[ti]SOLVED[/ti]Several malwares that can't be deleted?

new

moeko
New Helpee

Posts: 13

[ti]SOLVED[/ti]Several malwares that can't be deleted? May 5, 2015 18:34:05 GMT -8

Post by moeko on May 5, 2015 18:34:05 GMT -8

Hello,
I have a Toshiba Notebook, AMD E-240 Processor 1.50Hz, 64-bit Operating System, and several problems.
I don't even know how these programs got onto the laptop, because it's my dad's, but he entrusted me with fixing it.
So, I can't seem to delete following programs: YTDownloader, Terminal Chip, Sytem NotifierV10.03, Remote Desktop Access (VuuPC), Pro PC Cleaner, and LolyKey.

Please bear with me, because I'm certainly no computer expert....

Last Edit: Jun 1, 2015 17:08:13 GMT -8 by dbrisen

Krusty
Logging Assistant

In Oz

Posts: 2,330

[ti]SOLVED[/ti]Several malwares that can't be deleted? May 5, 2015 18:46:56 GMT -8

Post by Krusty on May 5, 2015 18:46:56 GMT -8

Which version of Windows?

Please read all steps carefully. If you are not sure about something or are having problems with a step, first please re-read the instructions.

Do Not use any tools or any programs for cleaning used until being asked / instructed to do so!!!!!

Malware removal can be difficult over a forum as it is, without a user doing their own actions, the tools used are more advanced and thus have added danger that comes with that. This board is protected so that only Malware removers, Admin and Mods can reply to a users thread but all members can create a thread asking for removal of Infection(s)

Make changes to your computer only when the Malware Expert specifically states it. The Malware Experts request specific steps to be followed, as some malware removal requires multiple steps and evaluations along the way. When you take other advice or make other changes, this often negates the work done by the expert, and can sometimes result in an inoperable system.

This also includes any tools or steps other than those the from the Malware Expert. We need to be certain about the state of your system to see what actually is going on, and what is required to fix the system while not harming the rest of the system. Most often, well-intentioned independent efforts can make things much worse. The malware remediation tools are more advanced than othe tools, and can often create bigger problems when used without expert guidance.

Follow all the directions in order, and to the end. Please perform all steps in the order they are listed in each set of instructions. As you might imagine, some steps are a bit complicated. If things are not clear, be sure to stop and let the Malware Expert know the problem. We don't mind clarifying a situation, as others might have the same question. If a tool does not run as expected, don't force it. Stop the steps, and update the forum topic with the current situation. It is better stop and let us know, than to force a tool to run and cause bigger problems.

Also, when your computer is clean and we are finished, the Expert will tell you we are finished. Malware removal is a process that requires verification, and we want to be sure your system is completely clean before we're done.

When describing your problem, provide as much information as possible, as soon as possible. Explain as best you can what happens with your computer, e.g. it beeps three times, black screen with cursor then goes no further, system gets stuck at the Windows startup logo, etc. This helps the expert to understand what is happening to the system and what may be wrong. If your computer cannot start up successfully please provide details about your installed Windows Operating System, including the Version, Edition and if it is a 32bit or a 64bit system. (e.g. Windows Vista Home Premium 32-bit)

When the user follow instructions and things still go a little haywire, and it does happen, it is up to us to sort the extra problem out.

Take longer to read if your language is not English, so that hopefully it is understood.

Reply stating you have read the post fully.

I also if it is busy (have a lot of systems at once to deal with) like being in a supermarket checkout line, waiting their turn, I use the forum like a checkout line.

And the Forum is VERY BUSY at the moment for just 2 Removers, so Please be patient as no one would want us to do a script wrong and hurt someones Computer / System.

I do NOT do support by PM.

Thank you.

moeko New Helpee Posts: 13	[ti]SOLVED[/ti]Several malwares that can't be deleted? May 5, 2015 18:49:10 GMT -8 Select Post Deselect Post Link to Post Member Give Gift Back to Top Post by moeko on May 5, 2015 18:49:10 GMT -8 I have read the post fully. Update: I managed to get rid of everything except Pro PC Cleaner. It's Windows 7

Krusty
Logging Assistant

In Oz

Posts: 2,330

[ti]SOLVED[/ti]Several malwares that can't be deleted? May 5, 2015 19:18:24 GMT -8

Post by Krusty on May 5, 2015 19:18:24 GMT -8

Read Slowly and all of it.

Please download Farbar Recovery Scan Tool 64bit and save it to your Desktop.

Place FRST64.exe onto your desktop from where ever it downloaded to. IF IT IS NOT ON THE DESKTOP (YOU DID NOT DOWNLOAD DIRECTLY TO DESKTOP), THEN RIGHT CLICK ON THE DOWNLOADED FILE AND SELECT CUT. FIND A BLANK SPOT ON YOUR DESKTOP AND RIGHT CLICK ON IT, SELECT PASTE AND THE FILE WILL BE ON THE DESKTOP. Thank You (this is very important later on)!

Start FRST64 that is on your Desktop by right clicking on it and selecting "Run as Administrator..." .

The tool will start to run.
When the tool opens click Yes to disclaimer. (if it does)
Press Scan button.

It will make two logs (FRST.txt and addition.txt) on your Desktop. Please attach the logs in your reply back. Or open the logs in notepad and copy the logs and paste back in a message as a reply. (Ask if you don't know how to do either of these).

Notes:

If your Security software blocks the running or download of FRST / FRST64, please disable the security software or make an exception for this file. FRST is updated very frequently and is safe to run but because of the frequent changes (to keep up with newest malware techniques) most Security Software does not approve of the unknown file.

Right now the forum will not allow one to attach the Addition.txt file so please use wikisend.com or pastebin.com/ to upload the file and then post the download link here in your reply post.

I do NOT do support by PM.

Thank you.

moeko
New Helpee

Posts: 13

[ti]SOLVED[/ti]Several malwares that can't be deleted? May 6, 2015 12:24:49 GMT -8

Post by moeko on May 6, 2015 12:24:49 GMT -8

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 06-05-2015 01
Ran by Marius (administrator) on MARIUS-PC on 06-05-2015 14:18:02
Running from C:\Users\Marius\Desktop
Loaded Profiles: Marius (Available profiles: Marius)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: English (United States)
Internet Explorer Version 11 (Default browser path: "C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\Crossbrowse.exe" -- "%1")
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
() C:\Windows\lnx.exe
() C:\Users\Marius\AppData\Roaming\003F0CDE-1430876041-E011-A025-00266CD20EB8\nswD013.tmpfs
() C:\Windows\mlnx.exe
(TOSHIBA Corporation) C:\Windows\System32\TODDSrv.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
() C:\Users\Marius\AppData\Roaming\003F0CDE-1430876041-E011-A025-00266CD20EB8\jnsc147.tmp
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\SmoothView\SmoothView.exe
(Conexant Systems, Inc) C:\Program Files\CONEXANT\SAII\SmartAudio.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\ReelTime\TosReelTimeMonitor.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\BulletinBoard\TosNcCore.exe
(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Deskjet 3050A J611 series\Bin\ScanToPCActivationApp.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\AppleIEDAV.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudDrive.exe
() C:\ProgramData\{c0c6049b-348f-9f0c-c0c6-6049b348126c}\priceless_p_soft_partner.exe
(TOSHIBA CORPORATION) C:\Program Files (x86)\Toshiba\ConfigFree\NDSTray.exe
(TOSHIBA Corporation) C:\Program Files (x86)\Toshiba\TOSHIBA Service Station\ToshibaServiceStation.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSENotify.exe
(Microsoft Corporation) C:\Windows\System32\msfeedssync.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(TOSHIBA Corporation) C:\Program Files (x86)\Toshiba\TOSHIBA Service Station\TMachInfo.exe
(TOSHIBA CORPORATION) C:\Program Files (x86)\Toshiba\ConfigFree\CFIWmxSvcs64.exe
(TOSHIBA CORPORATION) C:\Program Files (x86)\Toshiba\ConfigFree\CFSvcs.exe
(TOSHIBA CORPORATION) C:\Program Files (x86)\Toshiba\ConfigFree\CFSwMgr.exe
(Microsoft Corporation) C:\Windows\System32\msiexec.exe
(Microsoft Corporation) C:\Windows\System32\CompatTel\wicainventory.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Deskjet 3050A J611 series\Bin\HPNetworkCommunicator.exe

==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [] => [X]
HKLM\...\Run: [SmartAudio] => C:\Program Files\CONEXANT\SAII\SAIICpl.exe [316032 2010-12-14] (Conexant systems, Inc.)
HKLM\...\Run: [TPwrMain] => C:\Program Files\TOSHIBA\Power Saver\TPwrMain.EXE [566184 2010-09-28] (TOSHIBA Corporation)
HKLM\...\Run: [SmoothView] => C:\Program Files\Toshiba\SmoothView\SmoothView.exe [508216 2009-07-28] (TOSHIBA Corporation)
HKLM\...\Run: [00TCrdMain] => C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe [915320 2010-05-10] (TOSHIBA Corporation)
HKLM\...\Run: [SmartFaceVWatcher] => C:\Program Files\Toshiba\SmartFaceV\SmartFaceVWatcher.exe [238080 2009-10-19] (TOSHIBA Corporation)
HKLM\...\Run: [TosSENotify] => C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosWaitSrv.exe [709976 2010-02-05] (TOSHIBA Corporation)
HKLM\...\Run: [TosVolRegulator] => C:\Program Files\TOSHIBA\TosVolRegulator\TosVolRegulator.exe [24376 2009-11-11] (TOSHIBA Corporation)
HKLM\...\Run: [TosReelTimeMonitor] => C:\Program Files\TOSHIBA\ReelTime\TosReelTimeMonitor.exe [38304 2010-07-09] (TOSHIBA Corporation)
HKLM\...\Run: [TosNC] => C:\Program Files\Toshiba\BulletinBoard\TosNcCore.exe [597928 2010-12-13] (TOSHIBA Corporation)
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [169768 2015-04-07] (Apple Inc.)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [336384 2011-02-16] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [ToshibaServiceStation] => C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe [1295224 2010-07-01] (TOSHIBA Corporation)
HKLM-x32\...\Run: [fst_ca_99] => [X]
HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [96056 2013-05-30] (Hewlett-Packard)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [mpck_ca_10] => [X]
HKLM-x32\...\Run: [mbot_ca_482] => [X]
HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [130048 2015-04-10] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [YTDownloader] => "C:\Program Files (x86)\YTDownloader\YTDownloader.exe" /boot
HKU\S-1-5-21-2827223565-3312671657-2323579203-1000\...\Run: [HP Deskjet 3050A J611 series (NET)] => C:\Program Files\HP\HP Deskjet 3050A J611 series\Bin\ScanToPCActivationApp.exe [2676584 2011-06-08] (Hewlett-Packard Co.)
HKU\S-1-5-21-2827223565-3312671657-2323579203-1000\...\Run: [iCloudServices] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe [43816 2015-04-26] (Apple Inc.)
HKU\S-1-5-21-2827223565-3312671657-2323579203-1000\...\Run: [ApplePhotoStreams] => C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe [43816 2015-04-26] (Apple Inc.)
HKU\S-1-5-21-2827223565-3312671657-2323579203-1000\...\Run: [AppleIEDAV] => C:\Program Files (x86)\Common Files\Apple\Internet Services\AppleIEDAV.exe [1079592 2015-04-26] (Apple Inc.)
HKU\S-1-5-21-2827223565-3312671657-2323579203-1000\...\Run: [iCloudDrive] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudDrive.exe [43816 2015-04-26] (Apple Inc.)
HKU\S-1-5-21-2827223565-3312671657-2323579203-1000\...\Run: [YTDownloader] => "C:\Program Files (x86)\YTDownloader\YTDownloader.exe" /boot
HKU\S-1-5-21-2827223565-3312671657-2323579203-1000\...\Run: [GoogleChromeAutoLaunch_B73401D408F5FBC1A31E4154B60B5830] => "C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\crossbrowse.exe" --no-startup-window
HKU\S-1-5-21-2827223565-3312671657-2323579203-1000\...\Run: [Reg Pro Cleaner] => C:\Program Files (x86)\Reg Pro Cleaner\RegProCleaner.exe
AppInit_DLLs: C:\ProgramData\LolyKey\LolyKey64.dll => C:\ProgramData\LolyKey\LolyKey64.dll File Not Found
AppInit_DLLs: C:\PROGRA~2\Linkey\IEEXTE~1\iedll64.dll => C:\PROGRA~2\Linkey\IEEXTE~1\iedll64.dll File Not Found
AppInit_DLLs-x32: c:\programdata\lolykey\lolykey32.dll => "c:\programdata\lolykey\lolykey32.dll" File Not Found
IFEO\bitguard.exe: [Debugger] tasklist.exe
IFEO\bprotect.exe: [Debugger] tasklist.exe
IFEO\bpsvc.exe: [Debugger] tasklist.exe
IFEO\browsemngr.exe: [Debugger] tasklist.exe
IFEO\browserdefender.exe: [Debugger] tasklist.exe
IFEO\browsermngr.exe: [Debugger] tasklist.exe
IFEO\browserprotect.exe: [Debugger] tasklist.exe
IFEO\browsersafeguard.exe: [Debugger] tasklist.exe
IFEO\bundlesweetimsetup.exe: [Debugger] tasklist.exe
IFEO\cltmngsvc.exe: [Debugger]
IFEO\delta babylon.exe: [Debugger] tasklist.exe
IFEO\delta tb.exe: [Debugger] tasklist.exe
IFEO\delta2.exe: [Debugger] tasklist.exe
IFEO\deltainstaller.exe: [Debugger] tasklist.exe
IFEO\deltasetup.exe: [Debugger] tasklist.exe
IFEO\deltatb.exe: [Debugger] tasklist.exe
IFEO\deltatb_2501-c733154b.exe: [Debugger] tasklist.exe
IFEO\dprotectsvc.exe: [Debugger] tasklist.exe
IFEO\iminentsetup.exe: [Debugger] tasklist.exe
IFEO\protectedsearch.exe: [Debugger] tasklist.exe
IFEO\rjatydimofu.exe: [Debugger] tasklist.exe
IFEO\searchprotection.exe: [Debugger] tasklist.exe
IFEO\searchprotector.exe: [Debugger] tasklist.exe
IFEO\snapdo.exe: [Debugger] tasklist.exe
IFEO\stinst32.exe: [Debugger] tasklist.exe
IFEO\stinst64.exe: [Debugger] tasklist.exe
IFEO\sweetimsetup.exe: [Debugger] tasklist.exe
IFEO\tbdelta.exetoolbar783881609.exe: [Debugger] tasklist.exe
IFEO\utiljumpflip.exe: [Debugger] tasklist.exe
Startup: C:\Users\Marius\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hqghumeaylnlf.lnk [2015-04-27]
ShortcutTarget: hqghumeaylnlf.lnk -> C:\ProgramData\{46880265-e519-0ffd-4688-80265e510997}\hqghumeaylnlf.exe (PC Utilities Software Limited)
Startup: C:\Users\Marius\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Monitor Ink Alerts - .lnk [2013-12-17]
ShortcutTarget: Monitor Ink Alerts - .lnk -> C:\Program Files\HP\HP Deskjet 3050A J611 series\Bin\HPStatusBL.dll (Hewlett-Packard Co.)
Startup: C:\Users\Marius\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\priceless_p_soft_partner.lnk [2015-05-04]
ShortcutTarget: priceless_p_soft_partner.lnk -> C:\ProgramData\{c0c6049b-348f-9f0c-c0c6-6049b348126c}\priceless_p_soft_partner.exe ()
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

ProxyEnable: [.DEFAULT] => Internet Explorer proxy is enabled.
ProxyServer: [.DEFAULT] => http=127.0.0.1:51213;https=127.0.0.1:51213
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = speedial.com/?f=1&a=spd_cmi_14_21_ff&cd=2XzuyEtN2Y1L1Qzu0DtD0D0Fzy0AyByDzyyEzzyB0Ezzzy0CtN0D0Tzu0SzzyBtDtN1L2XzutBtFtBtDtFtCtAtFtCtN1L1CzutCyEtDtAtDyD1V1StN1L1G1B1V1N2Y1L1Qzu2SyCtDtA0FtB0DyE0BtGzzyD0FyCtGtDyE0EyEtG0A0B0B0CtGyByByEyCyC0CtCtCtAtCyD0B2QtN1M1F1B2Z1V1N2Y1L1Qzu2StBtDtCyEtAtA0DtCtGyC0ByDtCtGyB0ByB0AtGyEtB0DtAtGyEyEtB0CyCyC0CyCyDzztAtC2Q&cr=1778512867&ir=
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = de.yahoo.com/?fr=mkg029
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = de.yahoo.com/?fr=mkg029
HKU\S-1-5-21-2827223565-3312671657-2323579203-1000\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.toshiba.ca/welcome
SearchScopes: HKLM -> DefaultScope {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7TSCA
SearchScopes: HKLM -> {31090377-0740-419E-BEFC-A56E50500D5B} URL = speedial.com/results.php?f=4&q={searchTerms}&a=spd_cmi_14_21_ff&cd=2XzuyEtN2Y1L1Qzu0DtD0D0Fzy0AyByDzyyEzzyB0Ezzzy0CtN0D0Tzu0SzzyBtDtN1L2XzutBtFtBtDtFtCtAtFtCtN1L1CzutCyEtDtAtDyD1V1StN1L1G1B1V1N2Y1L1Qzu2SyCtDtA0FtB0DyE0BtGzzyD0FyCtGtDyE0EyEtG0A0B0B0CtGyByByEyCyC0CtCtCtAtCyD0B2QtN1M1F1B2Z1V1N2Y1L1Qzu2StBtDtCyEtAtA0DtCtGyC0ByDtCtGyB0ByB0AtGyEtB0DtAtGyEyEtB0CyCyC0CyCyDzztAtC2Q&cr=1778512867&ir=
SearchScopes: HKLM -> {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7TSCA
SearchScopes: HKLM -> {9BB47C17-9C68-4BB3-B188-DD9AF0FD2476} URL = www.default-search.net/search?sid=476&aid=123&itype=n&ver=11471&tm=304&src=ds&p={searchTerms}
SearchScopes: HKLM-x32 -> DefaultScope {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7TSCA
SearchScopes: HKLM-x32 -> {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7TSCA
SearchScopes: HKLM-x32 -> {9BB47C17-9C68-4BB3-B188-DD9AF0FD2476} URL = www.default-search.net/search?sid=476&aid=123&itype=n&ver=11471&tm=304&src=ds&p={searchTerms}
SearchScopes: HKU\S-1-5-21-2827223565-3312671657-2323579203-1000 -> DefaultScope {015DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = www-searching.com/search.aspx?site=shdefault&pid=s&shr=d&q={searchTerms}&s=F4Sztutdk0004,62cd1a55-75d8-4297-8b96-3f3008bc6f3b,
SearchScopes: HKU\S-1-5-21-2827223565-3312671657-2323579203-1000 -> URL search.conduit.com/Results.aspx?ctid=CT3323737&octid=EB_ORIGINAL_CTID&SearchSource=58&CUI=&UM=4&UP=SP4A7CC89F-9D00-453F-801E-DC1A1A577853&q={searchTerms}&SSPV=
SearchScopes: HKU\S-1-5-21-2827223565-3312671657-2323579203-1000 -> SuggestionsURL_JSON suggest.search.conduit.com/CSuggestJson.ashx?prefix={searchTerms}
SearchScopes: HKU\S-1-5-21-2827223565-3312671657-2323579203-1000 -> AEE59D684DC54BE58C012BCD7DE9134C URL = www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7TSCA_enCA563
SearchScopes: HKU\S-1-5-21-2827223565-3312671657-2323579203-1000 -> {015DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = www-searching.com/search.aspx?site=shdefault&pid=s&shr=d&q={searchTerms}&s=F4Sztutdk0004,62cd1a55-75d8-4297-8b96-3f3008bc6f3b,
SearchScopes: HKU\S-1-5-21-2827223565-3312671657-2323579203-1000 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-2827223565-3312671657-2323579203-1000 -> {31090377-0740-419E-BEFC-A56E50500D5B} URL = speedial.com/results.php?f=4&q={searchTerms}&a=spd_cmi_14_21_ff&cd=2XzuyEtN2Y1L1Qzu0DtD0D0Fzy0AyByDzyyEzzyB0Ezzzy0CtN0D0Tzu0SzzyBtDtN1L2XzutBtFtBtDtFtCtAtFtCtN1L1CzutCyEtDtAtDyD1V1StN1L1G1B1V1N2Y1L1Qzu2SyCtDtA0FtB0DyE0BtGzzyD0FyCtGtDyE0EyEtG0A0B0B0CtGyByByEyCyC0CtCtCtAtCyD0B2QtN1M1F1B2Z1V1N2Y1L1Qzu2StBtDtCyEtAtA0DtCtGyC0ByDtCtGyB0ByB0AtGyEtB0DtAtGyEyEtB0CyCyC0CyCyDzztAtC2Q&cr=1778512867&ir=
SearchScopes: HKU\S-1-5-21-2827223565-3312671657-2323579203-1000 -> {3BD44F0E-0596-4008-AEE0-45D47E3A8F0E} URL = www.mystart.com/results.php?gen=ms&pr=vmn&id=mystarttb&v=5_4&ent=ch_5108&q={searchTerms}
SearchScopes: HKU\S-1-5-21-2827223565-3312671657-2323579203-1000 -> {41B3F996-1E5D-4747-8F4B-ED6AEEE2F544} URL = search.conduit.com/Results.aspx?ctid=CT3323737&octid=EB_ORIGINAL_CTID&SearchSource=58&CUI=&UM=4&UP=SP4A7CC89F-9D00-453F-801E-DC1A1A577853&q={searchTerms}&SSPV=
SearchScopes: HKU\S-1-5-21-2827223565-3312671657-2323579203-1000 -> {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7TSCA_enCA563
SearchScopes: HKU\S-1-5-21-2827223565-3312671657-2323579203-1000 -> {7F4EFF06-7032-458e-AE16-1C1D8255C28A} URL = www-searching.com/search.aspx?site=shdefault&pid=s&shr=d&q={searchTerms}&s=F4Sztutdk0004,62cd1a55-75d8-4297-8b96-3f3008bc6f3b,
SearchScopes: HKU\S-1-5-21-2827223565-3312671657-2323579203-1000 -> {9BB47C17-9C68-4BB3-B188-DD9AF0FD2476} URL = www.default-search.net/search?sid=476&aid=123&itype=n&ver=11471&tm=304&src=ds&p={searchTerms}
SearchScopes: HKU\S-1-5-21-2827223565-3312671657-2323579203-1000 -> {9F3C458B-4494-4EE0-A486-535ED0420E03} URL = www.trovi.com/Results.aspx?gd=&ctid=CT3324769&octid=EB_ORIGINAL_CTID&ISID=M25827412-7801-4FC6-BCA9-014202123AE0&SearchSource=58&CUI=&UM=8&UP=SP4C619BAA-02B5-4133-AE25-8C66039ED0E7&q={searchTerms}&D=042715&SSPV=SP2230TB_sp_ie
SearchScopes: HKU\S-1-5-21-2827223565-3312671657-2323579203-1000 -> {DECA3892-BA8F-44b8-A993-A466AD694AE4} URL = de.search.yahoo.com/search?p={searchTerms}&fr=mkg028
BHO: No Name -> {4D9101D6-5BA0-4048-BDDE-7E2DF54C8C47} -> No File
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2010-09-21] (Microsoft Corp.)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
BHO-x32: No Name -> {02478D38-C3F9-4efb-9B51-7695ECA05670} -> No File
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\ssv.dll [2015-04-19] (Oracle Corporation)
BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2010-09-21] (Microsoft Corp.)
BHO-x32: Windows Live Messenger Companion Helper -> {9FDDE16B-836F-4806-AB1F-1455CBEFF289} -> C:\Program Files (x86)\Windows Live\Companion\companioncore.dll [2010-09-23] (Microsoft Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\jp2ssv.dll [2015-04-19] (Oracle Corporation)
Toolbar: HKU\S-1-5-21-2827223565-3312671657-2323579203-1000 -> No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
Toolbar: HKU\S-1-5-21-2827223565-3312671657-2323579203-1000 -> No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File
Toolbar: HKU\S-1-5-21-2827223565-3312671657-2323579203-1000 -> No Name - {4F524A2D-5350-4500-76A7-7A786E7484D7} - No File
Tcpip\Parameters: [DhcpNameServer] 172.16.1.254 142.165.200.5
Tcpip\..\Interfaces\{439C369E-7A1F-4FA0-881A-2DEBD7C25EE4}: [NameServer] 208.69.150.250,208.69.150.252

