Win32.Downloader.gen

[laksi]

Hi all,
I ran Spybot and found:
Sb1.JPG
I broused to C:/END and it contained: ConduitOK.
I searched the entire disk for: Conduit; Win32.Downloader.gen; verupd.exe - none found.
I searched services for both: Win32.Downloader.gen; verupd.exe - none found.
I am still a little worried as I might have overlooked something.
Pleaese advise.
cordially
laksi

[ken545]

You need to read this , its hard to assist someone without seeing any scans or info on which operating system you use
http://forums.spybot.info/showthread...tance)-Updated



Please download aswMBR to your desktop.

• Double click the aswMBR icon to run it.
• Click the Scan button to start scan.
• If you are asked to update the Avast Virus database please allow it to do so.
• When it finishes, press the save log button, save the logfile to your desktop and post its contents in your next reply.

I just want to see the report....Please Do Not Fix Anything

============================================================================



Please download Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

How to determine whether a computer is running a 32-bit version or 64-bit version of the Windows operating system
A simple way to check your system: Start --> Computer (right click) --> Properties

• Right click to run as administrator (XP users click run after receipt of Windows Security Warning - Open File). When the tool opens click Yes to disclaimer.
• Please make sure All Users is checked
• Do not check
  *List BCD
  *Drivers MD5
  *Shortcut txt
• Press Scan button.
• It will produce a log called FRST.txt in the same directory the tool is run from.
• Please copy and paste log back here.
• The first time the tool is run it generates another log (Addition.txt - also located in the same directory as FRST.exe/FRST64.exe). Please also paste that along with the FRST.txt into your reply.

[laksi]

Hi and thanks for prompt reply,
I just read this:

If one has already run tools/fixes before posting please inform your helper, so that s/he is aware changes may have been made to the system and why. Running fixes before being assisted can destroy evidence in an infection, leaving the malware difficult to detect. Please do not attempt to "do it yourself" while waiting for someone to respond to your topic.

Before contacting this forum I ran MalwareBytes and fixed minor issues it found. I also ran MBAR's AntiRootkit Chameleon which found nothing.
I then ran SpyBot which found Win32.Downloader.gen or a shadow of it in C:/End - contnets: ConduitOK
I then fixed all.
I now proceed with your instructions.
Sincerely
laksi

[laksi]

logs are attached
yours
laksi


Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 12-10-2014 01
Ran by Yaakov Laks (administrator) on LAPTOSH-PC on 13-10-2014 13:20:46
Running from E:\F\Downloads\DLSoftware 15\SpyBot
Loaded Profile: Yaakov Laks (Available profiles: Yaakov Laks)
Platform: Microsoft Windows 7 Home Premium Service Pack 1 (X86) OS Language: English (United States)
Internet Explorer Version 11
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic...ery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(IObit) C:\Program Files\IObit\Advanced SystemCare 7\ASCService.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(IObit) C:\Program Files\IObit\IObit Malware Fighter\IMFsrv.exe
(Microsoft Corporation) C:\Program Files\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe
(Microsoft Corporation) C:\Program Files\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe
(Brio) D:\Program Files\1Utils\Folder Size\FolderSizeSvc.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
(Giraffic) C:\Program Files\Giraffic\GirafficWatchdog.exe
(IObit) C:\Program Files\IObit\Smart Defrag 3\SmartDefrag.exe
(Google Inc.) C:\Program Files\Google\Update\1.3.24.15\GoogleCrashHandler.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Synaptics, Inc.) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\VS7DEBUG\mdm.exe
(Safer-Networking Ltd.) D:\Program Files\1AntiVandals\Spybot - Search & Destroy 2\SDTray.exe
(Giraffic) C:\Program Files\Giraffic\Giraffic.exe
(Chicony) C:\Program Files\Camera Assistant Software for Toshiba\traybar.exe
() C:\Program Files\Hosts_Anti_Adwares_PUPs\HOSTS_Anti-Adware_main.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Nokia) C:\Program Files\Nokia\Nokia Suite\NokiaSuite.exe
(Akamai Technologies, Inc.) C:\Users\Yaakov Laks\AppData\Local\Akamai\netsession_win.exe
(Akamai Technologies, Inc.) C:\Users\Yaakov Laks\AppData\Local\Akamai\netsession_win.exe
() C:\Program Files\G9G11_ScreenCapture\ScreenCapture.exe
(Secunia) C:\Program Files\Secunia\PSI\psia.exe
(Secunia) C:\Program Files\Secunia\PSI\sua.exe
(Toshiba Europe GmbH) D:\Program Files\1Maint\Toshiba TEMPRO\TemproSvc.exe
(TOSHIBA Corporation) D:\Program Files\TOSHIBA\TOSHIBA DVD PLAYER\TNaviSrv.exe
(Secunia) C:\Program Files\Secunia\PSI\psi_tray.exe
(IObit) C:\Program Files\IObit\IObit Malware Fighter\IMF.exe
(Firetrust Ltd) D:\Program Files\1AntiVandals\MailWasher Pro654\MailWasher Pro\MailWasher.exe
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
(Piriform Ltd) D:\Program Files\1Maint\ccleaner\CCleaner.exe
(Safer-Networking Ltd.) D:\Program Files\1AntiVandals\Spybot - Search & Destroy 2\SDUpdSvc.exe
(Safer-Networking Ltd.) D:\Program Files\1AntiVandals\Spybot - Search & Destroy 2\SDWSCSvc.exe
(Microsoft Corporation) C:\Windows\System32\wbem\unsecapp.exe
(StorageCraft Technology Corporation) D:\Program Files\1Maint\StorageCraft\vsnapvss.exe
(Nokia) C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
(Safer-Networking Ltd.) D:\Program Files\1AntiVandals\Spybot - Search & Destroy 2\SDFSSvc.exe
(Nokia) C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe
(Nokia) C:\Program Files\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
(Synaptics, Inc.) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(LSI Corporation) C:\Program Files\LSI SoftModem\agrsmsvc.exe
(Adobe Systems Incorporated) D:\Program Files\Adobe\Reader\AcroRd32.exe
(Adobe Systems Incorporated) D:\Program Files\Adobe\Reader\AcroRd32.exe
(Mozilla Corporation) D:\Program Files\Firefox\firefox.exe
(Mozilla Corporation) D:\Program Files\Firefox\plugin-container.exe
(Adobe Systems, Inc.) C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_15_0_0_152.exe
(Adobe Systems, Inc.) C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_15_0_0_152.exe
(Microsoft Corporation) C:\Program Files\Windows Live\Mail\wlmail.exe
(Microsoft Corporation) C:\Program Files\Windows Live\Contacts\wlcomm.exe
(Microsoft Corporation) C:\Windows\System32\Dxpserver.exe
(Microsoft Corporation) C:\Windows\System32\DeviceDisplayObjectProvider.exe
(Microsoft Corporation) C:\Windows\System32\Dxpserver.exe
(AVAST Software) E:\F\Downloads\DLSoftware 15\SpyBot\aswMBR.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [MSC] => C:\Program Files\Microsoft Security Client\msseces.exe [974432 2014-08-22] (Microsoft Corporation)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1348904 2008-08-14] (Synaptics, Inc.)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [12021464 2014-07-21] (Realtek Semiconductor)
HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959176 2014-08-21] (Adobe Systems Incorporated)
HKLM\...\Run: [SDTray] => D:\Program Files\1AntiVandals\Spybot - Search & Destroy 2\SDTray.exe [5624784 2013-07-25] (Safer-Networking Ltd.)
HKLM\...\Run: [Camera Assistant Software] => C:\Program Files\Camera Assistant Software for Toshiba\traybar.exe [417792 2009-04-10] (Chicony)
HKLM\...\Run: [HOSTS Anti-Adware_PUPs] => C:\Program Files\Hosts_Anti_Adwares_PUPs\HOSTS_Anti-Adware_main.exe [302961 2013-10-07] ()
HKLM\...\Run: [] => [X]
HKLM\...\Run: [IObit Malware Fighter] => C:\Program Files\IObit\IObit Malware Fighter\IMF.exe [1601856 2014-05-23] (IObit)
HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [256896 2014-07-25] (Oracle Corporation)
Winlogon\Notify\SDWinLogon: SDWinLogon.dll [X]
HKU\S-1-5-21-2920106312-904050420-1618604034-1001\...\Run: [] => [X]
HKU\S-1-5-21-2920106312-904050420-1618604034-1001\...\Run: [NokiaSuite.exe] => C:\Program Files\Nokia\Nokia Suite\NokiaSuite.exe [1090912 2013-10-02] (Nokia)
HKU\S-1-5-21-2920106312-904050420-1618604034-1001\...\Run: [Akamai NetSession Interface] => C:\Users\Yaakov Laks\AppData\Local\Akamai\netsession_win.exe [4672920 2014-04-17] (Akamai Technologies, Inc.)
HKU\S-1-5-21-2920106312-904050420-1618604034-1001\...\Run: [OscarEditor] => C:\Program Files\G9G11_ScreenCapture\ScreenCapture.exe [3538944 2012-05-18] ()
HKU\S-1-5-21-2920106312-904050420-1618604034-1001\...\Run: [CCleaner Monitoring] => D:\Program Files\1Maint\ccleaner\CCleaner.exe [4811032 2014-09-26] (Piriform Ltd)
HKU\S-1-5-21-2920106312-904050420-1618604034-1001\...\Policies\Explorer: [NoFavoritesMenu] 1
HKU\S-1-5-18\...\Run: [Advanced SystemCare 7] => C:\Program Files\IObit\Advanced SystemCare 7\ASCTray.exe [2295584 2014-04-21] (IObit)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Secunia PSI Tray.lnk
ShortcutTarget: Secunia PSI Tray.lnk -> C:\Program Files\Secunia\PSI\psi_tray.exe (Secunia)
Startup: C:\Users\Yaakov Laks\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MailWasherPro.lnk
ShortcutTarget: MailWasherPro.lnk -> D:\Program Files\1AntiVandals\MailWasher Pro654\MailWasher Pro\MailWasher.exe (Firetrust Ltd)
ShellIconOverlayIdentifiers: [GDriveBlacklistedOverlay] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42} => C:\Program Files\Google\Drive\googledrivesync32.dll (Google)
ShellIconOverlayIdentifiers: [GDriveSharedEditOverlay] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44} => C:\Program Files\Google\Drive\googledrivesync32.dll (Google)
ShellIconOverlayIdentifiers: [GDriveSharedViewOverlay] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43} => C:\Program Files\Google\Drive\googledrivesync32.dll (Google)
ShellIconOverlayIdentifiers: [GDriveSyncedOverlay] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40} => C:\Program Files\Google\Drive\googledrivesync32.dll (Google)
ShellIconOverlayIdentifiers: [GDriveSyncingOverlay] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41} => C:\Program Files\Google\Drive\googledrivesync32.dll (Google)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = he-IL
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x4C67C112E0E3CF01
URLSearchHook: HKCU - IObit Apps Toolbar - {03EB0E9C-7A91-4381-A220-9B52B641CDB1} - C:\Program Files\IObit Apps Toolbar\IE\9.0\iobitappsToolbarIE.dll (Spigot, Inc.)
SearchScopes: HKLM - DefaultScope {BB8E83F6-B1EF-4F91-95FF-ABFFBB9D8DDF} URL =
SearchScopes: HKCU - {7DAAAB92-E210-43F8-AA79-83FD3E90890A} URL = http://search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=902615&p={searchTerms}
BHO: IObit Apps Toolbar -> {03EB0E9C-7A91-4381-A220-9B52B641CDB1} -> C:\Program Files\IObit Apps Toolbar\IE\9.0\iobitappsToolbarIE.dll (Spigot, Inc.)
BHO: ExplorerWnd Helper -> {10921475-03CE-4E04-90CE-E2E7EF20C814} -> D:\Program Files\1Maint\IObit Uninstaller\UninstallExplorer32.dll (IObit)
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Ads Removal -> {9D974C8C-6D92-44FB-BEAF-B45A1C0CF17F} -> C:\Program Files\IObit\IObit Malware Fighter\adsremoval\IE\Adblock.dll (Adblock)
BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
BHO: Advanced SystemCare Browser Protection -> {BA0C978D-D909-49B6-AFE2-8BDE245DC7E6} -> C:\Program Files\IObit\Surfing Protection\BrowerProtect\ASCPlugin_Protection.dll (IObit)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - IObit Apps Toolbar - {03EB0E9C-7A91-4381-A220-9B52B641CDB1} - C:\Program Files\IObit Apps Toolbar\IE\9.0\iobitappsToolbarIE.dll (Spigot, Inc.)
Handler: belarc - {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - C:\Program Files\Belarc\Advisor\System\BAVoilaX.dll (Belarc, Inc.)
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 80.179.52.100 80.179.55.100

