767-1000\...\MountPoints2: E - E:\Autorun.exe /Auto
HKU\S-1-5-21-891173389-2658835656-2395992767-1000\...\MountPoints2: {750af871-c974-11e4-b325-642737f2a352} - E:\Autorun.exe /Auto
HKU\S-1-5-21-891173389-2658835656-2395992767-1000\...\MountPoints2: {750af882-c974-11e4-b325-642737f2a352} - E:\Autorun.exe /Auto
HKU\S-1-5-21-891173389-2658835656-2395992767-1000\Control Panel\Desktop\\SCRNSAVE.EXE ->
HKU\S-1-5-18\Control Panel\Desktop\\SCRNSAVE.EXE ->
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\AFS Credentials.lnk
ShortcutTarget: AFS Credentials.lnk -> C:\Program Files\OpenAFS\Client\Program\afscreds.exe (OpenAFS Project)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk
ShortcutTarget: Bluetooth.lnk -> C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\vpngui.exe.lnk
ShortcutTarget: vpngui.exe.lnk -> C:\WINDOWS\Installer\{467D5E81-8349-4892-9E81-C3674ED8E451}\Icon09DB8A851.exe ()
Startup: C:\Users\Maulik\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Clash of Clans.lnk
ShortcutTarget: Clash of Clans.lnk -> C:\ProgramData\{416eca45-de47-9077-416e-eca45de42917}\Clash of Clans.exe ()
ShellIconOverlayIdentifiers: [AFS Mount Point Overlay] -> {5F820CA1-3DDE-11DB-B2CE-001558092DB5} => C:\Program Files\OpenAFS\Client\Program\afs_shl_ext.dll (OpenAFS Project)
ShellIconOverlayIdentifiers: [AFS Symlink Overlay] -> {5F820CA1-3DDE-11DB-B2CE-001558092DB6} => C:\Program Files\OpenAFS\Client\Program\afs_shl_ext.dll (OpenAFS Project)
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://start.mysearc...r=860089911&ir=
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = http://websearch.goo...&cc=US&unqvl=86
HKU\S-1-5-21-891173389-2658835656-2395992767-1000\Software\Microsoft\Internet Explorer\Main,Start Page = http://websearch.goo...&cc=US&unqvl=86
HKU\S-1-5-21-891173389-2658835656-2395992767-1000\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.com/ie
HKU\S-1-5-21-891173389-2658835656-2395992767-1000\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com/ie
SearchScopes: HKLM -> {2F1E335A-858A-4BE9-8F6B-D0AF1D018B53} URL = http://www.bing.com/...rc=IE-SearchBox
SearchScopes: HKLM -> {77AA745B-F4F8-45DA-9B14-61D2D95054C8} URL =
SearchScopes: HKLM-x32 -> DefaultScope {BB82DE59-BC4C-4172-9AC4-73315F71CFFE} URL = http://websearch.goo...&cc=US&unqvl=86
SearchScopes: HKLM-x32 -> {2F1E335A-858A-4BE9-8F6B-D0AF1D018B53} URL = http://www.bing.com/...rc=IE-SearchBox
SearchScopes: HKLM-x32 -> {BB82DE59-BC4C-4172-9AC4-73315F71CFFE} URL = http://websearch.goo...&cc=US&unqvl=86
SearchScopes: HKU\S-1-5-21-891173389-2658835656-2395992767-1000 -> DefaultScope {8552A5F7-68D6-4B7E-B34A-0708F8C7F986} URL = https://search.yahoo...p={searchTerms}
SearchScopes: HKU\S-1-5-21-891173389-2658835656-2395992767-1000 -> D0C77116AB7449E8A4D947C02915D5CE URL = http://start.mysearc...r=860089911&ir=
SearchScopes: HKU\S-1-5-21-891173389-2658835656-2395992767-1000 -> {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL =
SearchScopes: HKU\S-1-5-21-891173389-2658835656-2395992767-1000 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-891173389-2658835656-2395992767-1000 -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = http://www.google.com/search?q={sear
SearchScopes: HKU\S-1-5-21-891173389-2658835656-2395992767-1000 -> {77AA745B-F4F8-45DA-9B14-61D2D95054C8} URL = http://search.condui...5773792673&UM=2
SearchScopes: HKU\S-1-5-21-891173389-2658835656-2395992767-1000 -> {8552A5F7-68D6-4B7E-B34A-0708F8C7F986} URL = https://search.yahoo...p={searchTerms}
SearchScopes: HKU\S-1-5-21-891173389-2658835656-2395992767-1000 -> {A9023071-08B6-45F7-B480-5411E54BDDB2} URL = http://www.bing.com/...rc=IE-SearchBox
SearchScopes: HKU\S-1-5-21-891173389-2658835656-2395992767-1000 -> {BB82DE59-BC4C-4172-9AC4-73315F71CFFE} URL = http://websearch.goo...&cc=US&unqvl=86
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL [2013-12-19] (Microsoft Corporation)
BHO: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll No File
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2010-09-21] (Microsoft Corp.)
BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2014-07-14] (Microsoft Corporation)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
BHO: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll No File
BHO-x32: No Name -> {26B19FA4-E8A1-4A1B-A163-1A1E46F830DD} ->  No File
BHO-x32: SaveSense -> {71e129ff-6c2a-4984-818c-7e2c998b8d99} -> C:\Users\Maulik\AppData\Local\SaveSense\SaveSenseIE.dll [2014-01-07] (SaveSense)
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL [2013-12-19] (Microsoft Corporation)
BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2010-09-21] (Microsoft Corp.)
BHO-x32: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2014-07-14] (Microsoft Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll [2014-05-02] (Skype Technologies)
Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2014-07-14] (Microsoft Corporation)
Handler-x32: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2014-07-14] (Microsoft Corporation)
Filter: application/octet-stream - {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - mscoree.dll No File
Filter: application/x-complus - {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - mscoree.dll No File
Filter: application/x-msdownload - {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - mscoree.dll No File
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

FireFox:
========
FF ProfilePath: C:\Users\Maulik\AppData\Roaming\Mozilla\Firefox\Profiles\6u0wperb.default
FF DefaultSearchEngine: Yahoo!
FF DefaultSearchEngine,S: WebSearch
FF DefaultSearchEngine.US: Yahoo!
FF DefaultSearchUrl: hxxp://websearch.goodforsearch.info/?pid=24380&r=2015/04/14&hid=8004382613692767312&lg=EN&cc=US&unqvl=86&l=1&q=
FF SearchEngineOrder.1: WebSearch
FF SearchEngineOrder.1,S: WebSearch
FF SelectedSearchEngine: Yahoo!
FF SelectedSearchEngine,S: WebSearch
FF Homepage: https://www.google.com/
FF Keyword.URL: https://search.yahoo...&type=667671&p=
FF Plugin: @adobe.com/FlashPlayer -> C:\windows\system32\Macromed\Flash\NPSWF64_17_0_0_169.dll [2015-04-15] ()
FF Plugin: @java.com/DTPlugin,version=10.51.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll No File
FF Plugin: @java.com/JavaPlugin,version=10.51.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll No File
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.31010.0\npctrl.dll [2014-10-10] ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\windows\SysWOW64\Macromed\Flash\NPSWF32_17_0_0_169.dll [2015-04-15] ()
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.31010.0\npctrl.dll [2014-10-10] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2010-11-10] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2010-11-10] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-05] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-05] (Google Inc.)
FF Plugin-x32: @tools.updaterss.com/SaveSenseLive Update;version=3 -> C:\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\npGoogleUpdate3.dll [2014-01-26] (SaveSense)
FF Plugin-x32: @tools.updaterss.com/SaveSenseLive Update;version=9 -> C:\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\npGoogleUpdate3.dll [2014-01-26] (SaveSense)
FF Plugin-x32: @videolan.org/vlc,version=2.1.0 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2014-02-04] (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.2 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2014-02-04] (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.3 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2014-02-04] (VideoLAN)
FF Plugin-x32: @wolfram.com/Mathematica -> C:\Program Files (x86)\Common Files\Wolfram Research\Browser\10.0.0.5099479\npmathplugin.dll [2014-07-01] (Wolfram Research, Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll [2014-12-03] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-891173389-2658835656-2395992767-1000: @Skype Limited.com/Facebook Video Calling Plugin -> C:\Users\Maulik\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll [2014-07-24] (Skype Limited)
FF Plugin HKU\S-1-5-21-891173389-2658835656-2395992767-1000: @talk.google.com/GoogleTalkPlugin -> C:\Users\Maulik\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll [2015-03-26] (Google)
FF Plugin HKU\S-1-5-21-891173389-2658835656-2395992767-1000: @talk.google.com/O1DPlugin -> C:\Users\Maulik\AppData\Roaming\Mozilla\plugins\npo1d.dll [2015-03-26] (Google)
FF Plugin HKU\S-1-5-21-891173389-2658835656-2395992767-1000: @tools.google.com/Google Update;version=3 -> C:\Users\Maulik\AppData\Local\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-04] (Google Inc.)
FF Plugin HKU\S-1-5-21-891173389-2658835656-2395992767-1000: @tools.google.com/Google Update;version=9 -> C:\Users\Maulik\AppData\Local\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-04] (Google Inc.)
FF Plugin HKU\S-1-5-21-891173389-2658835656-2395992767-1000: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\Maulik\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll [2014-07-07] (Unity Technologies ApS)
FF Plugin HKU\S-1-5-21-891173389-2658835656-2395992767-1000: pokki.com/PokkiDownloadHelper -> C:\Users\Maulik\AppData\Local\Pokki\Download Helper\npPokkiDownloadHelper.1.2.0.78.dll [2014-07-21] (Pokki)
FF user.js: detected! => C:\Users\Maulik\AppData\Roaming\Mozilla\Firefox\Profiles\6u0wperb.default\user.js [2014-01-30]
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\np-mswmp.dll [2007-04-10] (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll [2014-12-03] (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Users\Maulik\AppData\Roaming\mozilla\plugins\npatgpc.dll [2015-01-27] (Cisco WebEx LLC)
FF Plugin ProgramFiles/Appdata: C:\Users\Maulik\AppData\Roaming\mozilla\plugins\npgoogletalk.dll [2015-03-26] (Google)
FF Plugin ProgramFiles/Appdata: C:\Users\Maulik\AppData\Roaming\mozilla\plugins\npo1d.dll [2015-03-26] (Google)
FF SearchPlugin: C:\Users\Maulik\AppData\Roaming\Mozilla\Firefox\Profiles\6u0wperb.default\searchplugins\ask-web-search.xml [2014-07-29]
FF SearchPlugin: C:\Users\Maulik\AppData\Roaming\Mozilla\Firefox\Profiles\6u0wperb.default\searchplugins\conduit-search.xml [2014-01-26]
FF SearchPlugin: C:\Users\Maulik\AppData\Roaming\Mozilla\Firefox\Profiles\6u0wperb.default\searchplugins\conduit.xml [2013-10-10]
FF SearchPlugin: C:\Users\Maulik\AppData\Roaming\Mozilla\Firefox\Profiles\6u0wperb.default\searchplugins\Mysearchdial.xml [2014-01-26]
FF SearchPlugin: C:\Users\Maulik\AppData\Roaming\Mozilla\Firefox\Profiles\6u0wperb.default\searchplugins\WebSearch.xml [2015-04-14]
FF SearchPlugin: C:\Users\Maulik\AppData\Roaming\Mozilla\Firefox\Profiles\6u0wperb.default\searchplugins\yahoo_ff.xml [2015-04-14]
FF SearchPlugin: C:\Users\Maulik\AppData\Roaming\Mozilla\Firefox\Profiles\6u0wperb.default\searchplugins\youtube-video-search.xml [2015-03-29]
FF Extension: bestadblocker - C:\Users\Maulik\AppData\Roaming\Mozilla\Firefox\Profiles\6u0wperb.default\Extensions\[email protected] [2015-04-14]
FF Extension: youtubeadblocker - C:\Users\Maulik\AppData\Roaming\Mozilla\Firefox\Profiles\6u0wperb.default\Extensions\[email protected] [2015-02-17]
FF Extension: Print pages to PDF - C:\Users\Maulik\AppData\Roaming\Mozilla\Firefox\Profiles\6u0wperb.default\Extensions\[email protected] [2014-11-10]
FF Extension: Stylish - C:\Users\Maulik\AppData\Roaming\Mozilla\Firefox\Profiles\6u0wperb.default\Extensions\{46551EC9-40F0-4e47-8E18-8E5CF550CFB8}.xpi [2014-10-16]
FF Extension: Adblock Plus - C:\Users\Maulik\AppData\Roaming\Mozilla\Firefox\Profiles\6u0wperb.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2013-09-26]
FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi [2015-04-03]
FF HKLM-x32\...\Firefox\Extensions: [[email protected]] - C:\Program Files (x86)\Mozilla Firefox\extensions\[email protected]

Chrome:
=======
CHR dev: Chrome dev build detected! <======= ATTENTION
CHR StartupUrls: Default -> "hxxp://websearch.look-for-it.info/?pid=20494&r=2015/02/17&hid=8004382613692767312&lg=EN&cc=US&unqvl=82"
CHR DefaultSearchKeyword: Default -> yahoo.com search
CHR DefaultSearchURL: Default -> https://search.yahoo...p={searchTerms}
CHR DefaultSuggestURL: Default -> https://ff.search.ya...d={searchTerms}
CHR Profile: C:\Users\Maulik\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Adblock Plus) - C:\Users\Maulik\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2014-09-10]
CHR Extension: (MediaPlus) - C:\Users\Maulik\AppData\Local\Google\Chrome\User Data\Default\Extensions\emaamodndfmmmcjepfigalbjjjemadom [2015-02-17]
CHR Extension: (Topface 2 ) - C:\Users\Maulik\AppData\Local\Google\Chrome\User Data\Default\Extensions\hppaelnlbojhnjbjcdoaddedbnbaiocf [2015-02-17]
CHR Extension: (Facebook Invite Them All) - C:\Users\Maulik\AppData\Local\Google\Chrome\User Data\Default\Extensions\jladghljinmlokelojmdmblikkifabea [2015-04-14]
CHR Extension: (Chrome Hotword Shared Module) - C:\Users\Maulik\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-03-23]
CHR Extension: (Skype Click to Call) - C:\Users\Maulik\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl [2015-01-26]
CHR Extension: (Google Wallet) - C:\Users\Maulik\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-21]
CHR HKLM\...\Chrome\Extension: [pflphaooapbgpeakohlggbpidpppgdff] - C:\Users\Maulik\AppData\Local\mysearchdial-speeddial.crx [2014-01-26]
CHR HKU\S-1-5-21-891173389-2658835656-2395992767-1000\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [gpkdnelacfdbmlcelmaiabghmhaoceef] - C:\Users\Maulik\AppData\Local\CRE\gpkdnelacfdbmlcelmaiabghmhaoceef.crx [2013-10-10]
CHR HKU\S-1-5-21-891173389-2658835656-2395992767-1000\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [pflphaooapbgpeakohlggbpidpppgdff] - C:\Users\Maulik\AppData\Local\mysearchdial-speeddial.crx [2014-01-26]
CHR HKLM-x32\...\Chrome\Extension: [gpkdnelacfdbmlcelmaiabghmhaoceef] - C:\Users\Maulik\AppData\Local\CRE\gpkdnelacfdbmlcelmaiabghmhaoceef.crx [2013-10-10]
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\ChromeExtension\skype_chrome_extension.crx [2014-07-14]
CHR HKLM-x32\...\Chrome\Extension: [pflphaooapbgpeakohlggbpidpppgdff] - C:\Users\Maulik\AppData\Local\mysearchdial-speeddial.crx [2014-01-26]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 869b9e4a; c:\Program Files (x86)\keepsbrowse\keepsbrowse.dll [1605632 2015-04-14] () [File not signed]
R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [77128 2015-01-19] (Apple Inc.)
R2 BcmBtRSupport; C:\Windows\system32\BtwRSupportService.exe [2253016 2013-10-02] (Broadcom Corporation.)
R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1390176 2014-07-14] (Microsoft Corporation)
R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1767520 2014-07-14] (Microsoft Corporation)
R2 lxbl_device; C:\windows\system32\lxblcoms.exe [566704 2007-04-20] ( )
R2 lxbl_device; C:\windows\SysWOW64\lxblcoms.exe [537520 2007-04-20] ( )
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [23784 2014-08-22] (Microsoft Corporation)
R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [368624 2014-08-22] (Microsoft Corporation)
S3 rpcapd; C:\Program Files (x86)\WinPcap\rpcapd.exe [118520 2013-02-28] (Riverbed Technology, Inc.)
S2 savesenselive; C:\Program Files (x86)\SaveSenseLive\Update\SaveSenseLive.exe [146920 2014-01-26] (SaveSense)
S3 savesenselivem; C:\Program Files (x86)\SaveSenseLive\Update\SaveSenseLive.exe [146920 2014-01-26] (SaveSense)
R2 ss_conn_service; C:\Program Files (x86)\Samsung\USB Drivers\25_escape\conn\ss_conn_service.exe [743688 2014-10-13] (DEVGURU Co., LTD.)
R2 TransarcAFSDaemon; C:\Program Files\OpenAFS\Client\Program\afsd_service.exe [1011608 2014-05-13] (OpenAFS Project)
R2 UDisk Monitor; C:\Program Files\Reliance Netconnect+\bin\MonServiceUDisk.exe [406528 2013-09-05] () [File not signed]
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
S3 WinHttpAutoProxySvc; winhttp.dll [X]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R3 AFSLibrary; C:\Windows\System32\DRIVERS\AFSRedirLib.sys [338288 2014-05-13] (OpenAFS Project)
R1 AFSRedirector; C:\Windows\System32\DRIVERS\AFSRedir.sys [102768 2014-05-13] (OpenAFS Project)
R3 bcbtums; C:\Windows\System32\drivers\bcbtums.sys [170712 2013-08-09] (Broadcom Corporation.)
R3 CVPNDRVA; C:\windows\system32\Drivers\CVPNDRVA.sys [304784 2010-03-23] ()
S3 Generalusbserialser20679; C:\Windows\System32\DRIVERS\CT_U_USBSER.sys [124160 2013-09-05] (Incorporated)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [269008 2014-07-17] (Microsoft Corporation)
R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [125584 2014-07-17] (Microsoft Corporation)
R2 NPF; C:\Windows\System32\drivers\npf.sys [36600 2013-02-28] (Riverbed Technology, Inc.)
S1 hlnfd; system32\drivers\hlnfd.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-04-18 11:52 - 2015-04-18 11:53 - 00031714 _____ () C:\Users\Maulik\Desktop\FRST.txt
2015-04-18 11:52 - 2015-04-18 11:52 - 02098176 _____ (Farbar) C:\Users\Maulik\Desktop\FRST64.exe
2015-04-18 11:52 - 2015-04-18 11:52 - 00000000 ____D () C:\FRST
2015-04-18 11:50 - 2015-04-18 11:50 - 01115136 _____ (Farbar) C:\Users\Maulik\Desktop\Farbar-Recovery-Scan-Tool_6.1.exe
2015-04-15 23:03 - 2015-04-15 23:03 - 18178736 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerInstaller.exe
2015-04-14 18:55 - 2015-04-14 18:55 - 00000000 ____D () C:\Program Files (x86)\keepsbrowse
2015-04-14 18:53 - 2015-04-14 18:53 - 00000000 ____D () C:\ProgramData\10254911128936596356
2015-04-14 18:53 - 2015-04-14 18:53 - 00000000 ____D () C:\Program Files (x86)\SallePlus
2015-04-14 18:53 - 2015-04-14 18:53 - 00000000 ____D () C:\Program Files (x86)\SalePlus
2015-04-14 18:53 - 2015-04-14 18:53 - 00000000 ____D () C:\Program Files (x86)\Facebook Invite Them All
2015-04-14 18:53 - 2015-04-14 18:53 - 00000000 ____D () C:\Program Files (x86)\bestadblocker
2015-04-14 18:52 - 2015-04-14 18:52 - 00000000 ____D () C:\ProgramData\hllhchdknemmjoahhcemlmgemmpabejo
2015-04-14 18:50 - 2015-04-18 11:08 - 00000000 ____D () C:\ProgramData\{416eca45-de47-9077-416e-eca45de42917}
2015-04-14 03:20 - 2015-04-14 03:20 - 00364179 _____ () C:\Users\Maulik\Documents\a thought of life.wma
2015-04-12 00:09 - 2015-04-12 00:09 - 17385800 _____ (Google Inc.) C:\Users\Maulik\Downloads\picasa39-setup.exe
2015-04-11 08:32 - 2015-04-14 12:03 - 02009674 _____ () C:\Users\Maulik\Documents\CH 15 the chemical revolution.pptx
2015-04-08 18:03 - 2015-04-08 18:03 - 00300975 _____ () C:\Users\Maulik\Downloads\IS 350 Debate.pptx
2015-04-07 16:52 - 2015-04-07 16:52 - 00046248 _____ () C:\Users\Maulik\Downloads\Java_Socke183657142005.zip
2015-04-07 16:23 - 2015-04-07 16:23 - 00935657 _____ () C:\Users\Maulik\Downloads\C2J.exe
2015-04-07 16:22 - 2015-04-07 16:22 - 00232216 _____ () C:\Users\Maulik\Downloads\C2J-33860593.exe
2015-04-03 21:31 - 2015-04-03 21:31 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-04-01 22:49 - 2015-01-14 01:47 - 00389808 _____ (Microsoft Corporation) C:\windows\system32\iedkcs32.dll
2015-04-01 22:49 - 2015-01-14 01:09 - 00342712 _____ (Microsoft Corporation) C:\windows\SysWOW64\iedkcs32.dll
2015-04-01 22:49 - 2015-01-11 23:05 - 02724864 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb
2015-04-01 22:49 - 2015-01-11 23:05 - 00004096 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollectorres.dll
2015-04-01 22:49 - 2015-01-11 22:49 - 00066560 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll
2015-04-01 22:49 - 2015-01-11 22:48 - 02885632 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll
2015-04-01 22:49 - 2015-01-11 22:48 - 00048640 _____ (Microsoft Corporation) C:\windows\system32\ieetwproxystub.dll
2015-04-01 22:49 - 2015-01-11 22:40 - 00054784 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll
2015-04-01 22:49 - 2015-01-11 22:39 - 00034304 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll
2015-04-01 22:49 - 2015-01-11 22:34 - 00144384 _____ (Microsoft Corporation) C:\windows\system32\ieUnatt.exe
2015-04-01 22:49 - 2015-01-11 22:34 - 00114688 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollector.exe
2015-04-01 22:49 - 2015-01-11 22:25 - 19740160 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll
2015-04-01 22:49 - 2015-01-11 22:25 - 00968704 _____ (Microsoft Corporation) C:\windows\system32\MsSpellCheckingFacility.exe
2015-04-01 22:49 - 2015-01-11 22:21 - 02724864 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.tlb
2015-04-01 22:49 - 2015-01-11 22:21 - 00490496 _____ (Microsoft Corporation) C:\windows\system32\dxtmsft.dll
2015-04-01 22:49 - 2015-01-11 22:13 - 00077824 _____ (Microsoft Corporation) C:\windows\system32\JavaScriptCollectionAgent.dll
2015-04-01 22:49 - 2015-01-11 22:08 - 00503296 _____ (Microsoft Corporation) C:\windows\SysWOW64\vbscript.dll
2015-04-01 22:49 - 2015-01-11 22:07 - 00062464 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesetup.dll
2015-04-01 22:49 - 2015-01-11 22:07 - 00047616 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieetwproxystub.dll
2015-04-01 22:49 - 2015-01-11 22:05 - 00064000 _____ (Microsoft Corporation) C:\windows\SysWOW64\MshtmlDac.dll
2015-04-01 22:49 - 2015-01-11 22:04 - 00316928 _____ (Microsoft Corporation) C:\windows\system32\dxtrans.dll
2015-04-01 22:49 - 2015-01-11 22:02 - 02277888 _____ (Microsoft Corporation) C:\windows\SysWOW64\iertutil.dll
2015-04-01 22:49 - 2015-01-11 22:00 - 00047104 _____ (Microsoft Corporation) C:\windows\SysWOW64\jsproxy.dll
2015-04-01 22:49 - 2015-01-11 21:59 - 00030720 _____ (Microsoft Corporation) C:\windows\SysWOW64\iernonce.dll
2015-04-01 22:49 - 2015-01-11 21:57 - 00478208 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieui.dll
2015-04-01 22:49 - 2015-01-11 21:55 - 00620032 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9diag.dll
2015-04-01 22:49 - 2015-01-11 21:55 - 00115712 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieUnatt.exe
2015-04-01 22:49 - 2015-01-11 21:48 - 00801280 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll
2015-04-01 22:49 - 2015-01-11 21:48 - 00718848 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe
2015-04-01 22:49 - 2015-01-11 21:46 - 02125824 _____ (Microsoft Corporation) C:\windows\system32\inetcpl.cpl
2015-04-01 22:49 - 2015-01-11 21:45 - 00418304 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtmsft.dll
2015-04-01 22:49 - 2015-01-11 21:40 - 00060416 _____ (Microsoft Corporation) C:\windows\SysWOW64\JavaScriptCollectionAgent.dll
2015-04-01 22:49 - 2015-01-11 21:36 - 00168960 _____ (Microsoft Corporation) C:\windows\SysWOW64\msrating.dll
2015-04-01 22:49 - 2015-01-11 21:35 - 00076288 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmled.dll
2015-04-01 22:49 - 2015-01-11 21:33 - 00285696 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtrans.dll
2015-04-01 22:49 - 2015-01-11 21:29 - 04300800 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll
2015-04-01 22:49 - 2015-01-11 21:23 - 02052608 _____ (Microsoft Corporation) C:\windows\SysWOW64\inetcpl.cpl
2015-04-01 22:49 - 2015-01-11 21:23 - 00688640 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll
2015-04-01 22:49 - 2015-01-11 21:22 - 01155072 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmlmedia.dll
2015-04-01 22:49 - 2015-01-11 21:14 - 12829184 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll
2015-04-01 22:49 - 2015-01-11 21:14 - 01548288 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll
2015-04-01 22:49 - 2015-01-11 21:02 - 00800768 _____ (Microsoft Corporation) C:\windows\system32\ieapfltr.dll
2015-04-01 22:49 - 2015-01-11 21:00 - 01888256 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll
2015-04-01 22:49 - 2015-01-11 20:56 - 01307136 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll
2015-04-01 22:49 - 2015-01-11 20:55 - 00710144 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieapfltr.dll
2015-04-01 22:49 - 2015-01-10 02:51 - 00155064 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ksecpkg.sys
2015-04-01 22:49 - 2015-01-10 02:51 - 00095672 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ksecdd.sys
2015-04-01 22:49 - 2015-01-10 02:48 - 01461760 _____ (Microsoft Corporation) C:\windows\system32\lsasrv.dll
2015-04-01 22:49 - 2015-01-10 02:48 - 00728064 _____ (Microsoft Corporation) C:\windows\system32\kerberos.dll
2015-04-01 22:49 - 2015-01-10 02:48 - 00341504 _____ (Microsoft Corporation) C:\windows\system32\schannel.dll
2015-04-01 22:49 - 2015-01-10 02:48 - 00314880 _____ (Microsoft Corporation) C:\windows\system32\msv1_0.dll
2015-04-01 22:49 - 2015-01-10 02:48 - 00309760 _____ (Microsoft Corporation) C:\windows\system32\ncrypt.dll
2015-04-01 22:49 - 2015-01-10 02:48 - 00210944 _____ (Microsoft Corporation) C:\windows\system32\wdigest.dll
2015-04-01 22:49 - 2015-01-10 02:48 - 00136192 _____ (Microsoft Corporation) C:\windows\system32\sspicli.dll
2015-04-01 22:49 - 2015-01-10 02:48 - 00086528 _____ (Microsoft Corporation) C:\windows\system32\TSpkg.dll
2015-04-01 22:49 - 2015-01-10 02:48 - 00029184 _____ (Microsoft Corporation) C:\windows\system32\sspisrv.dll
2015-04-01 22:49 - 2015-01-10 02:48 - 00028160 _____ (Microsoft Corporation) C:\windows\system32\secur32.dll
2015-04-01 22:49 - 2015-01-10 02:48 - 00022016 _____ (Microsoft Corporation) C:\windows\system32\credssp.dll
2015-04-01 22:49 - 2015-01-10 02:47 - 00064000 _____ (Microsoft Corporation) C:\windows\system32\auditpol.exe
2015-04-01 22:49 - 2015-01-10 02:47 - 00031232 _____ (Microsoft Corporation) C:\windows\system32\lsass.exe
2015-04-01 22:49 - 2015-01-10 02:44 - 00146432 _____ (Microsoft Corporation) C:\windows\system32\msaudite.dll
2015-04-01 22:49 - 2015-01-10 02:44 - 00060416 _____ (Microsoft Corporation) C:\windows\system32\msobjs.dll
2015-04-01 22:49 - 2015-01-10 02:42 - 00686080 _____ (Microsoft Corporation) C:\windows\system32\adtschema.dll
2015-04-01 22:49 - 2015-01-10 02:27 - 00550912 _____ (Microsoft Corporation) C:\windows\SysWOW64\kerberos.dll
2015-04-01 22:49 - 2015-01-10 02:27 - 00259584 _____ (Microsoft Corporation) C:\windows\SysWOW64\msv1_0.dll
2015-04-01 22:49 - 2015-01-10 02:27 - 00248832 _____ (Microsoft Corporation) C:\windows\SysWOW64\schannel.dll
2015-04-01 22:49 - 2015-01-10 02:27 - 00221184 _____ (Microsoft Corporation) C:\windows\SysWOW64\ncrypt.dll
2015-04-01 22:49 - 2015-01-10 02:27 - 00172032 _____ (Microsoft Corporation) C:\windows\SysWOW64\wdigest.dll
2015-04-01 22:49 - 2015-01-10 02:27 - 00065536 _____ (Microsoft Corporation) C:\windows\SysWOW64\TSpkg.dll
2015-04-01 22:49 - 2015-01-10 02:27 - 00022016 _____ (Microsoft Corporation) C:\windows\SysWOW64\secur32.dll
2015-04-01 22:49 - 2015-01-10 02:27 - 00017408 _____ (Microsoft Corporation) C:\windows\SysWOW64\credssp.dll
2015-04-01 22:49 - 2015-01-10 02:26 - 00096768 _____ (Microsoft Corporation) C:\windows\SysWOW64\sspicli.dll
2015-04-01 22:49 - 2015-01-10 02:26 - 00050176 _____ (Microsoft Corporation) C:\windows\SysWOW64\auditpol.exe
2015-04-01 22:49 - 2015-01-10 02:24 - 00146432 _____ (Microsoft Corporation) C:\windows\SysWOW64\msaudite.dll
2015-04-01 22:49 - 2015-01-10 02:24 - 00060416 _____ (Microsoft Corporation) C:\windows\SysWOW64\msobjs.dll
2015-04-01 22:49 - 2015-01-10 02:23 - 00686080 _____ (Microsoft Corporation) C:\windows\SysWOW64\adtschema.dll
2015-04-01 22:49 - 2014-12-29 21:23 - 00459336 _____ (Microsoft Corporation) C:\windows\system32\Drivers\cng.sys
2015-04-01 22:48 - 2015-01-11 23:09 - 25056256 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll
2015-04-01 22:48 - 2015-01-11 22:48 - 00584192 _____ (Microsoft Corporation) C:\windows\system32\vbscript.dll
2015-04-01 22:48 - 2015-01-11 22:47 - 00088064 _____ (Microsoft Corporation) C:\windows\system32\MshtmlDac.dll
2015-04-01 22:48 - 2015-01-11 22:36 - 00633856 _____ (Microsoft Corporation) C:\windows\system32\ieui.dll
2015-04-01 22:48 - 2015-01-11 22:33 - 00814080 _____ (Microsoft Corporation) C:\windows\system32\jscript9diag.dll
2015-04-01 22:48 - 2015-01-11 22:32 - 06041088 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll
2015-04-01 22:48 - 2015-01-11 22:08 - 00199680 _____ (Microsoft Corporation) C:\windows\system32\msrating.dll
2015-04-01 22:48 - 2015-01-11 22:07 - 00092160 _____ (Microsoft Corporation) C:\windows\system32\mshtmled.dll
2015-04-01 22:48 - 2015-01-11 21:46 - 01359360 _____ (Microsoft Corporation) C:\windows\system32\mshtmlmedia.dll
2015-04-01 22:48 - 2015-01-11 21:43 - 14401024 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll
2015-04-01 22:48 - 2015-01-11 21:27 - 02358272 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll
2015-04-01 00:34 - 2015-04-01 00:34 - 00460800 _____ () C:\Users\Maulik\Downloads\[ZZSeries] Alektra Blue, Ava Addams, Dani Daniels, Gianna Nicole, Kayla Kayden, Kaylani Lei, Missy Martinez, Nikki Benz, Phoenix Marie, Romi Rain, Tory Lane (Brazzers House Episode Two _ 03.27.2015).exe
2015-03-31 21:34 - 2015-03-31 23:04 - 00000564 _____ () C:\windows\Tasks\PCDoctorBackgroundMonitorTask-Delay.job
2015-03-31 21:34 - 2015-03-31 21:34 - 00003402 _____ () C:\windows\System32\Tasks\PCDoctorBackgroundMonitorTask-Delay
2015-03-31 12:03 - 2015-03-31 12:03 - 00000000 ____D () C:\Users\Maulik\AppData\Roaming\Mathematica
2015-03-31 12:03 - 2015-03-31 12:03 - 00000000 ____D () C:\Users\Maulik\AppData\Local\Wolfram Research
2015-03-31 12:03 - 2015-03-31 12:03 - 00000000 ____D () C:\Users\Maulik\AppData\Local\Mathematica
2015-03-31 12:02 - 2015-03-31 12:03 - 00000000 ____D () C:\ProgramData\Mathematica
2015-03-31 12:02 - 2015-03-31 12:02 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Wolfram Mathematica
2015-03-31 12:02 - 2015-03-31 12:02 - 00000000 ____D () C:\Program Files\Extras
2015-03-31 12:02 - 2015-03-31 12:02 - 00000000 ____D () C:\Program Files\Common Files\Wolfram Research
2015-03-31 11:07 - 2015-03-31 11:07 - 00000000 ____D () C:\Program Files\Wolfram Research
2015-03-29 16:31 - 2015-03-29 16:31 - 00002519 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Apple Software Update.lnk
2015-03-29 16:31 - 2015-03-29 16:31 - 00000000 ____D () C:\windows\System32\Tasks\Apple
2015-03-29 16:31 - 2015-03-29 16:31 - 00000000 ____D () C:\Users\Maulik\AppData\Local\Apple
2015-03-29 16:31 - 2015-03-29 16:31 - 00000000 ____D () C:\Program Files\Bonjour
2015-03-29 16:31 - 2015-03-29 16:31 - 00000000 ____D () C:\Program Files (x86)\Bonjour
2015-03-29 16:31 - 2015-03-29 16:31 - 00000000 ____D () C:\Program Files (x86)\Apple Software Update
2015-03-29 16:30 - 2015-03-29 16:31 - 00000000 ____D () C:\ProgramData\Apple
2015-03-29 16:30 - 2015-03-29 16:31 - 00000000 ____D () C:\Program Files\Common Files\Apple
2015-03-26 11:26 - 2015-03-26 11:29 - 00001584 _____ () C:\Users\Maulik\Downloads\Midterm 2 Solutions.py
2015-03-26 11:24 - 2015-03-26 11:29 - 00001914 _____ () C:\Users\Maulik\Downloads\PMT2.py
2015-03-24 11:17 - 2015-03-24 11:17 - 00000000 ____D () C:\Users\Maulik\Tracing