FireFox:
========
FF ProfilePath: C:\Users\Marius\AppData\Roaming\Mozilla\Firefox\Profiles\gmvxix60.default
FF DefaultSearchUrl: hxxp://de.search.yahoo.com/search?fr=mkg030&p=
FF SearchEngineOrder.1: default-search.net
FF SearchEngineOrder.3: Bing
FF SelectedSearchEngine: Trovi
FF Homepage: hxxp://www.trovi.com/?gd=&ctid=CT3324769&octid=EB_ORIGINAL_CTID&ISID=M25827412-7801-4FC6-BCA9-014202123AE0&SearchSource=55&CUI=&UM=8&UP=SP4C619BAA-02B5-4133-AE25-8C66039ED0E7&D=042715&SSPV=SP2230TB_sp_ff
FF Keyword.URL: hxxp://de.search.yahoo.com/search?fr=mkg030&p=
FF NewTab: hxxp://www.trovi.com/?gd=&ctid=CT3324769&octid=EB_ORIGINAL_CTID&ISID=M25827412-7801-4FC6-BCA9-014202123AE0&SearchSource=69&CUI=&SSPV=SP2230TB_sp_ff&Lay=1&UM=8&UP=SP4C619BAA-02B5-4133-AE25-8C66039ED0E7&D=042715
FF SelectedSearchEngine: Search The Web
FF Homepage: hxxp://www.mystart.com/?pr=vmn&id=mystarttb&v=5_4&ent=hp_5108&src=5108
FF Plugin: @adobe.com/FlashPlayer -> C:\windows\system32\Macromed\Flash\NPSWF64_17_0_0_169.dll [2015-04-15] ()
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\windows\SysWOW64\Macromed\Flash\NPSWF32_17_0_0_169.dll [2015-04-15] ()
FF Plugin-x32: @apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2014-10-30] ()
FF Plugin-x32: @java.com/DTPlugin,version=11.45.2 -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\dtplugin\npDeployJava1.dll [2015-04-19] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.45.2 -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\plugin2\npjp2.dll [2015-04-19] (Oracle Corporation)
FF Plugin-x32: @messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.6 -> C:\Program Files (x86)\Yahoo!\Shared\npYState.dll [2012-05-25] (Yahoo! Inc.)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~3\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~3\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2010-09-23] (Microsoft Corporation)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2014-12-03] (Adobe Systems Inc.)
FF user.js: detected! => C:\Users\Marius\AppData\Roaming\Mozilla\Firefox\Profiles\gmvxix60.default\user.js [2014-05-19]
FF Plugin ProgramFiles/Appdata: C:\Users\Marius\AppData\Roaming\mozilla\plugins\np-mswmp.dll [2009-09-25] (Microsoft Corporation)
FF SearchPlugin: C:\Users\Marius\AppData\Roaming\Mozilla\Firefox\Profiles\gmvxix60.default\searchplugins\avira-safesearch.xml [2014-03-22]
FF SearchPlugin: C:\Users\Marius\AppData\Roaming\Mozilla\Firefox\Profiles\gmvxix60.default\searchplugins\bingp.xml [2014-05-10]
FF SearchPlugin: C:\Users\Marius\AppData\Roaming\Mozilla\Firefox\Profiles\gmvxix60.default\searchplugins\default-search.xml [2014-03-31]
FF SearchPlugin: C:\Users\Marius\AppData\Roaming\Mozilla\Firefox\Profiles\gmvxix60.default\searchplugins\Speedial.xml [2014-05-19]
FF SearchPlugin: C:\Users\Marius\AppData\Roaming\Mozilla\Firefox\Profiles\gmvxix60.default\searchplugins\trovi.xml [2015-05-05]
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\mystarttb.xml [2015-05-03]
FF Extension: PruiceLEssi - C:\Users\Marius\AppData\Roaming\Mozilla\Firefox\Profiles\gmvxix60.default\Extensions\8q@n.edu [2015-05-05]
FF Extension: Avira Browser Safety - C:\Users\Marius\AppData\Roaming\Mozilla\Firefox\Profiles\gmvxix60.default\Extensions\abs@avira.com [2015-04-29]
FF Extension: Speedial - C:\Users\Marius\AppData\Roaming\Mozilla\Firefox\Profiles\gmvxix60.default\Extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52} [2014-05-19]
FF Extension: No Name - C:\Users\Marius\AppData\Roaming\Mozilla\Firefox\Profiles\gmvxix60.default\Extensions\59D317DB041748fdB89B47E6F96058F3@jetpack.xpi [2015-04-27]
FF Extension: Adblock Plus - C:\Users\Marius\AppData\Roaming\Mozilla\Firefox\Profiles\gmvxix60.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2015-04-23]
FF Extension: No Name - C:\Users\Marius\AppData\Roaming\Mozilla\Firefox\Profiles\gmvxix60.default\extensions\{607b689f-7600-45e4-b8e5-887f72dab15c} [Not Found]
FF Extension: No Name - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} [Not Found]

Chrome:
=======
CHR StartupUrls: Default -> "hxxp://www.trovi.com/?gd=&ctid=CT3324769&octid=EB_ORIGINAL_CTID&ISID=M25827412-7801-4FC6-BCA9-014202123AE0&SearchSource=55&CUI=&UM=8&UP=SP4C619BAA-02B5-4133-AE25-8C66039ED0E7&D=042715&SSPV=SP2230TB_sp_ch"
CHR DefaultSearchKeyword: Default -> trovi.search
CHR DefaultNewTabURL: Default -> www.trovi.com/?gd=&ctid=CT3324769&octid=EB_ORIGINAL_CTID&ISID=M25827412-7801-4FC6-BCA9-014202123AE0&SearchSource=69&CUI=&SSPV=SP2230TB_sp_ch&lay=5&p=cnts&UM=8&UP=SP4C619BAA-02B5-4133-AE25-8C66039ED0E7&SAT=CNTS&D=042715
CHR DefaultSuggestURL: Default -> suggest.seccint.com/CSuggestJson.ashx?prefix={searchTerms}
CHR Profile: C:\Users\Marius\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Slides) - C:\Users\Marius\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-04-23]
CHR Extension: (Google Docs) - C:\Users\Marius\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-06-16]
CHR Extension: (Google Drive) - C:\Users\Marius\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-06-16]
CHR Extension: (YouTube) - C:\Users\Marius\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-06-16]
CHR Extension: (Google Search) - C:\Users\Marius\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-06-16]
CHR Extension: (Google Sheets) - C:\Users\Marius\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-04-23]
CHR Extension: (Avira Browser Safety) - C:\Users\Marius\AppData\Local\Google\Chrome\User Data\Default\Extensions\flliilndjeohchalpbbcdekjklbdgfkk [2015-04-23]
CHR Extension: (BetaFish Adblocker) - C:\Users\Marius\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2015-04-23]
CHR Extension: (Bookmark Manager) - C:\Users\Marius\AppData\Local\Google\Chrome\User Data\Default\Extensions\gmlllbghnfkpflemihljekbapjopfjik [2015-04-23]
CHR Extension: (Chrome Hotword Shared Module) - C:\Users\Marius\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-04-23]
CHR Extension: (Skype Click to Call) - C:\Users\Marius\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl [2015-04-23]
CHR Extension: (Google Wallet) - C:\Users\Marius\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-06-16]
CHR Extension: (Gmail) - C:\Users\Marius\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-06-16]
CHR HKLM-x32\...\Chrome\Extension: [dghncoeocefmhkhiphdgikkamjeglbfh] - C:\Program Files (x86)\mystarttb\chrome-newtab-search.crx [Not Found]
CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\ChromeExtension\skype_chrome_extension.crx [Not Found]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [77128 2015-01-19] (Apple Inc.)
S2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [205104 2015-04-10] (Avira Operations GmbH & Co. KG)
S2 CoupoonService64; C:\Program Files (x86)\coupoon\iiwjljrnpc64.exe [172344 2015-04-02] ()
R2 lnx; c:\windows\lnx.exe [417792 2015-05-05] () [File not signed]
R2 mlnx; c:\windows\mlnx.exe [408576 2015-05-05] () [File not signed]
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-26] (Microsoft Corporation)
R2 xoxufewe; C:\Users\Marius\AppData\Roaming\003F0CDE-1430876041-E011-A025-00266CD20EB8\jnsc147.tmp [222720 2015-05-05] () [File not signed]
S2 BrsHelper; C:\PROGRA~2\YTDOWN~1\BROWSE~2.EXE [X]
R2 lydeteku; C:\Users\Marius\AppData\Roaming\003F0CDE-1430876041-E011-A025-00266CD20EB8\nswD013.tmpfs [X]
S2 UpdateCheck; C:\Program Files (x86)\Coupoon\UpdateCheck.exe run [X]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R1 netfilter64; C:\Windows\System32\drivers\netfilter64.sys [46376 2015-04-02] (NetFilterSDK.com)
S1 innfd_1_10_0_13; system32\drivers\innfd_1_10_0_13.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)