FireFox:
========
FF ProfilePath: C:\Users\Yaakov Laks\AppData\Roaming\Mozilla\Firefox\Profiles\9l7tyrid.default-1405248970516
FF Homepage: about:home
FF Keyword.URL: hxxp://trovi.com/ResultsExt.aspx?ctid=CT3202343&SearchSource=2&CUI=UN22221367211835714&UM=4&q=
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_15_0_0_152.dll ()
FF Plugin: @adobe.com/ShockwavePlayer -> C:\Windows\system32\Adobe\Director\np32dsw_1213153.dll (Adobe Systems, Inc.)
FF Plugin: @Google.com/GoogleEarthPlugin -> C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin: @java.com/DTPlugin,version=10.67.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.67.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE -> C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/VirtualEarth3D,version=4.0 -> C:\Program Files\Virtual Earth 3D\ ()
FF Plugin: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @nokia.com/EnablerPlugin -> C:\Program Files\Nokia\Nokia Suite\npNokiaSuiteEnabler.dll ( )
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @videolan.org/vlc,version=2.0.8 -> D:\Program Files\1Viewers\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.2 -> D:\Program Files\1Viewers\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.3 -> D:\Program Files\1Viewers\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.5 -> D:\Program Files\1Viewers\VLC\npvlc.dll (VideoLAN)
FF Plugin: Adobe Reader -> D:\Program Files\Adobe\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\Yaakov Laks\AppData\Roaming\Mozilla\Firefox\Profiles\9l7tyrid.default-1405248970516\searchplugins\nana10-customized-web-search.xml
FF Extension: Ads Removal - C:\Users\Yaakov Laks\AppData\Roaming\Mozilla\Firefox\Profiles\9l7tyrid.default-1405248970516\Extensions\adremoveext@adremoveext.net [2014-08-25]
FF Extension: Advanced SystemCare Surfing Protection - C:\Users\Yaakov Laks\AppData\Roaming\Mozilla\Firefox\Profiles\9l7tyrid.default-1405248970516\Extensions\ascsurfingprotection@iobit.com [2014-08-10]
FF Extension: Adblock Plus - C:\Users\Yaakov Laks\AppData\Roaming\Mozilla\Firefox\Profiles\9l7tyrid.default-1405248970516\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-08-21]
FF Extension: IObit Apps Toolbar - C:\Program Files\IObit Apps Toolbar\FF [2014-04-09]
FF StartMenuInternet: FIREFOX.EXE - D:\Program Files\Firefox\firefox.exe

Chrome:
=======
CHR HomePage: Default ->
CHR StartupUrls: Default -> ""
CHR DefaultSuggestURL: Default -> {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&gs_ri={google:suggestRid}&xssi=t&q={searchTerms}&{google:inputType}{google:cursorPosition}{google:currentPageUrl}{google:pageClassification}{google:searchVersion}{google:sessionToken}{google:prefetchQuery}sugkey={google:suggestAPIKeyParameter}
CHR Profile: C:\Users\Yaakov Laks\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Docs) - C:\Users\Yaakov Laks\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2013-09-08]
CHR Extension: (כונן Google) - C:\Users\Yaakov Laks\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-09-08]
CHR Extension: (Advanced SystemCare Surfing Protection) - C:\Users\Yaakov Laks\AppData\Local\Google\Chrome\User Data\Default\Extensions\bbmegnmpleoagolcnjnejdacakedpcgd [2014-03-20]
CHR Extension: (YouTube) - C:\Users\Yaakov Laks\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-09-08]
CHR Extension: (חיפוש Google) - C:\Users\Yaakov Laks\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-09-08]
CHR Extension: (Ads Removal) - C:\Users\Yaakov Laks\AppData\Local\Google\Chrome\User Data\Default\Extensions\fopdddcinljmpmioaklghcalngfhbaen [2014-02-28]
CHR Extension: (AD Block) - C:\Users\Yaakov Laks\AppData\Local\Google\Chrome\User Data\Default\Extensions\lfgjbmhakaffflkjecineeaadpidgikb [2014-01-15]
CHR Extension: (Advanced SystemCare Surfing Protection) - C:\Users\Yaakov Laks\AppData\Local\Google\Chrome\User Data\Default\Extensions\nfengeggddojhakldhlpjdlddgkkjkdd [2014-03-20]
CHR Extension: (תוספת RSS Subscription (מאת Google)) - C:\Users\Yaakov Laks\AppData\Local\Google\Chrome\User Data\Default\Extensions\nlbjncdgjeocebhnmkbbbdekmmmcbfjd [2014-03-09]
CHR Extension: (Google Wallet) - C:\Users\Yaakov Laks\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-08]
CHR Extension: (Nana10) - C:\Users\Yaakov Laks\AppData\Local\Google\Chrome\User Data\Default\Extensions\okemjkdkkihnhdaanohnleknbaddlddb [2014-10-10]
CHR Extension: (Gmail) - C:\Users\Yaakov Laks\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-09-08]
CHR Profile: C:\Users\Yaakov Laks\AppData\Local\Google\Chrome\User Data\Profile 1
CHR Extension: (Google Docs) - C:\Users\Yaakov Laks\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\aohghmighlieiainnegkcijnfilokake [2014-05-24]
CHR Extension: (Google Drive) - C:\Users\Yaakov Laks\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-05-24]
CHR Extension: (YouTube) - C:\Users\Yaakov Laks\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-05-24]
CHR Extension: (Google Search) - C:\Users\Yaakov Laks\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-05-24]
CHR Extension: (Advanced SystemCare Surfing Protection) - C:\Users\Yaakov Laks\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\nfengeggddojhakldhlpjdlddgkkjkdd [2014-05-24]
CHR Extension: (Google Wallet) - C:\Users\Yaakov Laks\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-05-24]
CHR Extension: (No Name) - C:\Users\Yaakov Laks\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\okemjkdkkihnhdaanohnleknbaddlddb [2014-10-03]
CHR Extension: (Gmail) - C:\Users\Yaakov Laks\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-05-24]
CHR HKLM\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files\Skype\Toolbars\ChromeExtension\skype_chrome_extension.crx [2014-07-14]
CHR HKLM\...\Chrome\Extension: [nfengeggddojhakldhlpjdlddgkkjkdd] - C:\Program Files\IObit\Surfing Protection\BrowerProtect\ASC_GhromePlugin.crx [2013-11-05]
CHR HKLM\...\Chrome\Extension: [okemjkdkkihnhdaanohnleknbaddlddb] - C:\Users\Yaakov Laks\AppData\Local\CRE\okemjkdkkihnhdaanohnleknbaddlddb.crx [2014-06-26]
CHR HKCU\...\Chrome\Extension: [okemjkdkkihnhdaanohnleknbaddlddb] - C:\Users\Yaakov Laks\AppData\Local\CRE\okemjkdkkihnhdaanohnleknbaddlddb.crx [2014-06-26]