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-04-18 11:40 - 2014-02-11 21:54 - 00000912 _____ () C:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-891173389-2658835656-2395992767-1000UA.job
2015-04-18 11:25 - 2014-01-26 22:20 - 00000932 _____ () C:\windows\Tasks\SaveSenseLiveUpdateTaskMachineUA.job
2015-04-18 11:25 - 2012-07-25 20:07 - 01693053 _____ () C:\windows\WindowsUpdate.log
2015-04-18 11:15 - 2009-07-14 00:45 - 00028576 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-04-18 11:15 - 2009-07-14 00:45 - 00028576 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-04-18 11:11 - 2009-07-14 01:13 - 00782470 _____ () C:\windows\system32\PerfStringBackup.INI
2015-04-18 11:07 - 2014-01-26 22:20 - 00000928 _____ () C:\windows\Tasks\SaveSenseLiveUpdateTaskMachineCore.job
2015-04-18 11:07 - 2013-09-21 02:27 - 00000894 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-04-18 11:07 - 2012-07-25 20:52 - 00000000 ____D () C:\Users\Default\AppData\Local\SoftThinks
2015-04-18 11:07 - 2012-07-25 20:52 - 00000000 ____D () C:\Users\Default User\AppData\Local\SoftThinks
2015-04-18 11:07 - 2012-07-25 20:41 - 00000000 ____D () C:\Program Files (x86)\Dell DataSafe Local Backup
2015-04-18 11:06 - 2014-01-29 23:46 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2015-04-18 11:06 - 2010-11-20 23:47 - 00235576 _____ () C:\windows\PFRO.log
2015-04-18 11:06 - 2009-07-14 01:08 - 00000006 ____H () C:\windows\Tasks\SA.DAT
2015-04-18 11:06 - 2009-07-14 00:51 - 00077969 _____ () C:\windows\setupact.log
2015-04-18 03:13 - 2013-09-25 03:08 - 00000932 _____ () C:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-891173389-2658835656-2395992767-1000UA.job
2015-04-18 03:13 - 2013-09-25 03:08 - 00000910 _____ () C:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-891173389-2658835656-2395992767-1000Core.job
2015-04-18 03:03 - 2012-07-25 20:15 - 00000830 _____ () C:\windows\Tasks\Adobe Flash Player Updater.job
2015-04-18 03:01 - 2013-09-21 02:27 - 00000898 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-04-18 01:47 - 2014-02-14 00:30 - 00000000 ____D () C:\Users\Maulik\AppData\Roaming\Skype
2015-04-17 20:33 - 2014-01-29 19:56 - 00000468 _____ () C:\windows\Tasks\ParetoLogic Registration.job
2015-04-17 15:45 - 2013-09-13 14:33 - 00000422 _____ () C:\windows\Tasks\SystemToolsDailyTest.job
2015-04-17 15:43 - 2014-02-11 21:54 - 00000860 _____ () C:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-891173389-2658835656-2395992767-1000Core.job
2015-04-17 15:43 - 2013-09-15 14:00 - 00003488 _____ () C:\windows\System32\Tasks\PCDEventLauncher
2015-04-17 15:43 - 2013-09-13 14:33 - 00003452 _____ () C:\windows\System32\Tasks\SystemToolsDailyTest
2015-04-16 22:24 - 2015-01-27 16:17 - 00000000 ____D () C:\Users\Maulik\Documents\CS113
2015-04-16 22:23 - 2014-05-16 14:56 - 00000000 ____D () C:\Users\Maulik\Desktop\Vivek and Mrugha Wedding5.16
2015-04-16 22:23 - 2014-01-28 02:01 - 00000000 ____D () C:\Users\Maulik\.grasp_settings
2015-04-16 03:47 - 2013-12-09 16:36 - 00000000 ____D () C:\windows\System32\Tasks\Games
2015-04-15 23:03 - 2012-07-25 20:15 - 00778416 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe
2015-04-15 23:03 - 2012-07-25 20:15 - 00142512 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-04-15 23:03 - 2012-07-25 20:15 - 00003768 _____ () C:\windows\System32\Tasks\Adobe Flash Player Updater
2015-04-14 17:36 - 2015-01-27 18:39 - 00000000 ____D () C:\Users\Maulik\Documents\CS356
2015-04-13 14:25 - 2015-02-04 08:13 - 00000000 ____D () C:\Users\Maulik\Documents\CS114
2015-04-13 10:02 - 2014-09-18 14:14 - 00001064 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamViewer 9.lnk
2015-04-13 10:02 - 2014-09-18 14:14 - 00001052 _____ () C:\Users\Public\Desktop\TeamViewer 9.lnk
2015-04-12 00:43 - 2013-09-21 02:27 - 00000000 ____D () C:\Users\Maulik\AppData\Local\Google
2015-04-12 00:43 - 2013-09-21 02:27 - 00000000 ____D () C:\Program Files (x86)\Google
2015-04-08 21:20 - 2015-02-03 11:53 - 00000000 ____D () C:\Users\Maulik\Documents\IS350
2015-04-02 03:56 - 2009-07-13 23:20 - 00000000 ____D () C:\windows\rescache
2015-04-01 22:52 - 2014-07-16 23:58 - 00000000 ____D () C:\Users\Maulik\AppData\Local\Adobe
2015-04-01 22:39 - 2013-09-13 14:33 - 00000564 _____ () C:\windows\Tasks\PCDoctorBackgroundMonitorTask.job
2015-04-01 00:56 - 2015-02-03 12:32 - 00000000 ____D () C:\Users\Maulik\Downloads\junk
2015-04-01 00:56 - 2014-03-19 00:25 - 00000000 ____D () C:\Users\Maulik\AppData\Roaming\BitTorrent
2015-03-31 21:34 - 2013-09-13 14:33 - 00004272 _____ () C:\windows\System32\Tasks\PCDoctorBackgroundMonitorTask
2015-03-31 11:04 - 2014-03-19 05:12 - 00000000 ____D () C:\Users\Maulik\Downloads\software plugins
2015-03-30 10:45 - 2012-07-25 20:29 - 00000000 ____D () C:\ProgramData\Nero
2015-03-30 10:45 - 2012-07-25 20:29 - 00000000 ____D () C:\Program Files (x86)\Nero
2015-03-30 10:45 - 2012-07-25 20:20 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DELL
2015-03-30 10:36 - 2014-03-19 05:11 - 00000000 ____D () C:\Users\Maulik\Downloads\other stuff
2015-03-30 10:34 - 2015-03-03 11:19 - 00000000 ____D () C:\Users\Maulik\Downloads\SAMSUNG_USB_Driver_for_Mobile_Phones
2015-03-29 18:14 - 2013-09-23 21:39 - 00000000 ____D () C:\Users\Maulik\AppData\Local\Nero
2015-03-29 17:55 - 2009-07-13 23:20 - 00000000 ____D () C:\windows\system32\NDF
2015-03-27 06:01 - 2014-09-17 21:43 - 00000000 ____D () C:\Users\Maulik\Documents\CS100 Python
2015-03-24 11:17 - 2014-12-08 20:12 - 00000000 ___RD () C:\Program Files (x86)\Skype
2015-03-24 11:17 - 2014-02-14 00:29 - 00000000 ____D () C:\ProgramData\Skype
2015-03-24 11:17 - 2013-09-13 03:30 - 00000000 ____D () C:\Users\Maulik
2015-03-21 04:19 - 2013-09-26 00:33 - 00000000 ____D () C:\Users\Maulik\AppData\Roaming\vlc

==================== Files in the root of some directories =======

2014-01-26 22:15 - 2014-01-27 00:06 - 0000041 _____ () C:\Users\Maulik\AppData\Roaming\WB.CFG
2014-01-26 22:15 - 2014-01-26 22:14 - 0366611 _____ () C:\Users\Maulik\AppData\Local\mysearchdial-speeddial.crx

Some content of TEMP:
====================
C:\Users\Maulik\AppData\Local\Temp\5160.exe
C:\Users\Maulik\AppData\Local\Temp\54269uninstall.exe
C:\Users\Maulik\AppData\Local\Temp\Execute2App.exe
C:\Users\Maulik\AppData\Local\Temp\ezinstall.exe
C:\Users\Maulik\AppData\Local\Temp\install_flashplayer11x32_mssa_aaa_aih.exe
C:\Users\Maulik\AppData\Local\Temp\jre-7u71-windows-i586-iftw.exe
C:\Users\Maulik\AppData\Local\Temp\msvcp90.dll
C:\Users\Maulik\AppData\Local\Temp\msvcr90.dll
C:\Users\Maulik\AppData\Local\Temp\nsbD490.exe
C:\Users\Maulik\AppData\Local\Temp\nsd3AB5.exe
C:\Users\Maulik\AppData\Local\Temp\nsd62ED.exe
C:\Users\Maulik\AppData\Local\Temp\nsgA0D8.exe
C:\Users\Maulik\AppData\Local\Temp\nsiFC83.exe
C:\Users\Maulik\AppData\Local\Temp\nsn5968.exe
C:\Users\Maulik\AppData\Local\Temp\nsnB505.exe
C:\Users\Maulik\AppData\Local\Temp\nso5C9.exe
C:\Users\Maulik\AppData\Local\Temp\nss3101.exe
C:\Users\Maulik\AppData\Local\Temp\nst155.exe
C:\Users\Maulik\AppData\Local\Temp\nsxB482.exe
C:\Users\Maulik\AppData\Local\Temp\nsyBC95.exe
C:\Users\Maulik\AppData\Local\Temp\nsyC03E.exe
C:\Users\Maulik\AppData\Local\Temp\nsyE1A.exe
C:\Users\Maulik\AppData\Local\Temp\oi_{7B053B47-9F58-4272-BDF6-C86561757673}.exe
C:\Users\Maulik\AppData\Local\Temp\SearchProtectionSetup.exe
C:\Users\Maulik\AppData\Local\Temp\SkypeSetup.exe
C:\Users\Maulik\AppData\Local\Temp\SPStub.exe
C:\Users\Maulik\AppData\Local\Temp\Sqlite3.dll
C:\Users\Maulik\AppData\Local\Temp\tbWhit.dll
C:\Users\Maulik\AppData\Local\Temp\utt154B.tmp.exe
C:\Users\Maulik\AppData\Local\Temp\vcredist_x64.exe
C:\Users\Maulik\AppData\Local\Temp\vlc-2.1.2-win32.exe
C:\Users\Maulik\AppData\Local\Temp\vlc-2.1.3-win32.exe
C:\Users\Maulik\AppData\Local\Temp\vpnclient_setup.exe
C:\Users\Maulik\AppData\Local\Temp\xmlUpdater.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-04-14 19:17