==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-05-06 14:18 - 2015-05-06 14:18 - 00028998 _____ () C:\Users\Marius\Desktop\FRST.txt
2015-05-06 14:17 - 2015-05-06 14:17 - 02102272 _____ (Farbar) C:\Users\Marius\Desktop\FRST64.exe
2015-05-06 14:16 - 2015-05-06 14:18 - 00000000 ____D () C:\FRST
2015-05-05 21:51 - 2015-05-05 21:51 - 00003464 _____ () C:\windows\System32\Tasks\ProPCCleaner_Popup
2015-05-05 20:42 - 2015-05-05 20:42 - 00000000 ____D () C:\windows\pss
2015-05-05 20:09 - 2015-05-05 20:09 - 00000000 ____D () C:\ProgramData\653f05e4000027bf
2015-05-05 20:01 - 2015-05-05 20:01 - 00022512 _____ () C:\windows\system32\Drivers\SPPD.sys
2015-05-05 19:52 - 2015-05-05 19:52 - 00000136 _____ () C:\windows\wininit.ini
2015-05-05 19:39 - 2015-05-05 19:39 - 00000000 ____D () C:\Users\Marius\Documents\Optimizer Pro
2015-05-05 19:37 - 2015-05-05 19:58 - 00000000 ____D () C:\Users\Marius\AppData\Local\003F0CDE-1430854670-E011-A025-00266CD20EB8
2015-05-05 19:35 - 2015-05-05 19:41 - 00000296 _____ () C:\windows\Tasks\RPC.job
2015-05-05 19:35 - 2015-05-05 19:35 - 00000000 ____D () C:\Users\Marius\AppData\Roaming\003F0CDE-1430876102-E011-A025-00266CD20EB8
2015-05-05 19:34 - 2015-05-05 19:34 - 00000320 _____ () C:\windows\Tasks\HYJQUCPDKM1.job
2015-05-05 19:34 - 2015-05-05 19:34 - 00000000 ____D () C:\Users\Marius\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VOPackage
2015-05-05 19:34 - 2015-05-05 19:34 - 00000000 ____D () C:\Users\Marius\AppData\Roaming\003F0CDE-1430876059-E011-A025-00266CD20EB8
2015-05-05 19:34 - 2015-05-05 19:34 - 00000000 ____D () C:\Users\Marius\AppData\Roaming\003F0CDE-1430876041-E011-A025-00266CD20EB8
2015-05-05 19:34 - 2015-05-05 19:34 - 00000000 ____D () C:\ProgramData\8ef1706414cd42349b12fe5555daafbb
2015-05-05 19:33 - 2015-05-05 20:12 - 00000000 ____D () C:\Program Files (x86)\Reg Pro Cleaner
2015-05-05 19:33 - 2015-05-05 19:45 - 00000000 ____D () C:\ProgramData\{46880265-e519-0ffd-4688-80265e510997}
2015-05-05 19:33 - 2015-05-05 19:33 - 00631296 _____ () C:\windows\lnx.dat
2015-05-05 19:33 - 2015-05-05 19:33 - 00417792 _____ () C:\windows\lnx.exe
2015-05-05 19:33 - 2015-05-05 19:33 - 00408576 _____ () C:\windows\mlnx.exe
2015-05-05 19:33 - 2015-05-05 19:33 - 00000000 ____D () C:\ProgramData\c4e28be5fade45ddb77a805914116806
2015-05-05 19:32 - 2015-05-05 20:06 - 00002048 _____ () C:\Users\Marius\Desktop\Continue Mybest Offerstoday Uninstaller.lnk
2015-05-05 19:12 - 2015-05-05 19:12 - 00003200 _____ () C:\windows\System32\Tasks\ProPCCleaner_Start
2015-05-05 19:11 - 2015-05-05 19:11 - 00000000 ____D () C:\Users\Marius\AppData\Local\Pro_PC_Cleaner
2015-05-05 19:10 - 2015-05-05 21:55 - 00000000 ____D () C:\Users\Marius\Documents\ProPCCleaner
2015-05-05 19:06 - 2015-05-05 19:06 - 00000970 _____ () C:\Users\Public\Desktop\Pro PC Cleaner.lnk
2015-05-05 19:06 - 2015-05-05 19:06 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Pro PC Cleaner
2015-05-05 19:06 - 2015-05-05 19:06 - 00000000 ____D () C:\Program Files (x86)\Pro PC Cleaner
2015-05-05 19:05 - 2015-05-05 19:05 - 00000000 ____D () C:\Users\Marius\AppData\Roaming\Pro PC Cleaner
2015-05-04 21:16 - 2015-05-04 21:16 - 00000000 ____D () C:\ProgramData\2069728918344086924
2015-05-04 21:15 - 2015-05-05 18:40 - 00003476 _____ () C:\windows\System32\Tasks\avabvyxvdy
2015-05-04 21:12 - 2015-05-04 21:12 - 00000000 ____D () C:\ProgramData\coofbokbgcodjifeendogcpbkjdnjgpi
2015-05-04 21:10 - 2015-05-05 18:39 - 00000364 _____ () C:\windows\Tasks\Bidaily Synchronize Task.job
2015-05-04 21:10 - 2015-05-04 21:18 - 00000000 ____D () C:\ProgramData\{c0c6049b-348f-9f0c-c0c6-6049b348126c}
2015-05-04 21:10 - 2015-05-04 21:10 - 00003278 _____ () C:\windows\System32\Tasks\Bidaily Synchronize Task
2015-05-04 20:59 - 2015-05-04 21:02 - 01755850 _____ () C:\Users\Marius\Downloads\Ron_Pope-_A_Drop_In_The_Ocean-_lyrics(1).mp3.part
2015-05-04 20:58 - 2015-05-04 21:02 - 05376570 _____ () C:\Users\Marius\Downloads\Ron_Pope-_A_Drop_In_The_Ocean-_lyrics.mp3.part
2015-05-04 18:06 - 2015-05-04 18:07 - 00000000 ____D () C:\ProgramData\Uniblue
2015-05-03 12:28 - 2015-05-03 12:28 - 00003988 _____ () C:\windows\System32\Tasks\LaunchPreSignup
2015-05-03 12:26 - 2015-05-04 18:27 - 00000000 ____D () C:\Users\Marius\AppData\Roaming\Uniblue
2015-05-03 12:26 - 2015-05-04 18:27 - 00000000 ____D () C:\Program Files (x86)\Uniblue
2015-05-02 13:25 - 2015-05-02 13:25 - 00001764 _____ () C:\Users\Public\Desktop\iTunes.lnk
2015-05-02 13:22 - 2015-05-02 13:25 - 00000000 ____D () C:\ProgramData\E1864A66-75E3-486a-BD95-D1B7D99A84A7
2015-05-02 13:22 - 2015-05-02 13:25 - 00000000 ____D () C:\Program Files\iTunes
2015-05-02 13:22 - 2015-05-02 13:22 - 00000000 ____D () C:\Program Files\iPod
2015-05-02 13:22 - 2015-05-02 13:22 - 00000000 ____D () C:\Program Files (x86)\iTunes
2015-05-02 13:21 - 2015-05-02 13:21 - 00000000 ____D () C:\ProgramData\f20efdf800001b7e
2015-05-01 20:58 - 2015-05-01 20:58 - 00000000 ____D () C:\Program Files\Bonjour
2015-05-01 20:58 - 2015-05-01 20:58 - 00000000 ____D () C:\Program Files (x86)\Bonjour
2015-04-30 16:21 - 2015-04-30 16:31 - 00000000 ____D () C:\Users\Marius\AppData\Local\{B508A746-B78F-4A46-BD97-F47AF548DEA9}
2015-04-27 21:09 - 2015-05-05 20:38 - 00000004 _____ () C:\windows\SysWOW64\029B560A371F4E00AB32838EBC01B9E7
2015-04-27 20:10 - 2015-04-27 20:15 - 00000000 ____D () C:\Users\Marius\AppData\Local\BrowserHelper
2015-04-27 20:10 - 2015-04-27 20:10 - 00003908 _____ () C:\windows\System32\Tasks\YTDownloaderUpd
2015-04-27 20:10 - 2015-04-27 20:10 - 00003586 _____ () C:\windows\System32\Tasks\YTDownloader
2015-04-27 20:10 - 2015-04-27 20:10 - 00000000 ____D () C:\Users\Marius\AppData\Local\Crossbrowse
2015-04-27 20:09 - 2015-05-06 14:10 - 00001058 _____ () C:\windows\Tasks\Crossbrowse.job
2015-04-27 20:09 - 2015-05-06 14:09 - 00001340 _____ () C:\windows\Tasks\QJNFZ.job
2015-04-27 20:09 - 2015-04-27 20:10 - 00005478 _____ () C:\windows\System32\Tasks\a250569a-98c2-4048-95cc-84eb2edcd0f9-5
2015-04-27 20:09 - 2015-04-27 20:10 - 00004088 _____ () C:\windows\System32\Tasks\Crossbrowse
2015-04-27 20:09 - 2015-04-27 20:09 - 01973760 _____ (System NotifierV10.03) C:\Users\Marius\AppData\Roaming\QJNFZ.exe
2015-04-27 20:09 - 2015-04-27 20:09 - 00004370 _____ () C:\windows\System32\Tasks\QJNFZ
2015-04-27 20:08 - 2015-05-05 20:35 - 00000000 ____D () C:\Program Files\Common Files\Goobzo
2015-04-27 20:08 - 2015-04-27 20:08 - 00004246 _____ () C:\windows\System32\Tasks\SMW_UpdateTask_Time_323435363138363533362d3437415a556c2a3223346c41
2015-04-27 20:08 - 2015-04-27 20:08 - 00003596 _____ () C:\windows\System32\Tasks\SMWUpd
2015-04-27 20:08 - 2015-04-27 20:08 - 00000000 ____D () C:\ProgramData\SearchModule
2015-04-27 20:07 - 2015-04-27 20:07 - 00000000 ____D () C:\Users\Marius\AppData\Local\CrashRpt
2015-04-27 01:15 - 2015-04-27 01:15 - 00001182 _____ () C:\Users\Public\Desktop\Avira.lnk
2015-04-27 01:11 - 2015-04-27 01:11 - 04636584 _____ (Avira Operations GmbH & Co. KG) C:\Users\Marius\Downloads\avira_de_av_5824665454__ws.exe
2015-04-27 01:08 - 2015-04-27 01:08 - 00003478 _____ () C:\windows\System32\Tasks\avabvxvadx
2015-04-27 01:05 - 2015-04-27 01:14 - 00000000 ____D () C:\ProgramData\Package Cache
2015-04-27 01:04 - 2015-04-30 16:37 - 00000000 ____D () C:\Users\Marius\AppData\Local\avabvxvadx
2015-04-27 01:03 - 2015-05-05 19:22 - 00000112 _____ () C:\ProgramData\AMOD3075.dat
2015-04-27 01:01 - 2015-04-27 01:01 - 00004310 _____ () C:\windows\System32\Tasks\GoogleUpdateTaskUserM_1_7_22_478699874-4155726479-3780505679-3006UA__323435363138363533362d3437415a556c2a3223346c41
2015-04-27 01:01 - 2015-04-27 01:01 - 00000000 ____D () C:\ProgramData\PastaLeadsAgent
2015-04-27 01:00 - 2015-05-05 20:10 - 00000000 ____D () C:\Program Files\Common Files\PastaLeads
2015-04-27 01:00 - 2015-05-05 19:54 - 00000000 ____D () C:\Program Files\Coupoon
2015-04-27 00:59 - 2015-05-05 20:04 - 00000000 ____D () C:\Program Files (x86)\Coupoon
2015-04-27 00:59 - 2015-05-04 18:07 - 00000000 ____D () C:\ProgramData\{a94a5059-3dd9-3ecb-a94a-a50593dd4164}
2015-04-27 00:59 - 2015-05-02 13:21 - 00000000 ____D () C:\Program Files (x86)\Super Optimizer
2015-04-26 21:49 - 2015-04-27 00:57 - 00000000 ____D () C:\Program Files\COMODO
2015-04-26 21:48 - 2015-04-26 21:48 - 00000000 ____D () C:\Users\Marius\AppData\Local\Comodo
2015-04-26 21:47 - 2015-04-26 21:47 - 00000000 ____D () C:\Program Files (x86)\Comodo
2015-04-26 21:45 - 2015-04-27 00:57 - 00000000 ____D () C:\ProgramData\Comodo
2015-04-26 21:24 - 2015-04-26 21:32 - 214041880 _____ (COMODO) C:\Users\Marius\Downloads\cav_installer_3272_7b.exe
2015-04-23 21:10 - 2015-04-23 21:10 - 00003894 _____ () C:\windows\System32\Tasks\GoogleUpdateTaskMachineUA
2015-04-23 21:10 - 2015-04-23 21:10 - 00003642 _____ () C:\windows\System32\Tasks\GoogleUpdateTaskMachineCore
2015-04-23 21:09 - 2015-04-23 21:09 - 00880208 _____ (Google Inc.) C:\Users\Marius\Downloads\ChromeSetup.exe
2015-04-21 20:36 - 2015-05-05 21:24 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-04-15 20:54 - 2015-03-24 21:24 - 03298816 _____ (Microsoft Corporation) C:\windows\system32\wucltux.dll
2015-04-15 20:54 - 2015-03-24 21:24 - 02553856 _____ (Microsoft Corporation) C:\windows\system32\wuaueng.dll
2015-04-15 20:54 - 2015-03-24 21:24 - 00696320 _____ (Microsoft Corporation) C:\windows\system32\wuapi.dll
2015-04-15 20:54 - 2015-03-24 21:24 - 00191488 _____ (Microsoft Corporation) C:\windows\system32\wuwebv.dll
2015-04-15 20:54 - 2015-03-24 21:24 - 00098304 _____ (Microsoft Corporation) C:\windows\system32\wudriver.dll
2015-04-15 20:54 - 2015-03-24 21:24 - 00060416 _____ (Microsoft Corporation) C:\windows\system32\WinSetupUI.dll
2015-04-15 20:54 - 2015-03-24 21:24 - 00037376 _____ (Microsoft Corporation) C:\windows\system32\wups2.dll
2015-04-15 20:54 - 2015-03-24 21:24 - 00035328 _____ (Microsoft Corporation) C:\windows\system32\wups.dll
2015-04-15 20:54 - 2015-03-24 21:23 - 00135168 _____ (Microsoft Corporation) C:\windows\system32\wuauclt.exe
2015-04-15 20:54 - 2015-03-24 21:23 - 00036864 _____ (Microsoft Corporation) C:\windows\system32\wuapp.exe
2015-04-15 20:54 - 2015-03-24 21:23 - 00012288 _____ (Microsoft Corporation) C:\windows\system32\wu.upgrade.ps.dll
2015-04-15 20:54 - 2015-03-24 21:00 - 00566784 _____ (Microsoft Corporation) C:\windows\SysWOW64\wuapi.dll
2015-04-15 20:54 - 2015-03-24 21:00 - 00173056 _____ (Microsoft Corporation) C:\windows\SysWOW64\wuwebv.dll
2015-04-15 20:54 - 2015-03-24 21:00 - 00092672 _____ (Microsoft Corporation) C:\windows\SysWOW64\wudriver.dll
2015-04-15 20:54 - 2015-03-24 21:00 - 00033792 _____ (Microsoft Corporation) C:\windows\SysWOW64\wuapp.exe
2015-04-15 20:54 - 2015-03-24 21:00 - 00029696 _____ (Microsoft Corporation) C:\windows\SysWOW64\wups.dll
2015-04-15 20:53 - 2015-03-22 21:25 - 00769536 _____ (Microsoft Corporation) C:\windows\system32\invagent.dll
2015-04-15 20:53 - 2015-03-22 21:25 - 00726528 _____ (Microsoft Corporation) C:\windows\system32\generaltel.dll
2015-04-15 20:53 - 2015-03-22 21:24 - 00957952 _____ (Microsoft Corporation) C:\windows\system32\appraiser.dll
2015-04-15 20:53 - 2015-03-22 21:24 - 00419840 _____ (Microsoft Corporation) C:\windows\system32\devinv.dll
2015-04-15 20:53 - 2015-03-22 21:24 - 00227328 _____ (Microsoft Corporation) C:\windows\system32\aepdu.dll
2015-04-15 20:53 - 2015-03-22 21:24 - 00192000 _____ (Microsoft Corporation) C:\windows\system32\aepic.dll
2015-04-15 20:53 - 2015-03-22 21:24 - 00030720 _____ (Microsoft Corporation) C:\windows\system32\acmigration.dll
2015-04-15 20:53 - 2015-03-22 21:17 - 01111552 _____ (Microsoft Corporation) C:\windows\system32\aeinv.dll
2015-04-15 20:53 - 2015-03-09 21:25 - 01882624 _____ (Microsoft Corporation) C:\windows\system32\msxml3.dll
2015-04-15 20:53 - 2015-03-09 21:21 - 00002048 _____ (Microsoft Corporation) C:\windows\system32\msxml3r.dll
2015-04-15 20:53 - 2015-03-09 21:08 - 01237504 _____ (Microsoft Corporation) C:\windows\SysWOW64\msxml3.dll
2015-04-15 20:53 - 2015-03-09 21:05 - 00002048 _____ (Microsoft Corporation) C:\windows\SysWOW64\msxml3r.dll
2015-04-15 20:53 - 2015-03-04 23:12 - 00404480 _____ (Microsoft Corporation) C:\windows\system32\gdi32.dll
2015-04-15 20:53 - 2015-03-04 22:05 - 00311808 _____ (Microsoft Corporation) C:\windows\SysWOW64\gdi32.dll
2015-04-15 20:51 - 2015-03-16 23:22 - 05557696 _____ (Microsoft Corporation) C:\windows\system32\ntoskrnl.exe
2015-04-15 20:51 - 2015-03-16 23:22 - 00155576 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ksecpkg.sys
2015-04-15 20:51 - 2015-03-16 23:22 - 00095672 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ksecdd.sys
2015-04-15 20:51 - 2015-03-16 23:19 - 01727904 _____ (Microsoft Corporation) C:\windows\system32\ntdll.dll
2015-04-15 20:51 - 2015-03-16 23:17 - 00362496 _____ (Microsoft Corporation) C:\windows\system32\wow64win.dll
2015-04-15 20:51 - 2015-03-16 23:17 - 00243712 _____ (Microsoft Corporation) C:\windows\system32\wow64.dll
2015-04-15 20:51 - 2015-03-16 23:17 - 00013312 _____ (Microsoft Corporation) C:\windows\system32\wow64cpu.dll
2015-04-15 20:51 - 2015-03-16 23:16 - 01461760 _____ (Microsoft Corporation) C:\windows\system32\lsasrv.dll
2015-04-15 20:51 - 2015-03-16 23:16 - 01163264 _____ (Microsoft Corporation) C:\windows\system32\kernel32.dll
2015-04-15 20:51 - 2015-03-16 23:16 - 00728064 _____ (Microsoft Corporation) C:\windows\system32\kerberos.dll
2015-04-15 20:51 - 2015-03-16 23:16 - 00503808 _____ (Microsoft Corporation) C:\windows\system32\srcore.dll
2015-04-15 20:51 - 2015-03-16 23:16 - 00424448 _____ (Microsoft Corporation) C:\windows\system32\KernelBase.dll
2015-04-15 20:51 - 2015-03-16 23:16 - 00341504 _____ (Microsoft Corporation) C:\windows\system32\schannel.dll
2015-04-15 20:51 - 2015-03-16 23:16 - 00314880 _____ (Microsoft Corporation) C:\windows\system32\msv1_0.dll
2015-04-15 20:51 - 2015-03-16 23:16 - 00309760 _____ (Microsoft Corporation) C:\windows\system32\ncrypt.dll
2015-04-15 20:51 - 2015-03-16 23:16 - 00296960 _____ (Microsoft Corporation) C:\windows\system32\rstrui.exe
2015-04-15 20:51 - 2015-03-16 23:16 - 00215040 _____ (Microsoft Corporation) C:\windows\system32\winsrv.dll
2015-04-15 20:51 - 2015-03-16 23:16 - 00210944 _____ (Microsoft Corporation) C:\windows\system32\wdigest.dll
2015-04-15 20:51 - 2015-03-16 23:16 - 00136192 _____ (Microsoft Corporation) C:\windows\system32\sspicli.dll
2015-04-15 20:51 - 2015-03-16 23:16 - 00112640 _____ (Microsoft Corporation) C:\windows\system32\smss.exe
2015-04-15 20:51 - 2015-03-16 23:16 - 00086528 _____ (Microsoft Corporation) C:\windows\system32\TSpkg.dll
2015-04-15 20:51 - 2015-03-16 23:16 - 00050176 _____ (Microsoft Corporation) C:\windows\system32\srclient.dll
2015-04-15 20:51 - 2015-03-16 23:16 - 00043520 _____ (Microsoft Corporation) C:\windows\system32\csrsrv.dll
2015-04-15 20:51 - 2015-03-16 23:16 - 00029184 _____ (Microsoft Corporation) C:\windows\system32\sspisrv.dll
2015-04-15 20:51 - 2015-03-16 23:16 - 00028160 _____ (Microsoft Corporation) C:\windows\system32\secur32.dll
2015-04-15 20:51 - 2015-03-16 23:16 - 00022016 _____ (Microsoft Corporation) C:\windows\system32\credssp.dll
2015-04-15 20:51 - 2015-03-16 23:16 - 00016384 _____ (Microsoft Corporation) C:\windows\system32\ntvdm64.dll
2015-04-15 20:51 - 2015-03-16 23:15 - 00338432 _____ (Microsoft Corporation) C:\windows\system32\conhost.exe
2015-04-15 20:51 - 2015-03-16 23:15 - 00064000 _____ (Microsoft Corporation) C:\windows\system32\auditpol.exe
2015-04-15 20:51 - 2015-03-16 23:15 - 00031232 _____ (Microsoft Corporation) C:\windows\system32\lsass.exe
2015-04-15 20:51 - 2015-03-16 23:11 - 00005120 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-file-l1-1-0.dll
2015-04-15 20:51 - 2015-03-16 23:11 - 00004608 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2015-04-15 20:51 - 2015-03-16 23:11 - 00004608 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2015-04-15 20:51 - 2015-03-16 23:11 - 00004096 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2015-04-15 20:51 - 2015-03-16 23:11 - 00004096 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-synch-l1-1-0.dll
2015-04-15 20:51 - 2015-03-16 23:11 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-04-15 20:51 - 2015-03-16 23:11 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-misc-l1-1-0.dll
2015-04-15 20:51 - 2015-03-16 23:11 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2015-04-15 20:51 - 2015-03-16 23:11 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-util-l1-1-0.dll
2015-04-15 20:51 - 2015-03-16 23:11 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-string-l1-1-0.dll
2015-04-15 20:51 - 2015-03-16 23:11 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-profile-l1-1-0.dll
2015-04-15 20:51 - 2015-03-16 23:01 - 03976632 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntkrnlpa.exe
2015-04-15 20:51 - 2015-03-16 23:01 - 03920824 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntoskrnl.exe
2015-04-15 20:51 - 2015-03-16 22:59 - 01309696 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntdll.dll
2015-04-15 20:51 - 2015-03-16 22:57 - 00550912 _____ (Microsoft Corporation) C:\windows\SysWOW64\kerberos.dll
2015-04-15 20:51 - 2015-03-16 22:57 - 00259584 _____ (Microsoft Corporation) C:\windows\SysWOW64\msv1_0.dll
2015-04-15 20:51 - 2015-03-16 22:57 - 00248832 _____ (Microsoft Corporation) C:\windows\SysWOW64\schannel.dll
2015-04-15 20:51 - 2015-03-16 22:57 - 00221184 _____ (Microsoft Corporation) C:\windows\SysWOW64\ncrypt.dll
2015-04-15 20:51 - 2015-03-16 22:57 - 00172032 _____ (Microsoft Corporation) C:\windows\SysWOW64\wdigest.dll
2015-04-15 20:51 - 2015-03-16 22:57 - 00065536 _____ (Microsoft Corporation) C:\windows\SysWOW64\TSpkg.dll
2015-04-15 20:51 - 2015-03-16 22:57 - 00043008 _____ (Microsoft Corporation) C:\windows\SysWOW64\srclient.dll
2015-04-15 20:51 - 2015-03-16 22:57 - 00022016 _____ (Microsoft Corporation) C:\windows\SysWOW64\secur32.dll
2015-04-15 20:51 - 2015-03-16 22:57 - 00014336 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntvdm64.dll
2015-04-15 20:51 - 2015-03-16 22:56 - 01114112 _____ (Microsoft Corporation) C:\windows\SysWOW64\kernel32.dll
2015-04-15 20:51 - 2015-03-16 22:56 - 00274944 _____ (Microsoft Corporation) C:\windows\SysWOW64\KernelBase.dll
2015-04-15 20:51 - 2015-03-16 22:56 - 00096768 _____ (Microsoft Corporation) C:\windows\SysWOW64\sspicli.dll
2015-04-15 20:51 - 2015-03-16 22:56 - 00050176 _____ (Microsoft Corporation) C:\windows\SysWOW64\auditpol.exe
2015-04-15 20:51 - 2015-03-16 22:56 - 00025600 _____ (Microsoft Corporation) C:\windows\SysWOW64\setup16.exe
2015-04-15 20:51 - 2015-03-16 22:56 - 00017408 _____ (Microsoft Corporation) C:\windows\SysWOW64\credssp.dll
2015-04-15 20:51 - 2015-03-16 22:56 - 00005120 _____ (Microsoft Corporation) C:\windows\SysWOW64\wow32.dll
2015-04-15 20:51 - 2015-03-16 22:50 - 00005120 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2015-04-15 20:51 - 2015-03-16 22:50 - 00004608 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2015-04-15 20:51 - 2015-03-16 22:50 - 00004096 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2015-04-15 20:51 - 2015-03-16 22:50 - 00004096 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2015-04-15 20:51 - 2015-03-16 22:50 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2015-04-15 20:51 - 2015-03-16 22:50 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2015-04-15 20:51 - 2015-03-16 22:50 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-04-15 20:51 - 2015-03-16 22:50 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2015-04-15 20:50 - 2015-03-16 23:13 - 00146432 _____ (Microsoft Corporation) C:\windows\system32\msaudite.dll
2015-04-15 20:50 - 2015-03-16 23:13 - 00060416 _____ (Microsoft Corporation) C:\windows\system32\msobjs.dll
2015-04-15 20:50 - 2015-03-16 23:11 - 00686080 _____ (Microsoft Corporation) C:\windows\system32\adtschema.dll
2015-04-15 20:50 - 2015-03-16 23:11 - 00006656 _____ (Microsoft Corporation) C:\windows\system32\apisetschema.dll
2015-04-15 20:50 - 2015-03-16 23:11 - 00006144 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-security-base-l1-1-0.dll
2015-04-15 20:50 - 2015-03-16 23:11 - 00004096 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2015-04-15 20:50 - 2015-03-16 23:11 - 00004096 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-localization-l1-1-0.dll
2015-04-15 20:50 - 2015-03-16 23:11 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2015-04-15 20:50 - 2015-03-16 23:11 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2015-04-15 20:50 - 2015-03-16 23:11 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-memory-l1-1-0.dll
2015-04-15 20:50 - 2015-03-16 23:11 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2015-04-15 20:50 - 2015-03-16 23:11 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-heap-l1-1-0.dll
2015-04-15 20:50 - 2015-03-16 23:11 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-io-l1-1-0.dll
2015-04-15 20:50 - 2015-03-16 23:11 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2015-04-15 20:50 - 2015-03-16 23:11 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-handle-l1-1-0.dll
2015-04-15 20:50 - 2015-03-16 23:11 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2015-04-15 20:50 - 2015-03-16 23:11 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2015-04-15 20:50 - 2015-03-16 23:11 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2015-04-15 20:50 - 2015-03-16 23:11 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-debug-l1-1-0.dll
2015-04-15 20:50 - 2015-03-16 23:11 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2015-04-15 20:50 - 2015-03-16 23:11 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-console-l1-1-0.dll
2015-04-15 20:50 - 2015-03-16 22:53 - 00146432 _____ (Microsoft Corporation) C:\windows\SysWOW64\msaudite.dll
2015-04-15 20:50 - 2015-03-16 22:53 - 00060416 _____ (Microsoft Corporation) C:\windows\SysWOW64\msobjs.dll
2015-04-15 20:50 - 2015-03-16 22:50 - 00686080 _____ (Microsoft Corporation) C:\windows\SysWOW64\adtschema.dll
2015-04-15 20:50 - 2015-03-16 22:50 - 00006656 _____ (Microsoft Corporation) C:\windows\SysWOW64\apisetschema.dll
2015-04-15 20:50 - 2015-03-16 22:50 - 00004096 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2015-04-15 20:50 - 2015-03-16 22:50 - 00004096 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2015-04-15 20:50 - 2015-03-16 22:50 - 00004096 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2015-04-15 20:50 - 2015-03-16 22:50 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2015-04-15 20:50 - 2015-03-16 22:50 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2015-04-15 20:50 - 2015-03-16 22:50 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2015-04-15 20:50 - 2015-03-16 22:50 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2015-04-15 20:50 - 2015-03-16 22:50 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2015-04-15 20:50 - 2015-03-16 22:50 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2015-04-15 20:50 - 2015-03-16 22:50 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2015-04-15 20:50 - 2015-03-16 22:50 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2015-04-15 20:50 - 2015-03-16 22:50 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2015-04-15 20:50 - 2015-03-16 22:50 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2015-04-15 20:50 - 2015-03-16 22:50 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2015-04-15 20:50 - 2015-03-16 22:50 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2015-04-15 20:50 - 2015-03-16 22:50 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2015-04-15 20:50 - 2015-03-16 21:45 - 00007680 _____ (Microsoft Corporation) C:\windows\SysWOW64\instnm.exe
2015-04-15 20:50 - 2015-03-16 21:45 - 00002048 _____ (Microsoft Corporation) C:\windows\SysWOW64\user.exe
2015-04-15 20:50 - 2015-03-16 21:43 - 00006144 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2015-04-15 20:50 - 2015-03-16 21:43 - 00004608 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2015-04-15 20:50 - 2015-03-16 21:43 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2015-04-15 20:50 - 2015-03-16 21:43 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2015-04-15 20:48 - 2015-04-01 17:49 - 00342704 _____ (Microsoft Corporation) C:\windows\SysWOW64\iedkcs32.dll
2015-04-15 20:48 - 2015-03-12 22:25 - 02724864 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb
2015-04-15 20:48 - 2015-03-12 22:08 - 00048640 _____ (Microsoft Corporation) C:\windows\system32\ieetwproxystub.dll
2015-04-15 20:48 - 2015-03-12 21:59 - 00034304 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll
2015-04-15 20:48 - 2015-03-12 21:54 - 00114688 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollector.exe
2015-04-15 20:48 - 2015-03-12 21:42 - 19695616 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll
2015-04-15 20:48 - 2015-03-12 21:42 - 02724864 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.tlb
2015-04-15 20:48 - 2015-03-12 21:32 - 00077824 _____ (Microsoft Corporation) C:\windows\system32\JavaScriptCollectionAgent.dll
2015-04-15 20:48 - 2015-03-12 21:27 - 00047616 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieetwproxystub.dll
2015-04-15 20:48 - 2015-03-12 21:26 - 00064000 _____ (Microsoft Corporation) C:\windows\SysWOW64\MshtmlDac.dll
2015-04-15 20:48 - 2015-03-12 21:20 - 00030720 _____ (Microsoft Corporation) C:\windows\SysWOW64\iernonce.dll
2015-04-15 20:48 - 2015-03-12 21:08 - 00720384 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe
2015-04-15 20:48 - 2015-03-12 21:01 - 00060416 _____ (Microsoft Corporation) C:\windows\SysWOW64\JavaScriptCollectionAgent.dll
2015-04-15 20:48 - 2015-03-12 20:56 - 00076288 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmled.dll
2015-04-15 20:48 - 2015-03-12 20:54 - 00285696 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtrans.dll
2015-04-15 20:48 - 2015-03-12 20:44 - 00689152 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll
2015-04-15 20:48 - 2015-03-12 20:16 - 01311232 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll
2015-04-15 20:48 - 2015-02-24 21:18 - 00754688 _____ (Microsoft Corporation) C:\windows\system32\Drivers\http.sys
2015-04-15 20:47 - 2015-04-01 18:17 - 00389808 _____ (Microsoft Corporation) C:\windows\system32\iedkcs32.dll
2015-04-15 20:47 - 2015-03-12 22:32 - 24980480 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll
2015-04-15 20:47 - 2015-03-12 22:25 - 00004096 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollectorres.dll
2015-04-15 20:47 - 2015-03-12 22:09 - 00066560 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll
2015-04-15 20:47 - 2015-03-12 22:08 - 00584192 _____ (Microsoft Corporation) C:\windows\system32\vbscript.dll
2015-04-15 20:47 - 2015-03-12 22:08 - 00417280 _____ (Microsoft Corporation) C:\windows\system32\html.iec
2015-04-15 20:47 - 2015-03-12 22:07 - 02886144 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll
2015-04-15 20:47 - 2015-03-12 22:06 - 00088064 _____ (Microsoft Corporation) C:\windows\system32\MshtmlDac.dll
2015-04-15 20:47 - 2015-03-12 22:00 - 00054784 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll
2015-04-15 20:47 - 2015-03-12 21:55 - 00633856 _____ (Microsoft Corporation) C:\windows\system32\ieui.dll
2015-04-15 20:47 - 2015-03-12 21:54 - 00144384 _____ (Microsoft Corporation) C:\windows\system32\ieUnatt.exe
2015-04-15 20:47 - 2015-03-12 21:53 - 00814080 _____ (Microsoft Corporation) C:\windows\system32\jscript9diag.dll
2015-04-15 20:47 - 2015-03-12 21:50 - 06025216 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll
2015-04-15 20:47 - 2015-03-12 21:44 - 00968704 _____ (Microsoft Corporation) C:\windows\system32\MsSpellCheckingFacility.exe
2015-04-15 20:47 - 2015-03-12 21:40 - 00490496 _____ (Microsoft Corporation) C:\windows\system32\dxtmsft.dll
2015-04-15 20:47 - 2015-03-12 21:28 - 00503296 _____ (Microsoft Corporation) C:\windows\SysWOW64\vbscript.dll
2015-04-15 20:47 - 2015-03-12 21:28 - 00062464 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesetup.dll
2015-04-15 20:47 - 2015-03-12 21:27 - 00340992 _____ (Microsoft Corporation) C:\windows\SysWOW64\html.iec
2015-04-15 20:47 - 2015-03-12 21:27 - 00199680 _____ (Microsoft Corporation) C:\windows\system32\msrating.dll
2015-04-15 20:47 - 2015-03-12 21:26 - 00092160 _____ (Microsoft Corporation) C:\windows\system32\mshtmled.dll
2015-04-15 20:47 - 2015-03-12 21:23 - 00316928 _____ (Microsoft Corporation) C:\windows\system32\dxtrans.dll
2015-04-15 20:47 - 2015-03-12 21:22 - 02278400 _____ (Microsoft Corporation) C:\windows\SysWOW64\iertutil.dll
2015-04-15 20:47 - 2015-03-12 21:20 - 00047104 _____ (Microsoft Corporation) C:\windows\SysWOW64\jsproxy.dll
2015-04-15 20:47 - 2015-03-12 21:17 - 00478208 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieui.dll
2015-04-15 20:47 - 2015-03-12 21:16 - 00115712 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieUnatt.exe
2015-04-15 20:47 - 2015-03-12 21:15 - 00620032 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9diag.dll
2015-04-15 20:47 - 2015-03-12 21:07 - 00801280 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll
2015-04-15 20:47 - 2015-03-12 21:06 - 00418304 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtmsft.dll
2015-04-15 20:47 - 2015-03-12 21:05 - 02125824 _____ (Microsoft Corporation) C:\windows\system32\inetcpl.cpl
2015-04-15 20:47 - 2015-03-12 21:05 - 01359360 _____ (Microsoft Corporation) C:\windows\system32\mshtmlmedia.dll
2015-04-15 20:47 - 2015-03-12 21:00 - 14397440 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll
2015-04-15 20:47 - 2015-03-12 20:57 - 00168960 _____ (Microsoft Corporation) C:\windows\SysWOW64\msrating.dll
2015-04-15 20:47 - 2015-03-12 20:49 - 04305408 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll
2015-04-15 20:47 - 2015-03-12 20:45 - 02358784 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll
2015-04-15 20:47 - 2015-03-12 20:43 - 02052608 _____ (Microsoft Corporation) C:\windows\SysWOW64\inetcpl.cpl
2015-04-15 20:47 - 2015-03-12 20:42 - 01155072 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmlmedia.dll
2015-04-15 20:47 - 2015-03-12 20:34 - 12825600 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll
2015-04-15 20:47 - 2015-03-12 20:33 - 01548288 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll
2015-04-15 20:47 - 2015-03-12 20:22 - 00800768 _____ (Microsoft Corporation) C:\windows\system32\ieapfltr.dll
2015-04-15 20:47 - 2015-03-12 20:20 - 01888256 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll
2015-04-15 20:47 - 2015-03-12 20:14 - 00710144 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieapfltr.dll
2015-04-15 20:46 - 2015-03-03 22:55 - 00367552 _____ (Microsoft Corporation) C:\windows\system32\clfs.sys
2015-04-15 20:46 - 2015-03-03 22:41 - 00079360 _____ (Microsoft Corporation) C:\windows\system32\clfsw32.dll
2015-04-15 20:46 - 2015-03-03 22:10 - 00058880 _____ (Microsoft Corporation) C:\windows\SysWOW64\clfsw32.dll