========================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AdvancedSystemCareService7; C:\Program Files\IObit\Advanced SystemCare 7\ASCService.exe [881952 2014-01-14] (IObit)
R2 AgereModemAudio; C:\Program Files\LSI SoftModem\agrsmsvc.exe [14336 2000-01-01] (LSI Corporation)
R2 c2cautoupdatesvc; C:\Program Files\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1390176 2014-07-14] (Microsoft Corporation)
R2 c2cpnrsvc; C:\Program Files\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1767520 2014-07-14] (Microsoft Corporation)
R2 FolderSize; D:\Program Files\1Utils\Folder Size\FolderSizeSvc.exe [116224 2010-04-06] (Brio) [File not signed]
R2 Giraffic; C:\Program Files\Giraffic\GirafficWatchdog.exe [2245232 2013-05-13] (Giraffic)
S2 HOSTS Anti-PUPs; C:\Program Files\Hosts_Anti_Adwares_PUPs\HOSTS_Anti-Adware.exe [285795 2013-10-07] () [File not signed]
R2 IMFservice; C:\Program Files\IObit\IObit Malware Fighter\IMFsrv.exe [342336 2014-05-15] (IObit)
S2 LiveUpdateSvc; C:\Program Files\IObit\LiveUpdate\LiveUpdate.exe [2152736 2014-05-04] (IObit)
R2 MDM; C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe [335872 2006-10-26] (Microsoft Corporation) [File not signed]
R2 MsMpSvc; C:\Program Files\Microsoft Security Client\MsMpEng.exe [22192 2014-08-22] (Microsoft Corporation)
R3 NisSrv; C:\Program Files\Microsoft Security Client\NisSrv.exe [288120 2014-08-22] (Microsoft Corporation)
R2 SDScannerService; D:\Program Files\1AntiVandals\Spybot - Search & Destroy 2\SDFSSvc.exe [1817560 2013-05-16] (Safer-Networking Ltd.)
R2 SDUpdateService; D:\Program Files\1AntiVandals\Spybot - Search & Destroy 2\SDUpdSvc.exe [1033688 2013-05-16] (Safer-Networking Ltd.)
R2 SDWSCService; D:\Program Files\1AntiVandals\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2013-05-15] (Safer-Networking Ltd.)
R2 Secunia PSI Agent; C:\Program Files\Secunia\PSI\PSIA.exe [1228504 2013-07-03] (Secunia)
R2 Secunia Update Agent; C:\Program Files\Secunia\PSI\sua.exe [660184 2013-07-03] (Secunia)
S2 ShadowProtectSvc; D:\Program Files\1Maint\StorageCraft\ShadowProtectSvc.exe [4672336 2014-10-12] (StorageCraft Technology Corporation)
R2 TemproMonitoringService; D:\Program Files\1Maint\Toshiba TEMPRO\TemproSvc.exe [112080 2011-02-10] (Toshiba Europe GmbH)
R2 TNaviSrv; D:\Program Files\TOSHIBA\TOSHIBA DVD PLAYER\TNaviSrv.exe [83312 2008-07-18] (TOSHIBA Corporation)
R2 VSNAPVSS; D:\Program Files\1Maint\StorageCraft\vsnapvss.exe [71976 2014-10-12] (StorageCraft Technology Corporation)
S2 HPSLPSVC; C:\Users\Yaakov Laks\AppData\Local\Temp\7zS669C\hpslpsvc32.dll [X]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R1 Amfilter; C:\Windows\System32\DRIVERS\Amfilter.sys [8704 2009-08-27] (A4Tech Co.,Ltd.) [File not signed]
S3 Amusbprt; C:\Windows\System32\DRIVERS\Amusbprt.sys [14336 2009-08-27] (A4Tech Co.,Ltd.) [File not signed]
R3 athr; C:\Windows\System32\DRIVERS\athr.sys [3234304 2014-07-22] (Qualcomm Atheros Communications, Inc.)
S3 BroadcomWModem; C:\Windows\System32\DRIVERS\bcmww.sys [118400 2005-06-02] (Broadcom Corporation)
S3 BroadcomWWNIC; C:\Windows\System32\DRIVERS\bcmwwNet.sys [58496 2005-02-09] (Broadcom Corporation)
R3 FileMonitor; C:\Program Files\IObit\IObit Malware Fighter\Drivers\win7_x86\FileMonitor.sys [21480 2013-03-23] (IObit)
R0 giveio; C:\Windows\System32\giveio.sys [5248 1996-04-03] () [File not signed]
S3 IT9135BDA; C:\Windows\System32\Drivers\IT9135BDA.sys [123008 2010-12-19] (ITE )
R3 KeyScrambler; C:\Windows\System32\drivers\keyscrambler.sys [209016 2013-05-31] (QFX Software Corporation)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [231800 2014-07-17] (Microsoft Corporation)
R1 MpKsl9f7ce270; C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{D1944752-903C-491D-9CA1-06DD0B9B8497}\MpKsl9f7ce270.sys [39464 2014-10-13] (Microsoft Corporation)
R2 PfFilter; C:\Program Files\IObit\Protected Folder\pffilter.sys [34336 2013-04-03] (IObit Information Technology)
S3 PSI; C:\Windows\System32\DRIVERS\psi_mf_x86.sys [16024 2013-07-03] (Secunia)
R3 RegFilter; C:\Program Files\IObit\IObit Malware Fighter\drivers\win7_x86\regfilter.sys [32288 2013-11-19] (IObit.com)
S3 RTHDMIAzAudService; C:\Windows\System32\drivers\RtHDMIV.sys [141408 2008-02-27] (Realtek Semiconductor Corp.)
R3 rusb3hub; C:\Windows\System32\DRIVERS\rusb3hub.sys [91016 2012-08-27] (Renesas Electronics Corporation)
R3 rusb3xhc; C:\Windows\System32\DRIVERS\rusb3xhc.sys [181128 2012-08-27] (Renesas Electronics Corporation)
R0 SmartDefragDriver; C:\Windows\System32\Drivers\SmartDefragDriver.sys [18624 2014-06-04] (IObit)
R3 SmbDrvI; C:\Windows\System32\DRIVERS\Smb_driver_Intel.sys [27888 2014-01-26] (Synaptics Incorporated)
R0 speedfan; C:\Windows\System32\speedfan.sys [24184 2012-12-29] (Almico Software)
S3 SWDUMon; C:\Windows\System32\DRIVERS\SWDUMon.sys [13464 2014-08-13] ()
R3 UrlFilter; C:\Program Files\IObit\IObit Malware Fighter\drivers\win7_x86\UrlFilter.sys [20944 2013-11-19] (IObit.com)
R3 UVCFTR; C:\Windows\System32\Drivers\UVCFTR_S.SYS [17960 2009-04-10] (Chicony Electronics Co., Ltd.)
U3 aswMBR; \??\C:\Users\YAAKOV~1\AppData\Local\Temp\aswMBR.sys [X]
U3 aswVmm; \??\C:\Users\YAAKOV~1\AppData\Local\Temp\aswVmm.sys [X]

==================== NetSvcs (Whitelisted) ===================


(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-10-13 13:20 - 2014-10-13 13:21 - 00000000 ___DC () C:\FRST
2014-10-13 13:17 - 2014-10-13 13:17 - 00000582 ____C () C:\Users\Yaakov Laks\Desktop\aswMBR.txt
2014-10-13 12:54 - 2014-10-13 12:54 - 00000000 ___DC () C:\Users\Yaakov Laks\Desktop\RegBackup
2014-10-13 12:53 - 2014-10-13 12:53 - 00000207 ____C () C:\Windows\tweaking.com-regbackup-LAPTOSH-PC-Microsoft-Windows-7-Home-Premium-(32-bit).dat
2014-10-13 12:52 - 2014-10-13 12:52 - 00000000 ___DC () C:\RegBackup
2014-10-13 12:51 - 2014-10-13 12:51 - 00001002 ____C () C:\Users\Public\Desktop\Tweaking.com - Registry Backup.lnk
2014-10-13 12:51 - 2014-10-13 12:51 - 00000000 ___DC () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Tweaking.com
2014-10-12 18:56 - 2014-10-12 18:56 - 00123160 ____C () C:\Users\Yaakov Laks\AppData\Local\GDIPFONTCACHEV1.DAT
2014-10-12 18:55 - 2014-10-12 19:33 - 00000112 ____C () C:\Windows\setupact.log
2014-10-12 18:55 - 2014-10-12 18:55 - 00000000 ____C () C:\Windows\setuperr.log
2014-10-12 18:54 - 2014-10-12 18:55 - 00442096 ____C () C:\Windows\system32\FNTCACHE.DAT
2014-10-12 01:56 - 2014-10-12 01:56 - 00004096 ___SH () C:\VSM000.IDX
2014-10-12 01:45 - 2014-10-12 01:53 - 00000000 ___DC () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StorageCraft
2014-10-11 17:43 - 2014-10-11 18:38 - 00000000 ___DC () C:\Users\Yaakov Laks\Desktop\spybot
2014-10-10 23:29 - 2014-10-10 23:30 - 14349744 ____C (Malwarebytes Corp.) C:\Users\Yaakov Laks\Downloads\mbar-1.07.0.1012.exe
2014-10-10 12:18 - 2014-10-10 12:18 - 00000528 ____C () C:\Users\Yaakov Laks\Desktop\תת עריכה עד 2-1-14.txt
2014-10-09 13:01 - 2014-10-09 13:01 - 00000000 ___HC () C:\Users\Yaakov Laks\Documents\Default.rdp
2014-10-08 18:12 - 2014-10-12 00:03 - 00000000 ___DC () C:\Users\Yaakov Laks\Desktop\מסמך טיוטת מדיניות 201308
2014-10-07 02:19 - 2014-10-07 02:22 - 00020254 ____C () C:\Users\Yaakov Laks\Desktop\גיבוי של בגצ 6396-96.wbk
2014-10-06 22:35 - 2014-10-06 22:35 - 00044932 ____C () C:\Users\Yaakov Laks\Desktop\הנחייה להוריד שלט מחאה.tif
2014-10-06 21:17 - 2014-10-06 21:17 - 00000841 ____C () C:\Users\Yaakov Laks\Desktop\אילתי בפייס.URL
2014-10-06 17:06 - 2014-10-06 17:06 - 00895120 ____C (Google Inc.) C:\Users\Yaakov Laks\Downloads\GoogleEarthSetup(1).exe
2014-10-06 11:22 - 2014-10-06 11:22 - 00895120 ____C (Google Inc.) C:\Users\Yaakov Laks\Downloads\GoogleEarthSetup.exe
2014-10-03 09:03 - 2014-10-03 09:04 - 00000000 ___DC () C:\Users\Yaakov Laks\Desktop\תמונות למיון
2014-10-03 01:45 - 2014-10-03 12:45 - 00000000 ___DC () C:\Program Files\Tbccint
2014-10-03 01:45 - 2014-10-03 01:45 - 00000000 ___DC () C:\ProgramData\Tbccint
2014-10-03 01:44 - 2014-10-03 01:44 - 00000000 ___DC () C:\Users\Yaakov Laks\AppData\Local\TB
2014-10-03 01:44 - 2014-10-03 01:44 - 00000000 ___DC () C:\Users\Yaakov Laks\AppData\Local\NativeMessaging
2014-10-03 01:43 - 2014-10-03 12:45 - 00000000 ___DC () C:\Users\Yaakov Laks\AppData\Local\tbccint
2014-10-03 01:43 - 2014-10-03 01:43 - 00000000 ___DC () C:\Users\Yaakov Laks\AppData\Local\CRE
2014-10-01 09:39 - 2014-10-01 09:45 - 00519680 _____ (Microsoft Corporation) C:\Windows\system32\qdvd.dll
2014-09-30 01:17 - 2014-09-30 01:18 - 04965896 ____C (Piriform Ltd) C:\Users\Yaakov Laks\Downloads\ccsetup418(1).exe
2014-09-30 01:17 - 2014-09-30 01:17 - 04965896 ____C (Piriform Ltd) C:\Users\Yaakov Laks\Downloads\ccsetup418.exe
2014-09-25 18:41 - 2014-09-25 18:41 - 01626568 ____C () C:\Users\Yaakov Laks\Downloads\setup_Pixum_Fotoboek.exe
2014-09-24 19:44 - 2014-09-25 00:03 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2014-09-23 18:59 - 2014-09-23 18:59 - 00000000 ___DC () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2014-09-23 18:59 - 2014-09-23 18:59 - 00000000 ___DC () C:\Program Files\Common Files\Skype
2014-09-22 23:00 - 2014-09-22 23:00 - 00718552 ____C (Realtek ) C:\Windows\system32\Drivers\Rt86win7.sys
2014-09-22 23:00 - 2014-09-22 23:00 - 00076872 ____C (Realtek Semiconductor Corporation) C:\Windows\system32\RtNicProp32.dll
2014-09-22 22:49 - 2014-09-22 22:49 - 00001064 ____C () C:\Users\Public\Desktop\Driver Booster.lnk