==================== End Of Log ============================

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 18-04-2015 01
Ran by Maulik at 2015-04-18 11:54:09
Running from C:\Users\Maulik\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Microsoft Security Essentials (Enabled - Up to date) {4F35CFC4-45A3-FC37-EF17-759A02E39AB1}
AS: Microsoft Security Essentials (Enabled - Up to date) {F4542E20-6399-F3B9-D5A7-4EE87964D00C}
AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Accidental Damage Services Agreement (HKLM-x32\...\{EF85FEF4-EB92-4075-A6D2-5F519BB30A2C}) (Version: 2.0.0 - Dell Inc.)
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 2.6.0.19120 - Adobe Systems Incorporated)
Adobe Flash Player 17 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 17.0.0.169 - Adobe Systems Incorporated)
Adobe Flash Player 17 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 17.0.0.169 - Adobe Systems Incorporated)
Adobe Reader X (10.1.13) MUI (HKLM-x32\...\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}) (Version: 10.1.13 - Adobe Systems Incorporated)
Advanced Audio FX Engine (HKLM-x32\...\Advanced Audio FX Engine) (Version: 1.12.05 - Creative Technology Ltd)
Android Studio (HKLM\...\Android Studio) (Version: 1.0 - Google Inc.)
Apple Application Support (32-bit) (HKLM-x32\...\{447CDCE5-F555-429B-BFA6-642C3C6D684F}) (Version: 3.1.2 - Apple Inc.)
Apple Application Support (64-bit) (HKLM\...\{0DF7096B-715A-4233-8633-C7A16ED6D616}) (Version: 3.1.2 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{C4123106-B685-48E6-B9BD-E4F911841EB4}) (Version: 8.1.1.3 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Banctec Service Agreement (HKLM-x32\...\{42D68A86-DB1C-4256-B8C9-5D0D92919AF5}) (Version: 2.0.0 - Dell Inc.)
bestadblocker (HKLM-x32\...\{4820778D-AB0D-6D18-C316-52A6A0E1D507}) (Version:  - ) <==== ATTENTION
BitTorrent (HKU\S-1-5-21-891173389-2658835656-2395992767-1000\...\BitTorrent) (Version: 7.9.2.38657 - BitTorrent Inc.)
Blio (HKLM-x32\...\{400182B4-CA55-46A9-9D88-F8413DCFB36D}) (Version: 2.3.7140 - K-NFB Reading Technology, Inc.)
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
Cisco Systems VPN Client 5.0.07.0290 (HKLM\...\{467D5E81-8349-4892-9E81-C3674ED8E451}) (Version: 5.0.7 - Cisco Systems, Inc.)
Cisco WebEx Meetings (HKU\S-1-5-21-891173389-2658835656-2395992767-1000\...\ActiveTouchMeetingClient) (Version:  - Cisco WebEx LLC)
Complete Care Business Service Agreement (HKLM-x32\...\{0ECFCB07-9BFE-4970-ACA1-D568D982760B}) (Version: 2.0.0 - Dell Inc.)
Consumer In-Home Service Agreement (HKLM-x32\...\{F47C37A4-7189-430A-B81D-739FF8A7A554}) (Version: 2.0.0 - Dell Inc.)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Dell DataSafe Local Backup - Support Software (HKLM-x32\...\{A9668246-FB70-4103-A1E3-66C9BC2EFB49}) (Version: 9.4.67 - Dell Inc.)
Dell DataSafe Local Backup (HKLM-x32\...\{0ED7EE95-6A97-47AA-AD73-152C08A15B04}) (Version: 9.4.67 - Dell Inc.)
Dell DataSafe Online (HKLM-x32\...\{7EC66A95-AC2D-4127-940B-0445A526AB2F}) (Version: 2.1.19634 - Dell)
Dell Edoc Viewer (HKLM\...\{8EBA8727-ADC2-477B-9D9A-1A1836BE4E05}) (Version: 1.0.0 - Dell Inc)
Dell Getting Started Guide (HKLM-x32\...\{7DB9F1E5-9ACB-410D-A7DC-7A3D023CE045}) (Version: 1.00.0000 - Dell Inc.)
Dell Home Systems Service Agreement (HKLM-x32\...\{AB2FDE4F-6BED-4E9E-B676-3DCCEBB1FBFE}) (Version: 2.0.0 - Dell Inc.)
Dell MusicStage (HKLM-x32\...\{3BD7DD08-991B-4A2F-A165-614ED14EAADD}) (Version: 1.6.225.0 - Fingertapps)
Dell PhotoStage (HKLM-x32\...\{E4335E82-17B3-460F-9E70-39D9BC269DB3}) (Version: 1.5.0.130 - ArcSoft)
Dell Product Registration (HKLM-x32\...\{2A0F2CC5-3065-492C-8380-B03AA7106B1A}) (Version: 1.1.3 - Dell Inc.)
Dell Stage (HKLM-x32\...\{FE182796-F6BA-486A-8590-89B7E8D1D60F}) (Version: 1.7.209.0 - Fingertapps)
Dell Stage Remote (HKLM-x32\...\{AF4D3C63-009B-4A17-B02E-D395065DD3F0}) (Version: 2.0.0.43 - ArcSoft)
Dell Support Center (HKLM\...\Dell Support Center) (Version: 3.1.5907.16 - Dell Inc.)
Dell Support Center (Version: 3.1.5907.16 - PC-Doctor, Inc.) Hidden
Dell Touchpad (HKLM\...\{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}) (Version: 7.1207.101.225 - ALPS ELECTRIC CO., LTD.)
Dell VideoStage  (HKLM-x32\...\InstallShield_{DCE0E79A-B9AC-41AC-98C1-7EF0538BCA7F}) (Version: 1.3.0.2513 - CyberLink Corp.)
Dell VideoStage  (x32 Version: 1.3.0.2513 - CyberLink Corp.) Hidden
Dell Webcam Central (HKLM-x32\...\Dell Webcam Central) (Version: 2.01.15 - Creative Technology Ltd)
DW WLAN Card (HKLM\...\DW WLAN Card) (Version: 5.100.82.88 - Dell Inc.)
Facebook Invite Them All (HKLM-x32\...\{AD11DADE-C597-45D9-D8C5-1D2EB0B89613}) (Version:  - ) <==== ATTENTION
Facebook Video Calling 3.1.0.521 (HKLM-x32\...\{2091F234-EB58-4B80-8C96-8EB78C808CF7}) (Version: 3.1.521 - Skype Limited)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 42.0.2311.90 - Google Inc.)
Google Talk Plugin (HKLM-x32\...\{A7365B85-57D8-39EA-BB3E-D20137E92369}) (Version: 5.41.0.0 - Google)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.26.9 - Google Inc.) Hidden
IDT Audio (HKLM-x32\...\{E3A5A8AB-58F6-45FF-AFCB-C9AE18C05001}) (Version: 1.0.6341.0 - IDT)
Intel® Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1007 - Intel Corporation)
Intel® Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 7.0.0.1144 - Intel Corporation)
Intel® Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 8.15.10.2342 - Intel Corporation)
Intel® Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 10.1.2.1004 - Intel Corporation)
Java 7 Update 71 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F03217071FF}) (Version: 7.0.710 - Oracle)
Java SE Development Kit 7 Update 51 (64-bit) (HKLM\...\{64A3A4F4-B792-11D6-A78A-00B0D0170510}) (Version: 1.7.0.510 - Oracle)
jGRASP (HKLM-x32\...\jGRASP) (Version: 2.0.1_01 - )
Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Lexmark Z700-P700 Series (HKLM\...\Lexmark Z700-P700 Series) (Version:  - Lexmark International, Inc.)
Mathematica Extras 10.0 (5099479) (HKLM\...\A-WIN-Extras 10.0.0 5099479_is1) (Version: 10.0.0 - Wolfram Research, Inc.)
Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Office 2010 (HKLM-x32\...\{95140000-0070-0000-0000-0000000FF1CE}) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Office Professional Plus 2010 (HKLM-x32\...\Office14.PROPLUS) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Security Essentials (HKLM\...\Microsoft Security Client) (Version: 4.6.305.0 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.31010.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM-x32\...\{820B6609-4C97-3A2B-B644-573B06A0F0CC}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Mozilla Firefox 37.0.1 (x86 en-US) (HKLM-x32\...\Mozilla Firefox 37.0.1 (x86 en-US)) (Version: 37.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
MSXML 4.0 SP2 Parser and SDK (HKLM-x32\...\{716E0306-8318-4364-8B8F-0CC4E9376BAC}) (Version: 4.20.9818.0 - Microsoft Corporation)
MyFreeCodec (HKU\S-1-5-21-891173389-2658835656-2395992767-1000\...\MyFreeCodec) (Version:  - )
Notepad++ (HKLM-x32\...\Notepad++) (Version: 6.6.9 - Notepad++ Team)
OneUp (HKLM-x32\...\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}{869b9e4a}) (Version:  - OneUp) <==== ATTENTION
OpenAFS for Windows (64-bit) (HKLM\...\{2BF69D53-032B-424F-A98D-AA0596FBCB16}) (Version: 1.7.3100 - OpenAFS.org)
PlayReady PC Runtime x86 (HKLM-x32\...\{CCA5EAAD-92F4-4B7A-B5EE-14294C66AB61}) (Version: 1.3.0 - Microsoft Corporation)
Pokki Download Helper (HKU\S-1-5-21-891173389-2658835656-2395992767-1000\...\PokkiDownloadHelper) (Version: 1.3.1.282 - Pokki)
Premium Service Agreement (HKLM-x32\...\{C33AA6D6-F5EC-48F3-AFDC-8141345D473A}) (Version: 2.0.0 - Dell Inc.)
Python 3.4.1 (HKLM-x32\...\{df32bb9e-3ed8-36b5-a649-e8c845c5f3a2}) (Version: 3.4.1150 - Python Software Foundation)
QualxServ Service Agreement (HKLM-x32\...\{903679E8-44C8-4C07-9600-05C92654FC50}) (Version: 2.0.0 - Dell Inc.)
Quickset64 (HKLM\...\{87CF757E-C1F1-4D22-865C-00C6950B5258}) (Version: 10.09.25 - Dell Inc.)
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.45.516.2011 - Realtek)
Realtek USB 2.0 Card Reader (HKLM-x32\...\{96AE7E41-E34E-47D0-AC07-1091A8127911}) (Version: 6.1.7600.30126 - Realtek Semiconductor Corp.)
Reliance Netconnect+ (HKLM\...\ZTEWireless-101_is1) (Version:  - )
SalePlus (HKLM-x32\...\{B696F285-F54E-2524-58B1-E06A70ABE6BE}) (Version:  - ) <==== ATTENTION
Samsung Kies (HKLM-x32\...\InstallShield_{758C8301-2696-4855-AF45-534B1200980A}) (Version: 2.6.3.14044_16 - Samsung Electronics Co., Ltd.)
Samsung Kies (x32 Version: 2.6.3.14044_16 - Samsung Electronics Co., Ltd.) Hidden
Samsung Kies3 (HKLM-x32\...\InstallShield_{88547073-C566-4895-9005-EBE98EA3F7C7}) (Version: 3.2.15013.17 - Samsung Electronics Co., Ltd.)
Samsung Kies3 (x32 Version: 3.2.15013.17 - Samsung Electronics Co., Ltd.) Hidden
SAMSUNG USB Driver for Mobile Phones (HKLM\...\{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}) (Version: 1.5.49.0 - SAMSUNG Electronics Co., Ltd.)
Search Protection (HKU\S-1-5-21-891173389-2658835656-2395992767-1000\...\Search Protection) (Version: 20.8.0.3 - Spigot, Inc.) <==== ATTENTION
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version:  - Microsoft)
Skype Click to Call (HKLM-x32\...\{6D1221A9-17BF-4EC0-81F2-27D30EC30701}) (Version: 7.3.16540.9015 - Microsoft Corporation)
Skype™ 7.2 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.2.103 - Skype Technologies S.A.)
SSH Secure Shell (HKLM-x32\...\{74E2CD0C-D4A2-11D3-95A6-0000E86CFDE5}) (Version:  - )
SyncDroid version 1.2.3 (HKLM-x32\...\{BE7E35A4-59E5-412B-9B18-57B4938B8C0B}_is1) (Version: 1.2.3 - JunTu Software, Inc.)
TeamViewer 9 (HKLM-x32\...\TeamViewer 9) (Version: 9.0.41110 - TeamViewer)
Unity Web Player (HKU\S-1-5-21-891173389-2658835656-2395992767-1000\...\UnityWebPlayer) (Version: 4.5.2f1 - Unity Technologies ApS)
Visual Studio 2008 x64 Redistributables (HKLM-x32\...\{FCDBEA60-79F0-4FAE-BBA8-55A26C609A49}) (Version: 10.0.0.2 - AVG Technologies)
VLC media player 2.1.3 (HKLM-x32\...\VLC media player) (Version: 2.1.3 - VideoLAN)
WIDCOMM Bluetooth Software (HKLM\...\{436E0B79-2CFB-4E5F-9380-E17C1B25D0C5}) (Version: 6.3.0.7600 - Broadcom Corporation)
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3508.1109 - Microsoft Corporation)
Windows Live Mesh ActiveX Control for Remote Connections (HKLM-x32\...\{2902F983-B4C1-44BA-B85D-5C6D52E2C441}) (Version: 15.4.5722.2 - Microsoft Corporation)
Windows Media Player Firefox Plugin (HKLM-x32\...\{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}) (Version: 1.0.0.8 - Microsoft Corp)
WinPcap 4.1.3 (HKLM-x32\...\WinPcapInst) (Version: 4.1.0.2980 - Riverbed Technology, Inc.)
Wireshark 1.12.3 (64-bit) (HKLM-x32\...\Wireshark) (Version: 1.12.3 - The Wireshark developer community, http://www.wireshark.org)
Wolfram Mathematica 10 (M-WIN-L 10.0.0 5099521) (HKLM\...\M-WIN-L 10.0.0 5099521_is1) (Version: 10.0.0 - Wolfram Research, Inc.)
Zinio Reader 4 (HKLM-x32\...\ZinioReader4) (Version: 4.2.4164 - Zinio LLC)
Zinio Reader 4 (x32 Version: 4.2.4164 - Zinio LLC) Hidden

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-891173389-2658835656-2395992767-1000_Classes\CLSID\{0F22A205-CFB0-4679-8499-A6F44A80A208}\InprocServer32 -> C:\Users\Maulik\AppData\Local\Google\Update\1.3.25.5\psuser_64.dll No File
CustomCLSID: HKU\S-1-5-21-891173389-2658835656-2395992767-1000_Classes\CLSID\{355EC88A-02E2-4547-9DEE-F87426484BD1}\InprocServer32 -> C:\Users\Maulik\AppData\Local\Google\Update\1.3.23.9\psuser_64.dll No File
CustomCLSID: HKU\S-1-5-21-891173389-2658835656-2395992767-1000_Classes\CLSID\{90B3DFBF-AF6A-4EA0-8899-F332194690F8}\InprocServer32 -> C:\Users\Maulik\AppData\Local\Google\Update\1.3.24.15\psuser_64.dll No File
CustomCLSID: HKU\S-1-5-21-891173389-2658835656-2395992767-1000_Classes\CLSID\{C3BC25C0-FCD3-4F01-AFDD-41373F017C9A}\InprocServer32 -> C:\Users\Maulik\AppData\Local\Google\Update\1.3.26.9\psuser_64.dll (Google Inc.)
CustomCLSID: HKU\S-1-5-21-891173389-2658835656-2395992767-1000_Classes\CLSID\{D0336C0B-7919-4C04-8CCE-2EBAE2ECE8C9}\InprocServer32 -> C:\Users\Maulik\AppData\Local\Google\Update\1.3.25.11\psuser_64.dll No File
CustomCLSID: HKU\S-1-5-21-891173389-2658835656-2395992767-1000_Classes\CLSID\{E8CF3E55-F919-49D9-ABC0-948E6CB34B9F}\InprocServer32 -> C:\Users\Maulik\AppData\Local\Google\Update\1.3.26.9\psuser_64.dll (Google Inc.)
CustomCLSID: HKU\S-1-5-21-891173389-2658835656-2395992767-1000_Classes\CLSID\{FE498BAB-CB4C-4F88-AC3F-3641AAAF5E9E}\InprocServer32 -> C:\Users\Maulik\AppData\Local\Google\Update\1.3.24.7\psuser_64.dll No File

==================== Restore Points  =========================

07-04-2015 03:00:11 Windows Update
09-04-2015 03:00:20 Windows Update
09-04-2015 21:35:11 Windows Update
10-04-2015 03:00:14 Windows Update
12-04-2015 03:00:23 Windows Update
13-04-2015 03:00:22 Windows Update
14-04-2015 03:00:11 Windows Update
15-04-2015 03:00:22 Windows Update
16-04-2015 03:00:12 Windows Update
17-04-2015 03:00:19 Windows Update
18-04-2015 03:00:12 Windows Update
18-04-2015 03:12:15 Windows Update

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-13 22:34 - 2009-06-10 17:00 - 00000824 ____A C:\windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {02B0AD76-A161-4250-8FEB-D8133E645032} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-891173389-2658835656-2395992767-1000UA => C:\Users\Maulik\AppData\Local\Google\Update\GoogleUpdate.exe [2014-02-11] (Google Inc.)
Task: {14C3EEE6-4A72-454C-B38D-71EC49430EFC} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc
Task: {2B803F54-54F4-4E41-85DC-75CF50903D44} - System32\Tasks\{72D097A9-B308-48CB-9DAB-00011703ED9E} => pcalua.exe -a "C:\Users\Maulik\Downloads\EA SPORTS™ Cricket 07_uninst.exe" -d C:\Users\Maulik\Downloads
Task: {3614485B-54FD-4584-B4C6-3364C9CD16BA} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-891173389-2658835656-2395992767-1000UA => C:\Users\Maulik\AppData\Local\Facebook\Update\FacebookUpdate.exe [2013-09-25] (Facebook Inc.)
Task: {38EE5A46-00AE-4AEF-BF56-626284B19AEA} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-09-21] (Google Inc.)
Task: {570E2B20-2508-4A08-AE2B-C2E95189BD43} - System32\Tasks\{3CFC623F-BD02-44A7-A4D7-16470AF7D571} => pcalua.exe -a "C:\Users\Maulik\Downloads\Sophos AntiVirus v7.3.3 Cracked - vibept\Sophos_Anti-Virus_Enterprise 2009.exe" -d "C:\Users\Maulik\Downloads\Sophos AntiVirus v7.3.3 Cracked - vibept"
Task: {6189AEC2-49A5-4D13-8521-0FF342651CBF} - System32\Tasks\ParetoLogic Registration => Rundll32.exe "C:\Program Files (x86)\Common Files\ParetoLogic\UUS2\UUS.dll" RunUns
Task: {6852EAE7-D025-4B12-8DA1-A4D29EAC7DB6} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-09-21] (Google Inc.)
Task: {70585652-4CDC-4221-8644-E124031CAF1E} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-891173389-2658835656-2395992767-1000Core => C:\Users\Maulik\AppData\Local\Facebook\Update\FacebookUpdate.exe [2013-09-25] (Facebook Inc.)
Task: {872F8A02-00CD-4042-9ECF-8248AB3C0280} - System32\Tasks\PCDoctorBackgroundMonitorTask => C:\Program Files\Dell Support Center\uaclauncher.exe [2011-12-14] (PC-Doctor, Inc.)
Task: {960625F2-D23D-455F-BCCD-972BEEA5CD53} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {98C0FC19-A5BE-422D-826E-304764BA2570} - System32\Tasks\UpdaterEX => C:\Users\Maulik\AppData\Roaming\UPDATE~1\UPDATE~1\UPDATE~1.EXE <==== ATTENTION
Task: {AC4E5ACF-89F7-4220-BA21-81EE183975E2} - System32\Tasks\Microsoft\Windows\Application Experience\AitAgent => aitagent.exe
Task: {B255DC66-6B1E-4D12-91B1-BBE6E5F93C2A} - System32\Tasks\PCDoctorBackgroundMonitorTask-Delay => C:\Program Files\Dell Support Center\uaclauncher.exe [2011-12-14] (PC-Doctor, Inc.)
Task: {BA40DB9E-7495-4AB5-8D59-613B23953D87} - System32\Tasks\SaveSenseLiveUpdateTaskMachineCore => C:\Program Files (x86)\SaveSenseLive\Update\SaveSenseLive.exe [2014-01-26] (SaveSense) <==== ATTENTION
Task: {C0E511F9-1AAD-45AF-8234-26F755386F3B} - System32\Tasks\SaveSense => C:\Users\Maulik\AppData\Roaming\SAVESE~1\UPDATE~1\UPDATE~1.EXE <==== ATTENTION
Task: {C54BC790-889F-42FC-B406-DB7749805A00} - System32\Tasks\Leader Technologies\PowerRegister\Seagate Product Registration (Maulik) => C:\Users\Maulik\AppData\Roaming\Leadertech\PowerRegister\Seagate Product Registration.exe [2012-09-26] (Leader Technologies/Seagate)
Task: {C60FCC9C-2FFF-41AD-8E4B-9CDEA4E797FC} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-04-15] (Adobe Systems Incorporated)
Task: {D8CBF0DC-CC3B-49BE-B436-E703061EEA31} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-891173389-2658835656-2395992767-1000Core => C:\Users\Maulik\AppData\Local\Google\Update\GoogleUpdate.exe [2014-02-11] (Google Inc.)
Task: {DA67E510-B928-4545-BCC7-D776E2243540} - System32\Tasks\SaveSenseLiveUpdateTaskMachineUA => C:\Program Files (x86)\SaveSenseLive\Update\SaveSenseLive.exe [2014-01-26] (SaveSense) <==== ATTENTION
Task: {E3163C33-301D-4730-A266-5518C5ED3967} - System32\Tasks\Microsoft\Windows\Bluetooth\UninstallDeviceTask => BthUdTask.exe
Task: {E5DD8ADD-25A8-4237-A097-397A71705197} - System32\Tasks\SystemToolsDailyTest => c:\Program Files\Dell Support Center\pcdrcui.exe [2011-12-14] (PC-Doctor, Inc.)
Task: {FEC113C0-A0DA-4879-B684-AB6D03E20482} - System32\Tasks\PCDEventLauncher => c:\Program Files\Dell Support Center\sessionchecker.exe [2011-12-14] (PC-Doctor, Inc.)
Task: C:\windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-891173389-2658835656-2395992767-1000Core.job => C:\Users\Maulik\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-891173389-2658835656-2395992767-1000UA.job => C:\Users\Maulik\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-891173389-2658835656-2395992767-1000Core.job => C:\Users\Maulik\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-891173389-2658835656-2395992767-1000UA.job => C:\Users\Maulik\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\windows\Tasks\ParetoLogic Registration.job => C:\windows\system32\rundll32.exeFC:\Program Files (x86)\Common Files\ParetoLogic\UUS2\UUS.dll
Task: C:\windows\Tasks\PCDoctorBackgroundMonitorTask-Delay.job => C:\Program Files\Dell Support Center\uaclauncher.exeo-backgroundmon scripts\defaultscan.xml
Task: C:\windows\Tasks\PCDoctorBackgroundMonitorTask.job => C:\Program Files\Dell Support Center\uaclauncher.exeo-backgroundmon scripts\defaultscan.xml
Task: C:\windows\Tasks\SaveSense.job => C:\Users\Maulik\AppData\Roaming\SAVESE~1\UPDATE~1\UPDATE~1.EXE
Task: C:\windows\Tasks\SaveSenseLiveUpdateTaskMachineCore.job => C:\Program Files (x86)\SaveSenseLive\Update\SaveSenseLive.exe <==== ATTENTION
Task: C:\windows\Tasks\SaveSenseLiveUpdateTaskMachineUA.job => C:\Program Files (x86)\SaveSenseLive\Update\SaveSenseLive.exe <==== ATTENTION
Task: C:\windows\Tasks\SystemToolsDailyTest.job => c:\Program Files\Dell Support Center\pcdrcui.exe
Task: C:\windows\Tasks\UpdaterEX.job => C:\Users\Maulik\AppData\Roaming\UPDATE~1\UPDATE~1\UPDATE~1.EXE

==================== Loaded Modules (whitelisted) ==============

2015-02-13 04:20 - 2015-02-13 04:20 - 00085832 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
2015-02-13 04:20 - 2015-02-13 04:20 - 01346344 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
2015-03-13 07:35 - 2013-09-05 15:14 - 00406528 _____ () C:\Program Files\Reliance Netconnect+\bin\MonServiceUDisk.exe
2014-05-13 12:17 - 2014-05-13 12:17 - 00043416 _____ () C:\Program Files\OpenAFS\Client\Program\afs_shl_ext_1033.dll
2013-09-05 01:17 - 2013-09-05 01:17 - 04300456 _____ () C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\OFFICE.ODF
2010-10-20 15:23 - 2010-10-20 15:23 - 08801632 _____ () C:\Program Files\Microsoft Office\Office14\1033\GrooveIntlResource.dll
2014-05-12 05:49 - 2014-05-12 05:49 - 00222720 _____ () C:\Program Files (x86)\Notepad++\NppShell_06.dll
2012-07-25 20:41 - 2012-01-26 22:49 - 02751808 _____ () C:\Program Files (x86)\Dell DataSafe Local Backup\COMPONENTS\SCHEDULER\STSERVICE.EXE
2012-07-25 22:43 - 2011-03-25 21:28 - 00094208 _____ () C:\WINDOWS\System32\IccLibDll_x64.dll
2011-06-27 20:26 - 2011-06-27 20:26 - 02022976 _____ () C:\Program Files (x86)\Dell\Stage Remote\StageRemote.exe
2015-04-07 12:15 - 2015-04-07 12:15 - 00913520 _____ () C:\Users\Maulik\AppData\Roaming\Search Protection\SP.exe
2014-05-13 12:12 - 2014-05-13 12:12 - 00071576 _____ () C:\Program Files\OpenAFS\Common\TaAfsAppLib_1033.dll
2014-05-13 12:18 - 2014-05-13 12:18 - 00097688 _____ () C:\Program Files\OpenAFS\Client\Program\afscreds_1033.dll
2011-01-13 16:56 - 2011-01-13 16:56 - 00173856 _____ () C:\Program Files\WIDCOMM\Bluetooth Software\btkeyind.dll
2011-06-29 09:52 - 2011-06-29 09:52 - 00474176 _____ () C:\Program Files (x86)\Dell\Stage Remote\StageRemoteService.exe
2015-04-14 18:55 - 2015-04-14 18:55 - 01605632 _____ () c:\Program Files (x86)\keepsbrowse\keepsbrowse.dll
2010-03-23 13:26 - 2010-03-23 13:26 - 00201512 _____ () C:\Program Files (x86)\Cisco Systems\VPN Client\vpnapi.dll
2010-03-16 21:28 - 2010-03-16 21:28 - 01926144 _____ () C:\Program Files (x86)\Dell\Stage Remote\QtCore4.dll
2010-03-22 16:52 - 2010-03-22 16:52 - 06776832 _____ () C:\Program Files (x86)\Dell\Stage Remote\QtGui4.dll
2010-03-16 21:28 - 2010-03-16 21:28 - 00635904 _____ () C:\Program Files (x86)\Dell\Stage Remote\QtNetwork4.dll
2010-03-16 21:28 - 2010-03-16 21:28 - 00326144 _____ () C:\Program Files (x86)\Dell\Stage Remote\QtXml4.dll
2011-06-25 00:20 - 2011-06-25 00:20 - 00565968 _____ () C:\Program Files (x86)\Dell\Stage Remote\sqlite3.dll
2011-06-27 20:25 - 2011-06-27 20:25 - 00058944 _____ () C:\Program Files (x86)\Dell\Stage Remote\DataService.dll
2011-06-25 00:21 - 2011-06-25 00:21 - 00322624 _____ () C:\Program Files (x86)\Dell\Stage Remote\en-US\UI\ManagerUI.dll
2010-03-11 20:52 - 2010-03-11 20:52 - 00028160 _____ () C:\Program Files (x86)\Dell\Stage Remote\plugins\imageformats\qgif4.dll
2010-03-05 16:07 - 2010-03-05 16:07 - 00031744 _____ () C:\Program Files (x86)\Dell\Stage Remote\plugins\imageformats\qico4.dll
2010-03-05 16:07 - 2010-03-05 16:07 - 00125952 _____ () C:\Program Files (x86)\Dell\Stage Remote\plugins\imageformats\qjpeg4.dll
2010-03-11 20:52 - 2010-03-11 20:52 - 00225280 _____ () C:\Program Files (x86)\Dell\Stage Remote\plugins\imageformats\qmng4.dll
2013-09-05 01:14 - 2013-09-05 01:14 - 04300456 _____ () C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF
2010-10-20 15:45 - 2010-10-20 15:45 - 08801120 _____ () C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveIntlResource.dll
2014-10-15 04:12 - 2014-10-15 04:12 - 00169472 _____ () C:\windows\assembly\NativeImages_v2.0.50727_32\IsdiInterop\9b1cac8d98bd69d3e56a26ff2f96f266\IsdiInterop.ni.dll
2012-07-25 20:14 - 2011-01-12 18:56 - 00058880 _____ () C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IsdiInterop.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\sndappv2 => ""="service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Wdf01000.sys => ""="Driver"

==================== EXE Association (whitelisted) ===============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-891173389-2658835656-2395992767-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\Maulik\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 192.168.1.1

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)


==================== Accounts: =============================

Administrator (S-1-5-21-891173389-2658835656-2395992767-500 - Administrator - Disabled)
Guest (S-1-5-21-891173389-2658835656-2395992767-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-891173389-2658835656-2395992767-1002 - Limited - Enabled)
Maulik (S-1-5-21-891173389-2658835656-2395992767-1000 - Administrator - Enabled) => C:\Users\Maulik

==================== Faulty Device Manager Devices =============

Name: hlnfd
Description: hlnfd
Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Manufacturer:
Service: hlnfd
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.