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-05-06 14:17 - 2009-07-13 23:13 - 00916234 _____ () C:\windows\system32\PerfStringBackup.INI
2015-05-06 14:14 - 2014-05-19 09:12 - 00000000 ____D () C:\Program Files (x86)\globalUpdate
2015-05-06 14:14 - 2013-11-24 14:47 - 01768506 _____ () C:\windows\WindowsUpdate.log
2015-05-06 14:10 - 2014-12-21 21:18 - 00000000 ___RD () C:\Users\Marius\iCloudDrive
2015-05-06 14:09 - 2014-05-19 09:12 - 00002192 _____ () C:\windows\Tasks\d73553dc-f069-47b3-8808-35e7c4b13dc7-4.job
2015-05-06 14:09 - 2009-07-13 23:08 - 00000006 ____H () C:\windows\Tasks\SA.DAT
2015-05-06 14:09 - 2009-07-13 22:51 - 00083643 _____ () C:\windows\setupact.log
2015-05-05 21:50 - 2013-11-24 17:29 - 00003934 _____ () C:\windows\System32\Tasks\User_Feed_Synchronization-{C0C803C3-9DAB-4179-BCF8-1A69B5065300}
2015-05-05 21:49 - 2013-11-25 19:19 - 00000830 _____ () C:\windows\Tasks\Adobe Flash Player Updater.job
2015-05-05 21:45 - 2009-07-13 22:45 - 00025120 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-05-05 21:45 - 2009-07-13 22:45 - 00025120 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-05-05 21:27 - 2010-11-20 21:47 - 00566178 _____ () C:\windows\PFRO.log
2015-05-05 20:13 - 2013-11-24 16:48 - 00001440 _____ () C:\Users\Marius\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2015-05-05 20:01 - 2013-11-24 17:10 - 00000258 _____ () C:\windows\Tasks\HP Photo Creations Messager.job
2015-05-05 19:30 - 2013-11-24 15:49 - 00000000 ____D () C:\Program Files (x86)\Google
2015-05-05 18:39 - 2013-12-08 03:50 - 00000000 ____D () C:\Users\Marius\AppData\Local\CrashDumps
2015-05-03 12:28 - 2013-12-26 23:27 - 00000000 ____D () C:\Users\Marius\AppData\Roaming\Mozilla
2015-05-02 13:53 - 2014-12-21 21:19 - 00000000 ____D () C:\Users\Marius\AppData\Local\3D9A29EF-AEAE-42DA-B5EC-41E908C1C154.aplzod
2015-05-02 13:22 - 2014-12-21 20:23 - 00000000 ____D () C:\Program Files\Common Files\Apple
2015-04-27 20:09 - 2009-07-13 21:20 - 00000000 ____D () C:\Program Files\Common Files\System
2015-04-27 01:14 - 2013-12-25 07:55 - 00000000 ____D () C:\ProgramData\Avira
2015-04-27 01:14 - 2013-12-25 07:55 - 00000000 ____D () C:\Program Files (x86)\Avira
2015-04-26 21:25 - 2013-11-24 15:51 - 00000000 ____D () C:\Program Files (x86)\TOSHIBA Games
2015-04-26 21:23 - 2013-11-24 15:51 - 00000000 ____D () C:\ProgramData\WildTangent
2015-04-26 21:23 - 2009-07-13 23:32 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
2015-04-26 21:19 - 2014-10-18 22:32 - 00000000 ____D () C:\ProgramData\Yahoo!
2015-04-26 21:19 - 2014-10-18 22:29 - 00000000 ____D () C:\Program Files (x86)\Yahoo!
2015-04-25 20:56 - 2009-07-13 21:20 - 00000000 ____D () C:\windows\AppCompat
2015-04-21 19:03 - 2014-02-01 16:08 - 00542720 ___SH () C:\Users\Marius\Documents\Thumbs.db
2015-04-19 09:58 - 2009-07-13 21:20 - 00000000 ____D () C:\windows\system32\NDF
2015-04-19 08:39 - 2014-08-31 18:30 - 00000000 ____D () C:\ProgramData\Oracle
2015-04-19 08:30 - 2014-10-23 09:08 - 00098216 _____ (Oracle Corporation) C:\windows\SysWOW64\WindowsAccessBridge-32.dll
2015-04-19 08:30 - 2011-03-02 21:16 - 00000000 ____D () C:\Program Files (x86)\Java
2015-04-18 14:16 - 2013-11-27 22:15 - 00000000 ____D () C:\Users\Marius\AppData\Local\Microsoft Help
2015-04-16 21:08 - 2014-12-11 19:07 - 00000000 ____D () C:\windows\system32\appraiser
2015-04-16 21:08 - 2014-04-22 23:15 - 00000000 ___SD () C:\windows\system32\CompatTel
2015-04-16 21:08 - 2009-07-13 21:20 - 00000000 ____D () C:\windows\PolicyDefinitions
2015-04-16 00:03 - 2013-11-27 22:15 - 00000000 ____D () C:\ProgramData\Microsoft Help
2015-04-16 00:00 - 2014-02-26 17:30 - 00766100 _____ () C:\windows\SysWOW64\PerfStringBackup.INI
2015-04-15 23:53 - 2013-11-30 16:55 - 00000000 ____D () C:\windows\system32\MRT
2015-04-15 23:43 - 2013-11-30 16:54 - 128913832 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe
2015-04-15 23:42 - 2009-07-13 20:34 - 00000478 _____ () C:\windows\win.ini
2015-04-15 21:50 - 2013-11-25 19:19 - 00003768 _____ () C:\windows\System32\Tasks\Adobe Flash Player Updater
2015-04-15 21:49 - 2013-11-25 19:19 - 00778416 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe
2015-04-15 21:49 - 2013-11-25 19:19 - 00142512 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl

==================== Files in the root of some directories =======

2014-05-19 09:45 - 2014-05-19 09:45 - 0000000 _____ () C:\Users\Marius\AppData\Roaming\aps.uninstall.scan.results
2015-03-09 15:30 - 2015-03-09 15:30 - 0005487 _____ () C:\Users\Marius\AppData\Roaming\QJNFZ
2015-04-27 20:09 - 2015-04-27 20:09 - 1973760 _____ (System NotifierV10.03) C:\Users\Marius\AppData\Roaming\QJNFZ.exe
2014-05-19 09:42 - 2014-05-19 07:19 - 1705063 _____ (AnyProtect.com) C:\Users\Marius\AppData\Local\AnyProtectScannerSetup.exe
2015-05-05 20:11 - 2015-05-05 20:11 - 0000802 _____ () C:\Users\Marius\AppData\Local\Temp-log.txt
2013-11-24 17:06 - 2013-11-24 17:06 - 0000057 _____ () C:\ProgramData\Ament.ini
2015-04-27 01:03 - 2015-05-05 19:22 - 0000112 _____ () C:\ProgramData\AMOD3075.dat

Files to move or delete:
====================
C:\ProgramData\AMOD3075.dat

Some content of TEMP:
====================
C:\Users\Marius\AppData\Local\Temp\1910.exe
C:\Users\Marius\AppData\Local\Temp\8418.exe
C:\Users\Marius\AppData\Local\Temp\932.exe
C:\Users\Marius\AppData\Local\Temp\APNSetup.exe
C:\Users\Marius\AppData\Local\Temp\avgnt.exe
C:\Users\Marius\AppData\Local\Temp\Avira.exe
C:\Users\Marius\AppData\Local\Temp\BackupSetup.exe
C:\Users\Marius\AppData\Local\Temp\BundleSweetIMSetup.exe
C:\Users\Marius\AppData\Local\Temp\Coupoon72.exe
C:\Users\Marius\AppData\Local\Temp\d7a5711ffec14c4c8d518980af745940275714.exe
C:\Users\Marius\AppData\Local\Temp\Delta.exe
C:\Users\Marius\AppData\Local\Temp\DeltaTB.exe
C:\Users\Marius\AppData\Local\Temp\fp_pl_pfs_installer-1.exe
C:\Users\Marius\AppData\Local\Temp\fp_pl_pfs_installer.exe
C:\Users\Marius\AppData\Local\Temp\install_flashplayer11x32ax_chra_awa_aih.exe
C:\Users\Marius\AppData\Local\Temp\jre-7u71-windows-i586-iftw.exe
C:\Users\Marius\AppData\Local\Temp\jre-8u31-windows-au.exe
C:\Users\Marius\AppData\Local\Temp\jre-8u45-windows-au.exe
C:\Users\Marius\AppData\Local\Temp\looksafe-setup-looksftnc1.exe
C:\Users\Marius\AppData\Local\Temp\MobilePCStarterKit80.exe
C:\Users\Marius\AppData\Local\Temp\Mobogenie_Setup_2.1.36_506.exe
C:\Users\Marius\AppData\Local\Temp\MybabylonTB.exe
C:\Users\Marius\AppData\Local\Temp\MyBestOffersToday38.exe
C:\Users\Marius\AppData\Local\Temp\mytmpinstaller.exe
C:\Users\Marius\AppData\Local\Temp\nsdAFD5.exe
C:\Users\Marius\AppData\Local\Temp\nsdBCF0.exe
C:\Users\Marius\AppData\Local\Temp\nsiFBB0.exe
C:\Users\Marius\AppData\Local\Temp\nsj98C2.exe
C:\Users\Marius\AppData\Local\Temp\nso7846.exe
C:\Users\Marius\AppData\Local\Temp\Offercast_AVIRAV7_.exe
C:\Users\Marius\AppData\Local\Temp\optprosetup.exe
C:\Users\Marius\AppData\Local\Temp\PastaLeads78.exe
C:\Users\Marius\AppData\Local\Temp\SearchProtect34.exe
C:\Users\Marius\AppData\Local\Temp\SearchWithGoogleUpdate.exe
C:\Users\Marius\AppData\Local\Temp\SettingsManagerSetup.exe
C:\Users\Marius\AppData\Local\Temp\Setup.exe
C:\Users\Marius\AppData\Local\Temp\setup{0370F940-1307-4537-8603-AE8D140804DA}.exe
C:\Users\Marius\AppData\Local\Temp\SuperOptimizer21.exe
C:\Users\Marius\AppData\Local\Temp\supoptsetup.exe
C:\Users\Marius\AppData\Local\Temp\tu17p84.exe
C:\Users\Marius\AppData\Local\Temp\Uninstall.exe
C:\Users\Marius\AppData\Local\Temp\WSSetup.exe
C:\Users\Marius\AppData\Local\Temp\ZoomWeb_Installer51.exe
C:\Users\Marius\AppData\Local\Temp\_unps.exe
C:\Users\Marius\AppData\Local\Temp\{DB89853C-74AD-433D-A367-F9BEED394FAA}-42.0.2311.135_42.0.2311.90_chrome_updater.exe

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2014-05-03 19:19

==================== End Of Log ============================

moeko New Helpee Posts: 13	[ti]SOLVED[/ti]Several malwares that can't be deleted? May 6, 2015 12:28:02 GMT -8 Select Post Deselect Post Link to Post Member Give Gift Back to Top Post by moeko on May 6, 2015 12:28:02 GMT -8 the first one is from the frst.txt pastebin.com/YSNgHnJ8
	Last Edit: May 6, 2015 12:33:11 GMT -8 by moeko

Krusty Logging Assistant In Oz Posts: 2,330	[ti]SOLVED[/ti]Several malwares that can't be deleted? May 6, 2015 14:42:28 GMT -8 Select Post Deselect Post Link to Post Member Give Gift Back to Top Post by Krusty on May 6, 2015 14:42:28 GMT -8 Good job! Please wait patiently for a Malware Removalist to get to you. Please avoid bumping your thread as this will push it futher down the list. Thanks.
	I do NOT do support by PM. Thank you.

dbrisen
Malware Removalists

Posts: 3,688

[ti]SOLVED[/ti]Several malwares that can't be deleted? May 7, 2015 20:32:41 GMT -8

Post by dbrisen on May 7, 2015 20:32:41 GMT -8

Wow; quite a lot on this system. Let's get at it >>>>

FIRST >>>>

Please go to START (Windows Orb) >> Control Panel >> Uninstall a Program or Programs and Features[/i][/b] and remove the following (if listed):

Websteroids

To do so, left clicking on the name once and then click Uninstall/Change at the bar above the list window.

Follow the prompts of the uninstaller BUT please read carefully any questions it asks before answering; some uninstallers will try and deceive you into keeping the software.

SECOND >>>>

Open notepad by pressing the Windows Key + R key, typing notepad in the Run box and pressing Enter. Please copy the contents of the quote box below. To do this highlight the contents of the box and right click on it and select copy. Paste this into the open notepad. Save it to your desktop as fixlist.txt