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-10-13 12:58 - 2014-03-13 17:44 - 00000000 ___DC () C:\Program Files\Giraffic
2014-10-13 12:44 - 2013-08-29 09:28 - 00000926 ____C () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-10-13 12:42 - 2014-01-26 00:44 - 00000830 ____C () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-10-13 12:00 - 2014-03-13 17:44 - 00000000 ___DC () C:\ProgramData\Giraffic
2014-10-13 11:54 - 2014-06-01 23:20 - 01942688 ____C () C:\Windows\WindowsUpdate.log
2014-10-13 11:54 - 2009-07-14 05:37 - 00000000 ___DC () C:\Windows\system32\NDF
2014-10-13 10:20 - 2013-08-25 17:32 - 00000000 ___DC () C:\Users\Yaakov Laks\AppData\Roaming\MailWasherPro
2014-10-13 06:57 - 2013-08-29 09:28 - 00000922 ____C () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-10-12 23:00 - 2009-07-14 05:37 - 00000000 ___DC () C:\Windows\system32\LogFiles
2014-10-12 20:47 - 2013-08-23 16:41 - 00782470 ____C () C:\Windows\system32\PerfStringBackup.INI
2014-10-12 19:14 - 2013-08-23 18:08 - 00000000 ___DC () C:\Users\Yaakov Laks\AppData\Roaming\Skype
2014-10-12 19:05 - 2009-07-14 07:34 - 00014832 ___HC () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-10-12 19:05 - 2009-07-14 07:34 - 00014832 ___HC () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-10-12 18:55 - 2009-07-14 07:53 - 00000006 ___HC () C:\Windows\Tasks\SA.DAT
2014-10-12 01:59 - 2013-11-05 08:40 - 00000000 ___DC () C:\ProgramData\ProductData
2014-10-12 01:53 - 2014-09-07 02:15 - 00102824 ____C (StorageCraft Technology Corporation) C:\Windows\system32\Drivers\sbmount.sys
2014-10-12 00:22 - 2013-09-07 08:06 - 00000000 ___DC () C:\Users\Yaakov Laks\AppData\Roaming\Notepad++
2014-10-11 05:22 - 2013-08-31 13:37 - 00000000 ___DC () C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2014-10-10 23:33 - 2014-03-29 02:28 - 00113880 ____C (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-10-10 00:48 - 2014-08-16 07:29 - 00000000 ___DC () C:\Users\Yaakov Laks\AppData\Local\Adobe
2014-10-10 00:47 - 2013-12-04 06:33 - 00701104 ____C (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2014-10-10 00:47 - 2013-12-04 06:33 - 00071344 ____C (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2014-10-09 17:52 - 2009-07-14 05:37 - 00000000 ___DC () C:\Windows\Microsoft.NET
2014-10-09 13:29 - 2014-03-20 16:06 - 00000000 ___DC () C:\Users\Yaakov Laks\.gimp-2.8
2014-10-09 13:02 - 2014-04-21 10:18 - 00001259 ____C () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Movie Maker.lnk
2014-10-09 13:02 - 2014-04-21 10:18 - 00000000 __RDC () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live
2014-10-09 13:02 - 2013-08-24 02:55 - 00001328 ____C () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Photo Gallery.lnk
2014-10-09 13:00 - 2013-08-24 02:55 - 00001412 ____C () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live Mail.lnk
2014-10-09 01:18 - 2013-08-24 04:21 - 00000000 ___DC () C:\Users\Yaakov Laks\Desktop\111פוספטים
2014-10-07 22:40 - 2013-09-08 09:39 - 00000000 ___DC () C:\Users\Yaakov Laks\AppData\Roaming\Audacity
2014-10-07 22:40 - 2013-08-24 02:15 - 00000000 ___DC () C:\Users\Yaakov Laks\AppData\Roaming\vlc
2014-10-07 16:04 - 2013-08-24 04:21 - 00000000 ___DC () C:\Users\Yaakov Laks\Desktop\111עבודה שחורה
2014-10-06 11:21 - 2013-12-03 11:17 - 00044569 ____C () C:\Users\Yaakov Laks\Desktop\קליאו.xlsx
2014-09-27 10:58 - 2013-08-24 05:45 - 00000000 ___DC () C:\Users\Yaakov Laks\Desktop\11מפלגת העבודה
2014-09-26 19:34 - 2013-08-26 23:40 - 00000000 ___DC () C:\Windows\rescache
2014-09-24 08:25 - 2013-08-27 19:47 - 00002441 ____C () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2014-09-23 19:01 - 2013-08-23 18:08 - 00000000 __RDC () C:\Program Files\Skype
2014-09-23 18:59 - 2013-08-23 18:08 - 00000000 ___DC () C:\ProgramData\Skype
2014-09-22 23:00 - 2011-06-10 06:34 - 00100896 ____C (Realtek Semiconductor Corporation) C:\Windows\system32\RTNUninst32.dll
2014-09-22 22:49 - 2014-09-06 08:19 - 00000000 ___DC () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Driver Booster
2014-09-22 09:41 - 2013-08-23 17:14 - 00231568 ____C (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe

Some content of TEMP:
====================
C:\Users\Yaakov Laks\AppData\Local\Temp\NOSEventMessages.dll


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-10-12 04:50

==================== End Of Log ============================




Additional scan result of Farbar Recovery Scan Tool (x86) Version: 12-10-2014 01
Ran by Yaakov Laks at 2014-10-13 13:22:27
Running from E:\F\Downloads\DLSoftware 15\SpyBot
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Microsoft Security Essentials (Enabled - Up to date) {4F35CFC4-45A3-FC37-EF17-759A02E39AB1}
AS: Microsoft Security Essentials (Enabled - Up to date) {F4542E20-6399-F3B9-D5A7-4EE87964D00C}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Spybot - Search and Destroy (Enabled - Up to date) {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}
AS: IObit Malware Fighter (Enabled - Up to date) {A751AC20-3B48-5237-898A-78C4436BB78D}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