Name: Cisco Systems VPN Adapter for 64-bit Windows
Description: Cisco Systems VPN Adapter for 64-bit Windows
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Cisco Systems
Service: CVirtA
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.


==================== Event log errors: =========================

Application errors:
==================
Error: (04/18/2015 11:08:18 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (04/16/2015 10:23:05 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 13897286

Error: (04/16/2015 10:23:05 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 13897286

Error: (04/16/2015 10:23:05 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (04/16/2015 06:31:19 PM) (Source: Google Update) (EventID: 20) (User: Maulik-PC)
Description: Network Request Error.
Error: 0x80072ee7. Http status code: 0.
Url=https://www.facebook...maha/update.php
Trying config: source=FireFox, direct connection.
trying CUP:WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying CUP:iexplore.
Send request returned 0x80004005. Http status code 0.
Trying config: source=IE, wpad=1, script=.
trying CUP:WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying CUP:iexplore.
Send request returned 0x80004005. Http status code 0.
Trying config: source=FireFox, direct connection.
trying CUP:WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying CUP:iexplore.
Send request returned 0x80004005. Http status code 0.
Trying config: source=IE, wpad=1, script=.
trying CUP:WinHTTP.
Send request returned 0x80

Error: (04/16/2015 04:06:47 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 4446

Error: (04/16/2015 04:06:47 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 4446

Error: (04/16/2015 04:06:47 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (04/16/2015 04:06:46 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 3432

Error: (04/16/2015 04:06:46 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 3432


System errors:
=============
Error: (04/18/2015 11:08:24 AM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: The following boot-start or system-start driver(s) failed to load:
hlnfd

Error: (04/18/2015 03:12:24 AM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT AUTHORITY)
Description: Installation Failure: Windows failed to install the following update with error 0x80070643: Update for Windows 7 for x64-based Systems (KB3024777).

Error: (04/18/2015 03:11:57 AM) (Source: DCOM) (EventID: 10010) (User: )
Description: {51FA2736-5DEE-11D4-98E8-006008BF430C}

Error: (04/18/2015 03:04:56 AM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT AUTHORITY)
Description: Installation Failure: Windows failed to install the following update with error 0x80070643: Update for Windows 7 for x64-based Systems (KB3024777).

Error: (04/17/2015 03:05:22 AM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT AUTHORITY)
Description: Installation Failure: Windows failed to install the following update with error 0x80070643: Update for Windows 7 for x64-based Systems (KB3024777).

Error: (04/17/2015 03:00:42 AM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: A timeout (30000 milliseconds) was reached while waiting for a transaction response from the TransarcAFSDaemon service.

Error: (04/16/2015 03:03:45 AM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT AUTHORITY)
Description: Installation Failure: Windows failed to install the following update with error 0x80070643: Update for Windows 7 for x64-based Systems (KB3024777).

Error: (04/15/2015 10:42:22 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The Adobe Flash Player Update Service service terminated unexpectedly.  It has done this 1 time(s).

Error: (04/15/2015 03:05:50 AM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT AUTHORITY)
Description: Installation Failure: Windows failed to install the following update with error 0x80070643: Update for Windows 7 for x64-based Systems (KB3024777).

Error: (04/14/2015 03:05:12 AM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT AUTHORITY)
Description: Installation Failure: Windows failed to install the following update with error 0x80070643: Update for Windows 7 for x64-based Systems (KB3024777).


Microsoft Office Sessions:
=========================
Error: (04/18/2015 11:08:18 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (04/16/2015 10:23:05 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 13897286

Error: (04/16/2015 10:23:05 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 13897286

Error: (04/16/2015 10:23:05 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (04/16/2015 06:31:19 PM) (Source: Google Update) (EventID: 20) (User: Maulik-PC)
Description: Network Request Error.
Error: 0x80072ee7. Http status code: 0.
Url=https://www.facebook...maha/update.php
Trying config: source=FireFox, direct connection.
trying CUP:WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying CUP:iexplore.
Send request returned 0x80004005. Http status code 0.
Trying config: source=IE, wpad=1, script=.
trying CUP:WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying CUP:iexplore.
Send request returned 0x80004005. Http status code 0.
Trying config: source=FireFox, direct connection.
trying CUP:WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying CUP:iexplore.
Send request returned 0x80004005. Http status code 0.
Trying config: source=IE, wpad=1, script=.
trying CUP:WinHTTP.
Send request returned 0x80

Error: (04/16/2015 04:06:47 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 4446

Error: (04/16/2015 04:06:47 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 4446

Error: (04/16/2015 04:06:47 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (04/16/2015 04:06:46 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 3432

Error: (04/16/2015 04:06:46 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 3432


==================== Memory info ===========================

Processor: Intel® Core™ i3-2370M CPU @ 2.40GHz
Percentage of memory in use: 44%
Total physical RAM: 4004.27 MB
Available physical RAM: 2203.96 MB
Total Pagefile: 8006.73 MB
Available Pagefile: 5573.17 MB
Total Virtual: 8192 MB
Available Virtual: 8191.83 MB

==================== Drives ================================

Drive a: (smarat) (Fixed) (Total:210.13 GB) (Free:210.04 GB) NTFS
Drive c: (OS) (Fixed) (Total:236 GB) (Free:130.95 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 465.8 GB) (Disk ID: 1F908D00)
Partition 1: (Not Active) - (Size=100 MB) - (Type=DE)
Partition 2: (Active) - (Size=19.5 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=236 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=210.1 GB) - (Type=OF Extended)

==================== End Of Log ============================


Edited by maulik10, 18 April 2015 - 10:40 AM.

  • 0

Advertisements


#2
zep516

zep516

    Trusted Helper

  • Malware Removal
  • 8,090 posts
Hi! My name is zep516 and Welcome to Geekstogo!
I'll do the best I can to resolve your computer issue
Please make sure to carefully read any instruction that I give you. If you're not sure, or if something unexpected happens, don't continue Stop and ask! Never be afraid to ask questions! :)

You have a lot of addware on the computer, we have quite a bit of work to do. Let me look the logs over. I'll get back to you asap 1 hour approx.

Joe

Don't try fixing anymore.
  • 0

#3
maulik10

maulik10

    Member

  • Topic Starter
  • Member
  • PipPip
  • 13 posts

thank you very much and i won't do anything now and i will follow every step that you will give me and take your time and help me out thanks once again.


  • 0

#4
zep516

zep516

    Trusted Helper

  • Malware Removal
  • 8,090 posts
Hello,

First
Please remove these programs from your programs an features list,
To do that:
Click > Start > Control panel > Programs an features. In the list find the program listed below and uninstall it.
  • OneUp
  • SalePlus
  • Search Protection
If a program will not remove skip it and keep following instructions please.

Next

A few items to fix
NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

Open notepad (Start =>All Programs => Accessories => Notepad).
Copy/Paste the contents of the code box below into Notepad. Make sure you get it all.
 
start
CloseProcesses:
CreateRestorePoint:
2014-01-26 22:15 - 2014-01-26 22:14 - 0366611 _____ () C:\Users\Maulik\AppData\Local\mysearchdial-speeddial.crx
HKLM-x32\...\RunOnce: [AvgUninstallURL] => cmd.exe /c start http://www.avg.com/w...KzEtQ0lEMTIxVFQ(the data entry has 78 more characters).
Winlogon\Notify\igfxcui: igfxdev.dll [X]
HKU\S-1-5-19\Control Panel\Desktop\\SCRNSAVE.EXE ->
HKU\S-1-5-20\Control Panel\Desktop\\SCRNSAVE.EXE ->
HKU\S-1-5-21-891173389-2658835656-2395992767-1000\...\Run: [Search Protection] => C:\Users\Maulik\AppData\Roaming\Search Protection\SP.EXE [913520 2015-04-07] ()
HKU\S-1-5-21-891173389-2658835656-2395992767-1000\...\RunOnce: [Application Restart #5] => C:\Users\Maulik\AppData\Local\Pokki\Engine\pokki.exe  --disable-internal-flash --noerrdialogs --no-message-box --disable-extensions --disable-web-security --disable-web-resources --disable-client-side (the data entry has 542 more characters).
HKU\S-1-5-21-891173389-2658835656-2395992767-1000\Control Panel\Desktop\\SCRNSAVE.EXE ->
HKU\S-1-5-18\Control Panel\Desktop\\SCRNSAVE.EXE ->
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://start.mysearc...r=860089911&ir=
SearchScopes: HKLM -> {77AA745B-F4F8-45DA-9B14-61D2D95054C8} URL =
SearchScopes: HKU\S-1-5-21-891173389-2658835656-2395992767-1000 -> D0C77116AB7449E8A4D947C02915D5CE URL = http://start.mysearc...r=860089911&ir=
SearchScopes: HKU\S-1-5-21-891173389-2658835656-2395992767-1000 -> {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL =
SearchScopes: HKU\S-1-5-21-891173389-2658835656-2395992767-1000 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-891173389-2658835656-2395992767-1000 -> {77AA745B-F4F8-45DA-9B14-61D2D95054C8} URL = http://search.condui...5773792673&UM=2
BHO: Java Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll No File
BHO: Java Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll No File
BHO-x32: No Name -> {26B19FA4-E8A1-4A1B-A163-1A1E46F830DD} ->  No File
BHO-x32: SaveSense -> {71e129ff-6c2a-4984-818c-7e2c998b8d99} -> C:\Users\Maulik\AppData\Local\SaveSense\SaveSenseIE.dll [2014-01-07] (SaveSense)
Filter: application/octet-stream - {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - mscoree.dll No File
Filter: application/x-complus - {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - mscoree.dll No File
Filter: application/x-msdownload - {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - mscoree.dll No File
FF DefaultSearchEngine,S: WebSearch
FF DefaultSearchUrl: hxxp://websearch.goodforsearch.info/?pid=24380&r=2015/04/14&hid=8004382613692767312&lg=EN&cc=US&unqvl=86&l=1&q=
FF SearchEngineOrder.1: WebSearch
FF SearchEngineOrder.1,S: WebSearch
FF Plugin: @java.com/DTPlugin,version=10.51.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll No File
FF Plugin: @java.com/JavaPlugin,version=10.51.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll No File
FF Plugin-x32: @tools.updaterss.com/SaveSenseLive Update;version=3 -> C:\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\npGoogleUpdate3.dll [2014-01-26] (SaveSense)
FF Plugin-x32: @tools.updaterss.com/SaveSenseLive Update;version=9 -> C:\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\npGoogleUpdate3.dll [2014-01-26] (SaveSense)
FF Plugin HKU\S-1-5-21-891173389-2658835656-2395992767-1000: pokki.com/PokkiDownloadHelper -> C:\Users\Maulik\AppData\Local\Pokki\Download Helper\npPokkiDownloadHelper.1.2.0.78.dll [2014-07-21] (Pokki)
FF user.js: detected! => C:\Users\Maulik\AppData\Roaming\Mozilla\Firefox\Profiles\6u0wperb.default\user.js [2014-01-30]
FF SearchPlugin: C:\Users\Maulik\AppData\Roaming\Mozilla\Firefox\Profiles\6u0wperb.default\searchplugins\ask-web-search.xml [2014-07-29]
FF SearchPlugin: C:\Users\Maulik\AppData\Roaming\Mozilla\Firefox\Profiles\6u0wperb.default\searchplugins\conduit-search.xml [2014-01-26]
FF SearchPlugin: C:\Users\Maulik\AppData\Roaming\Mozilla\Firefox\Profiles\6u0wperb.default\searchplugins\conduit.xml [2013-10-10]
FF SearchPlugin: C:\Users\Maulik\AppData\Roaming\Mozilla\Firefox\Profiles\6u0wperb.default\searchplugins\Mysearchdial.xml [2014-01-26]
FF SearchPlugin: C:\Users\Maulik\AppData\Roaming\Mozilla\Firefox\Profiles\6u0wperb.default\searchplugins\WebSearch.xml [2015-04-14]
CHR StartupUrls: Default -> "hxxp://websearch.look-for-it.info/?pid=20494&r=2015/02/17&hid=8004382613692767312&lg=EN&cc=US&unqvl=82"
S2 savesenselive; C:\Program Files (x86)\SaveSenseLive\Update\SaveSenseLive.exe [146920 2014-01-26] (SaveSense)
S3 savesenselivem; C:\Program Files (x86)\SaveSenseLive\Update\SaveSenseLive.exe [146920 2014-01-26] (SaveSense)
S3 WinHttpAutoProxySvc; winhttp.dll [X]
S1 hlnfd; system32\drivers\hlnfd.sys [X]
2015-04-14 18:55 - 2015-04-14 18:55 - 00000000 ____D () C:\Program Files (x86)\keepsbrowse
2015-04-14 18:53 - 2015-04-14 18:53 - 00000000 ____D () C:\ProgramData\10254911128936596356
2015-04-14 18:53 - 2015-04-14 18:53 - 00000000 ____D () C:\Program Files (x86)\SallePlus
2015-04-14 18:53 - 2015-04-14 18:53 - 00000000 ____D () C:\Program Files (x86)\SalePlus
2015-04-14 18:53 - 2015-04-14 18:53 - 00000000 ____D () C:\Program Files (x86)\bestadblocker
2015-04-14 18:52 - 2015-04-14 18:52 - 00000000 ____D () C:\ProgramData\hllhchdknemmjoahhcemlmgemmpabejo
2015-04-18 11:25 - 2014-01-26 22:20 - 00000932 _____ () C:\windows\Tasks\SaveSenseLiveUpdateTaskMachineUA.job
CustomCLSID: HKU\S-1-5-21-891173389-2658835656-2395992767-1000_Classes\CLSID\{0F22A205-CFB0-4679-8499-A6F44A80A208}\InprocServer32 -> C:\Users\Maulik\AppData\Local\Google\Update\1.3.25.5\psuser_64.dll No File
CustomCLSID: HKU\S-1-5-21-891173389-2658835656-2395992767-1000_Classes\CLSID\{355EC88A-02E2-4547-9DEE-F87426484BD1}\InprocServer32 -> C:\Users\Maulik\AppData\Local\Google\Update\1.3.23.9\psuser_64.dll No File
CustomCLSID: HKU\S-1-5-21-891173389-2658835656-2395992767-1000_Classes\CLSID\{90B3DFBF-AF6A-4EA0-8899-F332194690F8}\InprocServer32 -> C:\Users\Maulik\AppData\Local\Google\Update\1.3.24.15\psuser_64.dll No File
CustomCLSID: HKU\S-1-5-21-891173389-2658835656-2395992767-1000_Classes\CLSID\{C3BC25C0-FCD3-4F01-AFDD-41373F017C9A}\InprocServer32 -> C:\Users\Maulik\AppData\Local\Google\Update\1.3.26.9\psuser_64.dll (Google Inc.)
CustomCLSID: HKU\S-1-5-21-891173389-2658835656-2395992767-1000_Classes\CLSID\{D0336C0B-7919-4C04-8CCE-2EBAE2ECE8C9}\InprocServer32 -> C:\Users\Maulik\AppData\Local\Google\Update\1.3.25.11\psuser_64.dll No File
CustomCLSID: HKU\S-1-5-21-891173389-2658835656-2395992767-1000_Classes\CLSID\{E8CF3E55-F919-49D9-ABC0-948E6CB34B9F}\InprocServer32 -> C:\Users\Maulik\AppData\Local\Google\Update\1.3.26.9\psuser_64.dll (Google Inc.)
CustomCLSID: HKU\S-1-5-21-891173389-2658835656-2395992767-1000_Classes\CLSID\{FE498BAB-CB4C-4F88-AC3F-3641AAAF5E9E}\InprocServer32 -> C:\Users\Maulik\AppData\Local\Google\Update\1.3.24.7\psuser_64.dll No File
Task: {98C0FC19-A5BE-422D-826E-304764BA2570} - System32\Tasks\UpdaterEX => C:\Users\Maulik\AppData\Roaming\UPDATE~1\UPDATE~1\UPDATE~1.EXE <==== ATTENTION
Task: {BA40DB9E-7495-4AB5-8D59-613B23953D87} - System32\Tasks\SaveSenseLiveUpdateTaskMachineCore => C:\Program Files (x86)\SaveSenseLive\Update\SaveSenseLive.exe [2014-01-26] (SaveSense) <==== ATTENTION
Task: {C0E511F9-1AAD-45AF-8234-26F755386F3B} - System32\Tasks\SaveSense => C:\Users\Maulik\AppData\Roaming\SAVESE~1\UPDATE~1\UPDATE~1.EXE <==== ATTENTION
Task: {DA67E510-B928-4545-BCC7-D776E2243540} - System32\Tasks\SaveSenseLiveUpdateTaskMachineUA => C:\Program Files (x86)\SaveSenseLive\Update\SaveSenseLive.exe [2014-01-26] (SaveSense) <==== ATTENTION
Task: C:\windows\Tasks\SaveSense.job => C:\Users\Maulik\AppData\Roaming\SAVESE~1\UPDATE~1\UPDATE~1.EXE
Task: C:\windows\Tasks\SaveSenseLiveUpdateTaskMachineCore.job => C:\Program Files (x86)\SaveSenseLive\Update\SaveSenseLive.exe <==== ATTENTION
Task: C:\windows\Tasks\SaveSenseLiveUpdateTaskMachineUA.job => C:\Program Files (x86)\SaveSenseLive\Update\SaveSenseLive.exe <==== ATTENTION
Task: C:\windows\Tasks\UpdaterEX.job => C:\Users\Maulik\AppData\Roaming\UPDATE~1\UPDATE~1\UPDATE~1.EXE
2015-04-07 12:15 - 2015-04-07 12:15 - 00913520 _____ () C:\Users\Maulik\AppData\Roaming\Search Protection\SP.exe
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\sndappv2 => ""="service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Wdf01000.sys => ""="Driver"
CMD: bitsadmin /reset /allusers
CMD: netsh winsock reset catalog
CMD: ipconfig /flushdns
hosts:
Emptytemp:
Click Format and ensure Wordwrap is unchecked.
Save as Fixlist.txt to your Desktop (Must be in this location)
Run FRST/FRST64 and press the Fix button just once and wait.
If the tool needed a restart please make sure you let the system to restart normally and let the tool completes its run after restart.
The tool will make a log on the Desktop (Fixlog.txt). Please post it to your reply.

Note: If the tool warns you about the version you're using being an outdated version please download and run the updated version.


In your next reply post to me:
Fixlog.txt That log will be found on your desktop after the fix above is run.

Thanks
Joe :)
  • 0

#5
maulik10

maulik10

    Member

  • Topic Starter
  • Member
  • PipPip
  • 13 posts

ok i have done each step that you gave me and also run the fix and got the file andalso my computer restarted after fix was completed so as you asked i am provideing lag file that you want to see and once you see the file please let me know if my computer is clean or not  clean

file lag:

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 18-04-2015 01
Ran by Maulik at 2015-04-18 13:52:12 Run:1
Running from C:\Users\Maulik\Desktop
Loaded Profiles: Maulik (Available profiles: Maulik)
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
start
CloseProcesses:
CreateRestorePoint:
2014-01-26 22:15 - 2014-01-26 22:14 - 0366611 _____ () C:\Users\Maulik\AppData\Local\mysearchdial-speeddial.crx
HKLM-x32\...\RunOnce: [AvgUninstallURL] => cmd.exe /c start http://www.avg.com/w...Q0lEMTIxVFQ(thedata entry has 78 more characters).
Winlogon\Notify\igfxcui: igfxdev.dll [X]
HKU\S-1-5-19\Control Panel\Desktop\\SCRNSAVE.EXE ->
HKU\S-1-5-20\Control Panel\Desktop\\SCRNSAVE.EXE ->
HKU\S-1-5-21-891173389-2658835656-2395992767-1000\...\Run: [Search Protection] => C:\Users\Maulik\AppData\Roaming\Search Protection\SP.EXE [913520 2015-04-07] ()
HKU\S-1-5-21-891173389-2658835656-2395992767-1000\...\RunOnce: [Application Restart #5] => C:\Users\Maulik\AppData\Local\Pokki\Engine\pokki.exe  --disable-internal-flash --noerrdialogs --no-message-box --disable-extensions --disable-web-security --disable-web-resources --disable-client-side (the data entry has 542 more characters).
HKU\S-1-5-21-891173389-2658835656-2395992767-1000\Control Panel\Desktop\\SCRNSAVE.EXE ->
HKU\S-1-5-18\Control Panel\Desktop\\SCRNSAVE.EXE ->
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://start.mysearc...r=860089911&ir=
SearchScopes: HKLM -> {77AA745B-F4F8-45DA-9B14-61D2D95054C8} URL =
SearchScopes: HKU\S-1-5-21-891173389-2658835656-2395992767-1000 -> D0C77116AB7449E8A4D947C02915D5CE URL = http://start.mysearc...r=860089911&ir=
SearchScopes: HKU\S-1-5-21-891173389-2658835656-2395992767-1000 -> {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL =
SearchScopes: HKU\S-1-5-21-891173389-2658835656-2395992767-1000 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-891173389-2658835656-2395992767-1000 -> {77AA745B-F4F8-45DA-9B14-61D2D95054C8} URL = http://search.condui...5773792673&UM=2
BHO: Java Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll No File
BHO: Java Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll No File
BHO-x32: No Name -> {26B19FA4-E8A1-4A1B-A163-1A1E46F830DD} ->  No File
BHO-x32: SaveSense -> {71e129ff-6c2a-4984-818c-7e2c998b8d99} -> C:\Users\Maulik\AppData\Local\SaveSense\SaveSenseIE.dll [2014-01-07] (SaveSense)
Filter: application/octet-stream - {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - mscoree.dll No File
Filter: application/x-complus - {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - mscoree.dll No File
Filter: application/x-msdownload - {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - mscoree.dll No File
FF DefaultSearchEngine,S: WebSearch
FF DefaultSearchUrl: hxxp://websearch.goodforsearch.info/?pid=24380&r=2015/04/14&hid=8004382613692767312&lg=EN&cc=US&unqvl=86&l=1&q=
FF SearchEngineOrder.1: WebSearch
FF SearchEngineOrder.1,S: WebSearch
FF Plugin: @java.com/DTPlugin,version=10.51.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll No File
FF Plugin: @java.com/JavaPlugin,version=10.51.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll No File
FF Plugin-x32: @tools.updaterss.com/SaveSenseLive Update;version=3 -> C:\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\npGoogleUpdate3.dll [2014-01-26] (SaveSense)
FF Plugin-x32: @tools.updaterss.com/SaveSenseLive Update;version=9 -> C:\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\npGoogleUpdate3.dll [2014-01-26] (SaveSense)
FF Plugin HKU\S-1-5-21-891173389-2658835656-2395992767-1000: pokki.com/PokkiDownloadHelper -> C:\Users\Maulik\AppData\Local\Pokki\Download Helper\npPokkiDownloadHelper.1.2.0.78.dll [2014-07-21] (Pokki)
FF user.js: detected! => C:\Users\Maulik\AppData\Roaming\Mozilla\Firefox\Profiles\6u0wperb.default\user.js [2014-01-30]
FF SearchPlugin: C:\Users\Maulik\AppData\Roaming\Mozilla\Firefox\Profiles\6u0wperb.default\searchplugins\ask-web-search.xml [2014-07-29]
FF SearchPlugin: C:\Users\Maulik\AppData\Roaming\Mozilla\Firefox\Profiles\6u0wperb.default\searchplugins\conduit-search.xml [2014-01-26]
FF SearchPlugin: C:\Users\Maulik\AppData\Roaming\Mozilla\Firefox\Profiles\6u0wperb.default\searchplugins\conduit.xml [2013-10-10]
FF SearchPlugin: C:\Users\Maulik\AppData\Roaming\Mozilla\Firefox\Profiles\6u0wperb.default\searchplugins\Mysearchdial.xml [2014-01-26]
FF SearchPlugin: C:\Users\Maulik\AppData\Roaming\Mozilla\Firefox\Profiles\6u0wperb.default\searchplugins\WebSearch.xml [2015-04-14]
CHR StartupUrls: Default -> "hxxp://websearch.look-for-it.info/?pid=20494&r=2015/02/17&hid=8004382613692767312&lg=EN&cc=US&unqvl=82"
S2 savesenselive; C:\Program Files (x86)\SaveSenseLive\Update\SaveSenseLive.exe [146920 2014-01-26] (SaveSense)
S3 savesenselivem; C:\Program Files (x86)\SaveSenseLive\Update\SaveSenseLive.exe [146920 2014-01-26] (SaveSense)
S3 WinHttpAutoProxySvc; winhttp.dll [X]
S1 hlnfd; system32\drivers\hlnfd.sys [X]
2015-04-14 18:55 - 2015-04-14 18:55 - 00000000 ____D () C:\Program Files (x86)\keepsbrowse
2015-04-14 18:53 - 2015-04-14 18:53 - 00000000 ____D () C:\ProgramData\10254911128936596356
2015-04-14 18:53 - 2015-04-14 18:53 - 00000000 ____D () C:\Program Files (x86)\SallePlus
2015-04-14 18:53 - 2015-04-14 18:53 - 00000000 ____D () C:\Program Files (x86)\SalePlus
2015-04-14 18:53 - 2015-04-14 18:53 - 00000000 ____D () C:\Program Files (x86)\bestadblocker
2015-04-14 18:52 - 2015-04-14 18:52 - 00000000 ____D () C:\ProgramData\hllhchdknemmjoahhcemlmgemmpabejo
2015-04-18 11:25 - 2014-01-26 22:20 - 00000932 _____ () C:\windows\Tasks\SaveSenseLiveUpdateTaskMachineUA.job
CustomCLSID: HKU\S-1-5-21-891173389-2658835656-2395992767-1000_Classes\CLSID\{0F22A205-CFB0-4679-8499-A6F44A80A208}\InprocServer32 -> C:\Users\Maulik\AppData\Local\Google\Update\1.3.25.5\psuser_64.dll No File
CustomCLSID: HKU\S-1-5-21-891173389-2658835656-2395992767-1000_Classes\CLSID\{355EC88A-02E2-4547-9DEE-F87426484BD1}\InprocServer32 -> C:\Users\Maulik\AppData\Local\Google\Update\1.3.23.9\psuser_64.dll No File
CustomCLSID: HKU\S-1-5-21-891173389-2658835656-2395992767-1000_Classes\CLSID\{90B3DFBF-AF6A-4EA0-8899-F332194690F8}\InprocServer32 -> C:\Users\Maulik\AppData\Local\Google\Update\1.3.24.15\psuser_64.dll No File
CustomCLSID: HKU\S-1-5-21-891173389-2658835656-2395992767-1000_Classes\CLSID\{C3BC25C0-FCD3-4F01-AFDD-41373F017C9A}\InprocServer32 -> C:\Users\Maulik\AppData\Local\Google\Update\1.3.26.9\psuser_64.dll (Google Inc.)
CustomCLSID: HKU\S-1-5-21-891173389-2658835656-2395992767-1000_Classes\CLSID\{D0336C0B-7919-4C04-8CCE-2EBAE2ECE8C9}\InprocServer32 -> C:\Users\Maulik\AppData\Local\Google\Update\1.3.25.11\psuser_64.dll No File
CustomCLSID: HKU\S-1-5-21-891173389-2658835656-2395992767-1000_Classes\CLSID\{E8CF3E55-F919-49D9-ABC0-948E6CB34B9F}\InprocServer32 -> C:\Users\Maulik\AppData\Local\Google\Update\1.3.26.9\psuser_64.dll (Google Inc.)
CustomCLSID: HKU\S-1-5-21-891173389-2658835656-2395992767-1000_Classes\CLSID\{FE498BAB-CB4C-4F88-AC3F-3641AAAF5E9E}\InprocServer32 -> C:\Users\Maulik\AppData\Local\Google\Update\1.3.24.7\psuser_64.dll No File
Task: {98C0FC19-A5BE-422D-826E-304764BA2570} - System32\Tasks\UpdaterEX => C:\Users\Maulik\AppData\Roaming\UPDATE~1\UPDATE~1\UPDATE~1.EXE <==== ATTENTION
Task: {BA40DB9E-7495-4AB5-8D59-613B23953D87} - System32\Tasks\SaveSenseLiveUpdateTaskMachineCore => C:\Program Files (x86)\SaveSenseLive\Update\SaveSenseLive.exe [2014-01-26] (SaveSense) <==== ATTENTION
Task: {C0E511F9-1AAD-45AF-8234-26F755386F3B} - System32\Tasks\SaveSense => C:\Users\Maulik\AppData\Roaming\SAVESE~1\UPDATE~1\UPDATE~1.EXE <==== ATTENTION
Task: {DA67E510-B928-4545-BCC7-D776E2243540} - System32\Tasks\SaveSenseLiveUpdateTaskMachineUA => C:\Program Files (x86)\SaveSenseLive\Update\SaveSenseLive.exe [2014-01-26] (SaveSense) <==== ATTENTION
Task: C:\windows\Tasks\SaveSense.job => C:\Users\Maulik\AppData\Roaming\SAVESE~1\UPDATE~1\UPDATE~1.EXE
Task: C:\windows\Tasks\SaveSenseLiveUpdateTaskMachineCore.job => C:\Program Files (x86)\SaveSenseLive\Update\SaveSenseLive.exe <==== ATTENTION
Task: C:\windows\Tasks\SaveSenseLiveUpdateTaskMachineUA.job => C:\Program Files (x86)\SaveSenseLive\Update\SaveSenseLive.exe <==== ATTENTION
Task: C:\windows\Tasks\UpdaterEX.job => C:\Users\Maulik\AppData\Roaming\UPDATE~1\UPDATE~1\UPDATE~1.EXE
2015-04-07 12:15 - 2015-04-07 12:15 - 00913520 _____ () C:\Users\Maulik\AppData\Roaming\Search Protection\SP.exe
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\sndappv2 => ""="service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Wdf01000.sys => ""="Driver"
CMD: bitsadmin /reset /allusers
CMD: netsh winsock reset catalog
CMD: ipconfig /flushdns
hosts:
Emptytemp:
*****************

Processes closed successfully.
Restore point was successfully created.
C:\Users\Maulik\AppData\Local\mysearchdial-speeddial.crx => Moved successfully.
HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\\AvgUninstallURL => value deleted successfully.
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui" => Key deleted successfully.
HKU\S-1-5-19\Control Panel\Desktop\\SCRNSAVE.EXE => value deleted successfully.
HKU\S-1-5-20\Control Panel\Desktop\\SCRNSAVE.EXE => value deleted successfully.
HKU\S-1-5-21-891173389-2658835656-2395992767-1000\Software\Microsoft\Windows\CurrentVersion\Run\\Search Protection => Value not found.
HKU\S-1-5-21-891173389-2658835656-2395992767-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\\Application Restart #5 => value deleted successfully.
HKU\S-1-5-21-891173389-2658835656-2395992767-1000\Control Panel\Desktop\\SCRNSAVE.EXE => value deleted successfully.
HKU\S-1-5-18\Control Panel\Desktop\\SCRNSAVE.EXE => value deleted successfully.
"HKLM\SOFTWARE\Policies\Google" => Key deleted successfully.
HKLM\Software\\Microsoft\Internet Explorer\Main\\Start Page => Value was restored successfully.
"HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{77AA745B-F4F8-45DA-9B14-61D2D95054C8}" => Key deleted successfully.
HKCR\CLSID\{77AA745B-F4F8-45DA-9B14-61D2D95054C8} => Key not found.
"HKU\S-1-5-21-891173389-2658835656-2395992767-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\D0C77116AB7449E8A4D947C02915D5CE" => Key deleted successfully.
HKCR\CLSID\D0C77116AB7449E8A4D947C02915D5CE => Key not found.
"HKU\S-1-5-21-891173389-2658835656-2395992767-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{014DB5FA-EAFB-4592-A95B-F44D3EE87FA9}" => Key deleted successfully.
HKCR\CLSID\{014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} => Key not found.
"HKU\S-1-5-21-891173389-2658835656-2395992767-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}" => Key deleted successfully.
HKCR\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} => Key not found.
"HKU\S-1-5-21-891173389-2658835656-2395992767-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{77AA745B-F4F8-45DA-9B14-61D2D95054C8}" => Key deleted successfully.
HKCR\CLSID\{77AA745B-F4F8-45DA-9B14-61D2D95054C8} => Key not found.
"HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}" => Key deleted successfully.
"HKCR\CLSID\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}" => Key deleted successfully.
"HKCR\CLSID\{DBC80044-A445-435b-BC74-9C25C1C588A9}" => Key deleted successfully.
"HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{26B19FA4-E8A1-4A1B-A163-1A1E46F830DD}" => Key deleted successfully.
HKCR\Wow6432Node\CLSID\{26B19FA4-E8A1-4A1B-A163-1A1E46F830DD} => Key not found.
"HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{71e129ff-6c2a-4984-818c-7e2c998b8d99}" => Key deleted successfully.
"HKCR\Wow6432Node\CLSID\{71e129ff-6c2a-4984-818c-7e2c998b8d99}" => Key deleted successfully.
"HKCR\PROTOCOLS\Filter\application/octet-stream" => Key deleted successfully.
"HKCR\CLSID\{1E66F26B-79EE-11D2-8710-00C04F79ED0D}" => Key Deleted successfully.
"HKCR\PROTOCOLS\Filter\application/x-complus" => Key deleted successfully.
HKCR\CLSID\{1E66F26B-79EE-11D2-8710-00C04F79ED0D} => Key not found.
"HKCR\PROTOCOLS\Filter\application/x-msdownload" => Key deleted successfully.
HKCR\CLSID\{1E66F26B-79EE-11D2-8710-00C04F79ED0D} => Key not found.
Firefox DefaultSearchEngine,S deleted successfully.
Firefox DefaultSearchUrl deleted successfully.
Firefox SearchEngineOrder.1 deleted successfully.
Firefox SearchEngineOrder.1,S deleted successfully.
"HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.51.2" => Key deleted successfully.
"HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.51.2" => Key deleted successfully.
"HKLM\Software\Wow6432Node\MozillaPlugins\@tools.updaterss.com/SaveSenseLive Update;version=3" => Key deleted successfully.
C:\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\npGoogleUpdate3.dll => Moved successfully.
"HKLM\Software\Wow6432Node\MozillaPlugins\@tools.updaterss.com/SaveSenseLive Update;version=9" => Key deleted successfully.
C:\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\npGoogleUpdate3.dll not found.
"HKU\S-1-5-21-891173389-2658835656-2395992767-1000\Software\MozillaPlugins\pokki.com/PokkiDownloadHelper" => Key deleted successfully.
C:\Users\Maulik\AppData\Local\Pokki\Download Helper\npPokkiDownloadHelper.1.2.0.78.dll => Moved successfully.
C:\Users\Maulik\AppData\Roaming\Mozilla\Firefox\Profiles\6u0wperb.default\user.js => Moved successfully.
C:\Users\Maulik\AppData\Roaming\Mozilla\Firefox\Profiles\6u0wperb.default\searchplugins\ask-web-search.xml => Moved successfully.
C:\Users\Maulik\AppData\Roaming\Mozilla\Firefox\Profiles\6u0wperb.default\searchplugins\conduit-search.xml => Moved successfully.
C:\Users\Maulik\AppData\Roaming\Mozilla\Firefox\Profiles\6u0wperb.default\searchplugins\conduit.xml => Moved successfully.
C:\Users\Maulik\AppData\Roaming\Mozilla\Firefox\Profiles\6u0wperb.default\searchplugins\Mysearchdial.xml => Moved successfully.
C:\Users\Maulik\AppData\Roaming\Mozilla\Firefox\Profiles\6u0wperb.default\searchplugins\WebSearch.xml => Moved successfully.
Chrome StartupUrls deleted successfully.
savesenselive => Service deleted successfully.
savesenselivem => Service deleted successfully.
WinHttpAutoProxySvc => Service stopped successfully.
WinHttpAutoProxySvc => Service deleted successfully.
hlnfd => Service deleted successfully.
"C:\Program Files (x86)\keepsbrowse" => File/Directory not found.
C:\ProgramData\10254911128936596356 => Moved successfully.
C:\Program Files (x86)\SallePlus => Moved successfully.
"C:\Program Files (x86)\SalePlus" => File/Directory not found.
C:\Program Files (x86)\bestadblocker => Moved successfully.
C:\ProgramData\hllhchdknemmjoahhcemlmgemmpabejo => Moved successfully.
C:\windows\Tasks\SaveSenseLiveUpdateTaskMachineUA.job => Moved successfully.
"HKU\S-1-5-21-891173389-2658835656-2395992767-1000_Classes\CLSID\{0F22A205-CFB0-4679-8499-A6F44A80A208}" => Key deleted successfully.
"HKU\S-1-5-21-891173389-2658835656-2395992767-1000_Classes\CLSID\{355EC88A-02E2-4547-9DEE-F87426484BD1}" => Key deleted successfully.
"HKU\S-1-5-21-891173389-2658835656-2395992767-1000_Classes\CLSID\{90B3DFBF-AF6A-4EA0-8899-F332194690F8}" => Key deleted successfully.
"HKU\S-1-5-21-891173389-2658835656-2395992767-1000_Classes\CLSID\{C3BC25C0-FCD3-4F01-AFDD-41373F017C9A}" => Key deleted successfully.
"HKU\S-1-5-21-891173389-2658835656-2395992767-1000_Classes\CLSID\{D0336C0B-7919-4C04-8CCE-2EBAE2ECE8C9}" => Key deleted successfully.
"HKU\S-1-5-21-891173389-2658835656-2395992767-1000_Classes\CLSID\{E8CF3E55-F919-49D9-ABC0-948E6CB34B9F}" => Key deleted successfully.
"HKU\S-1-5-21-891173389-2658835656-2395992767-1000_Classes\CLSID\{FE498BAB-CB4C-4F88-AC3F-3641AAAF5E9E}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{98C0FC19-A5BE-422D-826E-304764BA2570}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{98C0FC19-A5BE-422D-826E-304764BA2570}" => Key deleted successfully.
C:\Windows\System32\Tasks\UpdaterEX => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\UpdaterEX" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{BA40DB9E-7495-4AB5-8D59-613B23953D87}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{BA40DB9E-7495-4AB5-8D59-613B23953D87}" => Key deleted successfully.
C:\Windows\System32\Tasks\SaveSenseLiveUpdateTaskMachineCore => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\SaveSenseLiveUpdateTaskMachineCore" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{C0E511F9-1AAD-45AF-8234-26F755386F3B}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{C0E511F9-1AAD-45AF-8234-26F755386F3B}" => Key deleted successfully.
C:\Windows\System32\Tasks\SaveSense => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\SaveSense" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{DA67E510-B928-4545-BCC7-D776E2243540}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{DA67E510-B928-4545-BCC7-D776E2243540}" => Key deleted successfully.
C:\Windows\System32\Tasks\SaveSenseLiveUpdateTaskMachineUA => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\SaveSenseLiveUpdateTaskMachineUA" => Key deleted successfully.
C:\windows\Tasks\SaveSense.job => Moved successfully.
C:\windows\Tasks\SaveSenseLiveUpdateTaskMachineCore.job => Moved successfully.
C:\windows\Tasks\SaveSenseLiveUpdateTaskMachineUA.job not found.
C:\windows\Tasks\UpdaterEX.job => Moved successfully.
"C:\Users\Maulik\AppData\Roaming\Search Protection\SP.exe" => File/Directory not found.
"HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys" => Key deleted successfully.
"HKLM\System\CurrentControlSet\Control\SafeBoot\Network\sndappv2" => Key deleted successfully.
"HKLM\System\CurrentControlSet\Control\SafeBoot\Network\Wdf01000.sys" => Key deleted successfully.

=========  bitsadmin /reset /allusers =========

'bitsadmin' is not recognized as an internal or external command,
operable program or batch file.

========= End of CMD: =========


=========  netsh winsock reset catalog =========

'netsh' is not recognized as an internal or external command,
operable program or batch file.

========= End of CMD: =========


=========  ipconfig /flushdns =========

'ipconfig' is not recognized as an internal or external command,
operable program or batch file.

========= End of CMD: =========

C:\Windows\System32\Drivers\etc\hosts => Moved successfully.
Hosts was reset successfully.
EmptyTemp: => Removed 4.6 GB temporary data.


The system needed a reboot.

==== End of Fixlog 13:55:06 ====


  • 0

#6
zep516

zep516

    Trusted Helper

  • Malware Removal
  • 8,090 posts
  • Please download Malwarebytes Anti-Malware to your desktop.
  • Double-click mbam-setup-version.exe and follow the prompts to install the program.
  • At the end, be sure a check-mark is placed next to the following:
  • Enable free trial of Malwarebytes Anti-Malware Premium
  • Launch Malwarebytes Anti-Malware
  • Then click Finish.
  • If an update is found, you will be prompted to download and install the latest version.
  • Once the program has loaded, select Scan now. Or select the Threat Scan from the Scan menu.
  • When the scan is complete , make sure that everything is set to "Quarantine", and click Apply Actions.
  • Reboot your computer if prompted.


    Posting the Malwarebytes log.

  • After the restart once you are back at your desktop, open MBAM once more.
  • Click on the History tab > Application Logs.
  • Double click on the Scan Log which shows the Date and time of the scan just performed.
  • Click 'Export'.
  • Click 'Text file (*.txt)'
  • In the Save File dialog box which appears, click on Desktop.
  • In the File name: box type a name for your scan log.
  • A message box named 'File Saved' should appear stating "Your file has been successfully exported".
  • Click Ok
  • Attach that saved log to your next reply.

  • 0

#7
maulik10

maulik10

    Member

  • Topic Starter
  • Member
  • PipPip
  • 13 posts

thank you i have download the software and run the scan now i am attaching my file it is named results ok once you look over it please let me know that now my computer is clean or not thank you.

Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 4/18/2015
Scan Time: 2:33:18 PM
Logfile: results.txt
Administrator: Yes

Version: 2.01.4.1018
Malware Database: v2015.04.18.03
Rootkit Database: v2015.03.31.01
License: Trial
Malware Protection: Enabled
Malicious Website Protection: Enabled
Self-protection: Disabled

OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: Maulik

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 350583
Time Elapsed: 21 min, 27 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 97
PUP.Optional.SaveSense.A, HKLM\SOFTWARE\CLASSES\APPID\{A2D3FB7A-6873-45E8-AF96-57092D721828}, Quarantined, [d63581ed9ceeeb4b9096e65e8c770cf4],
PUP.Optional.SaveSense.A, HKLM\SOFTWARE\CLASSES\SaveSenseLiveUpdate.OnDemandCOMClassSvc, Quarantined, [d63581ed9ceeeb4b9096e65e8c770cf4],
PUP.Optional.SaveSense.A, HKLM\SOFTWARE\CLASSES\SaveSenseLiveUpdate.OnDemandCOMClassSvc.1.0, Quarantined, [d63581ed9ceeeb4b9096e65e8c770cf4],
PUP.Optional.SaveSense.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\SaveSenseLiveUpdate.OnDemandCOMClassSvc, Quarantined, [d63581ed9ceeeb4b9096e65e8c770cf4],
PUP.Optional.SaveSense.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\SaveSenseLiveUpdate.OnDemandCOMClassSvc.1.0, Quarantined, [d63581ed9ceeeb4b9096e65e8c770cf4],
PUP.Optional.SaveSense.A, HKLM\SOFTWARE\CLASSES\WOW6432NODE\SaveSenseLiveUpdate.OnDemandCOMClassSvc, Quarantined, [d63581ed9ceeeb4b9096e65e8c770cf4],
PUP.Optional.SaveSense.A, HKLM\SOFTWARE\CLASSES\WOW6432NODE\SaveSenseLiveUpdate.OnDemandCOMClassSvc.1.0, Quarantined, [d63581ed9ceeeb4b9096e65e8c770cf4],
PUP.Optional.SaveSense.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\APPID\{A2D3FB7A-6873-45E8-AF96-57092D721828}, Quarantined, [d63581ed9ceeeb4b9096e65e8c770cf4],
PUP.Optional.SaveSense.A, HKLM\SOFTWARE\CLASSES\WOW6432NODE\APPID\{A2D3FB7A-6873-45E8-AF96-57092D721828}, Quarantined, [d63581ed9ceeeb4b9096e65e8c770cf4],
PUP.Optional.SaveSense.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{A2D3FB7A-6873-45E8-AF96-57092D721828}, Quarantined, [d63581ed9ceeeb4b9096e65e8c770cf4],
PUP.Optional.SaveSense.A, HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{A2D3FB7A-6873-45E8-AF96-57092D721828}, Quarantined, [d63581ed9ceeeb4b9096e65e8c770cf4],
PUP.Optional.MySearchDial.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{D40753C7-8A59-4C1F-BE88-C300F4624D5B}, Quarantined, [d437cda15a304fe759fca2d6b44fcc34],
PUP.Optional.MySearchDial.A, HKLM\SOFTWARE\CLASSES\TYPELIB\{C292AD0A-C11F-479B-B8DB-743E72D283B0}, Quarantined, [d437cda15a304fe759fca2d6b44fcc34],
PUP.Optional.MySearchDial.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\TYPELIB\{C292AD0A-C11F-479B-B8DB-743E72D283B0}, Quarantined, [d437cda15a304fe759fca2d6b44fcc34],
PUP.Optional.MySearchDial.A, HKLM\SOFTWARE\CLASSES\WOW6432NODE\TYPELIB\{C292AD0A-C11F-479B-B8DB-743E72D283B0}, Quarantined, [d437cda15a304fe759fca2d6b44fcc34],
PUP.Optional.MySearchDial.A, HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{D40753C7-8A59-4C1F-BE88-C300F4624D5B}, Quarantined, [d437cda15a304fe759fca2d6b44fcc34],
PUP.Optional.SaveSense.A, HKU\S-1-5-21-891173389-2658835656-2395992767-1000\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{71e129ff-6c2a-4984-818c-7e2c998b8d99}, Quarantined, [a06bde90058532048bcc2f1346bda45c],
PUP.Optional.SaveSense.A, HKU\S-1-5-21-891173389-2658835656-2395992767-1000\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{71E129FF-6C2A-4984-818C-7E2C998B8D99}, Quarantined, [a06bde90058532048bcc2f1346bda45c],
PUP.Optional.SaveSense.A, HKU\S-1-5-21-891173389-2658835656-2395992767-1000\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{71E129FF-6C2A-4984-818C-7E2C998B8D99}, Quarantined, [a06bde90058532048bcc2f1346bda45c],
PUP.Optional.UninstallBHO, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{AD11DADE-C597-45D9-D8C5-1D2EB0B89613}, Quarantined, [02095717a8e2cd691cf932fe19e9659b],
PUP.Optional.SaveSense.A, HKLM\SOFTWARE\CLASSES\SaveSenseLive.OneClickCtrl.9, Quarantined, [11fa531b3258df57f60ccd65c83de11f],
PUP.Optional.SaveSense.A, HKLM\SOFTWARE\CLASSES\SaveSenseLive.OneClickProcessLauncherMachine, Quarantined, [ad5e90de375364d2ef133af8759007f9],
PUP.Optional.SaveSense.A, HKLM\SOFTWARE\CLASSES\SaveSenseLive.OneClickProcessLauncherMachine.1.0, Quarantined, [ea2128463f4b64d216ec70c260a5728e],
PUP.Optional.SaveSense.A, HKLM\SOFTWARE\CLASSES\SaveSenseLive.Update3WebControl.3, Quarantined, [54b74529e3a743f39a68d55d877e17e9],
PUP.Optional.SaveSense.A, HKLM\SOFTWARE\CLASSES\SaveSenseLiveUpdate.CoCreateAsync, Quarantined, [d536fc72bbcf171f16ecab87c5408b75],
PUP.Optional.SaveSense.A, HKLM\SOFTWARE\CLASSES\SaveSenseLiveUpdate.CoCreateAsync.1.0, Quarantined, [33d83c3295f5c274de2436fcac59f20e],
PUP.Optional.SaveSense.A, HKLM\SOFTWARE\CLASSES\SaveSenseLiveUpdate.CoreClass, Quarantined, [e32849257a1069cd56aca09242c323dd],
PUP.Optional.SaveSense.A, HKLM\SOFTWARE\CLASSES\SaveSenseLiveUpdate.CoreClass.1, Quarantined, [9873e18d1a7087af748e0929b84dc43c],
PUP.Optional.SaveSense.A, HKLM\SOFTWARE\CLASSES\SaveSenseLiveUpdate.CoreMachineClass, Quarantined, [c447eb83751560d63ec41e142cd9a759],
PUP.Optional.SaveSense.A, HKLM\SOFTWARE\CLASSES\SaveSenseLiveUpdate.CoreMachineClass.1, Quarantined, [010acf9f6f1b87af9b6768ca1de8be42],
PUP.Optional.SaveSense.A, HKLM\SOFTWARE\CLASSES\SaveSenseLiveUpdate.CredentialDialogMachine, Quarantined, [8d7e79f5ddadf54182802e04a5602ed2],
PUP.Optional.SaveSense.A, HKLM\SOFTWARE\CLASSES\SaveSenseLiveUpdate.CredentialDialogMachine.1.0, Quarantined, [69a294da771340f60ef48ba7699c38c8],
PUP.Optional.SaveSense.A, HKLM\SOFTWARE\CLASSES\SaveSenseLiveUpdate.OnDemandCOMClassMachine, Quarantined, [78936c029feb9b9b49b970c2ab5ac23e],
PUP.Optional.SaveSense.A, HKLM\SOFTWARE\CLASSES\SaveSenseLiveUpdate.OnDemandCOMClassMachine.1.0, Quarantined, [d536bfafbad0e84e837f52e0b74e20e0],
PUP.Optional.SaveSense.A, HKLM\SOFTWARE\CLASSES\SaveSenseLiveUpdate.OnDemandCOMClassMachineFallback, Quarantined, [25e6f975ccbee84e3bc7e250a560d62a],
PUP.Optional.SaveSense.A, HKLM\SOFTWARE\CLASSES\SaveSenseLiveUpdate.OnDemandCOMClassMachineFallback.1.0, Quarantined, [1feceb838604af8722e05fd3bb4ad030],
PUP.Optional.SaveSense.A, HKLM\SOFTWARE\CLASSES\SaveSenseLiveUpdate.ProcessLauncher, Quarantined, [808bcf9f008a87af4eb4ef4348bdfd03],
PUP.Optional.SaveSense.A, HKLM\SOFTWARE\CLASSES\SaveSenseLiveUpdate.ProcessLauncher.1.0, Quarantined, [0902660802881620d131161c8f769e62],
PUP.Optional.SaveSense.A, HKLM\SOFTWARE\CLASSES\SaveSenseLiveUpdate.Update3COMClassService, Quarantined, [8f7cf5791d6d10267f83bb7729dc8e72],
PUP.Optional.SaveSense.A, HKLM\SOFTWARE\CLASSES\SaveSenseLiveUpdate.Update3COMClassService.1.0, Quarantined, [f318b3bb7b0f9a9c976b250ded187888],
PUP.Optional.SaveSense.A, HKLM\SOFTWARE\CLASSES\SaveSenseLiveUpdate.Update3WebMachine, Quarantined, [20ebfa74fb8f2f07d32f31017c890df3],
PUP.Optional.SaveSense.A, HKLM\SOFTWARE\CLASSES\SaveSenseLiveUpdate.Update3WebMachine.1.0, Quarantined, [b5560767711963d3a65cff332adb58a8],
PUP.Optional.SaveSense.A, HKLM\SOFTWARE\CLASSES\SaveSenseLiveUpdate.Update3WebMachineFallback, Quarantined, [8b80c4aae9a10b2b26dc01318f761ce4],
PUP.Optional.SaveSense.A, HKLM\SOFTWARE\CLASSES\SaveSenseLiveUpdate.Update3WebMachineFallback.1.0, Quarantined, [63a8a1cded9dca6c6a98240e32d3bb45],
PUP.Optional.SaveSense.A, HKLM\SOFTWARE\CLASSES\SaveSenseLiveUpdate.Update3WebSvc, Quarantined, [f318dc92cbbf0630956dca6855b0e719],
PUP.Optional.SaveSense.A, HKLM\SOFTWARE\CLASSES\SaveSenseLiveUpdate.Update3WebSvc.1.0, Quarantined, [c744ff6f4842c175de24aa88a2638080],
PUP.Optional.SaveSense.A, HKLM\SOFTWARE\CLASSES\APPID\SaveSenseLive.exe, Quarantined, [15f6432b2664ef47629fcf63050016ea],
PUP.Optional.SaveSense.A, HKLM\SOFTWARE\CLASSES\WOW6432NODE\APPID\SaveSenseLive.exe, Quarantined, [a86389e5fe8c360005fcbc764eb736ca],
PUP.Optional.MySearchDial.A, HKLM\SOFTWARE\GOOGLE\CHROME\EXTENSIONS\pflphaooapbgpeakohlggbpidpppgdff, Quarantined, [010a511d7e0cfc3a6e904dc2f311d12f],
PUP.Optional.DealPly.A, HKLM\SOFTWARE\WOW6432NODE\DealPlyLive, Quarantined, [c645cba3cfbbe650e4dcff25ef1652ae],
PUP.Optional.Highlightly, HKLM\SOFTWARE\WOW6432NODE\Highlightly, Quarantined, [87846fffdeac95a1ac2039ff08fd33cd],
PUP.Optional.SaveSense.A, HKLM\SOFTWARE\WOW6432NODE\SaveSenseLive, Quarantined, [f01b82ec89019d99cc3bfa387095de22],
PUP.Optional.SaveSense.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\SaveSenseLive.OneClickCtrl.9, Quarantined, [bc4f422c513969cd4eb470c22fd645bb],
PUP.Optional.SaveSense.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\SaveSenseLive.OneClickProcessLauncherMachine, Quarantined, [fb10442ae6a4d36351b185ad31d46e92],
PUP.Optional.SaveSense.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\SaveSenseLive.OneClickProcessLauncherMachine.1.0, Quarantined, [19f24a2473174fe76e944ae83ec76e92],
PUP.Optional.SaveSense.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\SaveSenseLive.Update3WebControl.3, Quarantined, [2eddb1bd76145bdba85a72c056af2fd1],
PUP.Optional.SaveSense.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\SaveSenseLiveUpdate.CoCreateAsync, Quarantined, [f71416581d6d55e128da989acd3822de],
PUP.Optional.SaveSense.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\SaveSenseLiveUpdate.CoCreateAsync.1.0, Quarantined, [f714e38b4c3e7fb78c76e34f35d0dd23],
PUP.Optional.SaveSense.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\SaveSenseLiveUpdate.CoreClass, Quarantined, [7d8e78f65e2c320407fb33ff81841fe1],
PUP.Optional.SaveSense.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\SaveSenseLiveUpdate.CoreClass.1, Quarantined, [0308155991f94cea62a081b1986d1be5],
PUP.Optional.SaveSense.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\SaveSenseLiveUpdate.CoreMachineClass, Quarantined, [8586521c14761c1aaa58c46e1aeb659b],
PUP.Optional.SaveSense.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\SaveSenseLiveUpdate.CoreMachineClass.1, Quarantined, [719a2a446822ab8b9b675ad8d035718f],
PUP.Optional.SaveSense.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\SaveSenseLiveUpdate.CredentialDialogMachine, Quarantined, [18f3333bfc8e0b2b10f2f33fc0453ec2],
PUP.Optional.SaveSense.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\SaveSenseLiveUpdate.CredentialDialogMachine.1.0, Quarantined, [57b48de12862b68042c0131f4eb730d0],
PUP.Optional.SaveSense.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\SaveSenseLiveUpdate.OnDemandCOMClassMachine, Quarantined, [33d80866fd8dc4723bc7cb67ef164bb5],
PUP.Optional.SaveSense.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\SaveSenseLiveUpdate.OnDemandCOMClassMachine.1.0, Quarantined, [d5367ef043470b2b04fe9a98838216ea],
PUP.Optional.SaveSense.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\SaveSenseLiveUpdate.OnDemandCOMClassMachineFallback, Quarantined, [0dfef777bad07db92cd6b67cb055758b],
PUP.Optional.SaveSense.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\SaveSenseLiveUpdate.OnDemandCOMClassMachineFallback.1.0, Quarantined, [4bc04727ccbe50e66e9488aaf3129070],
PUP.Optional.SaveSense.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\SaveSenseLiveUpdate.ProcessLauncher, Quarantined, [8289c8a66d1df6400bf78ba701048d73],
PUP.Optional.SaveSense.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\SaveSenseLiveUpdate.ProcessLauncher.1.0, Quarantined, [be4de6881179033314ee55ddab5abf41],
PUP.Optional.SaveSense.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\SaveSenseLiveUpdate.Update3COMClassService, Quarantined, [7e8d343a1c6e94a255adf53dfb0a857b],
PUP.Optional.SaveSense.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\SaveSenseLiveUpdate.Update3COMClassService.1.0, Quarantined, [16f576f8622895a17a88b57dec19e61a],
PUP.Optional.SaveSense.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\SaveSenseLiveUpdate.Update3WebMachine, Quarantined, [15f606688dfd5fd747bbe44e50b59d63],
PUP.Optional.SaveSense.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\SaveSenseLiveUpdate.Update3WebMachine.1.0, Quarantined, [ec1f531b622878be0df54ee48d78dc24],
PUP.Optional.SaveSense.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\SaveSenseLiveUpdate.Update3WebMachineFallback, Quarantined, [58b372fc1d6dbe78a9593df5986ddd23],
PUP.Optional.SaveSense.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\SaveSenseLiveUpdate.Update3WebMachineFallback.1.0, Quarantined, [fe0dd698335740f647bbf63c2ed78b75],
PUP.Optional.SaveSense.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\SaveSenseLiveUpdate.Update3WebSvc, Quarantined, [0407a7c74d3dcd69cf3348eae223ee12],
PUP.Optional.SaveSense.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\SaveSenseLiveUpdate.Update3WebSvc.1.0, Quarantined, [55b64f1fa6e4bd79758d240e72936d93],
PUP.Optional.SaveSense.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\APPID\SaveSenseLive.exe, Quarantined, [66a5ff6f2b5f73c343be4ce6af5615eb],
PUP.Optional.MySearchDial.A, HKLM\SOFTWARE\WOW6432NODE\GOOGLE\CHROME\EXTENSIONS\pflphaooapbgpeakohlggbpidpppgdff, Quarantined, [a566d59943473df9c33b5fb093716799],
PUP.Optional.ConduitTB.Gen, HKLM\SOFTWARE\WOW6432NODE\GOOGLE\CHROME\EXTENSIONS\GPKDNELACFDBMLCELMAIABGHMHAOCEEF, Quarantined, [d734620cabdf1b1b3ef57a444ab9a35d],
PUP.Optional.MySearchDial.A, HKU\S-1-5-21-891173389-2658835656-2395992767-1000\SOFTWARE\mysearchdial.com, Quarantined, [2be073fb2961c96dd194170d729331cf],
PUP.Optional.SaveSense.A, HKU\S-1-5-21-891173389-2658835656-2395992767-1000\SOFTWARE\SaveSense, Quarantined, [4dbe6509078353e3f60d161cf510867a],
PUP.Optional.SaveSense.A, HKU\S-1-5-21-891173389-2658835656-2395992767-1000\SOFTWARE\SaveSenseLive, Quarantined, [7893a8c6e9a1a78fce36240e50b5ce32],
PUP.Optional.Conduit.A, HKU\S-1-5-21-891173389-2658835656-2395992767-1000\SOFTWARE\APPDATALOW\SOFTWARE\ConduitSearchScopes, Quarantined, [c843036ba6e4f93dfd7840951ae919e7],
PUP.Optional.Conduit.A, HKU\S-1-5-21-891173389-2658835656-2395992767-1000\SOFTWARE\CONDUIT\FF, Quarantined, [709b45293753c86ec709dd4bf510926e],
PUP.Optional.AlexaTB.A, HKU\S-1-5-21-891173389-2658835656-2395992767-1000\SOFTWARE\DISTROMATIC\Toolbars, Quarantined, [a3684f1fa3e7cd69587e0425a560a759],
PUP.Optional.MySearchDial.A, HKU\S-1-5-21-891173389-2658835656-2395992767-1000\SOFTWARE\GOOGLE\CHROME\EXTENSIONS\pflphaooapbgpeakohlggbpidpppgdff, Quarantined, [17f4541a8505e74f16e7957ab84cc739],
PUP.Optional.ConduitTB.Gen, HKU\S-1-5-21-891173389-2658835656-2395992767-1000\SOFTWARE\GOOGLE\CHROME\EXTENSIONS\GPKDNELACFDBMLCELMAIABGHMHAOCEEF, Quarantined, [d13a4d21aedc0f2757dd437bea1941bf],
PUP.Optional.InstallCore.A, HKU\S-1-5-21-891173389-2658835656-2395992767-1000\SOFTWARE\INSTALLCORE\1I1T1Q1S, Quarantined, [c744f975e6a42e08d5c128e5bc48c739],
PUP.Optional.InstallCore.A, HKU\S-1-5-21-891173389-2658835656-2395992767-1000\SOFTWARE\INSTALLCORE, Quarantined, [8883185616740432a6c24dd6040160a0],
PUP.Optional.SaveSense, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{998745A3-2AE4-488D-8092-B98FB20A00C2}, Quarantined, [7299bab44743082ef8e3f6976c977b85],
PUP.Optional.SaveSense, HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{998745A3-2AE4-488D-8092-B98FB20A00C2}, Quarantined, [7299bab44743082ef8e3f6976c977b85],
PUP.Optional.SaveSense, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{C1424421-D274-491E-9D47-11C8D8CB5F9A}, Quarantined, [7299bab44743082ef8e3f6976c977b85],
PUP.Optional.SaveSense, HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{C1424421-D274-491E-9D47-11C8D8CB5F9A}, Quarantined, [7299bab44743082ef8e3f6976c977b85],
PUP.Optional.SaveSense, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\SAVESENSELIVE.EXE, Quarantined, [7299bab44743082ef8e3f6976c977b85],
PUP.Optional.SaveSense, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\SAVESENSELIVE.EXE, Quarantined, [7299bab44743082ef8e3f6976c977b85],

Registry Values: 11
PUP.Optional.ConduitTB.Gen, HKLM\SOFTWARE\WOW6432NODE\GOOGLE\CHROME\EXTENSIONS\gpkdnelacfdbmlcelmaiabghmhaoceef|path, C:\Users\Maulik\AppData\Local\CRE\gpkdnelacfdbmlcelmaiabghmhaoceef.crx, Quarantined, [d734620cabdf1b1b3ef57a444ab9a35d]
PUP.Optional.GoodForYou.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{BB82DE59-BC4C-4172-9AC4-73315F71CFFE}|FaviconURL, http://websearch.goo...nfo/favicon.ico, Quarantined, [63a8c4aa4a40c373fe2d2f2320e5f20e]
PUP.Optional.GoodForYou.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{BB82DE59-BC4C-4172-9AC4-73315F71CFFE}|FaviconURLFallback, http://websearch.goo...nfo/favicon.ico, Quarantined, [9e6d6c0201895adc74b77cd65da811ef]
PUP.Optional.GoodForYou.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{BB82DE59-BC4C-4172-9AC4-73315F71CFFE}|URL, http://websearch.goo...cc=US&unqvl=86,Quarantined, [d932e589ed9dfd39ab808cc6b94cc937]
PUP.Optional.Highlightly.A, HKLM\SOFTWARE\WOW6432NODE\MOZILLA\FIREFOX\EXTENSIONS|[email protected], C:\Program Files (x86)\Mozilla Firefox\extensions\[email protected], Quarantined, [40cbb3bbc3c76dc92bf1b54ed331a35d]
PUP.Optional.ConduitTB.Gen, HKU\S-1-5-21-891173389-2658835656-2395992767-1000\SOFTWARE\GOOGLE\CHROME\EXTENSIONS\gpkdnelacfdbmlcelmaiabghmhaoceef|path, C:\Users\Maulik\AppData\Local\CRE\gpkdnelacfdbmlcelmaiabghmhaoceef.crx, Quarantined, [d13a4d21aedc0f2757dd437bea1941bf]
PUP.Optional.InstallCore.A, HKU\S-1-5-21-891173389-2658835656-2395992767-1000\SOFTWARE\INSTALLCORE|tb, 0X2O1C0R2R1R, Quarantined, [8883185616740432a6c24dd6040160a0]
PUP.Optional.Spigot.A, HKU\S-1-5-21-891173389-2658835656-2395992767-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{8552A5F7-68D6-4B7E-B34A-0708F8C7F986}|URL, https://search.yahoo...={searchTerms},Quarantined, [ac5f8fdf5337ee488156823d57ac9868]
PUP.Optional.GoodForYou.A, HKU\S-1-5-21-891173389-2658835656-2395992767-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{BB82DE59-BC4C-4172-9AC4-73315F71CFFE}|FaviconURL, http://websearch.goo...nfo/favicon.ico, Quarantined, [60ab0f5f5f2b3df9d555b69c5fa6b749]
PUP.Optional.GoodForYou.A, HKU\S-1-5-21-891173389-2658835656-2395992767-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{BB82DE59-BC4C-4172-9AC4-73315F71CFFE}|FaviconURLFallback, http://websearch.goo...nfo/favicon.ico, Quarantined, [33d89ed07b0fc17560ca64ee50b56f91]
PUP.Optional.GoodForYou.A, HKU\S-1-5-21-891173389-2658835656-2395992767-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{BB82DE59-BC4C-4172-9AC4-73315F71CFFE}|URL, http://websearch.goo...cc=US&unqvl=86,Quarantined, [0dfea4caeaa036006cbe3e14ac596997]

Registry Data: 3
PUP.Optional.MySearchDial.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\ABOUTURLS|Tabs, http://start.mysearc...r=860089911&ir=, Good: (www.google.com), Bad: (http://start.mysearchdial.com/?f=2&a=dnldstr0103&cd=2XzuyEtN2Y1L1QzuyCyEtByBtAyB0FtB0AtAyDtByBzztC0AtN0D0Tzu0SyByDyBtN1L2XzutBtFtBtFtCyDtFtCyCtAtCtN1L1CzutD1V1Q1L1V1B1J1V1N1V1B1V2Y1B1V2W1L1GyB1V1O1O1VyCyE1VtDtCtDtDtGtDtDtDtD1V1R2ZtAtAtCzzyCyCzy&cr=860089911&ir=),Replaced,[bd4e016d13771224689bf2056c99d828]
PUP.Optional.WebSearchInfo, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN|Start Page, http://websearch.goo...&cc=US&unqvl=86, Good: (www.google.com), Bad: (http://websearch.goodforsearch.info/?pid=24380&r=2015/04/14&hid=8004382613692767312&lg=EN&cc=US&unqvl=86),Replaced,[c447bdb1325881b58daddf18c441ae52]
PUP.Optional.WebSearchInfo, HKU\S-1-5-21-891173389-2658835656-2395992767-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Start Page, http://websearch.goo...&cc=US&unqvl=86, Good: (www.google.com), Bad: (http://websearch.goodforsearch.info/?pid=24380&r=2015/04/14&hid=8004382613692767312&lg=EN&cc=US&unqvl=86),Replaced,[927927470981171f91a86196a164d22e]

Folders: 30
PUP.Optional.ConduitTB.Gen, C:\Users\Maulik\AppData\Local\CRE, Quarantined, [16f53836fc8e5fd7e74b7e40d62d649c],
PUP.Optional.MultiPlug.A, C:\Users\Maulik\AppData\Roaming\Mozilla\Firefox\Profiles\6u0wperb.default\extensions\[email protected]\content, Quarantined, [0efdb8b6404aaa8c5a03f26023e24fb1],
PUP.Optional.MultiPlug.A, C:\Users\Maulik\AppData\Roaming\Mozilla\Firefox\Profiles\6u0wperb.default\extensions\[email protected], Quarantined, [0efdb8b6404aaa8c5a03f26023e24fb1],
PUP.Optional.OpenCandy, C:\Users\Maulik\AppData\Roaming\OpenCandy, Quarantined, [73984826c9c178be8b0e9fede61d7789],
PUP.Optional.OpenCandy, C:\Users\Maulik\AppData\Roaming\OpenCandy\0B8BA06FCE5E44B4904B42C0D8335111, Quarantined, [73984826c9c178be8b0e9fede61d7789],
PUP.Optional.Conduit.A, C:\ProgramData\Conduit\IE, Quarantined, [34d7d797cbbfba7c5bb8fc910bf803fd],
PUP.Optional.Conduit.A, C:\ProgramData\Conduit\IE\CT3312248, Quarantined, [34d7d797cbbfba7c5bb8fc910bf803fd],
PUP.Optional.SaveSense, C:\Program Files (x86)\SaveSenseLive, Quarantined, [7299bab44743082ef8e3f6976c977b85],
PUP.Optional.SaveSense, C:\Program Files (x86)\SaveSenseLive\CrashReports, Quarantined, [7299bab44743082ef8e3f6976c977b85],
PUP.Optional.SaveSense, C:\Program Files (x86)\SaveSenseLive\Update, Quarantined, [7299bab44743082ef8e3f6976c977b85],
PUP.Optional.SaveSense, C:\Program Files (x86)\SaveSenseLive\Update\1.3.23.0, Quarantined, [7299bab44743082ef8e3f6976c977b85],
PUP.Optional.SaveSense, C:\Program Files (x86)\SaveSenseLive\Update\Download, Quarantined, [7299bab44743082ef8e3f6976c977b85],
PUP.Optional.SaveSense, C:\Program Files (x86)\SaveSenseLive\Update\Install, Quarantined, [7299bab44743082ef8e3f6976c977b85],
PUP.Optional.SaveSense, C:\Program Files (x86)\SaveSenseLive\Update\Offline, Quarantined, [7299bab44743082ef8e3f6976c977b85],
PUP.Optional.SaveSense, C:\Program Files (x86)\SaveSenseLive\Update\Offline\{A8203906-A564-4DD6-8A84-0BC9FA7915DA}, Quarantined, [7299bab44743082ef8e3f6976c977b85],
PUP.Optional.SaveSense, C:\ProgramData\SaveSenseLive, Quarantined, [13f8e58971193cfaab31c9c403008b75],
PUP.Optional.SaveSense, C:\ProgramData\SaveSenseLive\Update, Quarantined, [13f8e58971193cfaab31c9c403008b75],
PUP.Optional.SaveSense, C:\ProgramData\SaveSenseLive\Update\Log, Quarantined, [13f8e58971193cfaab31c9c403008b75],
PUP.Optional.SaveSense, C:\Users\Maulik\AppData\Roaming\SaveSense, Quarantined, [8b806c0281093cfa8558c6c7f2118e72],
PUP.Optional.SaveSense, C:\Users\Maulik\AppData\Roaming\SaveSense\UpdateProc, Quarantined, [8b806c0281093cfa8558c6c7f2118e72],
PUP.Optional.SaveSense, C:\Users\Maulik\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SaveSense, Quarantined, [fd0e9bd3f5950a2c5d816c21d2318d73],
PUP.Optional.SaveSense.A, C:\Users\Maulik\AppData\Local\SaveSenseLive, Quarantined, [39d22747cac07db9469babe2b74cd729],
PUP.Optional.SaveSense.A, C:\Users\Maulik\AppData\Local\SaveSenseLive\CrashReports, Quarantined, [39d22747cac07db9469babe2b74cd729],
PUP.Optional.SaveSense.A, C:\Users\Maulik\AppData\Local\SaveSense, Quarantined, [f219a6c8503a58de4fe1236f55aeba46],
PUP.Optional.Mindspark.A, C:\Users\Maulik\AppData\Roaming\Mozilla\Firefox\Profiles\6u0wperb.default\HeadlineAlley_29, Quarantined, [41caadc12b5f5ed816a74d479b689f61],
PUP.Optional.Updater.A, C:\Users\Maulik\AppData\Roaming\UpdaterEX\UpdateProc, Quarantined, [48c33f2f3852c274730d3370e71c728e],
PUP.Optional.WhiteSmoke.A, C:\Users\Maulik\AppData\LocalLow\WhiteSmoke_New_V.12, Quarantined, [5bb03e30c4c6c76fae3ac8e49a699c64],
PUP.Optional.EzDownloader.A, C:\Users\Maulik\AppData\Roaming\EZDownloader, Quarantined, [36d51a545733fa3c667be2d32ed53ac6],
PUP.Optional.EzDownloader.A, C:\Users\Maulik\AppData\Roaming\EZDownloader\Errors, Quarantined, [36d51a545733fa3c667be2d32ed53ac6],
PUP.Optional.MyPCBackup.A, C:\Program Files (x86)\MyPC Backup, Quarantined, [e22990de2d5dee48933106b70ef501ff],