Start
CreateRestorePoint:
CloseProcesses:
HKLM\...\Run: [] => [X]
HKLM-x32\...\Run: [fst_ca_99] => [X]
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [mpck_ca_10] => [X]
HKLM-x32\...\Run: [mbot_ca_482] => [X]
HKLM-x32\...\Run: [YTDownloader] => "C:\Program Files (x86)\YTDownloader\YTDownloader.exe" /boot
C:\Program Files (x86)\YTDownloader
HKU\S-1-5-21-2827223565-3312671657-2323579203-1000\...\Run: [YTDownloader] => "C:\Program Files (x86)\YTDownloader\YTDownloader.exe" /boot
HKU\S-1-5-21-2827223565-3312671657-2323579203-1000\...\Run: [GoogleChromeAutoLaunch_B73401D408F5FBC1A31E4154B60B5830] => "C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\crossbrowse.exe" --no-startup-window
C:\Program Files (x86)\Crossbrowse
HKU\S-1-5-21-2827223565-3312671657-2323579203-1000\...\Run: [Reg Pro Cleaner] => C:\Program Files (x86)\Reg Pro Cleaner\RegProCleaner.exe
C:\Program Files (x86)\Reg Pro Cleaner
AppInit_DLLs: C:\ProgramData\LolyKey\LolyKey64.dll => C:\ProgramData\LolyKey\LolyKey64.dll File Not Found
C:\ProgramData\LolyKey
AppInit_DLLs: C:\PROGRA~2\Linkey\IEEXTE~1\iedll64.dll => C:\PROGRA~2\Linkey\IEEXTE~1\iedll64.dll File Not Found
C:\PROGRA~2\Linkey
AppInit_DLLs-x32: c:\programdata\lolykey\lolykey32.dll => "c:\programdata\lolykey\lolykey32.dll" File Not Found
c:\programdata\lolykey
IFEO\bitguard.exe: [Debugger] tasklist.exe
IFEO\bprotect.exe: [Debugger] tasklist.exe
IFEO\bpsvc.exe: [Debugger] tasklist.exe
IFEO\browsemngr.exe: [Debugger] tasklist.exe
IFEO\browserdefender.exe: [Debugger] tasklist.exe
IFEO\browsermngr.exe: [Debugger] tasklist.exe
IFEO\browserprotect.exe: [Debugger] tasklist.exe
IFEO\browsersafeguard.exe: [Debugger] tasklist.exe
IFEO\bundlesweetimsetup.exe: [Debugger] tasklist.exe
IFEO\cltmngsvc.exe: [Debugger]
IFEO\delta babylon.exe: [Debugger] tasklist.exe
IFEO\delta tb.exe: [Debugger] tasklist.exe
IFEO\delta2.exe: [Debugger] tasklist.exe
IFEO\deltainstaller.exe: [Debugger] tasklist.exe
IFEO\deltasetup.exe: [Debugger] tasklist.exe
IFEO\deltatb.exe: [Debugger] tasklist.exe
IFEO\deltatb_2501-c733154b.exe: [Debugger] tasklist.exe
IFEO\dprotectsvc.exe: [Debugger] tasklist.exe
IFEO\iminentsetup.exe: [Debugger] tasklist.exe
IFEO\protectedsearch.exe: [Debugger] tasklist.exe
IFEO\rjatydimofu.exe: [Debugger] tasklist.exe
IFEO\searchprotection.exe: [Debugger] tasklist.exe
IFEO\searchprotector.exe: [Debugger] tasklist.exe
IFEO\snapdo.exe: [Debugger] tasklist.exe
IFEO\stinst32.exe: [Debugger] tasklist.exe
IFEO\stinst64.exe: [Debugger] tasklist.exe
IFEO\sweetimsetup.exe: [Debugger] tasklist.exe
IFEO\tbdelta.exetoolbar783881609.exe: [Debugger] tasklist.exe
IFEO\utiljumpflip.exe: [Debugger] tasklist.exe
Startup: C:\Users\Marius\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hqghumeaylnlf.lnk [2015-04-27]
ShortcutTarget: hqghumeaylnlf.lnk -> C:\ProgramData\{46880265-e519-0ffd-4688-80265e510997}\hqghumeaylnlf.exe (PC Utilities Software Limited)
C:\ProgramData\{46880265-e519-0ffd-4688-80265e510997}
Startup: C:\Users\Marius\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\priceless_p_soft_partner.lnk [2015-05-04]
ShortcutTarget: priceless_p_soft_partner.lnk -> C:\ProgramData\{c0c6049b-348f-9f0c-c0c6-6049b348126c}\priceless_p_soft_partner.exe ()
C:\ProgramData\{c0c6049b-348f-9f0c-c0c6-6049b348126c}
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
ProxyEnable: [.DEFAULT] => Internet Explorer proxy is enabled.
ProxyServer: [.DEFAULT] => http=127.0.0.1:51213;https=127.0.0.1:51213
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = speedial.com/?f=1&a=spd_cmi_14_21_ff&cd=2XzuyEtN2Y1L1Qzu0DtD0D0Fzy0AyByDzyyEzzyB0Ezzzy0CtN0D0Tzu0SzzyBtDtN1L2XzutBtFtBtDtFtCtAtFtCtN1L1CzutCyEtDtAtDyD1V1StN1L1G1B1V1N2Y1L1Qzu2SyCtDtA0FtB0DyE0BtGzzyD0FyCtGtDyE0EyEtG0A0B0B0CtGyByByEyCyC0CtCtCtAtCyD0B2QtN1M1F1B2Z1V1N2Y1L1Qzu2StBtDtCyEtAtA0DtCtGyC0ByDtCtGyB0ByB0AtGyEtB0DtAtGyEyEtB0CyCyC0CyCyDzztAtC2Q&cr=1778512867&ir=
SearchScopes: HKLM -> DefaultScope {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7TSCA
SearchScopes: HKLM -> {31090377-0740-419E-BEFC-A56E50500D5B} URL = speedial.com/results.php?f=4&q={searchTerms}&a=spd_cmi_14_21_ff&cd=2XzuyEtN2Y1L1Qzu0DtD0D0Fzy0AyByDzyyEzzyB0Ezzzy0CtN0D0Tzu0SzzyBtDtN1L2XzutBtFtBtDtFtCtAtFtCtN1L1CzutCyEtDtAtDyD1V1StN1L1G1B1V1N2Y1L1Qzu2SyCtDtA0FtB0DyE0BtGzzyD0FyCtGtDyE0EyEtG0A0B0B0CtGyByByEyCyC0CtCtCtAtCyD0B2QtN1M1F1B2Z1V1N2Y1L1Qzu2StBtDtCyEtAtA0DtCtGyC0ByDtCtGyB0ByB0AtGyEtB0DtAtGyEyEtB0CyCyC0CyCyDzztAtC2Q&cr=1778512867&ir=
SearchScopes: HKLM -> {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7TSCA
SearchScopes: HKLM -> {9BB47C17-9C68-4BB3-B188-DD9AF0FD2476} URL = www.default-search.net/search?sid=476&aid=123&itype=n&ver=11471&tm=304&src=ds&p={searchTerms}
SearchScopes: HKLM-x32 -> DefaultScope {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7TSCA
SearchScopes: HKLM-x32 -> {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7TSCA
SearchScopes: HKLM-x32 -> {9BB47C17-9C68-4BB3-B188-DD9AF0FD2476} URL = www.default-search.net/search?sid=476&aid=123&itype=n&ver=11471&tm=304&src=ds&p={searchTerms}
SearchScopes: HKU\S-1-5-21-2827223565-3312671657-2323579203-1000 -> DefaultScope {015DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = www-searching.com/search.aspx?site=shdefault&pid=s&shr=d&q={searchTerms}&s=F4Sztutdk0004,62cd1a55-75d8-4297-8b96-3f3008bc6f3b,
SearchScopes: HKU\S-1-5-21-2827223565-3312671657-2323579203-1000 -> URL search.conduit.com/Results.aspx?ctid=CT3323737&octid=EB_ORIGINAL_CTID&SearchSource=58&CUI=&UM=4&UP=SP4A7CC89F-9D00-453F-801E-DC1A1A577853&q={searchTerms}&SSPV=
SearchScopes: HKU\S-1-5-21-2827223565-3312671657-2323579203-1000 -> SuggestionsURL_JSON suggest.search.conduit.com/CSuggestJson.ashx?prefix={searchTerms}
SearchScopes: HKU\S-1-5-21-2827223565-3312671657-2323579203-1000 -> AEE59D684DC54BE58C012BCD7DE9134C URL = www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7TSCA_enCA563
SearchScopes: HKU\S-1-5-21-2827223565-3312671657-2323579203-1000 -> {015DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = www-searching.com/search.aspx?site=shdefault&pid=s&shr=d&q={searchTerms}&s=F4Sztutdk0004,62cd1a55-75d8-4297-8b96-3f3008bc6f3b,
SearchScopes: HKU\S-1-5-21-2827223565-3312671657-2323579203-1000 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-2827223565-3312671657-2323579203-1000 -> {31090377-0740-419E-BEFC-A56E50500D5B} URL = speedial.com/results.php?f=4&q={searchTerms}&a=spd_cmi_14_21_ff&cd=2XzuyEtN2Y1L1Qzu0DtD0D0Fzy0AyByDzyyEzzyB0Ezzzy0CtN0D0Tzu0SzzyBtDtN1L2XzutBtFtBtDtFtCtAtFtCtN1L1CzutCyEtDtAtDyD1V1StN1L1G1B1V1N2Y1L1Qzu2SyCtDtA0FtB0DyE0BtGzzyD0FyCtGtDyE0EyEtG0A0B0B0CtGyByByEyCyC0CtCtCtAtCyD0B2QtN1M1F1B2Z1V1N2Y1L1Qzu2StBtDtCyEtAtA0DtCtGyC0ByDtCtGyB0ByB0AtGyEtB0DtAtGyEyEtB0CyCyC0CyCyDzztAtC2Q&cr=1778512867&ir=
SearchScopes: HKU\S-1-5-21-2827223565-3312671657-2323579203-1000 -> {3BD44F0E-0596-4008-AEE0-45D47E3A8F0E} URL = www.mystart.com/results.php?gen=ms&pr=vmn&id=mystarttb&v=5_4&ent=ch_5108&q={searchTerms}
SearchScopes: HKU\S-1-5-21-2827223565-3312671657-2323579203-1000 -> {41B3F996-1E5D-4747-8F4B-ED6AEEE2F544} URL = search.conduit.com/Results.aspx?ctid=CT3323737&octid=EB_ORIGINAL_CTID&SearchSource=58&CUI=&UM=4&UP=SP4A7CC89F-9D00-453F-801E-DC1A1A577853&q={searchTerms}&SSPV=
SearchScopes: HKU\S-1-5-21-2827223565-3312671657-2323579203-1000 -> {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7TSCA_enCA563
SearchScopes: HKU\S-1-5-21-2827223565-3312671657-2323579203-1000 -> {7F4EFF06-7032-458e-AE16-1C1D8255C28A} URL = www-searching.com/search.aspx?site=shdefault&pid=s&shr=d&q={searchTerms}&s=F4Sztutdk0004,62cd1a55-75d8-4297-8b96-3f3008bc6f3b,
SearchScopes: HKU\S-1-5-21-2827223565-3312671657-2323579203-1000 -> {9BB47C17-9C68-4BB3-B188-DD9AF0FD2476} URL = www.default-search.net/search?sid=476&aid=123&itype=n&ver=11471&tm=304&src=ds&p={searchTerms}
SearchScopes: HKU\S-1-5-21-2827223565-3312671657-2323579203-1000 -> {9F3C458B-4494-4EE0-A486-535ED0420E03} URL = www.trovi.com/Results.aspx?gd=&ctid=CT3324769&octid=EB_ORIGINAL_CTID&ISID=M25827412-7801-4FC6-BCA9-014202123AE0&SearchSource=58&CUI=&UM=8&UP=SP4C619BAA-02B5-4133-AE25-8C66039ED0E7&q={searchTerms}&D=042715&SSPV=SP2230TB_sp_ie
BHO: No Name -> {4D9101D6-5BA0-4048-BDDE-7E2DF54C8C47} -> No File
BHO-x32: No Name -> {02478D38-C3F9-4efb-9B51-7695ECA05670} -> No File
Toolbar: HKU\S-1-5-21-2827223565-3312671657-2323579203-1000 -> No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
Toolbar: HKU\S-1-5-21-2827223565-3312671657-2323579203-1000 -> No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File
Toolbar: HKU\S-1-5-21-2827223565-3312671657-2323579203-1000 -> No Name - {4F524A2D-5350-4500-76A7-7A786E7484D7} - No File
FF SearchEngineOrder.1: default-search.net
FF SearchEngineOrder.3: Bing
FF SelectedSearchEngine: Trovi
FF Homepage: hxxp://www.trovi.com/?gd=&ctid=CT3324769&octid=EB_ORIGINAL_CTID&ISID=M25827412-7801-4FC6-BCA9-014202123AE0&SearchSource=55&CUI=&UM=8&UP=SP4C619BAA-02B5-4133-AE25-8C66039ED0E7&D=042715&SSPV=SP2230TB_sp_ff
FF NewTab: hxxp://www.trovi.com/?gd=&ctid=CT3324769&octid=EB_ORIGINAL_CTID&ISID=M25827412-7801-4FC6-BCA9-014202123AE0&SearchSource=69&CUI=&SSPV=SP2230TB_sp_ff&Lay=1&UM=8&UP=SP4C619BAA-02B5-4133-AE25-8C66039ED0E7&D=042715
FF SelectedSearchEngine: Search The Web
FF Homepage: hxxp://www.mystart.com/?pr=vmn&id=mystarttb&v=5_4&ent=hp_5108&src=5108
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF user.js: detected! => C:\Users\Marius\AppData\Roaming\Mozilla\Firefox\Profiles\gmvxix60.default\user.js [2014-05-19]
FF SearchPlugin: C:\Users\Marius\AppData\Roaming\Mozilla\Firefox\Profiles\gmvxix60.default\searchplugins\default-search.xml [2014-03-31]
FF SearchPlugin: C:\Users\Marius\AppData\Roaming\Mozilla\Firefox\Profiles\gmvxix60.default\searchplugins\Speedial.xml [2014-05-19]
FF SearchPlugin: C:\Users\Marius\AppData\Roaming\Mozilla\Firefox\Profiles\gmvxix60.default\searchplugins\trovi.xml [2015-05-05]
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\mystarttb.xml [2015-05-03]
FF Extension: PruiceLEssi - C:\Users\Marius\AppData\Roaming\Mozilla\Firefox\Profiles\gmvxix60.default\Extensions\8q@n.edu [2015-05-05]
FF Extension: Speedial - C:\Users\Marius\AppData\Roaming\Mozilla\Firefox\Profiles\gmvxix60.default\Extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52} [2014-05-19]
FF Extension: No Name - C:\Users\Marius\AppData\Roaming\Mozilla\Firefox\Profiles\gmvxix60.default\Extensions\59D317DB041748fdB89B47E6F96058F3@jetpack.xpi [2015-04-27]
FF Extension: No Name - C:\Users\Marius\AppData\Roaming\Mozilla\Firefox\Profiles\gmvxix60.default\extensions\{607b689f-7600-45e4-b8e5-887f72dab15c} [Not Found]
CHR StartupUrls: Default -> "hxxp://www.trovi.com/?gd=&ctid=CT3324769&octid=EB_ORIGINAL_CTID&ISID=M25827412-7801-4FC6-BCA9-014202123AE0&SearchSource=55&CUI=&UM=8&UP=SP4C619BAA-02B5-4133-AE25-8C66039ED0E7&D=042715&SSPV=SP2230TB_sp_ch"
CHR DefaultSearchKeyword: Default -> trovi.search
CHR DefaultNewTabURL: Default -> www.trovi.com/?gd=&ctid=CT3324769&octid=EB_ORIGINAL_CTID&ISID=M25827412-7801-4FC6-BCA9-014202123AE0&SearchSource=69&CUI=&SSPV=SP2230TB_sp_ch&lay=5&p=cnts&UM=8&UP=SP4C619BAA-02B5-4133-AE25-8C66039ED0E7&SAT=CNTS&D=042715
CHR DefaultSuggestURL: Default -> suggest.seccint.com/CSuggestJson.ashx?prefix={searchTerms}
CHR HKLM-x32\...\Chrome\Extension: [dghncoeocefmhkhiphdgikkamjeglbfh] - C:\Program Files (x86)\mystarttb\chrome-newtab-search.crx [Not Found]
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\ChromeExtension\skype_chrome_extension.crx [Not Found]
S2 CoupoonService64; C:\Program Files (x86)\coupoon\iiwjljrnpc64.exe [172344 2015-04-02] ()
C:\Program Files (x86)\coupoon
R2 xoxufewe; C:\Users\Marius\AppData\Roaming\003F0CDE-1430876041-E011-A025-00266CD20EB8\jnsc147.tmp [222720 2015-05-05] () [File not signed]
S2 BrsHelper; C:\PROGRA~2\YTDOWN~1\BROWSE~2.EXE [X]
R2 lydeteku; C:\Users\Marius\AppData\Roaming\003F0CDE-1430876041-E011-A025-00266CD20EB8\nswD013.tmpfs [X]
S2 UpdateCheck; C:\Program Files (x86)\Coupoon\UpdateCheck.exe run [X]
R2 lnx; c:\windows\lnx.exe [417792 2015-05-05] () [File not signed]
R2 mlnx; c:\windows\mlnx.exe [408576 2015-05-05] () [File not signed]
c:\windows\lnx.exe
c:\windows\mlnx.exe
C:\Users\Marius\AppData\Roaming\003F0CDE-1430876041-E011-A025-00266CD20EB8
C:\PROGRA~2\YTDOWN~1
C:\Program Files (x86)\Coupoon
S1 innfd_1_10_0_13; system32\drivers\innfd_1_10_0_13.sys [X]
C:\Windows\System32\drivers\innfd_1_10_0_13.sys
2015-05-05 21:51 - 2015-05-05 21:51 - 00003464 _____ () C:\windows\System32\Tasks\ProPCCleaner_Popup
2015-05-05 20:42 - 2015-05-05 20:42 - 00000000 ____D () C:\windows\pss
2015-05-05 20:09 - 2015-05-05 20:09 - 00000000 ____D () C:\ProgramData\653f05e4000027bf
2015-05-05 20:01 - 2015-05-05 20:01 - 00022512 _____ () C:\windows\system32\Drivers\SPPD.sys
2015-05-05 19:39 - 2015-05-05 19:39 - 00000000 ____D () C:\Users\Marius\Documents\Optimizer Pro
2015-05-05 19:37 - 2015-05-05 19:58 - 00000000 ____D () C:\Users\Marius\AppData\Local\003F0CDE-1430854670-E011-A025-00266CD20EB8
2015-05-05 19:35 - 2015-05-05 19:41 - 00000296 _____ () C:\windows\Tasks\RPC.job
2015-05-05 19:35 - 2015-05-05 19:35 - 00000000 ____D () C:\Users\Marius\AppData\Roaming\003F0CDE-1430876102-E011-A025-00266CD20EB8
2015-05-05 19:34 - 2015-05-05 19:34 - 00000320 _____ () C:\windows\Tasks\HYJQUCPDKM1.job
2015-05-05 19:34 - 2015-05-05 19:34 - 00000000 ____D () C:\Users\Marius\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VOPackage
2015-05-05 19:34 - 2015-05-05 19:34 - 00000000 ____D () C:\Users\Marius\AppData\Roaming\003F0CDE-1430876059-E011-A025-00266CD20EB8
2015-05-05 19:34 - 2015-05-05 19:34 - 00000000 ____D () C:\Users\Marius\AppData\Roaming\003F0CDE-1430876041-E011-A025-00266CD20EB8
2015-05-05 19:34 - 2015-05-05 19:34 - 00000000 ____D () C:\ProgramData\8ef1706414cd42349b12fe5555daafbb
2015-05-05 19:33 - 2015-05-05 20:12 - 00000000 ____D () C:\Program Files (x86)\Reg Pro Cleaner
2015-05-05 19:33 - 2015-05-05 19:45 - 00000000 ____D () C:\ProgramData\{46880265-e519-0ffd-4688-80265e510997}
2015-05-05 19:33 - 2015-05-05 19:33 - 00631296 _____ () C:\windows\lnx.dat
2015-05-05 19:33 - 2015-05-05 19:33 - 00417792 _____ () C:\windows\lnx.exe
2015-05-05 19:33 - 2015-05-05 19:33 - 00408576 _____ () C:\windows\mlnx.exe
2015-05-05 19:33 - 2015-05-05 19:33 - 00000000 ____D () C:\ProgramData\c4e28be5fade45ddb77a805914116806
2015-05-05 19:32 - 2015-05-05 20:06 - 00002048 _____ () C:\Users\Marius\Desktop\Continue Mybest Offerstoday Uninstaller.lnk
2015-05-05 19:12 - 2015-05-05 19:12 - 00003200 _____ () C:\windows\System32\Tasks\ProPCCleaner_Start
2015-05-05 19:11 - 2015-05-05 19:11 - 00000000 ____D () C:\Users\Marius\AppData\Local\Pro_PC_Cleaner
2015-05-05 19:10 - 2015-05-05 21:55 - 00000000 ____D () C:\Users\Marius\Documents\ProPCCleaner
2015-05-05 19:06 - 2015-05-05 19:06 - 00000970 _____ () C:\Users\Public\Desktop\Pro PC Cleaner.lnk
2015-05-05 19:06 - 2015-05-05 19:06 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Pro PC Cleaner
2015-05-05 19:06 - 2015-05-05 19:06 - 00000000 ____D () C:\Program Files (x86)\Pro PC Cleaner
2015-05-05 19:05 - 2015-05-05 19:05 - 00000000 ____D () C:\Users\Marius\AppData\Roaming\Pro PC Cleaner
2015-05-04 21:16 - 2015-05-04 21:16 - 00000000 ____D () C:\ProgramData\2069728918344086924
2015-05-04 21:15 - 2015-05-05 18:40 - 00003476 _____ () C:\windows\System32\Tasks\avabvyxvdy
2015-05-04 21:12 - 2015-05-04 21:12 - 00000000 ____D () C:\ProgramData\coofbokbgcodjifeendogcpbkjdnjgpi
2015-05-04 21:10 - 2015-05-05 18:39 - 00000364 _____ () C:\windows\Tasks\Bidaily Synchronize Task.job
2015-05-04 21:10 - 2015-05-04 21:18 - 00000000 ____D () C:\ProgramData\{c0c6049b-348f-9f0c-c0c6-6049b348126c}
2015-05-04 21:10 - 2015-05-04 21:10 - 00003278 _____ () C:\windows\System32\Tasks\Bidaily Synchronize Task
2015-04-27 21:09 - 2015-05-05 20:38 - 00000004 _____ () C:\windows\SysWOW64\029B560A371F4E00AB32838EBC01B9E7
2015-04-27 20:10 - 2015-04-27 20:15 - 00000000 ____D () C:\Users\Marius\AppData\Local\BrowserHelper
2015-04-27 20:10 - 2015-04-27 20:10 - 00003908 _____ () C:\windows\System32\Tasks\YTDownloaderUpd
2015-04-27 20:10 - 2015-04-27 20:10 - 00003586 _____ () C:\windows\System32\Tasks\YTDownloader
2015-04-27 20:10 - 2015-04-27 20:10 - 00000000 ____D () C:\Users\Marius\AppData\Local\Crossbrowse
2015-04-27 20:09 - 2015-05-06 14:10 - 00001058 _____ () C:\windows\Tasks\Crossbrowse.job
2015-04-27 20:09 - 2015-05-06 14:09 - 00001340 _____ () C:\windows\Tasks\QJNFZ.job
2015-04-27 20:09 - 2015-04-27 20:10 - 00005478 _____ () C:\windows\System32\Tasks\a250569a-98c2-4048-95cc-84eb2edcd0f9-5
2015-04-27 20:09 - 2015-04-27 20:10 - 00004088 _____ () C:\windows\System32\Tasks\Crossbrowse
2015-04-27 20:09 - 2015-04-27 20:09 - 01973760 _____ (System NotifierV10.03) C:\Users\Marius\AppData\Roaming\QJNFZ.exe
2015-04-27 20:09 - 2015-04-27 20:09 - 00004370 _____ () C:\windows\System32\Tasks\QJNFZ
2015-04-27 20:08 - 2015-05-05 20:35 - 00000000 ____D () C:\Program Files\Common Files\Goobzo
2015-04-27 20:08 - 2015-04-27 20:08 - 00004246 _____ () C:\windows\System32\Tasks\SMW_UpdateTask_Time_323435363138363533362d3437415a556c2a3223346c41
2015-04-27 20:08 - 2015-04-27 20:08 - 00003596 _____ () C:\windows\System32\Tasks\SMWUpd
2015-04-27 20:08 - 2015-04-27 20:08 - 00000000 ____D () C:\ProgramData\SearchModule
2015-04-27 01:08 - 2015-04-27 01:08 - 00003478 _____ () C:\windows\System32\Tasks\avabvxvadx
2015-04-27 01:04 - 2015-04-30 16:37 - 00000000 ____D () C:\Users\Marius\AppData\Local\avabvxvadx
2015-04-27 01:03 - 2015-05-05 19:22 - 00000112 _____ () C:\ProgramData\AMOD3075.dat
2015-04-27 01:01 - 2015-04-27 01:01 - 00004310 _____ () C:\windows\System32\Tasks\GoogleUpdateTaskUserM_1_7_22_478699874-4155726479-3780505679-3006UA__323435363138363533362d3437415a556c2a3223346c41
2015-04-27 01:01 - 2015-04-27 01:01 - 00000000 ____D () C:\ProgramData\PastaLeadsAgent
2015-04-27 01:00 - 2015-05-05 20:10 - 00000000 ____D () C:\Program Files\Common Files\PastaLeads
2015-04-27 01:00 - 2015-05-05 19:54 - 00000000 ____D () C:\Program Files\Coupoon
2015-04-27 00:59 - 2015-05-05 20:04 - 00000000 ____D () C:\Program Files (x86)\Coupoon
2015-04-27 00:59 - 2015-05-04 18:07 - 00000000 ____D () C:\ProgramData\{a94a5059-3dd9-3ecb-a94a-a50593dd4164}
2015-04-27 00:59 - 2015-05-02 13:21 - 00000000 ____D () C:\Program Files (x86)\Super Optimizer
2015-05-06 14:14 - 2014-05-19 09:12 - 00000000 ____D () C:\Program Files (x86)\globalUpdate
2015-05-06 14:09 - 2014-05-19 09:12 - 00002192 _____ () C:\windows\Tasks\d73553dc-f069-47b3-8808-35e7c4b13dc7-4.job
2015-03-09 15:30 - 2015-03-09 15:30 - 0005487 _____ () C:\Users\Marius\AppData\Roaming\QJNFZ
2015-04-27 20:09 - 2015-04-27 20:09 - 1973760 _____ (System NotifierV10.03) C:\Users\Marius\AppData\Roaming\QJNFZ.exe
2014-05-19 09:42 - 2014-05-19 07:19 - 1705063 _____ (AnyProtect.com) C:\Users\Marius\AppData\Local\AnyProtectScannerSetup.exe
2015-05-05 20:11 - 2015-05-05 20:11 - 0000802 _____ () C:\Users\Marius\AppData\Local\Temp-log.txt
2015-04-27 01:03 - 2015-05-05 19:22 - 0000112 _____ () C:\ProgramData\AMOD3075.dat
C:\ProgramData\AMOD3075.dat
C:\Users\Marius\AppData\Local\Temp\1910.exe
C:\Users\Marius\AppData\Local\Temp\8418.exe
C:\Users\Marius\AppData\Local\Temp\932.exe
C:\Users\Marius\AppData\Local\Temp\APNSetup.exe
C:\Users\Marius\AppData\Local\Temp\avgnt.exe
C:\Users\Marius\AppData\Local\Temp\Avira.exe
C:\Users\Marius\AppData\Local\Temp\BackupSetup.exe
C:\Users\Marius\AppData\Local\Temp\BundleSweetIMSetup.exe
C:\Users\Marius\AppData\Local\Temp\Coupoon72.exe
C:\Users\Marius\AppData\Local\Temp\d7a5711ffec14c4c8d518980af745940275714.exe
C:\Users\Marius\AppData\Local\Temp\Delta.exe
C:\Users\Marius\AppData\Local\Temp\DeltaTB.exe
C:\Users\Marius\AppData\Local\Temp\fp_pl_pfs_installer-1.exe
C:\Users\Marius\AppData\Local\Temp\fp_pl_pfs_installer.exe
C:\Users\Marius\AppData\Local\Temp\install_flashplayer11x32ax_chra_awa_aih.exe
C:\Users\Marius\AppData\Local\Temp\jre-7u71-windows-i586-iftw.exe
C:\Users\Marius\AppData\Local\Temp\jre-8u31-windows-au.exe
C:\Users\Marius\AppData\Local\Temp\jre-8u45-windows-au.exe
C:\Users\Marius\AppData\Local\Temp\looksafe-setup-looksftnc1.exe
C:\Users\Marius\AppData\Local\Temp\MobilePCStarterKit80.exe
C:\Users\Marius\AppData\Local\Temp\Mobogenie_Setup_2.1.36_506.exe
C:\Users\Marius\AppData\Local\Temp\MybabylonTB.exe
C:\Users\Marius\AppData\Local\Temp\MyBestOffersToday38.exe
C:\Users\Marius\AppData\Local\Temp\mytmpinstaller.exe
C:\Users\Marius\AppData\Local\Temp\nsdAFD5.exe
C:\Users\Marius\AppData\Local\Temp\nsdBCF0.exe
C:\Users\Marius\AppData\Local\Temp\nsiFBB0.exe
C:\Users\Marius\AppData\Local\Temp\nsj98C2.exe
C:\Users\Marius\AppData\Local\Temp\nso7846.exe
C:\Users\Marius\AppData\Local\Temp\Offercast_AVIRAV7_.exe
C:\Users\Marius\AppData\Local\Temp\optprosetup.exe
C:\Users\Marius\AppData\Local\Temp\PastaLeads78.exe
C:\Users\Marius\AppData\Local\Temp\SearchProtect34.exe
C:\Users\Marius\AppData\Local\Temp\SearchWithGoogleUpdate.exe
C:\Users\Marius\AppData\Local\Temp\SettingsManagerSetup.exe
C:\Users\Marius\AppData\Local\Temp\Setup.exe
C:\Users\Marius\AppData\Local\Temp\setup{0370F940-1307-4537-8603-AE8D140804DA}.exe
C:\Users\Marius\AppData\Local\Temp\SuperOptimizer21.exe
C:\Users\Marius\AppData\Local\Temp\supoptsetup.exe
C:\Users\Marius\AppData\Local\Temp\tu17p84.exe
C:\Users\Marius\AppData\Local\Temp\Uninstall.exe
C:\Users\Marius\AppData\Local\Temp\WSSetup.exe
C:\Users\Marius\AppData\Local\Temp\ZoomWeb_Installer51.exe
C:\Users\Marius\AppData\Local\Temp\_unps.exe
C:\Users\Marius\AppData\Local\Temp\{DB89853C-74AD-433D-A367-F9BEED394FAA}-42.0.2311.135_42.0.2311.90_chrome_updater.exe
Task: {02C012EF-219F-4CE1-A080-9EBC2DFC34EA} - System32\Tasks\a250569a-98c2-4048-95cc-84eb2edcd0f9-5_user => C:\Program Files (x86)\System NotifierV10.03\a250569a-98c2-4048-95cc-84eb2edcd0f9-5.exe <==== ATTENTION
Task: {095D9D0E-576D-4870-B70E-DF8D7C3935AC} - System32\Tasks\LaunchPreSignup => C:\Program Files (x86)\OLBPre\OLBPre.exe <==== ATTENTION
Task: {131FD26F-8494-4BE9-B926-5149F9E6BB49} - System32\Tasks\SMWUpd => C:\Program Files\Common Files\Goobzo\GBUpdate\updater.exe <==== ATTENTION
Task: {14BDCAAC-E147-4D86-84B1-5C70C25DC090} - System32\Tasks\ProPCCleaner_Popup => C:\Program Files (x86)\Pro PC Cleaner\Splash.exe [2014-07-14] () <==== ATTENTION
Task: {1CF14623-8D93-4258-881E-4826C43158CE} - System32\Tasks\avabvyxvdy => C:\Users\Marius\AppData\Local\avabvyxvdy\avabvyxvdy.exe <==== ATTENTION
Task: {2B268BBF-B844-4636-80A4-FA42BB521F30} - System32\Tasks\YTDownloader => C:\Program Files (x86)\YTDownloader\YTDownloader.exe <==== ATTENTION
Task: {33309A6A-8A5C-43C4-B0A4-730A299102E8} - System32\Tasks\ProPCCleaner_Start => C:\Program Files (x86)\Pro PC Cleaner\ProPCCleaner.exe [2014-07-14] (Pro PC Cleaner) <==== ATTENTION
Task: {3631713A-6F7B-4358-900D-883BDDDB0EBA} - System32\Tasks\avabvxvadx => C:\Users\Marius\AppData\Local\avabvxvadx\avabvxvadx.exe [2015-04-19] () <==== ATTENTION
C:\Users\Marius\AppData\Local\avabvxvadx
Task: {382300CA-3792-4381-A94D-FA8A57CE5470} - System32\Tasks\a250569a-98c2-4048-95cc-84eb2edcd0f9-5 => C:\Program Files (x86)\System NotifierV10.03\a250569a-98c2-4048-95cc-84eb2edcd0f9-5.exe <==== ATTENTION
C:\Program Files (x86)\System NotifierV10.03
Task: {466AC41A-4F39-408B-9C75-712425B8956D} - System32\Tasks\GoogleUpdateTaskUserM_1_7_22_478699874-4155726479-3780505679-3006UA__323435363138363533362d3437415a556c2a3223346c41 => Wscript.exe //B "C:\ProgramData\PastaLeadsAgent\startprocess.js" pastaleadss.exe /invoke /f:check_services /l:0
C:\ProgramData\PastaLeadsAgent
Task: {4A2E6A93-5027-41F9-86BD-538ACFDD2519} - System32\Tasks\QJNFZ => C:\Users\Marius\AppData\Roaming\QJNFZ.exe [2015-04-27] (System NotifierV10.03) <==== ATTENTION
C:\Users\Marius\AppData\Roaming\QJNFZ.exe
Task: {84D41DD0-9518-47FA-8E4B-052606F8DEEA} - System32\Tasks\Bidaily Synchronize Task => C:\ProgramData\{c0c6049b-348f-9f0c-c0c6-6049b348126c}\priceless_p_soft_partner.exe [2014-05-04] () <==== ATTENTION
C:\ProgramData\{c0c6049b-348f-9f0c-c0c6-6049b348126c}
Task: {89D2DDAF-EABC-42FE-9A2F-DAE85DACCBE3} - System32\Tasks\Crossbrowse => C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\utility.exe <==== ATTENTION
C:\Program Files (x86)\Crossbrowse
Task: {BA5F908A-461F-4CD7-A596-5A182771CAB4} - System32\Tasks\a250569a-98c2-4048-95cc-84eb2edcd0f9-10_user => C:\Program Files (x86)\System NotifierV10.03\a250569a-98c2-4048-95cc-84eb2edcd0f9-10.exe <==== ATTENTION
Task: {BDE1BD95-4A59-497B-9FC3-8E8212A27B3F} - System32\Tasks\SMW_UpdateTask_Time_323435363138363533362d3437415a556c2a3223346c41 => Wscript.exe //B "C:\ProgramData\SearchModule\smhe.js" smu.exe /invoke /f:check_services /l:0 <==== ATTENTION
C:\ProgramData\SearchModule
Task: {C0BFF139-4002-4B6C-AC03-EC128EEB4A65} - System32\Tasks\d73553dc-f069-47b3-8808-35e7c4b13dc7-4 => C:\Program Files (x86)\MPlayerplus_01\d73553dc-f069-47b3-8808-35e7c4b13dc7-4.exe <==== ATTENTION
C:\Program Files (x86)\MPlayerplus_01
Task: {DF37AE53-AEFC-4038-97F0-5C132BF0B9BE} - System32\Tasks\YTDownloaderUpd => C:\Program Files (x86)\YTDownloader\updater.exe <==== ATTENTION
FirewallRules: [{A8BEF60E-5233-490B-9ADD-DBA974449FA8}] => (Allow) C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\crossbrowse.exe
FirewallRules: [{C1D7D2F6-8340-4FAD-B6D0-6AFE45A9193C}] => (Allow) C:\Program Files (x86)\mystarttb\ToolbarCleaner.exe
FirewallRules: [{B3D72E3E-BE87-4F50-BDE6-5CBDA7E572CE}] => (Allow) C:\Program Files (x86)\mystarttb\ToolbarCleaner.exe
C:\Program Files (x86)\mystarttb
RemoveProxy:
Reboot:
end

NOTE. It's important that both files, FRST64 and fixlist.txt are in the same location or the fix will not work.

NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

Start FRST that is on the desktop by right clicking on file and selecting "Run as Administrator..." and press the Fix button just once and wait.

If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
When finished FRST will generate a log on the Desktop (Fixlog.txt). Please post it to your reply.

I will not provide malware removal by PM; please post in your thread on the Malware Removal board.
My help is always free but if you would like to help encourage me or show your thanks -----> DONATE

moeko
New Helpee

Posts: 13

[ti]SOLVED[/ti]Several malwares that can't be deleted? May 7, 2015 21:26:18 GMT -8

Post by moeko on May 7, 2015 21:26:18 GMT -8

There was no Websteroids program, and I saved the notepad on my desktop and this is the result:

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 06-05-2015 01
Ran by Marius at 2015-05-07 23:06:44 Run:1
Running from C:\Users\Marius\Desktop
Loaded Profiles: Marius (Available profiles: Marius)
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
Start
CreateRestorePoint:
CloseProcesses:
HKLM\...\Run: [] => [X]
HKLM-x32\...\Run: [fst_ca_99] => [X]
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [mpck_ca_10] => [X]
HKLM-x32\...\Run: [mbot_ca_482] => [X]
HKLM-x32\...\Run: [YTDownloader] => "C:\Program Files (x86)\YTDownloader\YTDownloader.exe" /boot
C:\Program Files (x86)\YTDownloader
HKU\S-1-5-21-2827223565-3312671657-2323579203-1000\...\Run: [YTDownloader] => "C:\Program Files (x86)\YTDownloader\YTDownloader.exe" /boot
HKU\S-1-5-21-2827223565-3312671657-2323579203-1000\...\Run: [GoogleChromeAutoLaunch_B73401D408F5FBC1A31E4154B60B5830] => "C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\crossbrowse.exe" --no-startup-window
C:\Program Files (x86)\Crossbrowse
HKU\S-1-5-21-2827223565-3312671657-2323579203-1000\...\Run: [Reg Pro Cleaner] => C:\Program Files (x86)\Reg Pro Cleaner\RegProCleaner.exe
C:\Program Files (x86)\Reg Pro Cleaner
AppInit_DLLs: C:\ProgramData\LolyKey\LolyKey64.dll => C:\ProgramData\LolyKey\LolyKey64.dll File Not Found
C:\ProgramData\LolyKey
AppInit_DLLs: C:\PROGRA~2\Linkey\IEEXTE~1\iedll64.dll => C:\PROGRA~2\Linkey\IEEXTE~1\iedll64.dll File Not Found
C:\PROGRA~2\Linkey
AppInit_DLLs-x32: c:\programdata\lolykey\lolykey32.dll => "c:\programdata\lolykey\lolykey32.dll" File Not Found
c:\programdata\lolykey
IFEO\bitguard.exe: [Debugger] tasklist.exe
IFEO\bprotect.exe: [Debugger] tasklist.exe
IFEO\bpsvc.exe: [Debugger] tasklist.exe
IFEO\browsemngr.exe: [Debugger] tasklist.exe
IFEO\browserdefender.exe: [Debugger] tasklist.exe
IFEO\browsermngr.exe: [Debugger] tasklist.exe
IFEO\browserprotect.exe: [Debugger] tasklist.exe
IFEO\browsersafeguard.exe: [Debugger] tasklist.exe
IFEO\bundlesweetimsetup.exe: [Debugger] tasklist.exe
IFEO\cltmngsvc.exe: [Debugger]
IFEO\delta babylon.exe: [Debugger] tasklist.exe
IFEO\delta tb.exe: [Debugger] tasklist.exe
IFEO\delta2.exe: [Debugger] tasklist.exe
IFEO\deltainstaller.exe: [Debugger] tasklist.exe
IFEO\deltasetup.exe: [Debugger] tasklist.exe
IFEO\deltatb.exe: [Debugger] tasklist.exe
IFEO\deltatb_2501-c733154b.exe: [Debugger] tasklist.exe
IFEO\dprotectsvc.exe: [Debugger] tasklist.exe
IFEO\iminentsetup.exe: [Debugger] tasklist.exe
IFEO\protectedsearch.exe: [Debugger] tasklist.exe
IFEO\rjatydimofu.exe: [Debugger] tasklist.exe
IFEO\searchprotection.exe: [Debugger] tasklist.exe
IFEO\searchprotector.exe: [Debugger] tasklist.exe
IFEO\snapdo.exe: [Debugger] tasklist.exe
IFEO\stinst32.exe: [Debugger] tasklist.exe
IFEO\stinst64.exe: [Debugger] tasklist.exe
IFEO\sweetimsetup.exe: [Debugger] tasklist.exe
IFEO\tbdelta.exetoolbar783881609.exe: [Debugger] tasklist.exe
IFEO\utiljumpflip.exe: [Debugger] tasklist.exe
Startup: C:\Users\Marius\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hqghumeaylnlf.lnk [2015-04-27]
ShortcutTarget: hqghumeaylnlf.lnk -> C:\ProgramData\{46880265-e519-0ffd-4688-80265e510997}\hqghumeaylnlf.exe (PC Utilities Software Limited)
C:\ProgramData\{46880265-e519-0ffd-4688-80265e510997}
Startup: C:\Users\Marius\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\priceless_p_soft_partner.lnk [2015-05-04]
ShortcutTarget: priceless_p_soft_partner.lnk -> C:\ProgramData\{c0c6049b-348f-9f0c-c0c6-6049b348126c}\priceless_p_soft_partner.exe ()
C:\ProgramData\{c0c6049b-348f-9f0c-c0c6-6049b348126c}
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
ProxyEnable: [.DEFAULT] => Internet Explorer proxy is enabled.
ProxyServer: [.DEFAULT] => http=127.0.0.1:51213;https=127.0.0.1:51213
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = speedial.com/?f=1&a=spd_cmi_14_21_ff&cd=2XzuyEtN2Y1L1Qzu0DtD0D0Fzy0AyByDzyyEzzyB0Ezzzy0CtN0D0Tzu0SzzyBtDtN1L2XzutBtFtBtDtFtCtAtFtCtN1L1CzutCyEtDtAtDyD1V1StN1L1G1B1V1N2Y1L1Qzu2SyCtDtA0FtB0DyE0BtGzzyD0FyCtGtDyE0EyEtG0A0B0B0CtGyByByEyCyC0CtCtCtAtCyD0B2QtN1M1F1B2Z1V1N2Y1L1Qzu2StBtDtCyEtAtA0DtCtGyC0ByDtCtGyB0ByB0AtGyEtB0DtAtGyEyEtB0CyCyC0CyCyDzztAtC2Q&cr=1778512867&ir=
SearchScopes: HKLM -> DefaultScope {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7TSCA
SearchScopes: HKLM -> {31090377-0740-419E-BEFC-A56E50500D5B} URL = speedial.com/results.php?f=4&q={searchTerms}&a=spd_cmi_14_21_ff&cd=2XzuyEtN2Y1L1Qzu0DtD0D0Fzy0AyByDzyyEzzyB0Ezzzy0CtN0D0Tzu0SzzyBtDtN1L2XzutBtFtBtDtFtCtAtFtCtN1L1CzutCyEtDtAtDyD1V1StN1L1G1B1V1N2Y1L1Qzu2SyCtDtA0FtB0DyE0BtGzzyD0FyCtGtDyE0EyEtG0A0B0B0CtGyByByEyCyC0CtCtCtAtCyD0B2QtN1M1F1B2Z1V1N2Y1L1Qzu2StBtDtCyEtAtA0DtCtGyC0ByDtCtGyB0ByB0AtGyEtB0DtAtGyEyEtB0CyCyC0CyCyDzztAtC2Q&cr=1778512867&ir=
SearchScopes: HKLM -> {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7TSCA
SearchScopes: HKLM -> {9BB47C17-9C68-4BB3-B188-DD9AF0FD2476} URL = www.default-search.net/search?sid=476&aid=123&itype=n&ver=11471&tm=304&src=ds&p={searchTerms}
SearchScopes: HKLM-x32 -> DefaultScope {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7TSCA
SearchScopes: HKLM-x32 -> {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7TSCA
SearchScopes: HKLM-x32 -> {9BB47C17-9C68-4BB3-B188-DD9AF0FD2476} URL = www.default-search.net/search?sid=476&aid=123&itype=n&ver=11471&tm=304&src=ds&p={searchTerms}
SearchScopes: HKU\S-1-5-21-2827223565-3312671657-2323579203-1000 -> DefaultScope {015DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = www-searching.com/search.aspx?site=shdefault&pid=s&shr=d&q={searchTerms}&s=F4Sztutdk0004,62cd1a55-75d8-4297-8b96-3f3008bc6f3b,
SearchScopes: HKU\S-1-5-21-2827223565-3312671657-2323579203-1000 -> URL search.conduit.com/Results.aspx?ctid=CT3323737&octid=EB_ORIGINAL_CTID&SearchSource=58&CUI=&UM=4&UP=SP4A7CC89F-9D00-453F-801E-DC1A1A577853&q={searchTerms}&SSPV=
SearchScopes: HKU\S-1-5-21-2827223565-3312671657-2323579203-1000 -> SuggestionsURL_JSON suggest.search.conduit.com/CSuggestJson.ashx?prefix={searchTerms}
SearchScopes: HKU\S-1-5-21-2827223565-3312671657-2323579203-1000 -> AEE59D684DC54BE58C012BCD7DE9134C URL = www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7TSCA_enCA563
SearchScopes: HKU\S-1-5-21-2827223565-3312671657-2323579203-1000 -> {015DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = www-searching.com/search.aspx?site=shdefault&pid=s&shr=d&q={searchTerms}&s=F4Sztutdk0004,62cd1a55-75d8-4297-8b96-3f3008bc6f3b,
SearchScopes: HKU\S-1-5-21-2827223565-3312671657-2323579203-1000 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-2827223565-3312671657-2323579203-1000 -> {31090377-0740-419E-BEFC-A56E50500D5B} URL = speedial.com/results.php?f=4&q={searchTerms}&a=spd_cmi_14_21_ff&cd=2XzuyEtN2Y1L1Qzu0DtD0D0Fzy0AyByDzyyEzzyB0Ezzzy0CtN0D0Tzu0SzzyBtDtN1L2XzutBtFtBtDtFtCtAtFtCtN1L1CzutCyEtDtAtDyD1V1StN1L1G1B1V1N2Y1L1Qzu2SyCtDtA0FtB0DyE0BtGzzyD0FyCtGtDyE0EyEtG0A0B0B0CtGyByByEyCyC0CtCtCtAtCyD0B2QtN1M1F1B2Z1V1N2Y1L1Qzu2StBtDtCyEtAtA0DtCtGyC0ByDtCtGyB0ByB0AtGyEtB0DtAtGyEyEtB0CyCyC0CyCyDzztAtC2Q&cr=1778512867&ir=
SearchScopes: HKU\S-1-5-21-2827223565-3312671657-2323579203-1000 -> {3BD44F0E-0596-4008-AEE0-45D47E3A8F0E} URL = www.mystart.com/results.php?gen=ms&pr=vmn&id=mystarttb&v=5_4&ent=ch_5108&q={searchTerms}
SearchScopes: HKU\S-1-5-21-2827223565-3312671657-2323579203-1000 -> {41B3F996-1E5D-4747-8F4B-ED6AEEE2F544} URL = search.conduit.com/Results.aspx?ctid=CT3323737&octid=EB_ORIGINAL_CTID&SearchSource=58&CUI=&UM=4&UP=SP4A7CC89F-9D00-453F-801E-DC1A1A577853&q={searchTerms}&SSPV=
SearchScopes: HKU\S-1-5-21-2827223565-3312671657-2323579203-1000 -> {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7TSCA_enCA563
SearchScopes: HKU\S-1-5-21-2827223565-3312671657-2323579203-1000 -> {7F4EFF06-7032-458e-AE16-1C1D8255C28A} URL = www-searching.com/search.aspx?site=shdefault&pid=s&shr=d&q={searchTerms}&s=F4Sztutdk0004,62cd1a55-75d8-4297-8b96-3f3008bc6f3b,
SearchScopes: HKU\S-1-5-21-2827223565-3312671657-2323579203-1000 -> {9BB47C17-9C68-4BB3-B188-DD9AF0FD2476} URL = www.default-search.net/search?sid=476&aid=123&itype=n&ver=11471&tm=304&src=ds&p={searchTerms}
SearchScopes: HKU\S-1-5-21-2827223565-3312671657-2323579203-1000 -> {9F3C458B-4494-4EE0-A486-535ED0420E03} URL = www.trovi.com/Results.aspx?gd=&ctid=CT3324769&octid=EB_ORIGINAL_CTID&ISID=M25827412-7801-4FC6-BCA9-014202123AE0&SearchSource=58&CUI=&UM=8&UP=SP4C619BAA-02B5-4133-AE25-8C66039ED0E7&q={searchTerms}&D=042715&SSPV=SP2230TB_sp_ie
BHO: No Name -> {4D9101D6-5BA0-4048-BDDE-7E2DF54C8C47} -> No File
BHO-x32: No Name -> {02478D38-C3F9-4efb-9B51-7695ECA05670} -> No File
Toolbar: HKU\S-1-5-21-2827223565-3312671657-2323579203-1000 -> No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
Toolbar: HKU\S-1-5-21-2827223565-3312671657-2323579203-1000 -> No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File
Toolbar: HKU\S-1-5-21-2827223565-3312671657-2323579203-1000 -> No Name - {4F524A2D-5350-4500-76A7-7A786E7484D7} - No File
FF SearchEngineOrder.1: default-search.net
FF SearchEngineOrder.3: Bing
FF SelectedSearchEngine: Trovi
FF Homepage: hxxp://www.trovi.com/?gd=&ctid=CT3324769&octid=EB_ORIGINAL_CTID&ISID=M25827412-7801-4FC6-BCA9-014202123AE0&SearchSource=55&CUI=&UM=8&UP=SP4C619BAA-02B5-4133-AE25-8C66039ED0E7&D=042715&SSPV=SP2230TB_sp_ff
FF NewTab: hxxp://www.trovi.com/?gd=&ctid=CT3324769&octid=EB_ORIGINAL_CTID&ISID=M25827412-7801-4FC6-BCA9-014202123AE0&SearchSource=69&CUI=&SSPV=SP2230TB_sp_ff&Lay=1&UM=8&UP=SP4C619BAA-02B5-4133-AE25-8C66039ED0E7&D=042715
FF SelectedSearchEngine: Search The Web
FF Homepage: hxxp://www.mystart.com/?pr=vmn&id=mystarttb&v=5_4&ent=hp_5108&src=5108
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF user.js: detected! => C:\Users\Marius\AppData\Roaming\Mozilla\Firefox\Profiles\gmvxix60.default\user.js [2014-05-19]
FF SearchPlugin: C:\Users\Marius\AppData\Roaming\Mozilla\Firefox\Profiles\gmvxix60.default\searchplugins\default-search.xml [2014-03-31]
FF SearchPlugin: C:\Users\Marius\AppData\Roaming\Mozilla\Firefox\Profiles\gmvxix60.default\searchplugins\Speedial.xml [2014-05-19]
FF SearchPlugin: C:\Users\Marius\AppData\Roaming\Mozilla\Firefox\Profiles\gmvxix60.default\searchplugins\trovi.xml [2015-05-05]
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\mystarttb.xml [2015-05-03]
FF Extension: PruiceLEssi - C:\Users\Marius\AppData\Roaming\Mozilla\Firefox\Profiles\gmvxix60.default\Extensions\8q@n.edu [2015-05-05]
FF Extension: Speedial - C:\Users\Marius\AppData\Roaming\Mozilla\Firefox\Profiles\gmvxix60.default\Extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52} [2014-05-19]
FF Extension: No Name - C:\Users\Marius\AppData\Roaming\Mozilla\Firefox\Profiles\gmvxix60.default\Extensions\59D317DB041748fdB89B47E6F96058F3@jetpack.xpi [2015-04-27]
FF Extension: No Name - C:\Users\Marius\AppData\Roaming\Mozilla\Firefox\Profiles\gmvxix60.default\extensions\{607b689f-7600-45e4-b8e5-887f72dab15c} [Not Found]
CHR StartupUrls: Default -> "hxxp://www.trovi.com/?gd=&ctid=CT3324769&octid=EB_ORIGINAL_CTID&ISID=M25827412-7801-4FC6-BCA9-014202123AE0&SearchSource=55&CUI=&UM=8&UP=SP4C619BAA-02B5-4133-AE25-8C66039ED0E7&D=042715&SSPV=SP2230TB_sp_ch"
CHR DefaultSearchKeyword: Default -> trovi.search
CHR DefaultNewTabURL: Default -> www.trovi.com/?gd=&ctid=CT3324769&octid=EB_ORIGINAL_CTID&ISID=M25827412-7801-4FC6-BCA9-014202123AE0&SearchSource=69&CUI=&SSPV=SP2230TB_sp_ch&lay=5&p=cnts&UM=8&UP=SP4C619BAA-02B5-4133-AE25-8C66039ED0E7&SAT=CNTS&D=042715
CHR DefaultSuggestURL: Default -> suggest.seccint.com/CSuggestJson.ashx?prefix={searchTerms}
CHR HKLM-x32\...\Chrome\Extension: [dghncoeocefmhkhiphdgikkamjeglbfh] - C:\Program Files (x86)\mystarttb\chrome-newtab-search.crx [Not Found]
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\ChromeExtension\skype_chrome_extension.crx [Not Found]
S2 CoupoonService64; C:\Program Files (x86)\coupoon\iiwjljrnpc64.exe [172344 2015-04-02] ()
C:\Program Files (x86)\coupoon
R2 xoxufewe; C:\Users\Marius\AppData\Roaming\003F0CDE-1430876041-E011-A025-00266CD20EB8\jnsc147.tmp [222720 2015-05-05] () [File not signed]
S2 BrsHelper; C:\PROGRA~2\YTDOWN~1\BROWSE~2.EXE [X]
R2 lydeteku; C:\Users\Marius\AppData\Roaming\003F0CDE-1430876041-E011-A025-00266CD20EB8\nswD013.tmpfs [X]
S2 UpdateCheck; C:\Program Files (x86)\Coupoon\UpdateCheck.exe run [X]
R2 lnx; c:\windows\lnx.exe [417792 2015-05-05] () [File not signed]
R2 mlnx; c:\windows\mlnx.exe [408576 2015-05-05] () [File not signed]
c:\windows\lnx.exe
c:\windows\mlnx.exe
C:\Users\Marius\AppData\Roaming\003F0CDE-1430876041-E011-A025-00266CD20EB8
C:\PROGRA~2\YTDOWN~1
C:\Program Files (x86)\Coupoon
S1 innfd_1_10_0_13; system32\drivers\innfd_1_10_0_13.sys [X]
C:\Windows\System32\drivers\innfd_1_10_0_13.sys
2015-05-05 21:51 - 2015-05-05 21:51 - 00003464 _____ () C:\windows\System32\Tasks\ProPCCleaner_Popup
2015-05-05 20:42 - 2015-05-05 20:42 - 00000000 ____D () C:\windows\pss
2015-05-05 20:09 - 2015-05-05 20:09 - 00000000 ____D () C:\ProgramData\653f05e4000027bf
2015-05-05 20:01 - 2015-05-05 20:01 - 00022512 _____ () C:\windows\system32\Drivers\SPPD.sys
2015-05-05 19:39 - 2015-05-05 19:39 - 00000000 ____D () C:\Users\Marius\Documents\Optimizer Pro
2015-05-05 19:37 - 2015-05-05 19:58 - 00000000 ____D () C:\Users\Marius\AppData\Local\003F0CDE-1430854670-E011-A025-00266CD20EB8
2015-05-05 19:35 - 2015-05-05 19:41 - 00000296 _____ () C:\windows\Tasks\RPC.job
2015-05-05 19:35 - 2015-05-05 19:35 - 00000000 ____D () C:\Users\Marius\AppData\Roaming\003F0CDE-1430876102-E011-A025-00266CD20EB8
2015-05-05 19:34 - 2015-05-05 19:34 - 00000320 _____ () C:\windows\Tasks\HYJQUCPDKM1.job
2015-05-05 19:34 - 2015-05-05 19:34 - 00000000 ____D () C:\Users\Marius\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VOPackage
2015-05-05 19:34 - 2015-05-05 19:34 - 00000000 ____D () C:\Users\Marius\AppData\Roaming\003F0CDE-1430876059-E011-A025-00266CD20EB8
2015-05-05 19:34 - 2015-05-05 19:34 - 00000000 ____D () C:\Users\Marius\AppData\Roaming\003F0CDE-1430876041-E011-A025-00266CD20EB8
2015-05-05 19:34 - 2015-05-05 19:34 - 00000000 ____D () C:\ProgramData\8ef1706414cd42349b12fe5555daafbb
2015-05-05 19:33 - 2015-05-05 20:12 - 00000000 ____D () C:\Program Files (x86)\Reg Pro Cleaner
2015-05-05 19:33 - 2015-05-05 19:45 - 00000000 ____D () C:\ProgramData\{46880265-e519-0ffd-4688-80265e510997}
2015-05-05 19:33 - 2015-05-05 19:33 - 00631296 _____ () C:\windows\lnx.dat
2015-05-05 19:33 - 2015-05-05 19:33 - 00417792 _____ () C:\windows\lnx.exe
2015-05-05 19:33 - 2015-05-05 19:33 - 00408576 _____ () C:\windows\mlnx.exe
2015-05-05 19:33 - 2015-05-05 19:33 - 00000000 ____D () C:\ProgramData\c4e28be5fade45ddb77a805914116806
2015-05-05 19:32 - 2015-05-05 20:06 - 00002048 _____ () C:\Users\Marius\Desktop\Continue Mybest Offerstoday Uninstaller.lnk
2015-05-05 19:12 - 2015-05-05 19:12 - 00003200 _____ () C:\windows\System32\Tasks\ProPCCleaner_Start
2015-05-05 19:11 - 2015-05-05 19:11 - 00000000 ____D () C:\Users\Marius\AppData\Local\Pro_PC_Cleaner
2015-05-05 19:10 - 2015-05-05 21:55 - 00000000 ____D () C:\Users\Marius\Documents\ProPCCleaner
2015-05-05 19:06 - 2015-05-05 19:06 - 00000970 _____ () C:\Users\Public\Desktop\Pro PC Cleaner.lnk
2015-05-05 19:06 - 2015-05-05 19:06 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Pro PC Cleaner
2015-05-05 19:06 - 2015-05-05 19:06 - 00000000 ____D () C:\Program Files (x86)\Pro PC Cleaner
2015-05-05 19:05 - 2015-05-05 19:05 - 00000000 ____D () C:\Users\Marius\AppData\Roaming\Pro PC Cleaner
2015-05-04 21:16 - 2015-05-04 21:16 - 00000000 ____D () C:\ProgramData\2069728918344086924
2015-05-04 21:15 - 2015-05-05 18:40 - 00003476 _____ () C:\windows\System32\Tasks\avabvyxvdy
2015-05-04 21:12 - 2015-05-04 21:12 - 00000000 ____D () C:\ProgramData\coofbokbgcodjifeendogcpbkjdnjgpi
2015-05-04 21:10 - 2015-05-05 18:39 - 00000364 _____ () C:\windows\Tasks\Bidaily Synchronize Task.job
2015-05-04 21:10 - 2015-05-04 21:18 - 00000000 ____D () C:\ProgramData\{c0c6049b-348f-9f0c-c0c6-6049b348126c}
2015-05-04 21:10 - 2015-05-04 21:10 - 00003278 _____ () C:\windows\System32\Tasks\Bidaily Synchronize Task
2015-04-27 21:09 - 2015-05-05 20:38 - 00000004 _____ () C:\windows\SysWOW64\029B560A371F4E00AB32838EBC01B9E7
2015-04-27 20:10 - 2015-04-27 20:15 - 00000000 ____D () C:\Users\Marius\AppData\Local\BrowserHelper
2015-04-27 20:10 - 2015-04-27 20:10 - 00003908 _____ () C:\windows\System32\Tasks\YTDownloaderUpd
2015-04-27 20:10 - 2015-04-27 20:10 - 00003586 _____ () C:\windows\System32\Tasks\YTDownloader
2015-04-27 20:10 - 2015-04-27 20:10 - 00000000 ____D () C:\Users\Marius\AppData\Local\Crossbrowse
2015-04-27 20:09 - 2015-05-06 14:10 - 00001058 _____ () C:\windows\Tasks\Crossbrowse.job
2015-04-27 20:09 - 2015-05-06 14:09 - 00001340 _____ () C:\windows\Tasks\QJNFZ.job
2015-04-27 20:09 - 2015-04-27 20:10 - 00005478 _____ () C:\windows\System32\Tasks\a250569a-98c2-4048-95cc-84eb2edcd0f9-5
2015-04-27 20:09 - 2015-04-27 20:10 - 00004088 _____ () C:\windows\System32\Tasks\Crossbrowse
2015-04-27 20:09 - 2015-04-27 20:09 - 01973760 _____ (System NotifierV10.03) C:\Users\Marius\AppData\Roaming\QJNFZ.exe
2015-04-27 20:09 - 2015-04-27 20:09 - 00004370 _____ () C:\windows\System32\Tasks\QJNFZ
2015-04-27 20:08 - 2015-05-05 20:35 - 00000000 ____D () C:\Program Files\Common Files\Goobzo
2015-04-27 20:08 - 2015-04-27 20:08 - 00004246 _____ () C:\windows\System32\Tasks\SMW_UpdateTask_Time_323435363138363533362d3437415a556c2a3223346c41
2015-04-27 20:08 - 2015-04-27 20:08 - 00003596 _____ () C:\windows\System32\Tasks\SMWUpd
2015-04-27 20:08 - 2015-04-27 20:08 - 00000000 ____D () C:\ProgramData\SearchModule
2015-04-27 01:08 - 2015-04-27 01:08 - 00003478 _____ () C:\windows\System32\Tasks\avabvxvadx
2015-04-27 01:04 - 2015-04-30 16:37 - 00000000 ____D () C:\Users\Marius\AppData\Local\avabvxvadx
2015-04-27 01:03 - 2015-05-05 19:22 - 00000112 _____ () C:\ProgramData\AMOD3075.dat
2015-04-27 01:01 - 2015-04-27 01:01 - 00004310 _____ () C:\windows\System32\Tasks\GoogleUpdateTaskUserM_1_7_22_478699874-4155726479-3780505679-3006UA__323435363138363533362d3437415a556c2a3223346c41
2015-04-27 01:01 - 2015-04-27 01:01 - 00000000 ____D () C:\ProgramData\PastaLeadsAgent
2015-04-27 01:00 - 2015-05-05 20:10 - 00000000 ____D () C:\Program Files\Common Files\PastaLeads
2015-04-27 01:00 - 2015-05-05 19:54 - 00000000 ____D () C:\Program Files\Coupoon
2015-04-27 00:59 - 2015-05-05 20:04 - 00000000 ____D () C:\Program Files (x86)\Coupoon
2015-04-27 00:59 - 2015-05-04 18:07 - 00000000 ____D () C:\ProgramData\{a94a5059-3dd9-3ecb-a94a-a50593dd4164}
2015-04-27 00:59 - 2015-05-02 13:21 - 00000000 ____D () C:\Program Files (x86)\Super Optimizer
2015-05-06 14:14 - 2014-05-19 09:12 - 00000000 ____D () C:\Program Files (x86)\globalUpdate
2015-05-06 14:09 - 2014-05-19 09:12 - 00002192 _____ () C:\windows\Tasks\d73553dc-f069-47b3-8808-35e7c4b13dc7-4.job
2015-03-09 15:30 - 2015-03-09 15:30 - 0005487 _____ () C:\Users\Marius\AppData\Roaming\QJNFZ
2015-04-27 20:09 - 2015-04-27 20:09 - 1973760 _____ (System NotifierV10.03) C:\Users\Marius\AppData\Roaming\QJNFZ.exe
2014-05-19 09:42 - 2014-05-19 07:19 - 1705063 _____ (AnyProtect.com) C:\Users\Marius\AppData\Local\AnyProtectScannerSetup.exe
2015-05-05 20:11 - 2015-05-05 20:11 - 0000802 _____ () C:\Users\Marius\AppData\Local\Temp-log.txt
2015-04-27 01:03 - 2015-05-05 19:22 - 0000112 _____ () C:\ProgramData\AMOD3075.dat
C:\ProgramData\AMOD3075.dat
C:\Users\Marius\AppData\Local\Temp\1910.exe
C:\Users\Marius\AppData\Local\Temp\8418.exe
C:\Users\Marius\AppData\Local\Temp\932.exe
C:\Users\Marius\AppData\Local\Temp\APNSetup.exe
C:\Users\Marius\AppData\Local\Temp\avgnt.exe
C:\Users\Marius\AppData\Local\Temp\Avira.exe
C:\Users\Marius\AppData\Local\Temp\BackupSetup.exe
C:\Users\Marius\AppData\Local\Temp\BundleSweetIMSetup.exe
C:\Users\Marius\AppData\Local\Temp\Coupoon72.exe
C:\Users\Marius\AppData\Local\Temp\d7a5711ffec14c4c8d518980af745940275714.exe
C:\Users\Marius\AppData\Local\Temp\Delta.exe
C:\Users\Marius\AppData\Local\Temp\DeltaTB.exe
C:\Users\Marius\AppData\Local\Temp\fp_pl_pfs_installer-1.exe
C:\Users\Marius\AppData\Local\Temp\fp_pl_pfs_installer.exe
C:\Users\Marius\AppData\Local\Temp\install_flashplayer11x32ax_chra_awa_aih.exe
C:\Users\Marius\AppData\Local\Temp\jre-7u71-windows-i586-iftw.exe
C:\Users\Marius\AppData\Local\Temp\jre-8u31-windows-au.exe
C:\Users\Marius\AppData\Local\Temp\jre-8u45-windows-au.exe
C:\Users\Marius\AppData\Local\Temp\looksafe-setup-looksftnc1.exe
C:\Users\Marius\AppData\Local\Temp\MobilePCStarterKit80.exe
C:\Users\Marius\AppData\Local\Temp\Mobogenie_Setup_2.1.36_506.exe
C:\Users\Marius\AppData\Local\Temp\MybabylonTB.exe
C:\Users\Marius\AppData\Local\Temp\MyBestOffersToday38.exe
C:\Users\Marius\AppData\Local\Temp\mytmpinstaller.exe
C:\Users\Marius\AppData\Local\Temp\nsdAFD5.exe
C:\Users\Marius\AppData\Local\Temp\nsdBCF0.exe
C:\Users\Marius\AppData\Local\Temp\nsiFBB0.exe
C:\Users\Marius\AppData\Local\Temp\nsj98C2.exe
C:\Users\Marius\AppData\Local\Temp\nso7846.exe
C:\Users\Marius\AppData\Local\Temp\Offercast_AVIRAV7_.exe
C:\Users\Marius\AppData\Local\Temp\optprosetup.exe
C:\Users\Marius\AppData\Local\Temp\PastaLeads78.exe
C:\Users\Marius\AppData\Local\Temp\SearchProtect34.exe
C:\Users\Marius\AppData\Local\Temp\SearchWithGoogleUpdate.exe
C:\Users\Marius\AppData\Local\Temp\SettingsManagerSetup.exe
C:\Users\Marius\AppData\Local\Temp\Setup.exe
C:\Users\Marius\AppData\Local\Temp\setup{0370F940-1307-4537-8603-AE8D140804DA}.exe
C:\Users\Marius\AppData\Local\Temp\SuperOptimizer21.exe
C:\Users\Marius\AppData\Local\Temp\supoptsetup.exe
C:\Users\Marius\AppData\Local\Temp\tu17p84.exe
C:\Users\Marius\AppData\Local\Temp\Uninstall.exe
C:\Users\Marius\AppData\Local\Temp\WSSetup.exe
C:\Users\Marius\AppData\Local\Temp\ZoomWeb_Installer51.exe
C:\Users\Marius\AppData\Local\Temp\_unps.exe
C:\Users\Marius\AppData\Local\Temp\{DB89853C-74AD-433D-A367-F9BEED394FAA}-42.0.2311.135_42.0.2311.90_chrome_updater.exe
Task: {02C012EF-219F-4CE1-A080-9EBC2DFC34EA} - System32\Tasks\a250569a-98c2-4048-95cc-84eb2edcd0f9-5_user => C:\Program Files (x86)\System NotifierV10.03\a250569a-98c2-4048-95cc-84eb2edcd0f9-5.exe <==== ATTENTION
Task: {095D9D0E-576D-4870-B70E-DF8D7C3935AC} - System32\Tasks\LaunchPreSignup => C:\Program Files (x86)\OLBPre\OLBPre.exe <==== ATTENTION
Task: {131FD26F-8494-4BE9-B926-5149F9E6BB49} - System32\Tasks\SMWUpd => C:\Program Files\Common Files\Goobzo\GBUpdate\updater.exe <==== ATTENTION
Task: {14BDCAAC-E147-4D86-84B1-5C70C25DC090} - System32\Tasks\ProPCCleaner_Popup => C:\Program Files (x86)\Pro PC Cleaner\Splash.exe [2014-07-14] () <==== ATTENTION
Task: {1CF14623-8D93-4258-881E-4826C43158CE} - System32\Tasks\avabvyxvdy => C:\Users\Marius\AppData\Local\avabvyxvdy\avabvyxvdy.exe <==== ATTENTION
Task: {2B268BBF-B844-4636-80A4-FA42BB521F30} - System32\Tasks\YTDownloader => C:\Program Files (x86)\YTDownloader\YTDownloader.exe <==== ATTENTION
Task: {33309A6A-8A5C-43C4-B0A4-730A299102E8} - System32\Tasks\ProPCCleaner_Start => C:\Program Files (x86)\Pro PC Cleaner\ProPCCleaner.exe [2014-07-14] (Pro PC Cleaner) <==== ATTENTION
Task: {3631713A-6F7B-4358-900D-883BDDDB0EBA} - System32\Tasks\avabvxvadx => C:\Users\Marius\AppData\Local\avabvxvadx\avabvxvadx.exe [2015-04-19] () <==== ATTENTION
C:\Users\Marius\AppData\Local\avabvxvadx
Task: {382300CA-3792-4381-A94D-FA8A57CE5470} - System32\Tasks\a250569a-98c2-4048-95cc-84eb2edcd0f9-5 => C:\Program Files (x86)\System NotifierV10.03\a250569a-98c2-4048-95cc-84eb2edcd0f9-5.exe <==== ATTENTION
C:\Program Files (x86)\System NotifierV10.03
Task: {466AC41A-4F39-408B-9C75-712425B8956D} - System32\Tasks\GoogleUpdateTaskUserM_1_7_22_478699874-4155726479-3780505679-3006UA__323435363138363533362d3437415a556c2a3223346c41 => Wscript.exe //B "C:\ProgramData\PastaLeadsAgent\startprocess.js" pastaleadss.exe /invoke /f:check_services /l:0
C:\ProgramData\PastaLeadsAgent
Task: {4A2E6A93-5027-41F9-86BD-538ACFDD2519} - System32\Tasks\QJNFZ => C:\Users\Marius\AppData\Roaming\QJNFZ.exe [2015-04-27] (System NotifierV10.03) <==== ATTENTION
C:\Users\Marius\AppData\Roaming\QJNFZ.exe
Task: {84D41DD0-9518-47FA-8E4B-052606F8DEEA} - System32\Tasks\Bidaily Synchronize Task => C:\ProgramData\{c0c6049b-348f-9f0c-c0c6-6049b348126c}\priceless_p_soft_partner.exe [2014-05-04] () <==== ATTENTION
C:\ProgramData\{c0c6049b-348f-9f0c-c0c6-6049b348126c}
Task: {89D2DDAF-EABC-42FE-9A2F-DAE85DACCBE3} - System32\Tasks\Crossbrowse => C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\utility.exe <==== ATTENTION
C:\Program Files (x86)\Crossbrowse
Task: {BA5F908A-461F-4CD7-A596-5A182771CAB4} - System32\Tasks\a250569a-98c2-4048-95cc-84eb2edcd0f9-10_user => C:\Program Files (x86)\System NotifierV10.03\a250569a-98c2-4048-95cc-84eb2edcd0f9-10.exe <==== ATTENTION
Task: {BDE1BD95-4A59-497B-9FC3-8E8212A27B3F} - System32\Tasks\SMW_UpdateTask_Time_323435363138363533362d3437415a556c2a3223346c41 => Wscript.exe //B "C:\ProgramData\SearchModule\smhe.js" smu.exe /invoke /f:check_services /l:0 <==== ATTENTION
C:\ProgramData\SearchModule
Task: {C0BFF139-4002-4B6C-AC03-EC128EEB4A65} - System32\Tasks\d73553dc-f069-47b3-8808-35e7c4b13dc7-4 => C:\Program Files (x86)\MPlayerplus_01\d73553dc-f069-47b3-8808-35e7c4b13dc7-4.exe <==== ATTENTION
C:\Program Files (x86)\MPlayerplus_01
Task: {DF37AE53-AEFC-4038-97F0-5C132BF0B9BE} - System32\Tasks\YTDownloaderUpd => C:\Program Files (x86)\YTDownloader\updater.exe <==== ATTENTION
FirewallRules: [{A8BEF60E-5233-490B-9ADD-DBA974449FA8}] => (Allow) C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\crossbrowse.exe
FirewallRules: [{C1D7D2F6-8340-4FAD-B6D0-6AFE45A9193C}] => (Allow) C:\Program Files (x86)\mystarttb\ToolbarCleaner.exe
FirewallRules: [{B3D72E3E-BE87-4F50-BDE6-5CBDA7E572CE}] => (Allow) C:\Program Files (x86)\mystarttb\ToolbarCleaner.exe
C:\Program Files (x86)\mystarttb
RemoveProxy:
Reboot:
end
*****************