2007 Microsoft Office Suite Service Pack 3 (SP3) (HKLM\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version: - Microsoft)
2007 Microsoft Office Suite Service Pack 3 (SP3) (Version: - Microsoft) Hidden
7-Zip 9.20 (HKLM\...\7-Zip) (Version: - )
Adobe AIR (HKLM\...\Adobe AIR) (Version: 3.8.0.1430 - Adobe Systems Incorporated)
Adobe AIR (Version: 3.8.0.1430 - Adobe Systems Incorporated) Hidden
Adobe Flash Player 15 Plugin (HKLM\...\Adobe Flash Player Plugin) (Version: 15.0.0.152 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.09) MUI (HKLM\...\{AC76BA86-7AD7-FFFF-7B44-AB0000000001}) (Version: 11.0.09 - Adobe Systems Incorporated)
Adobe Shockwave Player 12.1 (HKLM\...\Adobe Shockwave Player) (Version: 12.1.3.153 - Adobe Systems, Inc.)
Advanced SystemCare 7 (HKLM\...\Advanced SystemCare 7_is1) (Version: 7.3.1 - IObit)
Akamai NetSession Interface (HKCU\...\Akamai) (Version: - Akamai Technologies, Inc)
Alcor Micro USB Card Reader (HKLM\...\AmUStor) (Version: 3.9.145.62246 - Alcor Micro Corp.)
Alcor Micro USB Card Reader (Version: 3.9.145.62246 - Alcor Micro Corp.) Hidden
Application Verifier (HKLM\...\{39556553-8C77-4C5E-8F30-4083274948A2}) (Version: 4.1.1078 - Microsoft Corporation)
Atheros Driver Installation Program (HKLM\...\{C3A32068-8AB1-4327-BB16-BED9C6219DC7}) (Version: 9.2 - Atheros)
Audacity 2.0.5 (HKLM\...\Audacity_is1) (Version: 2.0.5 - Audacity Team)
Belarc Advisor 8.1 (HKLM\...\Belarc Advisor) (Version: - )
Bing Maps 3D (HKLM\...\{2D87E961-577B-492B-AD54-1368680FB9A7}) (Version: 4.0.903.16005 - Microsoft Corporation)
BlazeDTV 6.0 (HKLM\...\BlazeDTV 6.0_is1) (Version: - )
calibre (HKLM\...\{A2A971DE-C864-4CF0-8FCA-FF7F569D8476}) (Version: 1.43.0 - Kovid Goyal)
Camera Assistant Software for Toshiba (HKLM\...\{37C866E4-AA67-4725-9E95-A39968DD7960}) (Version: 1.7.260.0526L - Chicony Electronics Co.,Ltd.)
CCleaner (HKLM\...\CCleaner) (Version: 4.18 - Piriform)
CrystalDiskInfo 6.0.1 Shizuku Edition (HKLM\...\CrystalDiskInfo_is1) (Version: 6.0.1 - Crystal Dew World)
D3DX10 (Version: 15.4.2368.0902 - Microsoft) Hidden
Debugging Tools for Windows (x86) (HKLM\...\{D09605BE-5587-4B0C-86C8-69B5092CB80F}) (Version: 6.12.2.633 - Microsoft Corporation)
Driver Booster (HKLM\...\Driver Booster_is1) (Version: 1.5 - IObit)
FileHippo.com Update Checker (HKLM\...\FileHippo.com) (Version: - )
Folder Size for Windows (HKLM\...\{FC8D21C8-7B29-4104-ADB0-FEE9CA1C7922}) (Version: 2.5 - Brio)
Folder Size Shell Extension v3.2 (HKLM\...\FolderSizePropertyPage) (Version: - )
GIMP 2.8.10 (HKLM\...\GIMP-2_is1) (Version: 2.8.10 - The GIMP Team)
Giraffic Video Accelerator (HKLM\...\Giraffic) (Version: 0.86.412.230 - Giraffic)
Google Chrome (HKLM\...\Google Chrome) (Version: 40.0.2182.3 - Google Inc.)
Google Drive (HKLM\...\{C6640705-7479-4EE5-BC86-879F05F65E74}) (Version: 1.17.7290.4094 - Google, Inc.)
Google Earth (HKLM\...\{4D2A6330-2F8B-11E3-9C40-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)
Google Update Helper (Version: 1.3.24.15 - Google Inc.) Hidden
HP Deskjet 2050 J510 series Basic Device Software (HKLM\...\{90BBACD9-526F-4AD5-8B92-80BB5F5E1A6D}) (Version: 28.0.1313.0 - Hewlett-Packard Co.)
HP Deskjet 2050 J510 series Help (HKLM\...\{7A3DF2E2-CF13-44FB-A93E-F71D5381DB3F}) (Version: 140.0.61.61 - Hewlett Packard)
HP Deskjet 2050 J510 series Product Improvement Study (HKLM\...\{B97BD710-382C-453D-B23C-C0663C6EDFA2}) (Version: 28.0.1313.0 - Hewlett-Packard Co.)
HP Update (HKLM\...\{6F1C00D2-25C2-4CBA-8126-AE9A6E2E9CD5}) (Version: 5.003.003.001 - Hewlett-Packard)
HPDiagnosticAlert (Version: 1.00.0000 - Microsoft) Hidden
Intel(R) Graphics Media Accelerator Driver (HKLM\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 8.15.10.2869 - Intel Corporation)
IObit Apps Toolbar v9.0 (HKLM\...\{48C13178-64E2-4964-9927-B71A04074D08}) (Version: 9.0 - Spigot, Inc.) <==== ATTENTION
IObit Malware Fighter (HKLM\...\IObit Malware Fighter_is1) (Version: 2.4 - IObit)
IObit Uninstaller (HKLM\...\IObitUninstall) (Version: 3.2.10.2466 - IObit)
IrfanView (remove only) (HKLM\...\IrfanView) (Version: 4.37 - Irfan Skiljan)
ISO Opener (HKLM\...\{CE235F00-F8CD-41AF-83D5-236D90E33BFB}_is1) (Version: - www.isoopener.com)
Java 7 Update 67 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83217051FF}) (Version: 7.0.670 - Oracle)
Java Auto Updater (Version: 2.1.67.1 - Oracle, Inc.) Hidden
Junk Mail filter update (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
jv16 PowerTools 2014 (HKLM\...\jv16 PowerTools 2014) (Version: - Macecraft Software)
KeyScrambler (HKLM\...\KeyScrambler) (Version: 3.2.0.3 - QFX Software Corporation)
LAME v3.99.3 (for Windows) (HKLM\...\LAME_is1) (Version: - )
LSI V92 MOH Application (HKLM\...\LTMOH) (Version: - LSI Corporation)
MailWasher Pro (HKLM\...\MailWasher Pro_is1) (Version: - FireTrust Limited)
Malwarebytes Anti-Malware version 2.0.2.1012 (HKLM\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.2.1012 - Malwarebytes Corporation)
MC FolderSize (Uninstall Only) (HKLM\...\MC FolderSize) (Version: - )
Microsoft .NET Framework 4 Multi-Targeting Pack (HKLM\...\{CFEF48A8-BFB8-3EAC-8BA5-DE4F8AA267CE}) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6012.5000 - Microsoft Corporation) Hidden
Microsoft Calculator Plus (HKLM\...\{83073C45-3003-4671-9A86-243AAADD915A}) (Version: 1.0.0 - Microsoft)
Microsoft Help Viewer 1.1 (HKLM\...\Microsoft Help Viewer 1.1) (Version: 1.1.40219 - Microsoft Corporation)
Microsoft Help Viewer 1.1 (Version: 1.1.40219 - Microsoft Corporation) Hidden
Microsoft Office Access MUI (Hebrew) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Enterprise 2007 (HKLM\...\ENTERPRISE) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Enterprise 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Excel MUI (Hebrew) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office File Validation Add-In (HKLM\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Groove MUI (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Groove Setup Metadata MUI (Hebrew) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office InfoPath MUI (Hebrew) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office OneNote MUI (Hebrew) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Outlook Connector (HKLM\...\{95140000-007A-0409-0000-0000000FF1CE}) (Version: 14.0.5118.5000 - Microsoft Corporation)
Microsoft Office Outlook MUI (Hebrew) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (Hebrew) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Arabic) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Hebrew) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Russian) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (Hebrew) 2007 (Version: 12.0.4518.1016 - Microsoft Corporation) Hidden
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) (Version: - Microsoft) Hidden
Microsoft Office Publisher MUI (Hebrew) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (Hebrew) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (Hebrew) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Security Client (Version: 4.6.0305.0 - Microsoft Corporation) Hidden
Microsoft Security Essentials (HKLM\...\Microsoft Security Client) (Version: 4.6.305.0 - Microsoft Corporation)
Microsoft Security Intelligence Report, Volume 14 (HKLM\...\{5794644E-FD67-417A-9792-034FC1D8BF6E}) (Version: 1.00.0000 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft SQL Server 2008 Setup Support Files (HKLM\...\{D441BD04-E548-4F8E-97A4-1B66135BAAA8}) (Version: 10.1.2731.0 - Microsoft Corporation)
Microsoft SQL Server Compact 3.5 SP2 ENU (HKLM\...\{3A9FC03D-C685-4831-94CF-4EDFD3749497}) (Version: 3.5.8080.0 - Microsoft Corporation)
Microsoft Visual C++ Compilers 2010 Standard - enu - x86 (Version: 10.0.40219 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Runtime - 10.0.40219 (HKLM\...\{5D9ED403-94DE-3BA0-B1D6-71F4BDA412E6}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 Express - ENU (HKLM\...\Microsoft Visual C++ 2010 Express - ENU) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 Express - ENU (Version: 10.0.40219 - Microsoft Corporation) Hidden
Microsoft Visual Studio 2010 Service Pack 1 (HKLM\...\Microsoft Visual Studio 2010 Service Pack 1) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual Studio 2010 Service Pack 1 (Version: 10.0.40219 - Microsoft Corporation) Hidden
Microsoft Visual Studio 2010 Tools for Office Runtime (x86) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x86)) (Version: 10.0.50701 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x86) (Version: 10.0.50706 - Microsoft Corporation) Hidden
Microsoft Windows Performance Toolkit (HKLM\...\{E7F9E526-2324-437B-A609-E8C5309465CB}) (Version: 4.8.0 - Microsoft Corporation)
Microsoft Windows SDK for Windows 7 (7.1) (HKLM\...\SDKSetup_7.1.7600.0.30514) (Version: 7.1.7600.0.30514 - Microsoft Corporation)
Microsoft Windows SDK for Windows 7 (7.1) (Version: 7.1.30514 - Microsoft Corporation) Hidden
Microsoft Windows SDK Intellisense and Reference Assemblies (30514) (Version: 7.1.30514 - Microsoft Corporation) Hidden
Microsoft Windows SDK MSHelp (30514) (Version: 7.1.30514 - Microsoft Corporation) Hidden
Microsoft_VC100_CRT_SP1_x86 (Version: 10.0.40219.1 - Nokia) Hidden
Movie Maker (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Mozilla Firefox 23.0.1 (x86 en-US) (HKLM\...\Mozilla Firefox 23.0.1 (x86 en-US)) (Version: 23.0.1 - Mozilla)
Mozilla Firefox 32.0.3 (x86 en-US) (HKCU\...\Mozilla Firefox 32.0.3 (x86 en-US)) (Version: 32.0.3 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 23.0.1 - Mozilla)
MSVC80_x86_v2 (Version: 1.0.3.0 - Nokia) Hidden
MSVC90_x86 (Version: 1.0.1.2 - Nokia) Hidden
MSVCRT (Version: 15.4.2862.0708 - Microsoft) Hidden
MSVCRT110 (Version: 16.4.1108.0727 - Microsoft) Hidden
MSXML 4.0 SP2 (KB954430) (HKLM\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (HKLM\...\{196467F1-C11F-4F76-858B-5812ADC83B94}) (Version: 4.30.2100.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB2758694) (HKLM\...\{1D95BA90-F4F8-47EC-A882-441C99D30C1E}) (Version: 4.30.2117.0 - Microsoft Corporation)
Nokia Connectivity Cable Driver (HKLM\...\{29373274-977E-413C-A4DE-DC0F8E80C429}) (Version: 7.1.172.0 - Nokia)
Nokia Suite (HKLM\...\Nokia Suite) (Version: 3.8.48.0 - Nokia)
Nokia Suite (Version: 3.8.48.0 - Nokia) Hidden
Notepad++ (HKLM\...\Notepad++) (Version: 6.6.9 - Notepad++ Team)
Office Shuttle Software (HKLM\...\InstallShield_{3F87539C-BD1B-4529-8F13-8B3599A51D6C}) (Version: 12.05.0004 - A4TECH)
Office Shuttle Software (Version: 12.05.0004 - A4TECH) Hidden
OpenWith (Enhanced) (HKLM\...\OpenWith Enhanced) (Version: 1.15 - Greg Frieger)
PC Connectivity Solution (HKLM\...\{6D01D1B1-17BD-4F10-BB11-F08F0C47D42B}) (Version: 12.0.109.0 - Nokia)
PDF Split And Merge Enhanced (HKLM\...\{126B830E-16E7-11E2-B42B-92326288709B}) (Version: 2.2.2 - Andrea Vacondio)
Photo Gallery (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Protected Folder (HKLM\...\Protected Folder_is1) (Version: - IObit)
Realtek Card Reader (HKLM\...\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}) (Version: 6.2.9200.29070 - Realtek Semiconductor Corp.)
Realtek High Definition Audio Driver (HKLM\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7246 - Realtek Semiconductor Corp.)
RICOH_Media_Driver_v2.14.18.01 (HKLM\...\{FE041B02-234C-4AAA-9511-80DF6482A458}) (Version: 2.14.18.01 - RICOH)
Secunia PSI (3.0.0.7011) (HKLM\...\Secunia PSI) (Version: 3.0.0.7011 - Secunia)
Shark007 Advanced Codecs (HKLM\...\{8C0CAA7A-3272-4991-A808-2C7559DE3409}) (Version: 4.2.3 - Shark007)
Skype Click to Call (HKLM\...\{6D1221A9-17BF-4EC0-81F2-27D30EC30701}) (Version: 7.3.16540.9015 - Microsoft Corporation)
Skype™ 6.20 (HKLM\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 6.20.104 - Skype Technologies S.A.)
SlimDrivers (HKLM\...\{A5457401-D56A-43F2-9524-78E54A7FC07A}) (Version: 2.2.32705 - SlimWare Utilities, Inc.)
Smart Defrag 3 (HKLM\...\Smart Defrag 3_is1) (Version: 3.2 - IObit)
SpeedFan (remove only) (HKLM\...\SpeedFan) (Version: - )
Spybot - Search & Destroy (HKLM\...\{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1) (Version: 2.1.21 - Safer-Networking Ltd.)
StorageCraft ShadowProtect (HKLM\...\ShadowProtect) (Version: 4.2.7.19756 - StorageCraft Technology Corporation (STC))
Surfing Protection (HKLM\...\IObit Surfing Protection_is1) (Version: 1.0 - IObit)
swMSM (Version: 12.0.0.1 - Adobe Systems, Inc) Hidden
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 11.2.4.0 - Synaptics)
System Requirements Lab for Intel (HKLM\...\{C7CA731B-BF9A-46D9-92CF-8A8737AE9240}) (Version: 4.5.13.0 - Husdawg, LLC)
TOSHIBA Assist (HKLM\...\{12B3A009-A080-4619-9A2A-C6DB151D8D67}) (Version: 2.01.11 - TOSHIBA)
TOSHIBA DVD PLAYER (HKLM\...\{6C5F3BDC-0A1B-4436-A696-5939629D5C31}) (Version: 1.31.14 - TOSHIBA Corporation)
TOSHIBA Manuals (HKLM\...\{E7271ABF-69D3-4E9D-AA0A-2DE34C10A93D}) (Version: 7.40 - TOSHIBA)
TOSHIBA Software Modem (HKLM\...\TOSHIBA Software Modem) (Version: 2.2.97 - LSI Corporation)
TOSHIBA Supervisor Password (HKLM\...\{401879D1-AC26-43CD-BDDE-E0D5D5608083}) (Version: 2.00.03PLV - )
TOSHIBA TEMPRO (HKLM\...\{F082CB11-4794-4259-99A1-D91BA762AD15}) (Version: 3.35 - Toshiba Europe GmbH)
TreeSize Free V3.0.1 (HKLM\...\TreeSize Free_is1) (Version: 3.0.1 - JAM Software)
Tweak UI Control Panel entry (HKLM\...\Tweak UI Control Panel entry_is1) (Version: - Ruby Software)
Tweaking.com - Registry Backup (HKLM\...\Tweaking.com - Registry Backup) (Version: 1.10.0 - Tweaking.com)
Update for 2007 Microsoft Office System (KB967642) (HKLM\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version: - Microsoft)
Update for Microsoft Office 2007 Help for Common Features (KB963673) (HKLM\...\{90120000-006E-0409-0000-0000000FF1CE}_ENTERPRISE_{AB365889-0395-4FAD-B702-CA5985D53D42}) (Version: - Microsoft)
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition (HKLM\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{A024FC7B-77DE-45DE-A058-1C049A17BFB3}) (Version: - Microsoft)
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (HKLM\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{CB68A5B0-3508-4193-AEB9-AF636DAECE0F}) (Version: - Microsoft)
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition (HKLM\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{E9A82945-BA29-4EE8-8F2A-2F49545E9CF2}) (Version: - Microsoft)
Update for Microsoft Office Outlook 2007 (KB2687404) 32-Bit Edition (HKLM\...\{90120000-001A-040D-0000-0000000FF1CE}_ENTERPRISE_{F70AA73C-2F85-4B32-A765-6EFA08F9C3D2}) (Version: - Microsoft)
Update for Microsoft Office Outlook 2007 (KB2863811) 32-Bit Edition (HKLM\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{53DEC068-4690-4F6B-9946-7D21EF02236B}) (Version: - Microsoft)
Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2889914) 32-Bit Edition (HKLM\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{F3F83933-75FC-4B60-84F2-3F8FA63D042E}) (Version: - Microsoft)
Update for Microsoft Office Script Editor Help (KB963671) (HKLM\...\{90120000-006E-0409-0000-0000000FF1CE}_ENTERPRISE_{CD11C6A2-FFC6-4271-8EAB-79C3582F505C}) (Version: - Microsoft)
VLC media player (HKLM\...\VLC media player) (Version: 2.1.5 - VideoLAN)
Windows Driver Package - Chicony (usbvideo) Image (05/12/2009 6.3.251.0512) (HKLM\...\84BA15BD1DFEAA8A233F801B29BDC48DEE17B71F) (Version: 05/12/2009 6.3.251.0512 - Chicony)
Windows Driver Package - Nokia pccsmcfd “LegacyDriver” (05/31/2012 7.1.2.0) (HKLM\...\17D063A0A9F5D5A225B76B1D9BCB5ADBE85C8382) (Version: 05/31/2012 7.1.2.0 - Nokia)
Windows Live Communications Platform (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Windows Live Essentials (HKLM\...\WinLiveSuite) (Version: 16.4.3528.0331 - Microsoft Corporation)
Windows Live Essentials (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Windows Live ID Sign-in Assistant (Version: 7.250.4311.0 - Microsoft Corporation) Hidden
Windows Live Installer (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Windows Live Mail (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Windows Live MIME IFilter (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Windows Live Photo Common (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Windows Live PIMT Platform (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Windows Live SOXE (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Windows Live SOXE Definitions (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Windows Live UX Platform (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Windows Live UX Platform Language Pack (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Windows Live Writer (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Windows Live Writer Resources (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Windows Media Player Firefox Plugin (HKLM\...\{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}) (Version: 1.0.0.8 - Microsoft Corp)
Windows Movie Maker 6.1 (HKLM\...\{3CC29C1A-B5FE-457B-8F22-32A2557A92C7}}_is1) (Version: - windows-movie-maker.org)
YoutubeMovieMaker (HKLM\...\{E084C471-FA8F-4468-93F1-25B3A13ED942}) (Version: 8.06 - Youtube Movie Maker)
עדכון עבור מסנן דואר הזבל של Microsoft Office Excel 2007 Help (KB963678) (HKLM\...\{90120000-0016-040D-0000-0000000FF1CE}_ENTERPRISE_{18E2D7BF-CC18-4CE8-B875-D2934B6086E2}) (Version: - Microsoft)
עדכון עבור מסנן דואר הזבל של Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM\...\{90120000-0018-040D-0000-0000000FF1CE}_ENTERPRISE_{54B50AC9-2088-4F43-B39A-0F10F53D425E}) (Version: - Microsoft)
עדכון עבור מסנן דואר הזבל של Microsoft Office Word 2007 Help (KB963665) (HKLM\...\{90120000-001B-040D-0000-0000000FF1CE}_ENTERPRISE_{CAB664CE-BBA4-4A81-A358-6CC6F7852FC9}) (Version: - Microsoft)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-2920106312-904050420-1618604034-1001_Classes\CLSID\{1BBF13E0-551E-42DD-91F4-1A547443FFDA}\InprocServer32 -> C:\Users\Yaakov Laks\AppData\Local\Tbccint\Community Alerts\Alert.dll (ClientConnect Ltd.)