Files: 124
PUP.Optional.MultiPlug, C:\ProgramData\{416eca45-de47-9077-416e-eca45de42917}\Clash of Clans.exe, Quarantined, [c6456707365481b55f217bcc020034cc],
PUP.Optional.UninstallBHO, C:\Program Files (x86)\Facebook Invite Them All\Facebook Invite Them All.exe, Quarantined, [02095717a8e2cd691cf932fe19e9659b],
PUP.Optional.MultiPlug, C:\Users\Maulik\Downloads\[ZZSeries] Alektra Blue, Ava Addams, Dani Daniels, Gianna Nicole, Kayla Kayden, Kaylani Lei, Missy Martinez, Nikki Benz, Phoenix Marie, Romi Rain, Tory Lane (Brazzers House Episode Two _ 03.27.2015).exe, Quarantined, [2be08de1c0ca38fe48bbe35dc63ccb35],
PUP.Optional.Proinstall, C:\Users\Maulik\Downloads\C2J-33860593.exe, Quarantined, [6f9c8be356341a1c58801b2d28da21df],
PUP.Optional.SaveSence.A, C:\Users\Maulik\AppData\Local\SaveSense\SaveSenseIE.dll, Quarantined, [d9326707dfab49edc8b539f4927453ad],
PUP.Optional.ConduitTB.Gen, C:\Users\Maulik\AppData\Local\CRE\gpkdnelacfdbmlcelmaiabghmhaoceef.crx, Quarantined, [16f53836fc8e5fd7e74b7e40d62d649c],
PUP.Optional.Spigot.A, C:\Users\Maulik\AppData\Roaming\Mozilla\Firefox\Profiles\6u0wperb.default\searchplugins\yahoo_ff.xml, Quarantined, [6e9d90de296164d25997943ae81b24dc],
PUP.Optional.MultiPlug.A, C:\Users\Maulik\AppData\Roaming\Mozilla\Firefox\Profiles\6u0wperb.default\extensions\[email protected]\content\bg.js, Quarantined, [0efdb8b6404aaa8c5a03f26023e24fb1],
PUP.Optional.MultiPlug.A, C:\Users\Maulik\AppData\Roaming\Mozilla\Firefox\Profiles\6u0wperb.default\extensions\[email protected]\bootstrap.js, Quarantined, [0efdb8b6404aaa8c5a03f26023e24fb1],
PUP.Optional.MultiPlug.A, C:\Users\Maulik\AppData\Roaming\Mozilla\Firefox\Profiles\6u0wperb.default\extensions\[email protected]\chrome.manifest, Quarantined, [0efdb8b6404aaa8c5a03f26023e24fb1],
PUP.Optional.MultiPlug.A, C:\Users\Maulik\AppData\Roaming\Mozilla\Firefox\Profiles\6u0wperb.default\extensions\[email protected]\install.rdf, Quarantined, [0efdb8b6404aaa8c5a03f26023e24fb1],
PUP.Optional.OpenCandy, C:\Users\Maulik\AppData\Roaming\OpenCandy\0B8BA06FCE5E44B4904B42C0D8335111\SendoriSetupx11915.exe, Quarantined, [73984826c9c178be8b0e9fede61d7789],
PUP.Optional.Conduit.A, C:\ProgramData\Conduit\IE\CT3312248\UninstallerUI.exe, Quarantined, [34d7d797cbbfba7c5bb8fc910bf803fd],
PUP.Optional.SaveSense, C:\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_de.dll, Quarantined, [7299bab44743082ef8e3f6976c977b85],
PUP.Optional.SaveSense, C:\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_el.dll, Quarantined, [7299bab44743082ef8e3f6976c977b85],
PUP.Optional.SaveSense, C:\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_en-GB.dll, Quarantined, [7299bab44743082ef8e3f6976c977b85],
PUP.Optional.SaveSense, C:\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_en.dll, Quarantined, [7299bab44743082ef8e3f6976c977b85],
PUP.Optional.SaveSense, C:\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_es-419.dll, Quarantined, [7299bab44743082ef8e3f6976c977b85],
PUP.Optional.SaveSense, C:\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_es.dll, Quarantined, [7299bab44743082ef8e3f6976c977b85],
PUP.Optional.SaveSense, C:\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_et.dll, Quarantined, [7299bab44743082ef8e3f6976c977b85],
PUP.Optional.SaveSense, C:\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_fa.dll, Quarantined, [7299bab44743082ef8e3f6976c977b85],
PUP.Optional.SaveSense, C:\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_fi.dll, Quarantined, [7299bab44743082ef8e3f6976c977b85],
PUP.Optional.SaveSense, C:\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_fil.dll, Quarantined, [7299bab44743082ef8e3f6976c977b85],
PUP.Optional.SaveSense, C:\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_fr.dll, Quarantined, [7299bab44743082ef8e3f6976c977b85],
PUP.Optional.SaveSense, C:\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_gu.dll, Quarantined, [7299bab44743082ef8e3f6976c977b85],
PUP.Optional.SaveSense, C:\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_hi.dll, Quarantined, [7299bab44743082ef8e3f6976c977b85],
PUP.Optional.SaveSense, C:\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_hr.dll, Quarantined, [7299bab44743082ef8e3f6976c977b85],
PUP.Optional.SaveSense, C:\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_hu.dll, Quarantined, [7299bab44743082ef8e3f6976c977b85],
PUP.Optional.SaveSense, C:\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_id.dll, Quarantined, [7299bab44743082ef8e3f6976c977b85],
PUP.Optional.SaveSense, C:\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_it.dll, Quarantined, [7299bab44743082ef8e3f6976c977b85],
PUP.Optional.SaveSense, C:\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_iw.dll, Quarantined, [7299bab44743082ef8e3f6976c977b85],
PUP.Optional.SaveSense, C:\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_ja.dll, Quarantined, [7299bab44743082ef8e3f6976c977b85],
PUP.Optional.SaveSense, C:\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_kn.dll, Quarantined, [7299bab44743082ef8e3f6976c977b85],
PUP.Optional.SaveSense, C:\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_ko.dll, Quarantined, [7299bab44743082ef8e3f6976c977b85],
PUP.Optional.SaveSense, C:\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_lt.dll, Quarantined, [7299bab44743082ef8e3f6976c977b85],
PUP.Optional.SaveSense, C:\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_lv.dll, Quarantined, [7299bab44743082ef8e3f6976c977b85],
PUP.Optional.SaveSense, C:\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_ml.dll, Quarantined, [7299bab44743082ef8e3f6976c977b85],
PUP.Optional.SaveSense, C:\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_mr.dll, Quarantined, [7299bab44743082ef8e3f6976c977b85],
PUP.Optional.SaveSense, C:\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_ms.dll, Quarantined, [7299bab44743082ef8e3f6976c977b85],
PUP.Optional.SaveSense, C:\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_nl.dll, Quarantined, [7299bab44743082ef8e3f6976c977b85],
PUP.Optional.SaveSense, C:\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_no.dll, Quarantined, [7299bab44743082ef8e3f6976c977b85],
PUP.Optional.SaveSense, C:\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_pl.dll, Quarantined, [7299bab44743082ef8e3f6976c977b85],
PUP.Optional.SaveSense, C:\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_pt-BR.dll, Quarantined, [7299bab44743082ef8e3f6976c977b85],
PUP.Optional.SaveSense, C:\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_pt-PT.dll, Quarantined, [7299bab44743082ef8e3f6976c977b85],
PUP.Optional.SaveSense, C:\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_ro.dll, Quarantined, [7299bab44743082ef8e3f6976c977b85],
PUP.Optional.SaveSense, C:\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\goopdate.dll, Quarantined, [7299bab44743082ef8e3f6976c977b85],
PUP.Optional.SaveSense, C:\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_am.dll, Quarantined, [7299bab44743082ef8e3f6976c977b85],
PUP.Optional.SaveSense, C:\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_ar.dll, Quarantined, [7299bab44743082ef8e3f6976c977b85],
PUP.Optional.SaveSense, C:\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_bg.dll, Quarantined, [7299bab44743082ef8e3f6976c977b85],
PUP.Optional.SaveSense, C:\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_bn.dll, Quarantined, [7299bab44743082ef8e3f6976c977b85],
PUP.Optional.SaveSense, C:\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_ca.dll, Quarantined, [7299bab44743082ef8e3f6976c977b85],
PUP.Optional.SaveSense, C:\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_cs.dll, Quarantined, [7299bab44743082ef8e3f6976c977b85],
PUP.Optional.SaveSense, C:\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_sk.dll, Quarantined, [7299bab44743082ef8e3f6976c977b85],
PUP.Optional.SaveSense, C:\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_sl.dll, Quarantined, [7299bab44743082ef8e3f6976c977b85],
PUP.Optional.SaveSense, C:\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_sr.dll, Quarantined, [7299bab44743082ef8e3f6976c977b85],
PUP.Optional.SaveSense, C:\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_sv.dll, Quarantined, [7299bab44743082ef8e3f6976c977b85],
PUP.Optional.SaveSense, C:\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_sw.dll, Quarantined, [7299bab44743082ef8e3f6976c977b85],
PUP.Optional.SaveSense, C:\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_ta.dll, Quarantined, [7299bab44743082ef8e3f6976c977b85],
PUP.Optional.SaveSense, C:\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_te.dll, Quarantined, [7299bab44743082ef8e3f6976c977b85],
PUP.Optional.SaveSense, C:\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_th.dll, Quarantined, [7299bab44743082ef8e3f6976c977b85],
PUP.Optional.SaveSense, C:\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_tr.dll, Quarantined, [7299bab44743082ef8e3f6976c977b85],
PUP.Optional.SaveSense, C:\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_uk.dll, Quarantined, [7299bab44743082ef8e3f6976c977b85],
PUP.Optional.SaveSense, C:\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_ur.dll, Quarantined, [7299bab44743082ef8e3f6976c977b85],
PUP.Optional.SaveSense, C:\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_vi.dll, Quarantined, [7299bab44743082ef8e3f6976c977b85],
PUP.Optional.SaveSense, C:\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_zh-CN.dll, Quarantined, [7299bab44743082ef8e3f6976c977b85],
PUP.Optional.SaveSense, C:\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_zh-TW.dll, Quarantined, [7299bab44743082ef8e3f6976c977b85],
PUP.Optional.SaveSense, C:\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\psmachine.dll, Quarantined, [7299bab44743082ef8e3f6976c977b85],
PUP.Optional.SaveSense, C:\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\psuser.dll, Quarantined, [7299bab44743082ef8e3f6976c977b85],
PUP.Optional.SaveSense, C:\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\SaveSenseLive.exe, Quarantined, [7299bab44743082ef8e3f6976c977b85],
PUP.Optional.SaveSense, C:\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\SaveSenseLiveBroker.exe, Quarantined, [7299bab44743082ef8e3f6976c977b85],
PUP.Optional.SaveSense, C:\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\SaveSenseLiveHandler.exe, Quarantined, [7299bab44743082ef8e3f6976c977b85],
PUP.Optional.SaveSense, C:\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\SaveSenseLiveHelper.msi, Quarantined, [7299bab44743082ef8e3f6976c977b85],
PUP.Optional.SaveSense, C:\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\SaveSenseLiveOnDemand.exe, Quarantined, [7299bab44743082ef8e3f6976c977b85],
PUP.Optional.SaveSense, C:\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_da.dll, Quarantined, [7299bab44743082ef8e3f6976c977b85],
PUP.Optional.SaveSense, C:\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_is.dll, Quarantined, [7299bab44743082ef8e3f6976c977b85],
PUP.Optional.SaveSense, C:\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_ru.dll, Quarantined, [7299bab44743082ef8e3f6976c977b85],
PUP.Optional.SaveSense, C:\ProgramData\SaveSenseLive\Update\Log\SaveSenseLive.log, Quarantined, [13f8e58971193cfaab31c9c403008b75],
PUP.Optional.SaveSense, C:\Users\Maulik\AppData\Roaming\SaveSense\UpdateProc\config.dat, Quarantined, [8b806c0281093cfa8558c6c7f2118e72],
PUP.Optional.SaveSense, C:\Users\Maulik\AppData\Roaming\SaveSense\UpdateProc\STTL.DAT, Quarantined, [8b806c0281093cfa8558c6c7f2118e72],
PUP.Optional.SaveSense, C:\Users\Maulik\AppData\Roaming\SaveSense\UpdateProc\TTL.DAT, Quarantined, [8b806c0281093cfa8558c6c7f2118e72],
PUP.Optional.SaveSense, C:\Users\Maulik\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SaveSense\SaveSense Help.url, Quarantined, [fd0e9bd3f5950a2c5d816c21d2318d73],
PUP.Optional.SaveSense, C:\Users\Maulik\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SaveSense\SaveSense.url, Quarantined, [fd0e9bd3f5950a2c5d816c21d2318d73],
PUP.Optional.SaveSense, C:\Users\Maulik\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SaveSense\Uninstall SaveSense.lnk, Quarantined, [fd0e9bd3f5950a2c5d816c21d2318d73],
PUP.Optional.SaveSense.A, C:\Users\Maulik\AppData\Local\SaveSense\icon.ico, Quarantined, [f219a6c8503a58de4fe1236f55aeba46],
PUP.Optional.SaveSense.A, C:\Users\Maulik\AppData\Local\SaveSense\installer_icon.ico, Quarantined, [f219a6c8503a58de4fe1236f55aeba46],
PUP.Optional.SaveSense.A, C:\Users\Maulik\AppData\Local\SaveSense\SaveSense.crx, Quarantined, [f219a6c8503a58de4fe1236f55aeba46],
PUP.Optional.SaveSense.A, C:\Users\Maulik\AppData\Local\SaveSense\SaveSense.xpi, Quarantined, [f219a6c8503a58de4fe1236f55aeba46],
PUP.Optional.SaveSense.A, C:\Users\Maulik\AppData\Local\SaveSense\SaveSenseIE64.dll, Quarantined, [f219a6c8503a58de4fe1236f55aeba46],
PUP.Optional.SaveSense.A, C:\Users\Maulik\AppData\Local\SaveSense\SaveSenseUpdateVer.exe, Quarantined, [f219a6c8503a58de4fe1236f55aeba46],
PUP.Optional.SaveSense.A, C:\Users\Maulik\AppData\Local\SaveSense\uninst.exe, Quarantined, [f219a6c8503a58de4fe1236f55aeba46],
PUP.Optional.Mindspark.A, C:\Users\Maulik\AppData\Roaming\Mozilla\Firefox\Profiles\6u0wperb.default\HeadlineAlley_29\3B59294A-B729-49BB-8B51-7C9292957B23.sqlite, Quarantined, [41caadc12b5f5ed816a74d479b689f61],
PUP.Optional.Updater.A, C:\Users\Maulik\AppData\Roaming\UpdaterEX\UpdateProc\config.dat, Quarantined, [48c33f2f3852c274730d3370e71c728e],
PUP.Optional.Updater.A, C:\Users\Maulik\AppData\Roaming\UpdaterEX\UpdateProc\prod.dat, Quarantined, [48c33f2f3852c274730d3370e71c728e],
PUP.Optional.Updater.A, C:\Users\Maulik\AppData\Roaming\UpdaterEX\UpdateProc\STTL.DAT, Quarantined, [48c33f2f3852c274730d3370e71c728e],
PUP.Optional.Updater.A, C:\Users\Maulik\AppData\Roaming\UpdaterEX\UpdateProc\TTL.DAT, Quarantined, [48c33f2f3852c274730d3370e71c728e],
PUP.Optional.WhiteSmoke.A, C:\Users\Maulik\AppData\LocalLow\WhiteSmoke_New_V.12\tbWhit.dll, Quarantined, [5bb03e30c4c6c76fae3ac8e49a699c64],
PUP.Optional.MyPCBackup.A, C:\Program Files (x86)\MyPC Backup\DEL_UnRegisterExtensions.exe, Quarantined, [e22990de2d5dee48933106b70ef501ff],
PUP.Optional.Spigot.A, C:\Users\Maulik\AppData\Roaming\Mozilla\Firefox\Profiles\6u0wperb.default\prefs.js, Good: (), Bad: (user_pref("keyword.URL", "https://search.yahoo...=667671&p=");),Replaced,[c546244ad2b800365b81ef4d808607f9]
PUP.Optional.MySearchDial.A, C:\Users\Maulik\AppData\Roaming\Mozilla\Firefox\Profiles\6u0wperb.default\prefs.js, Good: (), Bad: (user_pref("extensions.mysearchdial.AL", 2);), Replaced,[5caf7ef096f4f83e6ee69fa1e1251ae6]
PUP.Optional.MySearchDial.A, C:\Users\Maulik\AppData\Roaming\Mozilla\Firefox\Profiles\6u0wperb.default\prefs.js, Good: (), Bad: (ser Preferences

/* Do not edit this file.
 *
 * If y), Replaced,[30db442a197160d61e36d26e6a9c4ab6]
PUP.Optional.MySearchDial.A, C:\Users\Maulik\AppData\Roaming\Mozilla\Firefox\Profiles\6u0wperb.default\prefs.js, Good: (), Bad: (s

/* Do not edit this file.
 *
 * If you make changes to this file while the app), Replaced,[e02b9dd199f174c26ee6241cdc2a2cd4]
PUP.Optional.MySearchDial.A, C:\Users\Maulik\AppData\Roaming\Mozilla\Firefox\Profiles\6u0wperb.default\prefs.js, Good: (), Bad: (e.
 *
 * If you make changes to this file while the application is running,
 * the changes will be overwritten when the application exits.
 *
 * To make a manual change to preferences, you can visit the URL about:config
 */

use), Replaced,[50bbd8966525191d64f0c47ca06604fc]
PUP.Optional.MySearchDial.A, C:\Users\Maulik\AppData\Roaming\Mozilla\Firefox\Profiles\6u0wperb.default\prefs.js, Good: (), Bad: (o make a manual change to preferences, you can visit ), Replaced,[6f9cbfaf4d3dab8b03513e027f87b14f]
PUP.Optional.MySearchDial.A, C:\Users\Maulik\AppData\Roaming\Mozilla\Firefox\Profiles\6u0wperb.default\prefs.js, Good: (), Bad: (ences

/* Do not edit this file.
 *
 * If you), Replaced,[b05bbab4484224128cc885bbd53103fd]
PUP.Optional.MySearchDial.A, C:\Users\Maulik\AppData\Roaming\Mozilla\Firefox\Profiles\6u0wperb.default\prefs.js, Good: (), Bad: (eferences

/* Do not edit this file.
 *
 * If yo), Replaced,[5ead58168efcff37ba9a033d4fb74bb5]
PUP.Optional.MySearchDial.A, C:\Users\Maulik\AppData\Roaming\Mozilla\Firefox\Profiles\6u0wperb.default\prefs.js, Good: (), Bad: (rences

/* Do not edit this file.
 *
 * If you), Replaced,[48c370febecc15217ed6ae925aac02fe]
PUP.Optional.MySearchDial.A, C:\Users\Maulik\AppData\Roaming\Mozilla\Firefox\Profiles\6u0wperb.default\prefs.js, Good: (), Bad: (ferences

/* Do not edit this file.
 *
 * If you), Replaced,[3ccf115d76143cfa78dc79c79d69f40c]
PUP.Optional.MySearchDial.A, C:\Users\Maulik\AppData\Roaming\Mozilla\Firefox\Profiles\6u0wperb.default\prefs.js, Good: (), Bad: (rences

/* Do not edit this file.
 *
 * If y), Replaced,[cf3ca3cb0d7dfc3ac39170d06a9cfd03]
PUP.Optional.MySearchDial.A, C:\Users\Maulik\AppData\Roaming\Mozilla\Firefox\Profiles\6u0wperb.default\prefs.js, Good: (), Bad: (references

/* Do not edit this file.
 *
 * If you make changes to this file while the application is running,
 * the changes will be overwritten when the application exits.
 *
 * To make a manual change to preferences, you can visit the URL about:config
 */

user_pref("CT3312248.FF19Solved", "true"), Replaced,[32d917573555191de2722917e422c43c]
PUP.Optional.MySearchDial.A, C:\Users\Maulik\AppData\Roaming\Mozilla\Firefox\Profiles\6u0wperb.default\prefs.js, Good: (), Bad: (
 */

user_pref("CT3312248.FF19Solved", "true");
user_pre), Replaced,[2cdf08668a0077bf72e2e060699d9769]
PUP.Optional.MySearchDial.A, C:\Users\Maulik\AppData\Roaming\Mozilla\Firefox\Profiles\6u0wperb.default\prefs.js, Good: (), Bad: (
/* Do not edit this file.
 *
 * If you make changes), Replaced,[8685f37b9eec8da98ec65de37d89eb15]
PUP.Optional.MySearchDial.A, C:\Users\Maulik\AppData\Roaming\Mozilla\Firefox\Profiles\6u0wperb.default\prefs.js, Good: (), Bad: (ces

/* Do not edit this file.
 *
 * If you ma), Replaced,[68a38ce23c4e4beb401495ab6d999d63]
PUP.Optional.MySearchDial.A, C:\Users\Maulik\AppData\Roaming\Mozilla\Firefox\Profiles\6u0wperb.default\prefs.js, Good: (), Bad: (ferences

/* Do not edit this file.
 *
 * If you make changes to this file while the application is running,
 * the changes will be overwritten when the application exits.
 *
 * To make a manual change to preferences, you can visit the URL about:config
 */

user_pref("CT3312248.FF19Solved", "true");
), Replaced,[c546dc92c7c3ff37ba9ae858996d6799]
PUP.Optional.MySearchDial.A, C:\Users\Maulik\AppData\Roaming\Mozilla\Firefox\Profiles\6u0wperb.default\prefs.js, Good: (), Bad: (*/

user_pref("CT3312248.FF19Solved", "true");
user_pref), Replaced,[8a81c9a5a5e5d0664d0747f95aaca25e]
PUP.Optional.MySearchDial.A, C:\Users\Maulik\AppData\Roaming\Mozilla\Firefox\Profiles\6u0wperb.default\prefs.js, Good: (), Bad: (

/* Do not edit this file.
 *
 * If you make changes to t), Replaced,[6d9e5618474339fdb2a25be5a165b44c]
PUP.Optional.MySearchDial.A, C:\Users\Maulik\AppData\Roaming\Mozilla\Firefox\Profiles\6u0wperb.default\prefs.js, Good: (), Bad: (
/* Do not edit this file.
 *
 * If you make changes to this ), Replaced,[f3184c220684b97df262c878b650fc04]
PUP.Optional.MySearchDial.A, C:\Users\Maulik\AppData\Roaming\Mozilla\Firefox\Profiles\6u0wperb.default\prefs.js, Good: (), Bad: (* Do not edit this file.
 *
 * If you make changes), Replaced,[d4374b2397f3b5815ff5b18fe71f659b]
PUP.Optional.MySearchDial.A, C:\Users\Maulik\AppData\Roaming\Mozilla\Firefox\Profiles\6u0wperb.default\prefs.js, Good: (), Bad: (rences

/* Do not edit this file.
 *
 * If you make changes to this file while the application is running,
 * the changes will be overwritten when the application exits.
 *
 * To make a manual change to preferences, you can visit the URL about:config
 */

user_pref("CT3312248.FF19Solved", "true");
user_pr), Replaced,[2cdfa1cd3951e551f55fe759a5618b75]
PUP.Optional.MySearchDial.A, C:\Users\Maulik\AppData\Roaming\Mozilla\Firefox\Profiles\6u0wperb.default\prefs.js, Good: (), Bad: (
user_pref("CT3312248.FF19Solved", "true");
user_pref), Replaced,[33d8e28c6525c96daaaadc643ccaea16]
PUP.Optional.MySearchDial.A, C:\Users\Maulik\AppData\Roaming\Mozilla\Firefox\Profiles\6u0wperb.default\prefs.js, Good: (), Bad: (nces

/* Do not edit this file.
 *
 * If you make c), Replaced,[13f8214d7b0fa393aea6ea56c2448080]
PUP.Optional.MySearchDial.A, C:\Users\Maulik\AppData\Roaming\Mozilla\Firefox\Profiles\6u0wperb.default\prefs.js, Good: (), Bad: (ferences

/* Do not edit this file.
 *
 * If you ), Replaced,[89825915a7e3db5b04505de35fa78f71]
PUP.Optional.MySearchDial.A, C:\Users\Maulik\AppData\Roaming\Mozilla\Firefox\Profiles\6u0wperb.default\prefs.js, Good: (), Bad: (ences

/* Do not edit this file.
 *
 * If you make ), Replaced,[cd3e630b2367999d0a4a42fe0ef859a7]
PUP.Optional.MySearchDial.A, C:\Users\Maulik\AppData\Roaming\Mozilla\Firefox\Profiles\6u0wperb.default\prefs.js, Good: (), Bad: (ces

/* Do not edit this file.
 *
 * If you make changes to th), Replaced,[20ebf5798efcc17597bdb58b35d1758b]
PUP.Optional.ASK.A, C:\Users\Maulik\AppData\Roaming\Mozilla\Firefox\Profiles\6u0wperb.default\prefs.js, Good: (), Bad: (user_pref("extensions.toolbar.mindspark._29Members_.browser.startup.homepage.tb", "http://home.tb.ask.c...oogle_news");),Replaced,[2dde3d316228989ef4333d049571718f]

Physical Sectors: 0
(No malicious items detected)


(end)


  • 0

#8
zep516

zep516

    Trusted Helper

  • Malware Removal
  • 8,090 posts
Next

Please download AdwCleaner by Xplode onto your Desktop.
  • Close all open programs and internet browsers.
  • Double click on AdwCleaner.exe to run the tool.
  • Click the Scan button and wait for the process to complete.
  • Click the logfile button and the log will open in Notepad.
  • NOTE: If you get an error message, it means that nothing was found. Exit from AdwCleaner.
  • Click on the Clean button follow the prompts.
  • A log file will automatically open after the scan has finished and the PC has rebooted.
  • Please post the content of that log file with your next answer.
  • You can find the log file at C:\AdwCleaner
  • Next

    thisisujrt.gif Please download Junkware Removal Tool to your Desktop.