Restore point was successfully created.
Processes closed successfully.
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\ => value deleted successfully.
HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\fst_ca_99 => value deleted successfully.
HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\ => value deleted successfully.
HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\mpck_ca_10 => value deleted successfully.
HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\mbot_ca_482 => value deleted successfully.
HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\YTDownloader => value deleted successfully.
"C:\Program Files (x86)\YTDownloader" => File/Directory not found.
HKU\S-1-5-21-2827223565-3312671657-2323579203-1000\Software\Microsoft\Windows\CurrentVersion\Run\\YTDownloader => value deleted successfully.
HKU\S-1-5-21-2827223565-3312671657-2323579203-1000\Software\Microsoft\Windows\CurrentVersion\Run\\GoogleChromeAutoLaunch_B73401D408F5FBC1A31E4154B60B5830 => value deleted successfully.
"C:\Program Files (x86)\Crossbrowse" => File/Directory not found.
HKU\S-1-5-21-2827223565-3312671657-2323579203-1000\Software\Microsoft\Windows\CurrentVersion\Run\\Reg Pro Cleaner => value deleted successfully.
C:\Program Files (x86)\Reg Pro Cleaner => Moved successfully.
"C:\ProgramData\LolyKey\LolyKey64.dll" => Value Data removed successfully.
"C:\ProgramData\LolyKey" => File/Directory not found.
"C:\PROGRA~2\Linkey\IEEXTE~1\iedll64.dll" => Value Data removed successfully.
"C:\PROGRA~2\Linkey" => File/Directory not found.
"c:\programdata\lolykey\lolykey32.dll" => Value Data removed successfully.
"c:\programdata\lolykey" => File/Directory not found.
"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\bitguard.exe" => Key deleted successfully.
"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\bprotect.exe" => Key deleted successfully.
"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\bpsvc.exe" => Key deleted successfully.
"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\browsemngr.exe" => Key deleted successfully.
"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\browserdefender.exe" => Key deleted successfully.
"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\browsermngr.exe" => Key deleted successfully.
"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\browserprotect.exe" => Key deleted successfully.
"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\browsersafeguard.exe" => Key deleted successfully.
"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\bundlesweetimsetup.exe" => Key deleted successfully.
"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\cltmngsvc.exe" => Key deleted successfully.
"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\delta babylon.exe" => Key deleted successfully.
"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\delta tb.exe" => Key deleted successfully.
"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\delta2.exe" => Key deleted successfully.
"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\deltainstaller.exe" => Key deleted successfully.
"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\deltasetup.exe" => Key deleted successfully.
"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\deltatb.exe" => Key deleted successfully.
"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\deltatb_2501-c733154b.exe" => Key deleted successfully.
"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\dprotectsvc.exe" => Key deleted successfully.
"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\iminentsetup.exe" => Key deleted successfully.
"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\protectedsearch.exe" => Key deleted successfully.
"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\rjatydimofu.exe" => Key deleted successfully.
"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\searchprotection.exe" => Key deleted successfully.
"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\searchprotector.exe" => Key deleted successfully.
"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\snapdo.exe" => Key deleted successfully.
"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\stinst32.exe" => Key deleted successfully.
"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\stinst64.exe" => Key deleted successfully.
"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\sweetimsetup.exe" => Key deleted successfully.
"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\tbdelta.exetoolbar783881609.exe" => Key deleted successfully.
"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\utiljumpflip.exe" => Key deleted successfully.
C:\Users\Marius\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hqghumeaylnlf.lnk => Moved successfully.
C:\ProgramData\{46880265-e519-0ffd-4688-80265e510997}\hqghumeaylnlf.exe => Moved successfully.
C:\ProgramData\{46880265-e519-0ffd-4688-80265e510997} => Moved successfully.
C:\Users\Marius\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\priceless_p_soft_partner.lnk => Moved successfully.
C:\ProgramData\{c0c6049b-348f-9f0c-c0c6-6049b348126c}\priceless_p_soft_partner.exe => Moved successfully.
C:\ProgramData\{c0c6049b-348f-9f0c-c0c6-6049b348126c} => Moved successfully.
C:\windows\system32\GroupPolicy\Machine => Moved successfully.
C:\windows\system32\GroupPolicy\GPT.ini => Moved successfully.
C:\windows\SysWOW64\GroupPolicy\GPT.ini => Moved successfully.
"HKLM\SOFTWARE\Policies\Google" => Key deleted successfully.
HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable => value deleted successfully.
HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer => value deleted successfully.
HKLM\Software\\Microsoft\Internet Explorer\Main\\Start Page => Value was restored successfully.
HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Value was restored successfully.
"HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{31090377-0740-419E-BEFC-A56E50500D5B}" => Key deleted successfully.
HKCR\CLSID\{31090377-0740-419E-BEFC-A56E50500D5B} => Key not found.
"HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}" => Key deleted successfully.
HKCR\CLSID\{67A2568C-7A0A-4EED-AECC-B5405DE63B64} => Key not found.
"HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2476}" => Key deleted successfully.
HKCR\CLSID\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2476} => Key not found.
HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Value was restored successfully.
"HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}" => Key deleted successfully.
HKCR\Wow6432Node\CLSID\{67A2568C-7A0A-4EED-AECC-B5405DE63B64} => Key not found.
"HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2476}" => Key deleted successfully.
HKCR\Wow6432Node\CLSID\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2476} => Key not found.
HKU\S-1-5-21-2827223565-3312671657-2323579203-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value deleted successfully.
HKU\S-1-5-21-2827223565-3312671657-2323579203-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\URL => value deleted successfully.
HKU\S-1-5-21-2827223565-3312671657-2323579203-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\SuggestionsURL_JSON => value deleted successfully.
"HKU\S-1-5-21-2827223565-3312671657-2323579203-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\AEE59D684DC54BE58C012BCD7DE9134C" => Key deleted successfully.
HKCR\CLSID\AEE59D684DC54BE58C012BCD7DE9134C => Key not found.
"HKU\S-1-5-21-2827223565-3312671657-2323579203-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{015DB5FA-EAFB-4592-A95B-F44D3EE87FA9}" => Key deleted successfully.
HKCR\CLSID\{015DB5FA-EAFB-4592-A95B-F44D3EE87FA9} => Key not found.
"HKU\S-1-5-21-2827223565-3312671657-2323579203-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}" => Key deleted successfully.
HKCR\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} => Key not found.
"HKU\S-1-5-21-2827223565-3312671657-2323579203-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{31090377-0740-419E-BEFC-A56E50500D5B}" => Key deleted successfully.
HKCR\CLSID\{31090377-0740-419E-BEFC-A56E50500D5B} => Key not found.
"HKU\S-1-5-21-2827223565-3312671657-2323579203-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{3BD44F0E-0596-4008-AEE0-45D47E3A8F0E}" => Key deleted successfully.
HKCR\CLSID\{3BD44F0E-0596-4008-AEE0-45D47E3A8F0E} => Key not found.
"HKU\S-1-5-21-2827223565-3312671657-2323579203-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{41B3F996-1E5D-4747-8F4B-ED6AEEE2F544}" => Key deleted successfully.
HKCR\CLSID\{41B3F996-1E5D-4747-8F4B-ED6AEEE2F544} => Key not found.
"HKU\S-1-5-21-2827223565-3312671657-2323579203-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}" => Key deleted successfully.
HKCR\CLSID\{67A2568C-7A0A-4EED-AECC-B5405DE63B64} => Key not found.
"HKU\S-1-5-21-2827223565-3312671657-2323579203-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{7F4EFF06-7032-458e-AE16-1C1D8255C28A}" => Key deleted successfully.
HKCR\CLSID\{7F4EFF06-7032-458e-AE16-1C1D8255C28A} => Key not found.
"HKU\S-1-5-21-2827223565-3312671657-2323579203-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2476}" => Key deleted successfully.
HKCR\CLSID\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2476} => Key not found.
"HKU\S-1-5-21-2827223565-3312671657-2323579203-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9F3C458B-4494-4EE0-A486-535ED0420E03}" => Key deleted successfully.
HKCR\CLSID\{9F3C458B-4494-4EE0-A486-535ED0420E03} => Key not found.
"HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4D9101D6-5BA0-4048-BDDE-7E2DF54C8C47}" => Key deleted successfully.
HKCR\CLSID\{4D9101D6-5BA0-4048-BDDE-7E2DF54C8C47} => Key not found.
"HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}" => Key deleted successfully.
HKCR\Wow6432Node\CLSID\{02478D38-C3F9-4efb-9B51-7695ECA05670} => Key not found.
HKU\S-1-5-21-2827223565-3312671657-2323579203-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{2318C2B1-4965-11D4-9B18-009027A5CD4F} => value deleted successfully.
HKCR\CLSID\{2318C2B1-4965-11D4-9B18-009027A5CD4F} => Key not found.
HKU\S-1-5-21-2827223565-3312671657-2323579203-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} => value deleted successfully.
HKCR\CLSID\{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} => Key not found.
HKU\S-1-5-21-2827223565-3312671657-2323579203-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{4F524A2D-5350-4500-76A7-7A786E7484D7} => value deleted successfully.
HKCR\CLSID\{4F524A2D-5350-4500-76A7-7A786E7484D7} => Key not found.
Firefox SearchEngineOrder.1 deleted successfully.
Firefox SearchEngineOrder.3 deleted successfully.
Firefox SelectedSearchEngine deleted successfully.
Firefox homepage deleted successfully.
Firefox newtab deleted successfully.
Firefox SelectedSearchEngine deleted successfully.
Firefox homepage deleted successfully.
"HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE" => Key deleted successfully.
"HKLM\Software\Wow6432Node\MozillaPlugins\@microsoft.com/GENUINE" => Key deleted successfully.
C:\Users\Marius\AppData\Roaming\Mozilla\Firefox\Profiles\gmvxix60.default\user.js => Moved successfully.
C:\Users\Marius\AppData\Roaming\Mozilla\Firefox\Profiles\gmvxix60.default\searchplugins\default-search.xml => Moved successfully.
C:\Users\Marius\AppData\Roaming\Mozilla\Firefox\Profiles\gmvxix60.default\searchplugins\Speedial.xml => Moved successfully.
C:\Users\Marius\AppData\Roaming\Mozilla\Firefox\Profiles\gmvxix60.default\searchplugins\trovi.xml => Moved successfully.
C:\Program Files (x86)\mozilla firefox\browser\searchplugins\mystarttb.xml => Moved successfully.
C:\Users\Marius\AppData\Roaming\Mozilla\Firefox\Profiles\gmvxix60.default\Extensions\8q@n.edu => Moved successfully.
C:\Users\Marius\AppData\Roaming\Mozilla\Firefox\Profiles\gmvxix60.default\Extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52} => Moved successfully.
C:\Users\Marius\AppData\Roaming\Mozilla\Firefox\Profiles\gmvxix60.default\Extensions\59D317DB041748fdB89B47E6F96058F3@jetpack.xpi => Moved successfully.
C:\Users\Marius\AppData\Roaming\Mozilla\Firefox\Profiles\gmvxix60.default\extensions\{607b689f-7600-45e4-b8e5-887f72dab15c} not found.
Chrome StartupUrls deleted successfully.
Chrome DefaultSearchKeyword not detected.
CHR DefaultNewTabURL: Default -> www.trovi.com/?gd=&ctid=CT3324769&octid=EB_ORIGINAL_CTID&ISID=M25827412-7801-4FC6-BCA9-014202123AE0&SearchSource=69&CUI=&SSPV=SP2230TB_sp_ch&lay=5&p=cnts&UM=8&UP=SP4C619BAA-02B5-4133-AE25-8C66039ED0E7&SAT=CNTS&D=042715 => Error: No automatic fix found for this entry.
Chrome DefaultSuggestURL not detected.
"HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\dghncoeocefmhkhiphdgikkamjeglbfh" => Key deleted successfully.
"HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl" => Key deleted successfully.
CoupoonService64 => Service deleted successfully.
C:\Program Files (x86)\coupoon => Moved successfully.
xoxufewe => Service deleted successfully.
BrsHelper => Service deleted successfully.
lydeteku => Service deleted successfully.
UpdateCheck => Service deleted successfully.
lnx => Service deleted successfully.
mlnx => Service deleted successfully.
c:\windows\lnx.exe => Moved successfully.
c:\windows\mlnx.exe => Moved successfully.
C:\Users\Marius\AppData\Roaming\003F0CDE-1430876041-E011-A025-00266CD20EB8 => Moved successfully.
"C:\PROGRA~2\YTDOWN~1" => File/Directory not found.
"C:\Program Files (x86)\Coupoon" => File/Directory not found.
innfd_1_10_0_13 => Service deleted successfully.
"C:\Windows\System32\drivers\innfd_1_10_0_13.sys" => File/Directory not found.
C:\windows\System32\Tasks\ProPCCleaner_Popup => Moved successfully.
C:\windows\pss => Moved successfully.
C:\ProgramData\653f05e4000027bf => Moved successfully.
C:\windows\system32\Drivers\SPPD.sys => Moved successfully.
C:\Users\Marius\Documents\Optimizer Pro => Moved successfully.
C:\Users\Marius\AppData\Local\003F0CDE-1430854670-E011-A025-00266CD20EB8 => Moved successfully.
C:\windows\Tasks\RPC.job => Moved successfully.
C:\Users\Marius\AppData\Roaming\003F0CDE-1430876102-E011-A025-00266CD20EB8 => Moved successfully.
C:\windows\Tasks\HYJQUCPDKM1.job => Moved successfully.
C:\Users\Marius\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VOPackage => Moved successfully.
C:\Users\Marius\AppData\Roaming\003F0CDE-1430876059-E011-A025-00266CD20EB8 => Moved successfully.
"C:\Users\Marius\AppData\Roaming\003F0CDE-1430876041-E011-A025-00266CD20EB8" => File/Directory not found.
C:\ProgramData\8ef1706414cd42349b12fe5555daafbb => Moved successfully.
"C:\Program Files (x86)\Reg Pro Cleaner" => File/Directory not found.
"C:\ProgramData\{46880265-e519-0ffd-4688-80265e510997}" => File/Directory not found.
C:\windows\lnx.dat => Moved successfully.
"C:\windows\lnx.exe" => File/Directory not found.
"C:\windows\mlnx.exe" => File/Directory not found.
C:\ProgramData\c4e28be5fade45ddb77a805914116806 => Moved successfully.
C:\Users\Marius\Desktop\Continue Mybest Offerstoday Uninstaller.lnk => Moved successfully.
C:\windows\System32\Tasks\ProPCCleaner_Start => Moved successfully.
C:\Users\Marius\AppData\Local\Pro_PC_Cleaner => Moved successfully.
C:\Users\Marius\Documents\ProPCCleaner => Moved successfully.
C:\Users\Public\Desktop\Pro PC Cleaner.lnk => Moved successfully.
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Pro PC Cleaner => Moved successfully.
C:\Program Files (x86)\Pro PC Cleaner => Moved successfully.
C:\Users\Marius\AppData\Roaming\Pro PC Cleaner => Moved successfully.
C:\ProgramData\2069728918344086924 => Moved successfully.
C:\windows\System32\Tasks\avabvyxvdy => Moved successfully.
C:\ProgramData\coofbokbgcodjifeendogcpbkjdnjgpi => Moved successfully.
C:\windows\Tasks\Bidaily Synchronize Task.job => Moved successfully.
"C:\ProgramData\{c0c6049b-348f-9f0c-c0c6-6049b348126c}" => File/Directory not found.
C:\windows\System32\Tasks\Bidaily Synchronize Task => Moved successfully.
C:\windows\SysWOW64\029B560A371F4E00AB32838EBC01B9E7 => Moved successfully.
C:\Users\Marius\AppData\Local\BrowserHelper => Moved successfully.
C:\windows\System32\Tasks\YTDownloaderUpd => Moved successfully.
C:\windows\System32\Tasks\YTDownloader => Moved successfully.
C:\Users\Marius\AppData\Local\Crossbrowse => Moved successfully.
C:\windows\Tasks\Crossbrowse.job => Moved successfully.
C:\windows\Tasks\QJNFZ.job => Moved successfully.
C:\windows\System32\Tasks\a250569a-98c2-4048-95cc-84eb2edcd0f9-5 => Moved successfully.
C:\windows\System32\Tasks\Crossbrowse => Moved successfully.
C:\Users\Marius\AppData\Roaming\QJNFZ.exe => Moved successfully.
C:\windows\System32\Tasks\QJNFZ => Moved successfully.
C:\Program Files\Common Files\Goobzo => Moved successfully.
C:\windows\System32\Tasks\SMW_UpdateTask_Time_323435363138363533362d3437415a556c2a3223346c41 => Moved successfully.
C:\windows\System32\Tasks\SMWUpd => Moved successfully.
C:\ProgramData\SearchModule => Moved successfully.
C:\windows\System32\Tasks\avabvxvadx => Moved successfully.
C:\Users\Marius\AppData\Local\avabvxvadx => Moved successfully.
C:\ProgramData\AMOD3075.dat => Moved successfully.
C:\windows\System32\Tasks\GoogleUpdateTaskUserM_1_7_22_478699874-4155726479-3780505679-3006UA__323435363138363533362d3437415a556c2a3223346c41 => Moved successfully.
C:\ProgramData\PastaLeadsAgent => Moved successfully.
C:\Program Files\Common Files\PastaLeads => Moved successfully.
C:\Program Files\Coupoon => Moved successfully.
"C:\Program Files (x86)\Coupoon" => File/Directory not found.
C:\ProgramData\{a94a5059-3dd9-3ecb-a94a-a50593dd4164} => Moved successfully.
C:\Program Files (x86)\Super Optimizer => Moved successfully.
C:\Program Files (x86)\globalUpdate => Moved successfully.
C:\windows\Tasks\d73553dc-f069-47b3-8808-35e7c4b13dc7-4.job => Moved successfully.
C:\Users\Marius\AppData\Roaming\QJNFZ => Moved successfully.
"C:\Users\Marius\AppData\Roaming\QJNFZ.exe" => File/Directory not found.
C:\Users\Marius\AppData\Local\AnyProtectScannerSetup.exe => Moved successfully.
C:\Users\Marius\AppData\Local\Temp-log.txt => Moved successfully.
"C:\ProgramData\AMOD3075.dat" => File/Directory not found.
"C:\ProgramData\AMOD3075.dat" => File/Directory not found.
C:\Users\Marius\AppData\Local\Temp\1910.exe => Moved successfully.
C:\Users\Marius\AppData\Local\Temp\8418.exe => Moved successfully.
C:\Users\Marius\AppData\Local\Temp\932.exe => Moved successfully.
C:\Users\Marius\AppData\Local\Temp\APNSetup.exe => Moved successfully.
C:\Users\Marius\AppData\Local\Temp\avgnt.exe => Moved successfully.
C:\Users\Marius\AppData\Local\Temp\Avira.exe => Moved successfully.
C:\Users\Marius\AppData\Local\Temp\BackupSetup.exe => Moved successfully.
C:\Users\Marius\AppData\Local\Temp\BundleSweetIMSetup.exe => Moved successfully.
C:\Users\Marius\AppData\Local\Temp\Coupoon72.exe => Moved successfully.
C:\Users\Marius\AppData\Local\Temp\d7a5711ffec14c4c8d518980af745940275714.exe => Moved successfully.
C:\Users\Marius\AppData\Local\Temp\Delta.exe => Moved successfully.
C:\Users\Marius\AppData\Local\Temp\DeltaTB.exe => Moved successfully.
C:\Users\Marius\AppData\Local\Temp\fp_pl_pfs_installer-1.exe => Moved successfully.
C:\Users\Marius\AppData\Local\Temp\fp_pl_pfs_installer.exe => Moved successfully.
C:\Users\Marius\AppData\Local\Temp\install_flashplayer11x32ax_chra_awa_aih.exe => Moved successfully.
C:\Users\Marius\AppData\Local\Temp\jre-7u71-windows-i586-iftw.exe => Moved successfully.
C:\Users\Marius\AppData\Local\Temp\jre-8u31-windows-au.exe => Moved successfully.
C:\Users\Marius\AppData\Local\Temp\jre-8u45-windows-au.exe => Moved successfully.
C:\Users\Marius\AppData\Local\Temp\looksafe-setup-looksftnc1.exe => Moved successfully.
C:\Users\Marius\AppData\Local\Temp\MobilePCStarterKit80.exe => Moved successfully.
C:\Users\Marius\AppData\Local\Temp\Mobogenie_Setup_2.1.36_506.exe => Moved successfully.
C:\Users\Marius\AppData\Local\Temp\MybabylonTB.exe => Moved successfully.
C:\Users\Marius\AppData\Local\Temp\MyBestOffersToday38.exe => Moved successfully.
C:\Users\Marius\AppData\Local\Temp\mytmpinstaller.exe => Moved successfully.
C:\Users\Marius\AppData\Local\Temp\nsdAFD5.exe => Moved successfully.
C:\Users\Marius\AppData\Local\Temp\nsdBCF0.exe => Moved successfully.
C:\Users\Marius\AppData\Local\Temp\nsiFBB0.exe => Moved successfully.
C:\Users\Marius\AppData\Local\Temp\nsj98C2.exe => Moved successfully.
C:\Users\Marius\AppData\Local\Temp\nso7846.exe => Moved successfully.
C:\Users\Marius\AppData\Local\Temp\Offercast_AVIRAV7_.exe => Moved successfully.
C:\Users\Marius\AppData\Local\Temp\optprosetup.exe => Moved successfully.
C:\Users\Marius\AppData\Local\Temp\PastaLeads78.exe => Moved successfully.
C:\Users\Marius\AppData\Local\Temp\SearchProtect34.exe => Moved successfully.
C:\Users\Marius\AppData\Local\Temp\SearchWithGoogleUpdate.exe => Moved successfully.
C:\Users\Marius\AppData\Local\Temp\SettingsManagerSetup.exe => Moved successfully.
C:\Users\Marius\AppData\Local\Temp\Setup.exe => Moved successfully.
C:\Users\Marius\AppData\Local\Temp\setup{0370F940-1307-4537-8603-AE8D140804DA}.exe => Moved successfully.
C:\Users\Marius\AppData\Local\Temp\SuperOptimizer21.exe => Moved successfully.
C:\Users\Marius\AppData\Local\Temp\supoptsetup.exe => Moved successfully.
C:\Users\Marius\AppData\Local\Temp\tu17p84.exe => Moved successfully.
C:\Users\Marius\AppData\Local\Temp\Uninstall.exe => Moved successfully.
C:\Users\Marius\AppData\Local\Temp\WSSetup.exe => Moved successfully.
C:\Users\Marius\AppData\Local\Temp\ZoomWeb_Installer51.exe => Moved successfully.
C:\Users\Marius\AppData\Local\Temp\_unps.exe => Moved successfully.
C:\Users\Marius\AppData\Local\Temp\{DB89853C-74AD-433D-A367-F9BEED394FAA}-42.0.2311.135_42.0.2311.90_chrome_updater.exe => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{02C012EF-219F-4CE1-A080-9EBC2DFC34EA}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{02C012EF-219F-4CE1-A080-9EBC2DFC34EA}" => Key deleted successfully.
C:\Windows\System32\Tasks\a250569a-98c2-4048-95cc-84eb2edcd0f9-5_user => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\a250569a-98c2-4048-95cc-84eb2edcd0f9-5_user" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{095D9D0E-576D-4870-B70E-DF8D7C3935AC}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{095D9D0E-576D-4870-B70E-DF8D7C3935AC}" => Key deleted successfully.
C:\Windows\System32\Tasks\LaunchPreSignup => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\LaunchPreSignup" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{131FD26F-8494-4BE9-B926-5149F9E6BB49}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{131FD26F-8494-4BE9-B926-5149F9E6BB49}" => Key deleted successfully.
C:\Windows\System32\Tasks\SMWUpd not found.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\SMWUpd" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{14BDCAAC-E147-4D86-84B1-5C70C25DC090}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{14BDCAAC-E147-4D86-84B1-5C70C25DC090}" => Key deleted successfully.
C:\Windows\System32\Tasks\ProPCCleaner_Popup not found.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\ProPCCleaner_Popup" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{1CF14623-8D93-4258-881E-4826C43158CE}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{1CF14623-8D93-4258-881E-4826C43158CE}" => Key deleted successfully.
C:\Windows\System32\Tasks\avabvyxvdy not found.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\avabvyxvdy" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{2B268BBF-B844-4636-80A4-FA42BB521F30}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{2B268BBF-B844-4636-80A4-FA42BB521F30}" => Key deleted successfully.
C:\Windows\System32\Tasks\YTDownloader not found.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\YTDownloader" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{33309A6A-8A5C-43C4-B0A4-730A299102E8}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{33309A6A-8A5C-43C4-B0A4-730A299102E8}" => Key deleted successfully.
C:\Windows\System32\Tasks\ProPCCleaner_Start not found.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\ProPCCleaner_Start" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{3631713A-6F7B-4358-900D-883BDDDB0EBA}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3631713A-6F7B-4358-900D-883BDDDB0EBA}" => Key deleted successfully.
C:\Windows\System32\Tasks\avabvxvadx not found.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\avabvxvadx" => Key deleted successfully.
"C:\Users\Marius\AppData\Local\avabvxvadx" => File/Directory not found.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{382300CA-3792-4381-A94D-FA8A57CE5470}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{382300CA-3792-4381-A94D-FA8A57CE5470}" => Key deleted successfully.
C:\Windows\System32\Tasks\a250569a-98c2-4048-95cc-84eb2edcd0f9-5 not found.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\a250569a-98c2-4048-95cc-84eb2edcd0f9-5" => Key deleted successfully.
"C:\Program Files (x86)\System NotifierV10.03" => File/Directory not found.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{466AC41A-4F39-408B-9C75-712425B8956D}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{466AC41A-4F39-408B-9C75-712425B8956D}" => Key deleted successfully.
C:\Windows\System32\Tasks\GoogleUpdateTaskUserM_1_7_22_478699874-4155726479-3780505679-3006UA__323435363138363533362d3437415a556c2a3223346c41 not found.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\GoogleUpdateTaskUserM_1_7_22_478699874-4155726479-3780505679-3006UA__323435363138363533362d3437415a556c2a3223346c41" => Key deleted successfully.
"C:\ProgramData\PastaLeadsAgent" => File/Directory not found.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{4A2E6A93-5027-41F9-86BD-538ACFDD2519}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{4A2E6A93-5027-41F9-86BD-538ACFDD2519}" => Key deleted successfully.
C:\Windows\System32\Tasks\QJNFZ not found.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\QJNFZ" => Key deleted successfully.
"C:\Users\Marius\AppData\Roaming\QJNFZ.exe" => File/Directory not found.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{84D41DD0-9518-47FA-8E4B-052606F8DEEA}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{84D41DD0-9518-47FA-8E4B-052606F8DEEA}" => Key deleted successfully.
C:\Windows\System32\Tasks\Bidaily Synchronize Task not found.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Bidaily Synchronize Task" => Key deleted successfully.
"C:\ProgramData\{c0c6049b-348f-9f0c-c0c6-6049b348126c}" => File/Directory not found.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{89D2DDAF-EABC-42FE-9A2F-DAE85DACCBE3}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{89D2DDAF-EABC-42FE-9A2F-DAE85DACCBE3}" => Key deleted successfully.
C:\Windows\System32\Tasks\Crossbrowse not found.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Crossbrowse" => Key deleted successfully.
"C:\Program Files (x86)\Crossbrowse" => File/Directory not found.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{BA5F908A-461F-4CD7-A596-5A182771CAB4}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{BA5F908A-461F-4CD7-A596-5A182771CAB4}" => Key deleted successfully.
C:\Windows\System32\Tasks\a250569a-98c2-4048-95cc-84eb2edcd0f9-10_user => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\a250569a-98c2-4048-95cc-84eb2edcd0f9-10_user" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{BDE1BD95-4A59-497B-9FC3-8E8212A27B3F}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{BDE1BD95-4A59-497B-9FC3-8E8212A27B3F}" => Key deleted successfully.
C:\Windows\System32\Tasks\SMW_UpdateTask_Time_323435363138363533362d3437415a556c2a3223346c41 not found.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\SMW_UpdateTask_Time_323435363138363533362d3437415a556c2a3223346c41" => Key deleted successfully.
"C:\ProgramData\SearchModule" => File/Directory not found.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{C0BFF139-4002-4B6C-AC03-EC128EEB4A65}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{C0BFF139-4002-4B6C-AC03-EC128EEB4A65}" => Key deleted successfully.
C:\Windows\System32\Tasks\d73553dc-f069-47b3-8808-35e7c4b13dc7-4 => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\d73553dc-f069-47b3-8808-35e7c4b13dc7-4" => Key deleted successfully.
"C:\Program Files (x86)\MPlayerplus_01" => File/Directory not found.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{DF37AE53-AEFC-4038-97F0-5C132BF0B9BE}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{DF37AE53-AEFC-4038-97F0-5C132BF0B9BE}" => Key deleted successfully.
C:\Windows\System32\Tasks\YTDownloaderUpd not found.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\YTDownloaderUpd" => Key deleted successfully.
HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{A8BEF60E-5233-490B-9ADD-DBA974449FA8} => value deleted successfully.
HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{C1D7D2F6-8340-4FAD-B6D0-6AFE45A9193C} => value deleted successfully.
HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{B3D72E3E-BE87-4F50-BDE6-5CBDA7E572CE} => value deleted successfully.
"C:\Program Files (x86)\mystarttb" => File/Directory not found.

========= RemoveProxy: =========

HKLM\SYSTEM\CurrentControlSet\services\NlaSvc\Parameters\Internet\ManualProxies\\ => value deleted successfully.
HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings => value deleted successfully.
HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings => value deleted successfully.
HKU\S-1-5-21-2827223565-3312671657-2323579203-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings => value deleted successfully.
HKU\S-1-5-21-2827223565-3312671657-2323579203-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings => value deleted successfully.

========= End of RemoveProxy: =========

The system needed a reboot.

==== End of Fixlog 23:08:20 ====

Last Edit: May 7, 2015 21:28:48 GMT -8 by moeko

dbrisen
Malware Removalists

Posts: 3,688

[ti]SOLVED[/ti]Several malwares that can't be deleted? May 7, 2015 22:53:57 GMT -8

Post by dbrisen on May 7, 2015 22:53:57 GMT -8

First, reset Chrome >>>>

If Chrome was giving you problems then the best thing to do is to manually check the settings and adjust them if you find anything you did not install or use any more. Our scanners / script programs can fix Chrome but by removing some things from outside of Chrome's own settings, there is a chance of corrupting the user profile and making Chrome not start up properly.

Home Page - The Home Page is the page that the browser will open whenever you tell it start up. When you first open the browser, it loads your Home Page that is set in the browser's properties. To change the Home Page for Google Chrome, follow these directions:

1) Open Chrome and click on the menu button in the upper right corner of the browser. The Menu Button looks like three bars (see below).

2) On the Menu that opens down, click on Settings to open the Settings page in Chrome.

3) Look for the Appearance section in the Settings page and make sure the Show Home button box is checked. Then click on the blue Change next to New Tab Page.

4) A box will pop up and allow you to either set a New Tab Page as your home page or type a URL address for a Home Page ( for example, you could enter www.google.com there to set Google as your home page). Click OK when you have made the setting you want and the box will close. Close the Settings page when you are done making the changes to the Home Page.

Search Engines in Chrome - Search Engines are the search providers that your browser uses to search the web for whatever information you want searched for. Should malware change the browser's search engines to use the ones that benefit the malware writers more than it benefits you, you can change this setting back to remove the malicious search engines (usually referred to search redirects).

1) Start Chrome and click on the Menu Button in the upper right hand corner of Chrome.

2) In the drop down menu, select Settings.

3) on the Settings page, look for the Search section and click on "Manage search engines ..."

4) On the window that opens, use your mouse to highlight the search engine you want and click on the option that shows in the highlight bar. You can make the focused line the Default Search engine to use all the time or delete that Search Engine from Chrome. In the picture below, one could choose to make Ask.com the Default Search engine by clicking on the words "Make Default" or one could delete the search engine by clicking on the X. Once you are finished making the changes you would like, click on the Done button on the bottom and then close the Settings tab.

Clearing cache and cookies in Chrome

1) Start Chrome and click on the Menu button in the upper right hand corner.

2) In the drop down menu list, select Tools and then select (click on) Clear browsing data.

3) In the box that opens, first select the amount of time you want to clear data from; to clear all the data, select "the beginning of time" in the drop down box in the top. To make sure that the cache and cookies are cleared, select (click on the check box to mark them) "Cookies and other site and plug-in data", "Cached images and files" and "Browsing history". To be totally on the safe side, you can check all the boxes and this will ensure that all of Chrome is cleared. Once you have selected what you want cleared, click on the "Clear browsing data" button and Chrome will delete the saved data from its files.

When the window shown above closes (the clearing is done), close (exit) out of Chrome and restart it for the changes to take effect.

Next, scan with AdwCleaner >>>>

Read carefully

Download Adwcleaner from here to your desktop and run a scan.

You may have to right click adwcleaner.exe and choose "Run as Administrator" from the menu. (Click the Scan button to start the scanning).

It will create a log after it is finished scanning. If not (or if it just asks for you to uncheck what you don't wanted deleted), there is a LogFile button in the middle of the main window; click that and it will make the log file.

Once the report file is made, you can leave AdwCleaner running (but don't delete anything yet) or you can close it down (we can always get a fresh scan done before the deletions).

ONE SCAN ONLY, PLEASE

Attach or paste the log back here for review and further instructions. Thanks.

[ti]SOLVED[/ti]Several malwares that can't be deleted?

Post by moeko on May 5, 2015 18:34:05 GMT -8

Post by Krusty on May 5, 2015 18:46:56 GMT -8

Post by moeko on May 5, 2015 18:49:10 GMT -8

Post by Krusty on May 5, 2015 19:18:24 GMT -8

Post by moeko on May 6, 2015 12:24:49 GMT -8

Post by moeko on May 6, 2015 12:28:02 GMT -8

Post by Krusty on May 6, 2015 14:42:28 GMT -8

Post by dbrisen on May 7, 2015 20:32:41 GMT -8

Post by moeko on May 7, 2015 21:26:18 GMT -8

Post by dbrisen on May 7, 2015 22:53:57 GMT -8