==================== Restore Points =========================

11-10-2014 00:01:49 Windows Backup
11-10-2014 22:46:00 Device Driver Package Install: StorageCraft Technology Corporation System devices
12-10-2014 00:01:01 Windows Backup
12-10-2014 16:15:51 Windows Update
13-10-2014 00:00:17 Windows Backup

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 05:04 - 2014-08-12 22:50 - 01174442 ___RC C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 www.007guard.com
127.0.0.1 007guard.com
127.0.0.1 008i.com
127.0.0.1 www.008k.com
127.0.0.1 008k.com
127.0.0.1 www.00hq.com
127.0.0.1 00hq.com
127.0.0.1 010402.com
127.0.0.1 www.032439.com
127.0.0.1 032439.com
127.0.0.1 www.0scan.com
127.0.0.1 0scan.com
127.0.0.1 1000gratisproben.com
127.0.0.1 www.1000gratisproben.com
127.0.0.1 1001namen.com
127.0.0.1 www.1001namen.com
127.0.0.1 100888290cs.com
127.0.0.1 www.100888290cs.com
127.0.0.1 www.100sexlinks.com
127.0.0.1 100sexlinks.com
127.0.0.1 10sek.com
127.0.0.1 www.10sek.com
127.0.0.1 www.1-2005-search.com
127.0.0.1 1-2005-search.com
127.0.0.1 123fporn.info
127.0.0.1 www.123fporn.info
127.0.0.1 123haustiereundmehr.com
127.0.0.1 www.123haustiereundmehr.com
127.0.0.1 123moviedownload.com

There are 1000 more lines.


==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {03F1B913-D13F-4AE5-8FF6-714690775E74} - System32\Tasks\SlimDrivers Startup => C:\Program Files\SlimDrivers\SlimDrivers.exe [2013-09-24] (SlimWare Utilities, Inc.)
Task: {0CCDCBA6-4CCB-4553-A909-96CDE0DB8D90} - System32\Tasks\CCleanerSkipUAC => D:\Program Files\1Maint\ccleaner\CCleaner.exe [2014-09-26] (Piriform Ltd)
Task: {1B9271CE-0D33-476E-B7B0-C2DF24C51C43} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2014-10-10] (Adobe Systems Incorporated)
Task: {1EDB03BF-68ED-4139-9EB5-8AB31E4C3E6E} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2013-08-29] (Google Inc.)
Task: {22E7CAFD-204F-4241-9690-CF391713F5A8} - System32\Tasks\SmartDefrag3_Update => C:\Program Files\IObit\Smart Defrag 3\AutoUpdate.exe [2014-07-03] (IObit)
Task: {6B9331CE-3BFB-4AAC-BA73-C32EFDF32301} - System32\Tasks\Driver Booster Update => C:\Program Files\IObit\Driver Booster\AutoUpdate.exe [2014-08-01] (IObit)
Task: {79EEBE41-0CE7-4645-8A55-B60342BF4D0F} - System32\Tasks\{D47934EB-E025-4F1D-BDC4-35EB3BEC74D1} => D:\Program Files\A4Tech\Mouse\DevInst.exe
Task: {7CB5BB1C-E39D-418D-88A1-225EE0A57758} - System32\Tasks\Driver Booster Scan => C:\Program Files\IObit\Driver Booster\Scheduler.exe [2014-08-01] (IObit)
Task: {7D5495B3-CDF7-403E-A44C-C268713F5E44} - System32\Tasks\HPCustParticipation HP Deskjet 2050 J510 series => C:\Program Files\HP\HP Deskjet 2050 J510 series\Bin\HPCustPartic.exe [2012-10-02] (Hewlett-Packard Co.)
Task: {91BED418-7ED6-4F46-A414-6861CF3B8AEA} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => Rundll32.exe /d sdengin2.dll,ExecuteScheduledBackup
Task: {93854466-00E7-4E7D-8F16-2A6F59186783} - System32\Tasks\Driver Booster SkipUAC (Yaakov Laks) => C:\Program Files\IObit\Driver Booster\DriverBooster.exe [2014-08-06] (IObit)
Task: {BAD370E6-0C9E-43E3-BA3C-7E15B5F7CAF3} - System32\Tasks\SmartDefrag3_Startup => C:\Program Files\IObit\Smart Defrag 3\SmartDefrag.exe [2014-07-02] (IObit)
Task: {D33DB28C-F9D4-4B8C-BD8E-28E27BB594A1} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2013-08-29] (Google Inc.)
Task: {D813746A-2799-4837-9DF2-CB42F33576E7} - System32\Tasks\Driver Booster SkipUAC (SYSTEM) => C:\Program Files\IObit\Driver Booster\DriverBooster.exe [2014-08-06] (IObit)
Task: {DDBC0950-20BB-43A1-85CE-F57DACB08C1F} - System32\Tasks\ASC7_SkipUac_Yaakov Laks => C:\Program Files\IObit\Advanced SystemCare 7\ASC.exe [2014-05-29] (IObit)
Task: {EB20213D-780A-4F6D-BC85-17181C811567} - System32\Tasks\Uninstaller_SkipUac_Administrator => D:\Program Files\1Maint\IObit Uninstaller\IObitUninstaler.exe [2014-05-06] (IObit)

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\SlimDrivers Startup.job => C:\Program Files\SlimDrivers\SlimDrivers.exe

==================== Loaded Modules (whitelisted) =============

2014-03-20 10:12 - 2013-10-25 12:08 - 00517408 ____C () C:\Program Files\IObit\Advanced SystemCare 7\sqlite3.dll
2011-04-06 16:06 - 2011-04-06 16:06 - 00067072 ____C () C:\Program Files\G9G11_ScreenCapture\DLL\DLL_PenSuit.dll
2014-01-21 19:37 - 2014-06-04 15:17 - 00892288 ____C () C:\Program Files\IObit\Smart Defrag 3\webres.dll
2013-08-31 21:24 - 2013-05-16 10:55 - 00113496 ____C () D:\Program Files\1AntiVandals\Spybot - Search & Destroy 2\snlThirdParty150.bpl
2013-08-31 21:24 - 2013-05-16 10:55 - 00416600 ____C () D:\Program Files\1AntiVandals\Spybot - Search & Destroy 2\DEC150.bpl
2014-05-12 12:49 - 2014-05-12 12:49 - 00260608 ____C () D:\Program Files\Notepad++\NppShell_06.dll
2013-10-07 11:00 - 2013-10-07 11:00 - 00302961 ____C () C:\Program Files\Hosts_Anti_Adwares_PUPs\HOSTS_Anti-Adware_main.exe
2013-10-02 20:29 - 2013-10-02 20:29 - 08507232 ____C () C:\Program Files\Nokia\Nokia Suite\QtGui4.dll
2013-10-02 20:29 - 2013-10-02 20:29 - 02354016 ____C () C:\Program Files\Nokia\Nokia Suite\QtCore4.dll
2013-10-02 20:29 - 2013-10-02 20:29 - 01014624 ____C () C:\Program Files\Nokia\Nokia Suite\QtNetwork4.dll
2013-10-02 20:29 - 2013-10-02 20:29 - 00364384 ____C () C:\Program Files\Nokia\Nokia Suite\QtXml4.dll
2013-10-02 20:29 - 2013-10-02 20:29 - 02480992 ____C () C:\Program Files\Nokia\Nokia Suite\QtDeclarative4.dll
2013-10-02 20:29 - 2013-10-02 20:29 - 01346912 ____C () C:\Program Files\Nokia\Nokia Suite\QtScript4.dll
2013-10-02 20:29 - 2013-10-02 20:29 - 00206176 ____C () C:\Program Files\Nokia\Nokia Suite\QtSql4.dll
2013-10-02 20:29 - 2013-10-02 20:29 - 02653024 ____C () C:\Program Files\Nokia\Nokia Suite\QtXmlPatterns4.dll
2013-10-02 20:29 - 2013-10-02 20:29 - 00033120 ____C () C:\Program Files\Nokia\Nokia Suite\imageformats\qgif4.dll
2013-10-02 20:29 - 2013-10-02 20:29 - 00035680 ____C () C:\Program Files\Nokia\Nokia Suite\imageformats\qico4.dll
2013-10-02 20:29 - 2013-10-02 20:29 - 00207200 ____C () C:\Program Files\Nokia\Nokia Suite\imageformats\qjpeg4.dll
2013-10-02 20:29 - 2013-10-02 20:29 - 11166560 ____C () C:\Program Files\Nokia\Nokia Suite\QtWebKit4.dll
2013-10-02 20:30 - 2013-10-02 20:30 - 00276832 ____C () C:\Program Files\Nokia\Nokia Suite\phonon4.dll
2013-04-15 13:26 - 2013-04-15 13:26 - 00391600 ____C () C:\Program Files\Nokia\Nokia Suite\ssoengine.dll
2013-04-15 13:26 - 2013-04-15 13:26 - 00059280 ____C () C:\Program Files\Nokia\Nokia Suite\securestorage.dll
2013-10-02 20:28 - 2013-10-02 20:28 - 00438624 ____C () C:\Program Files\Nokia\Nokia Suite\NService.dll
2013-10-02 20:29 - 2013-10-02 20:29 - 00446304 ____C () C:\Program Files\Nokia\Nokia Suite\sqldrivers\qsqlite4.dll
2013-10-02 20:29 - 2013-10-02 20:29 - 00520544 ____C () C:\Program Files\Nokia\Nokia Suite\QtMultimediaKit1.dll
2013-10-02 20:29 - 2013-10-02 20:29 - 00720736 ____C () C:\Program Files\Nokia\Nokia Suite\QtOpenGL4.dll
2013-10-02 20:28 - 2013-10-02 20:28 - 00606560 ____C () C:\Program Files\Nokia\Nokia Suite\CommonUpdateChecker.dll
2013-10-02 20:30 - 2013-10-02 20:30 - 00093024 ____C () C:\Program Files\Nokia\Nokia Suite\qjson.dll
2012-05-18 19:59 - 2012-05-18 19:59 - 03538944 ____C () C:\Program Files\G9G11_ScreenCapture\ScreenCapture.exe
2010-12-02 17:56 - 2010-12-02 17:56 - 00815104 ____C () C:\Program Files\G9G11_ScreenCapture\Data\G11_ScreenCapture\Forms\OSD_Text\OSD_Text.dll
2011-01-09 20:45 - 2011-01-09 20:45 - 00088064 ____C () C:\Program Files\G9G11_ScreenCapture\DLL\DLL_MouseDeviceManager.dll
2012-02-07 11:20 - 2012-02-07 11:20 - 02413568 ____C () C:\Program Files\G9G11_ScreenCapture\Data\G11_ScreenCapture\Forms\ScreenCapture\ScreenCapture.dll
2011-03-21 19:33 - 2011-03-21 19:33 - 00999424 ____C () C:\Program Files\G9G11_ScreenCapture\Data\G11_ScreenCapture\Forms\TrayIconWebAdvertisement\TrayIconWebAdvertisement.dll
2011-05-20 16:52 - 2011-05-20 16:52 - 00901632 ____C () C:\Program Files\G9G11_ScreenCapture\Data\G11_ScreenCapture\Forms\ProfileHint\ProfileHint.dll
2010-09-20 14:18 - 2010-09-20 14:18 - 00085504 ____C () C:\Program Files\G9G11_ScreenCapture\DLL\DLL_ZoomControl.dll
2010-09-20 14:18 - 2010-09-20 14:18 - 00054272 ____C () C:\Program Files\G9G11_ScreenCapture\DLL\DLL_ScrollbarControl.dll
2011-04-12 15:14 - 2011-04-12 15:14 - 00063488 ____C () C:\Program Files\G9G11_ScreenCapture\DLL\DLL_AnalyzeGesturesInRight.dll
2010-11-01 20:16 - 2010-11-01 20:16 - 00062976 ____C () C:\Program Files\G9G11_ScreenCapture\DLL\DLL_AnalyzeGesturesInOne.dll
2012-04-27 11:40 - 2012-04-27 11:40 - 00118272 ____C () C:\Program Files\G9G11_ScreenCapture\DLL\DLL_Wheel4D.dll
2012-05-11 19:46 - 2012-05-11 19:46 - 00891904 ____C () C:\Program Files\G9G11_ScreenCapture\Data\G11_ScreenCapture\Forms\KeyboardLEDForm\KeyboardLEDForm.dll
2013-11-06 10:42 - 2013-01-15 18:48 - 00348992 ____C () C:\Program Files\IObit\IObit Malware Fighter\madExcept_.bpl
2013-11-06 10:42 - 2013-01-15 18:48 - 00183616 ____C () C:\Program Files\IObit\IObit Malware Fighter\madBasic_.bpl
2013-11-06 10:42 - 2013-01-15 18:48 - 00051008 ____C () C:\Program Files\IObit\IObit Malware Fighter\madDisAsm_.bpl
2013-11-06 10:42 - 2013-12-12 18:46 - 08001344 ____C () C:\Program Files\IObit\IObit Malware Fighter\WebUI.dll
2013-11-06 10:42 - 2013-05-16 19:26 - 00182080 ____C () C:\Program Files\IObit\IObit Malware Fighter\unrar.dll
2013-12-04 23:02 - 2013-10-16 22:17 - 00185168 ____C () C:\Program Files\IObit\IObit Malware Fighter\libcurl-4.dll
2013-11-06 10:42 - 2013-05-16 19:26 - 00145216 ____C () C:\Program Files\IObit\IObit Malware Fighter\zlibwapi.dll
2013-08-25 17:31 - 2010-05-28 13:57 - 00801976 ____C () D:\Program Files\1AntiVandals\MailWasher Pro654\MailWasher Pro\ContactsLib.dll
2013-08-25 17:31 - 2009-06-25 15:40 - 00977080 ____C () D:\Program Files\1AntiVandals\MailWasher Pro654\MailWasher Pro\MCORE.DLL
2013-08-25 17:31 - 2010-04-19 08:48 - 00277904 ____C () D:\Program Files\1AntiVandals\MailWasher Pro654\MailWasher Pro\sqlite3.dll
2013-08-25 17:31 - 2009-08-25 17:51 - 00155320 ____C () D:\Program Files\1AntiVandals\MailWasher Pro654\MailWasher Pro\MailPrefs.dll
2013-08-25 17:32 - 2008-09-12 17:39 - 00611936 ____C () D:\Program Files\1AntiVandals\MailWasher Pro654\MailWasher Pro\MailAnalysis.DLL
2013-08-25 17:31 - 2006-03-09 15:38 - 00684032 ____C () D:\Program Files\1AntiVandals\MailWasher Pro654\MailWasher Pro\libeay32.dll
2013-08-25 17:31 - 2006-03-09 15:38 - 00155648 ____C () D:\Program Files\1AntiVandals\MailWasher Pro654\MailWasher Pro\ssleay32.dll
2013-08-25 17:31 - 2008-09-12 17:40 - 00441440 ____C () D:\Program Files\1AntiVandals\MailWasher Pro654\MailWasher Pro\CFSSignatureAlgorithm.DLL
2013-08-31 21:24 - 2013-05-16 10:55 - 00161112 ____C () D:\Program Files\1AntiVandals\Spybot - Search & Destroy 2\snlFileFormats150.bpl
2013-08-31 21:24 - 2012-08-23 10:38 - 00574840 ____C () D:\Program Files\1AntiVandals\Spybot - Search & Destroy 2\sqlite3.dll
2013-08-31 21:24 - 2012-04-03 17:06 - 00565640 ____C () D:\Program Files\1AntiVandals\Spybot - Search & Destroy 2\av\BDSmartDB.dll
2012-09-23 20:43 - 2012-09-23 20:43 - 00313992 ____C () D:\Program Files\Adobe\Reader\sqlite.dll
2014-09-25 09:25 - 2014-09-25 09:26 - 03715184 ____C () D:\Program Files\Firefox\mozjs.dll
2014-09-11 17:59 - 2014-10-10 00:47 - 16825520 ____C () C:\Windows\system32\Macromed\Flash\NPSWF32_15_0_0_152.dll
2014-03-31 21:35 - 2014-03-31 21:35 - 00270016 ____C () C:\Program Files\Windows Live\Writer\en\WindowsLive.Writer.Localization.resources.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

AlternateDataStreams: C:\ProgramData\TEMP:618D0840

==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\IMFservice => ""="Service"

==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)

MSCONFIG\startupfolder: C:^Users^Yaakov Laks^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^גוזר מסך של OneNote 2007 ו- Launcher.lnk => C:\Windows\pss\גוזר מסך של OneNote 2007 ו- Launcher.lnk.Startup
MSCONFIG\startupreg: (default) =>
MSCONFIG\startupreg: BlazeServoTool => "D:\Program Files\1Viewers\BlazeDTV 6.0\MediaDetector.exe"
MSCONFIG\startupreg: GrooveMonitor => "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
MSCONFIG\startupreg: IObit Malware Fighter => "C:\Program Files\IObit\IObit Malware Fighter\IMF.exe" /autostart
MSCONFIG\startupreg: Skype => "C:\Program Files\Skype\Phone\Skype.exe" /minimized /regrun
MSCONFIG\startupreg: Toshiba TEMPRO => D:\Program Files\1Maint\Toshiba TEMPRO\TemproTray.exe

========================= Accounts: ==========================

Administrator (S-1-5-21-2920106312-904050420-1618604034-500 - Administrator - Disabled)
Guest (S-1-5-21-2920106312-904050420-1618604034-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-2920106312-904050420-1618604034-1002 - Limited - Enabled)
Yaakov Laks (S-1-5-21-2920106312-904050420-1618604034-1001 - Administrator - Enabled) => C:\Users\Yaakov Laks

==================== Faulty Device Manager Devices =============

Name:
Description:
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.


==================== Event log errors: =========================

Application errors:
==================
Error: (10/13/2014 01:13:08 PM) (Source: .NET Runtime) (EventID: 1022) (User: )
Description: .NET Runtime version 4.0.30319.18444 - There was a failure initializing profiling API attach infrastructure. This process will not allow a profiler to attach. HRESULT: 0x80004005. Process ID (decimal): 26164. Message ID: [0x2509].

Error: (10/13/2014 11:38:59 AM) (Source: .NET Runtime) (EventID: 1022) (User: )
Description: .NET Runtime version 4.0.30319.18444 - There was a failure initializing profiling API attach infrastructure. This process will not allow a profiler to attach. HRESULT: 0x80004005. Process ID (decimal): 22080. Message ID: [0x2509].

Error: (10/13/2014 11:35:33 AM) (Source: .NET Runtime) (EventID: 1022) (User: )
Description: .NET Runtime version 4.0.30319.18444 - There was a failure initializing profiling API attach infrastructure. This process will not allow a profiler to attach. HRESULT: 0x80004005. Process ID (decimal): 8612. Message ID: [0x2509].

Error: (10/13/2014 10:41:45 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: wlmail.exe, version: 16.4.3528.331, time stamp: 0x533a3fce
Faulting module name: unknown, version: 0.0.0.0, time stamp: 0x00000000
Exception code: 0xc0000005
Fault offset: 0x00000000
Faulting process id: 0x%9
Faulting application start time: 0xwlmail.exe0
Faulting application path: wlmail.exe1
Faulting module path: wlmail.exe2
Report Id: wlmail.exe3

Error: (10/13/2014 00:00:53 AM) (Source: .NET Runtime) (EventID: 1022) (User: )
Description: .NET Runtime version 4.0.30319.18444 - There was a failure initializing profiling API attach infrastructure. This process will not allow a profiler to attach. HRESULT: 0x80004005. Process ID (decimal): 10536. Message ID: [0x2509].

Error: (10/13/2014 00:00:07 AM) (Source: .NET Runtime) (EventID: 1022) (User: )
Description: .NET Runtime version 4.0.30319.18444 - There was a failure initializing profiling API attach infrastructure. This process will not allow a profiler to attach. HRESULT: 0x80004005. Process ID (decimal): 11948. Message ID: [0x2509].

Error: (10/12/2014 11:23:07 PM) (Source: .NET Runtime) (EventID: 1022) (User: )
Description: .NET Runtime version 4.0.30319.18444 - There was a failure initializing profiling API attach infrastructure. This process will not allow a profiler to attach. HRESULT: 0x80004005. Process ID (decimal): 9756. Message ID: [0x2509].

Error: (10/12/2014 11:21:02 PM) (Source: .NET Runtime) (EventID: 1022) (User: )
Description: .NET Runtime version 4.0.30319.18444 - There was a failure initializing profiling API attach infrastructure. This process will not allow a profiler to attach. HRESULT: 0x80004005. Process ID (decimal): 9352. Message ID: [0x2509].

Error: (10/12/2014 11:17:24 PM) (Source: .NET Runtime) (EventID: 1022) (User: )
Description: .NET Runtime version 4.0.30319.18444 - There was a failure initializing profiling API attach infrastructure. This process will not allow a profiler to attach. HRESULT: 0x80004005. Process ID (decimal): 6400. Message ID: [0x2509].

Error: (10/12/2014 11:14:54 PM) (Source: .NET Runtime) (EventID: 1022) (User: )
Description: .NET Runtime version 4.0.30319.18444 - There was a failure initializing profiling API attach infrastructure. This process will not allow a profiler to attach. HRESULT: 0x80004005. Process ID (decimal): 9008. Message ID: [0x2509].


System errors:
=============
Error: (10/13/2014 00:30:15 PM) (Source: Disk) (EventID: 11) (User: )
Description: The driver detected a controller error on \Device\Harddisk1\DR1.

Error: (10/13/2014 00:30:14 PM) (Source: Disk) (EventID: 11) (User: )
Description: The driver detected a controller error on \Device\Harddisk1\DR1.

Error: (10/13/2014 00:30:14 PM) (Source: Disk) (EventID: 11) (User: )
Description: The driver detected a controller error on \Device\Harddisk1\DR1.

Error: (10/13/2014 00:30:13 PM) (Source: Disk) (EventID: 11) (User: )
Description: The driver detected a controller error on \Device\Harddisk1\DR1.

Error: (10/13/2014 11:56:47 AM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: A timeout (30000 milliseconds) was reached while waiting for a transaction response from the Dnscache service.

Error: (10/13/2014 11:56:17 AM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: A timeout (30000 milliseconds) was reached while waiting for a transaction response from the Dnscache service.

Error: (10/13/2014 11:55:47 AM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: A timeout (30000 milliseconds) was reached while waiting for a transaction response from the Dnscache service.

Error: (10/13/2014 11:55:17 AM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: A timeout (30000 milliseconds) was reached while waiting for a transaction response from the LanmanWorkstation service.

Error: (10/13/2014 11:54:47 AM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: A timeout (30000 milliseconds) was reached while waiting for a transaction response from the Dnscache service.

Error: (10/13/2014 11:54:29 AM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: The Peer Name Resolution Protocol service terminated with the following error:
%%-2140993535


Microsoft Office Sessions:
=========================
Error: (10/08/2014 05:49:34 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 3, Application Name: Microsoft Office PowerPoint, Application Version: 12.0.6600.1000, Microsoft Office Version: 12.0.6612.1000. This session lasted 18991 seconds with 60 seconds of active time. This session ended with a crash.

Error: (01/11/2014 10:59:07 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 1, Application Name: Microsoft Office Excel, Application Version: 12.0.6683.5002, Microsoft Office Version: 12.0.6612.1000. This session lasted 10326 seconds with 5520 seconds of active time. This session ended with a crash.


CodeIntegrity Errors:
===================================
Date: 2014-01-30 22:00:30.889
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume6\Windows.old\Windows\winsxs\x86_microsoft-windows-appid_31bf3856ad364e35_6.1.7601.22318_none_59e0fbb029838c63\appidapi.dll because the set of per-page image hashes could not be found on the system.

Date: 2014-01-30 22:00:30.556
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume6\Windows.old\Windows\winsxs\x86_microsoft-windows-appid_31bf3856ad364e35_6.1.7601.22318_none_59e0fbb029838c63\appidapi.dll because the set of per-page image hashes could not be found on the system.

Date: 2014-01-30 22:00:29.885
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume6\Windows.old\Windows\winsxs\x86_microsoft-windows-appid_31bf3856ad364e35_6.1.7601.22318_none_59e0fbb029838c63\appid.sys because the set of per-page image hashes could not be found on the system.

Date: 2014-01-30 22:00:29.601
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume6\Windows.old\Windows\winsxs\x86_microsoft-windows-appid_31bf3856ad364e35_6.1.7601.22318_none_59e0fbb029838c63\appid.sys because the set of per-page image hashes could not be found on the system.

Date: 2014-01-11 16:33:33.186
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume6\Windows.old\Windows\winsxs\x86_microsoft-windows-appid_31bf3856ad364e35_6.1.7601.22318_none_59e0fbb029838c63\appidapi.dll because the set of per-page image hashes could not be found on the system.

Date: 2014-01-11 16:33:32.959
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume6\Windows.old\Windows\winsxs\x86_microsoft-windows-appid_31bf3856ad364e35_6.1.7601.22318_none_59e0fbb029838c63\appidapi.dll because the set of per-page image hashes could not be found on the system.

Date: 2014-01-11 16:33:32.536
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume6\Windows.old\Windows\winsxs\x86_microsoft-windows-appid_31bf3856ad364e35_6.1.7601.22318_none_59e0fbb029838c63\appid.sys because the set of per-page image hashes could not be found on the system.

Date: 2014-01-11 16:33:32.320
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume6\Windows.old\Windows\winsxs\x86_microsoft-windows-appid_31bf3856ad364e35_6.1.7601.22318_none_59e0fbb029838c63\appid.sys because the set of per-page image hashes could not be found on the system.

Date: 2013-12-18 10:07:39.737
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume6\Windows.old\Windows\winsxs\x86_microsoft-windows-appid_31bf3856ad364e35_6.1.7601.22318_none_59e0fbb029838c63\appidapi.dll because the set of per-page image hashes could not be found on the system.

Date: 2013-12-18 10:07:39.571
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume6\Windows.old\Windows\winsxs\x86_microsoft-windows-appid_31bf3856ad364e35_6.1.7601.22318_none_59e0fbb029838c63\appidapi.dll because the set of per-page image hashes could not be found on the system.


==================== Memory info ===========================

Processor: Intel(R) Pentium(R) Dual CPU T3400 @ 2.16GHz
Percentage of memory in use: 85%
Total physical RAM: 2939.99 MB
Available physical RAM: 414.02 MB
Total Pagefile: 11758.26 MB
Available Pagefile: 7750.18 MB
Total Virtual: 2047.88 MB
Available Virtual: 1900.43 MB

==================== Drives ================================

Drive c: (Windows7) (Fixed) (Total:133.41 GB) (Free:75.31 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: (Programs) (Fixed) (Total:141.32 GB) (Free:69.22 GB) NTFS
Drive e: (Data) (Fixed) (Total:189.56 GB) (Free:92.89 GB) NTFS
Drive g: (FreeAgent Drive) (Fixed) (Total:931.51 GB) (Free:174.03 GB) NTFS
Drive i: (STORE N GO) (Removable) (Total:3.73 GB) (Free:0.01 GB) FAT32

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: 305AD34B)
Partition 1: (Not Active) - (Size=1.5 GB) - (Type=27)
Partition 2: (Active) - (Size=133.4 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=141.3 GB) - (Type=05)
Partition 4: (Not Active) - (Size=189.6 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (Size: 3.7 GB) (Disk ID: 00000000)

Partition: GPT Partition Type.

========================================================
Disk: 2 (Size: 931.5 GB) (Disk ID: B1D2A137)
Partition 1: (Not Active) - (Size=931.5 GB) - (Type=07 NTFS)

==================== End Of Log ============================

[ken545]

Hi,

IObit

http://blogs.computerworld.com/15026...m_malwarebytes


-AdwCleaner-by Xplode

Click on this link to download : ADWCleaner
Click on ONE of the Two Blue Download Now buttons That have a blue arrow beside them and save it to your desktop.

Do not click on any links in the top Advertisment.

• Close all open programs and internet browsers.
• Double click on AdwCleaner.exe to run the tool.
• Click on Scan.
• After the scan is complete click on "Clean"
• Confirm each time with Ok.
• Your computer will be rebooted automatically. A text file will open after the restart.
• Please post the content of that logfile with your next reply.
• You can find the logfile at C:\AdwCleaner[S1].txt as well.

===============================================================================


Please download Junkware Removal Tool to your desktop.

• Shut down your protection software now to avoid potential conflicts.
• Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
• The tool will open and start scanning your system.
• Please be patient as this can take a while to complete depending on your system's specifications.
• On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
• Post the contents of JRT.txt into your next message.

===============================================================================

Download Malwarebytes' Anti-Malware to your desktop.

• Windows XP : Double click on the icon to run it.
• Windows Vista, Windows 7 & 8 : Right click and select "Run as Administrator"

• On the Dashboard click on Update Now
• Go to the Setting Tab
• Under Setting go to Detection and Protection
• Under PUP and PUM make sure both are set to show Treat Detections as Malware
• Go to Advanced setting and make sure Automatically Quarantine Detected Items is checked
• Then on the Dashboard click on Scan
• Make sure to select THREAT SCAN
• Then click on Scan
• When the scan is finished and the log pops up...select Copy to Clipboard
• Please paste the log back into this thread for review
• Exit Malwarebytes

[laksi]

Hi Ken 545,
1. logs attached.
2. In AdwCleaner under Quarantine/c/Program Data/Tbccint/Multi/CT3202343 I found these: configutaion.json.vir; SetupIcon.ico and UninstallerUI.exe.vir.
I now proceed with your other recommendations/
yours
laksi

[laksi]

Hi Ken545,
log is attached.
sincerely
laksi

[ken545]

OK, just waiting for you to run Malwarebytes and post the log

[laksi]

I attach a snip of the Quarantine "log" from within mbam

[ken545]

Try this as per instructions for Malwarebytes

1. Open up Malwarebytes
2. Go to the History Tab
3. Click on Application Logs
4. Click on the last Scan Log you just ran
5. Click on View
6. Then on the Bottom click on Copy to Clipboard
7. Then paste it into this thread