    Please close your security software to avoid potential conflicts. See Here how to disable you security protection (Anti Virus)
    Run the tool by double-clicking it. If you are using Windows Vista or 7, right-mouse click it and select Run as administrator.
    The tool will open and start scanning your system.
    Please be patient as this can take a while to complete, depending on your system's specifications.
    On completion, a log (JRT.txt) is saved to your Desktop and will automatically open.
    Please post the contents of JRT.txt into your reply.


    In your next reply post;
    • The AdwCleaner [SO].txt Log
    • The JRT.txt Log
    Thanks
    Joe :)

  • 0

#9
maulik10

maulik10

    Member

  • Topic Starter
  • Member
  • PipPip
  • 13 posts

hi there ok i done the both things but thr JRT.txt i didn't get it whenver i run the jrt it doesn't give me anything i am replying to this post from the different computer so i cannot provide you cleaner so file but can you tell me what should i do next .

thanks maulik


  • 0

#10
zep516

zep516

    Trusted Helper

  • Malware Removal
  • 8,090 posts
Post the adwCleaner log, then we move on. We need to reinstall Chrome. I'll tell you how after I get the cleaner log report.
  • 0

Advertisements


#11
maulik10

maulik10

    Member

  • Topic Starter
  • Member
  • PipPip
  • 13 posts

ok i am posting it here and you said we have to reinstall the chrome but this happened in the firefox just asking ok log is attched below:

# AdwCleaner v4.201 - Logfile created 18/04/2015 at 15:29:31
# Updated 08/04/2015 by Xplode
# Database : 2015-04-18.3 [Server]
# Operating system : Windows 7 Home Premium Service Pack 1 (x64)
# Username : Maulik - MAULIK-PC
# Running from : C:\Users\Maulik\Desktop\adwcleaner_4.201.exe
# Option : Cleaning

***** [ Services ] *****


***** [ Files / Folders ] *****

Folder Deleted : C:\ProgramData\AVG SafeGuard toolbar
Folder Deleted : C:\ProgramData\Conduit
Folder Deleted : C:\ProgramData\e46c39e0000029b2
Folder Deleted : C:\Program Files (x86)\Advanced System Protector
Folder Deleted : C:\Program Files (x86)\Conduit
Folder Deleted : C:\Program Files (x86)\rightsurf
Folder Deleted : C:\Program Files (x86)\UNiDealls
Folder Deleted : C:\Program Files (x86)\UniuDeailssi
Folder Deleted : C:\Program Files (x86)\youtubeadblocker
Folder Deleted : C:\Users\Maulik\AppData\Local\Conduit
Folder Deleted : C:\Users\Maulik\AppData\Local\emaze
Folder Deleted : C:\Users\Maulik\AppData\Local\pokki
Folder Deleted : C:\Users\Maulik\AppData\LocalLow\Conduit
Folder Deleted : C:\Users\Maulik\AppData\Roaming\Systweak
Folder Deleted : C:\Users\Maulik\AppData\Roaming\UpdaterEX
Folder Deleted : C:\Users\Maulik\AppData\Roaming\download Manager
Folder Deleted : C:\Users\Maulik\AppData\Roaming\Mozilla\Firefox\Profiles\6u0wperb.default\Extensions\[email protected]

***** [ Scheduled tasks ] *****


***** [ Shortcuts ] *****


***** [ Registry ] *****

Key Deleted : HKCU\Software\Classes\pokki
Key Deleted : HKCU\Software\Classes\MIME\Database\Content Type\application/x-pokkidownloadhelper
Key Deleted : HKLM\SOFTWARE\0ea4c0f1-1206-4a60-9382-155f65a0bedf
Key Deleted : HKLM\SOFTWARE\Classes\Toolbar.CT3312248
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{4D076AB4-7562-427A-B5D2-BD96E19DEE56}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{997E3BFB-F821-411C-8B96-D61D415EC8FA}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{C292AD0A-C11F-479B-B8DB-743E72D283B0}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{1070C156-160B-47A0-B7D9-1860396BAB57}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{27CE191D-733B-4450-AFCD-096D105288C3}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{39A29266-D3E4-462D-AB05-F93B1053F6CF}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{44FC7A33-2E5C-48DC-B6F5-B81E8005D122}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{73192D81-6D24-4C40-BF7B-2507C6FA0B1A}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{826D7151-8D99-434B-8540-082B8C2AE556}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{88C606E7-BA26-41CB-8CC3-D1E313E34E75}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{93D3100A-BBB6-456C-96FC-82CAC5F383AC}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{997E3BFB-F821-411C-8B96-D61D415EC8FA}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{9E0546FF-D44F-4FE4-A324-995FCACB8D33}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{A18D16ED-27B2-4B83-B70C-15E73F099546}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{BEE7E029-5037-4DAD-A2DB-82E397AB1A44}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{CDDAB3A4-E64D-4AE0-9E1D-F3132F5F913F}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{E66A759D-367F-433E-85C6-ED7F040BCC32}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{F4B8D46C-4EEE-401B-8607-DC03025F34B1}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{459DD0F7-0D55-D3DC-67BC-E6BE37E9D762}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8FFE}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{11549FE4-7C5A-4C17-9FC3-56FC5162A994}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{22848257-6A2D-4D2A-8D56-C886D25B8B58}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{22848257-6A2D-4D2A-8D56-C886D25B8B58}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{A18D16ED-27B2-4B83-B70C-15E73F099546}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{BEE7E029-5037-4DAD-A2DB-82E397AB1A44}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{27CE191D-733B-4450-AFCD-096D105288C3}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A18D16ED-27B2-4B83-B70C-15E73F099546}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{BEE7E029-5037-4DAD-A2DB-82E397AB1A44}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8FFE}
Key Deleted : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{BB82DE59-BC4C-4172-9AC4-73315F71CFFE}
Key Deleted : HKCU\Software\Conduit
Key Deleted : HKCU\Software\distromatic
Key Deleted : HKCU\Software\Myfree Codec
Key Deleted : HKCU\Software\ParetoLogic
Key Deleted : HKCU\Software\Softonic
Key Deleted : HKCU\Software\systweak
Key Deleted : HKCU\Software\UpdaterEX
Key Deleted : HKCU\Software\AppDataLow\{4A0F38A9-FE55-4B89-B73F-E60FDC0F72E9}
Key Deleted : HKCU\Software\AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}
Key Deleted : HKCU\Software\AppDataLow\Software\Conduit
Key Deleted : HKLM\SOFTWARE\{3A7D3E19-1B79-4E4E-BD96-5467DA2C4EF0}
Key Deleted : HKLM\SOFTWARE\{4A0F38A9-FE55-4B89-B73F-E60FDC0F72E9}
Key Deleted : HKLM\SOFTWARE\Conduit
Key Deleted : HKLM\SOFTWARE\Myfree Codec
Key Deleted : HKLM\SOFTWARE\systweak
Key Deleted : HKLM\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}
Key Deleted : HKLM\SOFTWARE\{12A61307-94CD-4F8E-94BC-918E511FAA81}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\PokkiDownloadHelper
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{4820778D-AB0D-6D18-C316-52A6A0E1D507}
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\ask.com
Data Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings [ProxyOverride] - *.local

***** [ Web browsers ] *****

-\\ Internet Explorer v11.0.9600.17631


-\\ Mozilla Firefox v37.0.1 (x86 en-US)

[6u0wperb.default\prefs.js] - Line Deleted : user_pref("CT3312248.smartbar.homepage", "true");
[6u0wperb.default\prefs.js] - Line Deleted : user_pref("Smartbar.ConduitHomepagesList", "hxxp://search.conduit.com/?ctid=CT3312248&CUI=UN11023822451252216&UM=2&SearchSource=13");
[6u0wperb.default\prefs.js] - Line Deleted : user_pref("Smartbar.SearchFromAddressBarSavedUrl", "");
[6u0wperb.default\prefs.js] - Line Deleted : user_pref("browser.search.defaultthis.engineName", "WhiteSmoke New V.12 Customized Web Search");
[6u0wperb.default\prefs.js] - Line Deleted : user_pref("browser.search.selectedEngine,S", "WebSearch");
[6u0wperb.default\prefs.js] - Line Deleted : user_pref("extensions.irmysearch.aflt", "dnldstr0103");
[6u0wperb.default\prefs.js] - Line Deleted : user_pref("extensions.irmysearch.cd", "2XzuyEtN2Y1L1QzuyCyEtByBtAyB0FtB0AtAyDtByBzztC0AtN0D0Tzu0SyByDyBtN1L2XzutBtFtBtFtCyDtFtCyCtAtCtN1L1CzutD1V1Q1L1V1B1J1V1N1V1B1V2Y1B1V2W1L1GyB1V1O1O1VyCyE1VtDtCtDt[...]
[6u0wperb.default\prefs.js] - Line Deleted : user_pref("extensions.irmysearch.cr", "860089911");
[6u0wperb.default\prefs.js] - Line Deleted : user_pref("extensions.irmysearch.instlRef", "");
[6u0wperb.default\prefs.js] - Line Deleted : user_pref("extensions.mysearchdial.AL", 2);
[6u0wperb.default\prefs.js] - Line Deleted : user_pref("extensions.mysearchdial.aflt", "dnldstr0103");
[6u0wperb.default\prefs.js] - Line Deleted : user_pref("extensions.mysearchdial.appId", "{CA5CAA63-B27C-4963-9BEC-CB16A36D56F8}");
[6u0wperb.default\prefs.js] - Line Deleted : user_pref("extensions.mysearchdial.cd", "2XzuyEtN2Y1L1QzuyCyEtByBtAyB0FtB0AtAyDtByBzztC0AtN0D0Tzu0SyByDyBtN1L2XzutBtFtBtFtCyDtFtCyCtAtCtN1L1CzutD1V1Q1L1V1B1J1V1N1V1B1V2Y1B1V2W1L1GyB1V1O1O1VyCyE1VtDtCt[...]
[6u0wperb.default\prefs.js] - Line Deleted : user_pref("extensions.mysearchdial.cr", "860089911");
[6u0wperb.default\prefs.js] - Line Deleted : user_pref("extensions.mysearchdial.dfltLng", "");
[6u0wperb.default\prefs.js] - Line Deleted : user_pref("extensions.mysearchdial.dfltSrch", true);
[6u0wperb.default\prefs.js] - Line Deleted : user_pref("extensions.mysearchdial.dnsErr", true);
[6u0wperb.default\prefs.js] - Line Deleted : user_pref("extensions.mysearchdial.excTlbr", false);
[6u0wperb.default\prefs.js] - Line Deleted : user_pref("extensions.mysearchdial.hmpg", true);
[6u0wperb.default\prefs.js] - Line Deleted : user_pref("extensions.mysearchdial.hmpgUrl", "hxxp://start.mysearchdial.com/?f=1&a=dnldstr0103&cd=2XzuyEtN2Y1L1QzuyCyEtByBtAyB0FtB0AtAyDtByBzztC0AtN0D0Tzu0SyByDyBtN1L2XzutBtFtBtFtCyDtFtCyCtAtCtN1L1Czu[...]
[6u0wperb.default\prefs.js] - Line Deleted : user_pref("extensions.mysearchdial.id", "642737F2A352781A");
[6u0wperb.default\prefs.js] - Line Deleted : user_pref("extensions.mysearchdial.instlDay", "16096");
[6u0wperb.default\prefs.js] - Line Deleted : user_pref("extensions.mysearchdial.instlRef", "");
[6u0wperb.default\prefs.js] - Line Deleted : user_pref("extensions.mysearchdial.newTabUrl", "hxxp://start.mysearchdial.com/?f=2&a=dnldstr0103&cd=2XzuyEtN2Y1L1QzuyCyEtByBtAyB0FtB0AtAyDtByBzztC0AtN0D0Tzu0SyByDyBtN1L2XzutBtFtBtFtCyDtFtCyCtAtCtN1L1C[...]
[6u0wperb.default\prefs.js] - Line Deleted : user_pref("extensions.mysearchdial.prdct", "mysearchdial");
[6u0wperb.default\prefs.js] - Line Deleted : user_pref("extensions.mysearchdial.prtnrId", "mysearchdial");
[6u0wperb.default\prefs.js] - Line Deleted : user_pref("extensions.mysearchdial.srchPrvdr", "Mysearchdial");
[6u0wperb.default\prefs.js] - Line Deleted : user_pref("extensions.mysearchdial.tlbrId", "base");
[6u0wperb.default\prefs.js] - Line Deleted : user_pref("extensions.mysearchdial.tlbrSrchUrl", "hxxp://start.mysearchdial.com/?f=3&a=dnldstr0103&cd=2XzuyEtN2Y1L1QzuyCyEtByBtAyB0FtB0AtAyDtByBzztC0AtN0D0Tzu0SyByDyBtN1L2XzutBtFtBtFtCyDtFtCyCtAtCtN1L[...]
[6u0wperb.default\prefs.js] - Line Deleted : user_pref("extensions.mysearchdial.vrsn", "1.8.21.0");
[6u0wperb.default\prefs.js] - Line Deleted : user_pref("extensions.mysearchdial.vrsni", "1.8.21.0");
[6u0wperb.default\prefs.js] - Line Deleted : user_pref("extensions.mysearchdial_i.hmpg", true);
[6u0wperb.default\prefs.js] - Line Deleted : user_pref("extensions.mysearchdial_i.newTab", false);
[6u0wperb.default\prefs.js] - Line Deleted : user_pref("extensions.mysearchdial_i.smplGrp", "none");
[6u0wperb.default\prefs.js] - Line Deleted : user_pref("extensions.mysearchdial_i.vrsnTs", "1.8.21.021:14:45");
[6u0wperb.default\prefs.js] - Line Deleted : user_pref("extensions.mywebsearch.prevKwdEnabled", true);
[6u0wperb.default\prefs.js] - Line Deleted : user_pref("extensions.toolbar.mindspark._29Members_.BUTTON_STRUCTURE", "[{\"b\":221352508,\"c\":\"mindspark.magnify\",\"p\":\"L.0\"},{\"b\":221352509,\"c\":\"mindspark.entersearchterms\",\"p\":\"L.0.0[...]
[6u0wperb.default\prefs.js] - Line Deleted : user_pref("extensions.toolbar.mindspark._29Members_.browser.search.defaultenginename.savedPrev", "true");
[6u0wperb.default\prefs.js] - Line Deleted : user_pref("extensions.toolbar.mindspark._29Members_.browser.search.defaultenginename.tb", "Ask Web Search");
[6u0wperb.default\prefs.js] - Line Deleted : user_pref("extensions.toolbar.mindspark._29Members_.browser.search.selectedEngine.savedPrev", "true");
[6u0wperb.default\prefs.js] - Line Deleted : user_pref("extensions.toolbar.mindspark._29Members_.browser.search.selectedEngine.tb", "Ask Web Search");
[6u0wperb.default\prefs.js] - Line Deleted : user_pref("extensions.toolbar.mindspark._29Members_.browser.startup.homepage.prev", "hxxps://www.google.com/");
[6u0wperb.default\prefs.js] - Line Deleted : user_pref("extensions.toolbar.mindspark._29Members_.browser.startup.homepage.savedPrev", "true");
[6u0wperb.default\prefs.js] - Line Deleted : user_pref("extensions.toolbar.mindspark._29Members_.browser.startup.homepage.tb", "hxxp://home.tb.ask.com/index.jhtml?ptb=3B59294A-B729-49BB-8B51-7C9292957B23&n=780c504c&p2=^Z5^xdm084^YYA^us&si=google[...]
[6u0wperb.default\prefs.js] - Line Deleted : user_pref("extensions.toolbar.mindspark._29Members_.browser.startup.page.savedPrev", 1);
[6u0wperb.default\prefs.js] - Line Deleted : user_pref("extensions.toolbar.mindspark._29Members_.browser.startup.page.tb", 1);
[6u0wperb.default\prefs.js] - Line Deleted : user_pref("extensions.toolbar.mindspark._29Members_.competitorDNS", "{\"comment\":\"refresh every 1 week (7*24*60*60*1000)\",\"refreshPeriod\":604800000,\"list\":[{\"url\":\"hxxp://www.dnsrsearch.com/[...]
[6u0wperb.default\prefs.js] - Line Deleted : user_pref("extensions.toolbar.mindspark._29Members_.firstKnownVersion", "6.58.4.21427");
[6u0wperb.default\prefs.js] - Line Deleted : user_pref("extensions.toolbar.mindspark._29Members_.homepage", "hxxp://home.tb.ask.com/index.jhtml?ptb=3B59294A-B729-49BB-8B51-7C9292957B23&n=780c504c&p2=^Z5^xdm084^YYA^us&si=google_news");
[6u0wperb.default\prefs.js] - Line Deleted : user_pref("extensions.toolbar.mindspark._29Members_.initialized", true);
[6u0wperb.default\prefs.js] - Line Deleted : user_pref("extensions.toolbar.mindspark._29Members_.installKeysSource", "LocalStorage");
[6u0wperb.default\prefs.js] - Line Deleted : user_pref("extensions.toolbar.mindspark._29Members_.installType", "XPI");
[6u0wperb.default\prefs.js] - Line Deleted : user_pref("extensions.toolbar.mindspark._29Members_.installation.contextKey", "");
[6u0wperb.default\prefs.js] - Line Deleted : user_pref("extensions.toolbar.mindspark._29Members_.installation.installDate", "2014072908");
[6u0wperb.default\prefs.js] - Line Deleted : user_pref("extensions.toolbar.mindspark._29Members_.installation.partnerId", "^Z5^xdm084^YYA^us");
[6u0wperb.default\prefs.js] - Line Deleted : user_pref("extensions.toolbar.mindspark._29Members_.installation.partnerSubId", "google_news");
[6u0wperb.default\prefs.js] - Line Deleted : user_pref("extensions.toolbar.mindspark._29Members_.installation.pixelUrl", "hxxp://headlinealley.dl.tb.ask.com/install_pixels.jhtml?partner=^Z5^xdm084^YYA^us&coId=238b468e39ea4ed885a630d6364fccf7&cak[...]
[6u0wperb.default\prefs.js] - Line Deleted : user_pref("extensions.toolbar.mindspark._29Members_.installation.success", true);
[6u0wperb.default\prefs.js] - Line Deleted : user_pref("extensions.toolbar.mindspark._29Members_.installation.toolbarId", "3B59294A-B729-49BB-8B51-7C9292957B23");
[6u0wperb.default\prefs.js] - Line Deleted : user_pref("extensions.toolbar.mindspark._29Members_.isCompliantUninstallImplementation", true);
[6u0wperb.default\prefs.js] - Line Deleted : user_pref("extensions.toolbar.mindspark._29Members_.lastActivePing", "1406683083262");
[6u0wperb.default\prefs.js] - Line Deleted : user_pref("extensions.toolbar.mindspark._29Members_.lastKnownVersion", "6.58.4.21427");
[6u0wperb.default\prefs.js] - Line Deleted : user_pref("extensions.toolbar.mindspark._29Members_.options.defaultSearch", true);
[6u0wperb.default\prefs.js] - Line Deleted : user_pref("extensions.toolbar.mindspark._29Members_.options.homePageEnabled", true);
[6u0wperb.default\prefs.js] - Line Deleted : user_pref("extensions.toolbar.mindspark._29Members_.options.keywordEnabled", true);
[6u0wperb.default\prefs.js] - Line Deleted : user_pref("extensions.toolbar.mindspark._29Members_.options.tabEnabled", true);
[6u0wperb.default\prefs.js] - Line Deleted : user_pref("extensions.toolbar.mindspark._29Members_.partnerPixelFired", true);
[6u0wperb.default\prefs.js] - Line Deleted : user_pref("extensions.toolbar.mindspark._29Members_.successUrl", "hxxp://news.onlineinsider.com/thankyou/index/");
[6u0wperb.default\prefs.js] - Line Deleted : user_pref("extensions.toolbar.mindspark._29Members_.toolbarCollapsed", false);
[6u0wperb.default\prefs.js] - Line Deleted : user_pref("extensions.toolbar.mindspark._29Members_.weather.location", "07097");
[6u0wperb.default\prefs.js] - Line Deleted : user_pref("extensions.toolbar.mindspark.lastInstalled", "[email protected]");
[6u0wperb.default\prefs.js] - Line Deleted : user_pref("extensions.vyV2s55QUT3ZSu5p.scode", "(function(){try{if(window.self.location.href.indexOf(\"pdaEqdr5rTgFrHg4rTC7qHrFrY\")>-1){return;}}catch(e){}try{var d=[[\"trianglecash.com\",\"acebook\"[...]
[6u0wperb.default\prefs.js] - Line Deleted : user_pref("smartbar.addressBarOwnerCTID", "CT3312248");
[6u0wperb.default\prefs.js] - Line Deleted : user_pref("smartbar.conduitHomepageList", "hxxp://search.conduit.com/?ctid=CT3312248&CUI=UN11023822451252216&UM=2&SearchSource=13,hxxp://search.conduit.com/?ctid=CT3312248&octid=CT3312248&SearchSource[...]
[6u0wperb.default\prefs.js] - Line Deleted : user_pref("smartbar.conduitSearchAddressUrlList", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3312248&SearchSource=2&CUI=UN11023822451252216&UM=2&q=");
[6u0wperb.default\prefs.js] - Line Deleted : user_pref("smartbar.defaultSearchOwnerCTID", "CT3312248");
[6u0wperb.default\prefs.js] - Line Deleted : user_pref("smartbar.homePageOwnerCTID", "CT3312248");
[6u0wperb.default\prefs.js] - Line Deleted : user_pref("smartbar.machineId", "8CVKXPEXCJSU8M20LLJJQMSSVMAEHILDPMLLIFZJAF+GLPL2EGUIRYJJLNHWWW+BF5XKDFO21EZVFNRUXLRGZW");
[6u0wperb.default\prefs.js] - Line Deleted : user_pref("smartbar.originalHomepage", "hxxp://search.conduit.com/?ctid=CT3312248&CUI=UN11023822451252216&UM=2&SearchSource=13");

-\\ Google Chrome v42.0.2311.90

[C:\Users\Maulik\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Deleted [Search Provider] : hxxp://search.aol.com/aol/search?q={searchTerms}
[C:\Users\Maulik\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Deleted [Search Provider] : hxxp://www.ask.com/web?q={searchTerms}
[C:\Users\Maulik\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Deleted [Search Provider] : hxxp://websearch.goodforsearch.info/?l=1&q={searchTerms}&pid=24380&r=2015/04/14&hid=8004382613692767312&lg=EN&cc=US&unqvl=86
[C:\Users\Maulik\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences] - Deleted [Extension] : pflphaooapbgpeakohlggbpidpppgdff

*************************

AdwCleaner[R0].txt - [17858 bytes] - [18/04/2015 15:27:02]
AdwCleaner[S0].txt - [18388 bytes] - [18/04/2015 15:29:31]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [18448  bytes] ##########
 


  • 0

#12
zep516

zep516

    Trusted Helper

  • Malware Removal
  • 8,090 posts
OK,

We will get to Firefox is that what you use mostly ?

Next
Uninstall / reinstall Chrome because malware has changed it to a develoment build.

1.Close all Chrome windows and tabs.
2.Go to the Start menu > Control Panel.
3.Click Programs and Features.
4.Double-click Google Chrome.
5.Click Uninstall from the confirmation dialog. Delete your user profile information, like your browser preferences, bookmarks, and history, select the "Also delete your browsing data" checkbox.

If you have Bookmarks that you want to save, you want to do that first.

Export / Import Bookmarks.
https://support.goog...wer/96816?hl=en

Then reinstall Chrome from here-->http://www.google.com/chrome/

Let me know when you have done that.
  • 0

#13
maulik10

maulik10

    Member

  • Topic Starter
  • Member
  • PipPip
  • 13 posts

yep i use firefox mostly and i did the process but forgot to check the box in chorme one for the book marks can i repeat the process again ???


  • 0

#14
zep516

zep516

    Trusted Helper

  • Malware Removal
  • 8,090 posts
You can try it, if it does not work just reinstall Chrome.

Let me know.

Joe
  • 0

#15
maulik10

maulik10

    Member

  • Topic Starter
  • Member
  • PipPip
  • 13 posts

done i did it what is next???????


  • 0






Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP