Page 2 of 3 FirstFirst 123 LastLast
Results 11 to 20 of 23

Thread: Win32.Downloader.gen

  1. #11
    Junior Member
    Join Date
    Oct 2014
    Posts
    12

    Default Mbam scan results

    Hi 545,
    I guess I don't have to worry now.
    Thanks "from the bottom of my heart" as the saying goes.
    Really thank you.
    And here we say
    SHALOM
    laksi - Yaakov Laks - Arad, Israel

    Malwarebytes Anti-Malware
    www.malwarebytes.org

    Scan Date: 13/10/2014
    Scan Time: 22:44:11
    Logfile:
    Administrator: Yes

    Version: 2.00.3.1025
    Malware Database: v2014.10.13.07
    Rootkit Database: v2014.10.11.01
    License: Trial
    Malware Protection: Enabled
    Malicious Website Protection: Enabled
    Self-protection: Disabled

    OS: Windows 7 Service Pack 1
    CPU: x86
    File System: NTFS
    User: Yaakov Laks

    Scan Type: Threat Scan
    Result: Completed
    Objects Scanned: 315942
    Time Elapsed: 1 hr, 1 min, 25 sec

    Memory: Enabled
    Startup: Enabled
    Filesystem: Enabled
    Archives: Enabled
    Rootkits: Enabled
    Heuristics: Enabled
    PUP: Enabled
    PUM: Enabled

    Processes: 0
    (No malicious items detected)

    Modules: 0
    (No malicious items detected)

    Registry Keys: 0
    (No malicious items detected)

    Registry Values: 0
    (No malicious items detected)

    Registry Data: 0
    (No malicious items detected)

    Folders: 0
    (No malicious items detected)

    Files: 0
    (No malicious items detected)

    Physical Sectors: 0
    (No malicious items detected)


    (end)

  2. #12
    Emeritus-Security Expert
    Join Date
    Nov 2005
    Location
    Florida's SpaceCoast
    Posts
    15,208

    Default

    Shalom Yaakov

    Did you ever uninstall IObit ?

    Why don't you go ahead and run a new scan with FRST , be sure to checkmark Additions, post both new logs please and let me take one final look
    Microsoft MVP Consumer Security 2007-2008-2009-2010-2011-2012-2013-2014

    ERROR MESSAGE 386
    No KeyBoard Detected
    Press F1 To Continue

    Just a reminder that threads will be closed if no reply in 3 days.

  3. #13
    Junior Member
    Join Date
    Oct 2014
    Posts
    12

    Default uninstall iobit

    Shalom Ken,
    I uninstalled iobit alright, but I'll run a search on the registry and wipe off any remains.
    Shalom, yours
    laksi

  4. #14
    Emeritus-Security Expert
    Join Date
    Nov 2005
    Location
    Florida's SpaceCoast
    Posts
    15,208

    Default

    If you post a new FRST log along with the Additions I can help you remove leftovers if we find them
    Microsoft MVP Consumer Security 2007-2008-2009-2010-2011-2012-2013-2014

    ERROR MESSAGE 386
    No KeyBoard Detected
    Press F1 To Continue

    Just a reminder that threads will be closed if no reply in 3 days.

  5. #15
    Junior Member
    Join Date
    Oct 2014
    Posts
    12

    Default frst scan results logs

    Shalom Ken,
    Logs are attached,
    thanks
    laksi

    Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 15-10-2014 02
    Ran by Yaakov Laks (administrator) on LAPTOSH-PC on 16-10-2014 08:42:56
    Running from E:\F\Downloads\DLSoftware 15\SpyBot
    Loaded Profile: Yaakov Laks (Available profiles: Yaakov Laks)
    Platform: Microsoft Windows 7 Home Premium Service Pack 1 (X86) OS Language: English (United States)
    Internet Explorer Version 11
    Boot Mode: Normal
    Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic...ery-scan-tool/

    ==================== Processes (Whitelisted) =================

    (If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

    (IObit) C:\Program Files\IObit\Advanced SystemCare 7\ASCService.exe
    (Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
    (Microsoft Corporation) C:\Program Files\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe
    (Microsoft Corporation) C:\Program Files\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe
    (Brio) D:\Program Files\1Utils\Folder Size\FolderSizeSvc.exe
    (Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
    (Giraffic) C:\Program Files\Giraffic\GirafficWatchdog.exe
    (Malwarebytes Corporation) D:\Program Files\1AntiVandals\Malwarebytes Anti-Malware\mbamscheduler.exe
    (Malwarebytes Corporation) D:\Program Files\1AntiVandals\Malwarebytes Anti-Malware\mbamservice.exe
    (Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\VS7DEBUG\mdm.exe
    (Giraffic) C:\Program Files\Giraffic\Giraffic.exe
    (Secunia) C:\Program Files\Secunia\PSI\psia.exe
    (Secunia) C:\Program Files\Secunia\PSI\sua.exe
    (Toshiba Europe GmbH) D:\Program Files\1Maint\Toshiba TEMPRO\TemproSvc.exe
    (TOSHIBA Corporation) D:\Program Files\TOSHIBA\TOSHIBA DVD PLAYER\TNaviSrv.exe
    (Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
    (Safer-Networking Ltd.) D:\Program Files\1AntiVandals\Spybot - Search & Destroy 2\SDUpdSvc.exe
    (Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
    (Safer-Networking Ltd.) D:\Program Files\1AntiVandals\Spybot - Search & Destroy 2\SDWSCSvc.exe
    (StorageCraft Technology Corporation) D:\Program Files\1Maint\StorageCraft\vsnapvss.exe
    (Safer-Networking Ltd.) D:\Program Files\1AntiVandals\Spybot - Search & Destroy 2\SDFSSvc.exe
    (Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
    (Malwarebytes Corporation) D:\Program Files\1AntiVandals\Malwarebytes Anti-Malware\mbam.exe
    (Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
    (Synaptics, Inc.) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
    (IObit) C:\Program Files\IObit\Smart Defrag 3\SmartDefrag.exe
    (Safer-Networking Ltd.) D:\Program Files\1AntiVandals\Spybot - Search & Destroy 2\SDTray.exe
    (Chicony) C:\Program Files\Camera Assistant Software for Toshiba\traybar.exe
    () C:\Program Files\Hosts_Anti_Adwares_PUPs\HOSTS_Anti-Adware_main.exe
    (Intel Corporation) C:\Windows\System32\igfxtray.exe
    (Intel Corporation) C:\Windows\System32\hkcmd.exe
    (Google Inc.) C:\Program Files\Google\Update\1.3.24.15\GoogleCrashHandler.exe
    (Intel Corporation) C:\Windows\System32\igfxpers.exe
    (Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
    (Synaptics, Inc.) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
    (Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
    (Nokia) C:\Program Files\Nokia\Nokia Suite\NokiaSuite.exe
    (Akamai Technologies, Inc.) C:\Users\Yaakov Laks\AppData\Local\Akamai\netsession_win.exe
    () C:\Program Files\G9G11_ScreenCapture\ScreenCapture.exe
    (Akamai Technologies, Inc.) C:\Users\Yaakov Laks\AppData\Local\Akamai\netsession_win.exe
    (Secunia) C:\Program Files\Secunia\PSI\psi_tray.exe
    (Firetrust Ltd) D:\Program Files\1AntiVandals\MailWasher Pro654\MailWasher Pro\MailWasher.exe
    (Piriform Ltd) D:\Program Files\1Maint\ccleaner\CCleaner.exe
    (LSI Corporation) C:\Program Files\LSI SoftModem\agrsmsvc.exe
    (Microsoft Corporation) C:\Windows\System32\wbem\unsecapp.exe
    (Nokia) C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
    (Nokia) C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe
    (Nokia) C:\Program Files\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe
    (Privacyware/PWI, Inc.) D:\Program Files\1AntiVandals\private firewall\pfsvc.exe
    (Privacyware/PWI, Inc.) D:\Program Files\1AntiVandals\private firewall\PFGUI.exe
    (Microsoft Corporation) C:\Program Files\Windows Live\Mail\wlmail.exe
    (Microsoft Corporation) C:\Program Files\Windows Live\Contacts\wlcomm.exe
    (Microsoft Corporation) C:\Program Files\Microsoft Office\Office12\WINWORD.EXE
    (StorageCraft Technology Corporation) D:\Program Files\1Maint\StorageCraft\ShadowProtect.exe
    (StorageCraft Technology Corporation) D:\Program Files\1Maint\StorageCraft\ShadowProtectSvc.exe
    (Microsoft Corporation) C:\Program Files\Microsoft Games\FreeCell\FreeCell.exe
    (Mozilla Corporation) D:\Program Files\Firefox\firefox.exe


    ==================== Registry (Whitelisted) ==================

    (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

    HKLM\...\Run: [MSC] => C:\Program Files\Microsoft Security Client\msseces.exe [974432 2014-08-22] (Microsoft Corporation)
    HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1348904 2008-08-14] (Synaptics, Inc.)
    HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [12021464 2014-07-21] (Realtek Semiconductor)
    HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959176 2014-08-21] (Adobe Systems Incorporated)
    HKLM\...\Run: [SDTray] => D:\Program Files\1AntiVandals\Spybot - Search & Destroy 2\SDTray.exe [5624784 2013-07-25] (Safer-Networking Ltd.)
    HKLM\...\Run: [Camera Assistant Software] => C:\Program Files\Camera Assistant Software for Toshiba\traybar.exe [417792 2009-04-10] (Chicony)
    HKLM\...\Run: [HOSTS Anti-Adware_PUPs] => C:\Program Files\Hosts_Anti_Adwares_PUPs\HOSTS_Anti-Adware_main.exe [302961 2013-10-07] ()
    HKLM\...\Run: [] => [X]
    HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [256896 2014-07-25] (Oracle Corporation)
    HKLM\...\Run: [Privatefirewall] => D:\Program Files\1AntiVandals\private firewall\PFGUI.exe [3048480 2013-12-17] (Privacyware/PWI, Inc.)
    Winlogon\Notify\SDWinLogon: SDWinLogon.dll [X]
    HKU\S-1-5-21-2920106312-904050420-1618604034-1001\...\Run: [] => [X]
    HKU\S-1-5-21-2920106312-904050420-1618604034-1001\...\Run: [NokiaSuite.exe] => C:\Program Files\Nokia\Nokia Suite\NokiaSuite.exe [1090912 2013-10-02] (Nokia)
    HKU\S-1-5-21-2920106312-904050420-1618604034-1001\...\Run: [Akamai NetSession Interface] => C:\Users\Yaakov Laks\AppData\Local\Akamai\netsession_win.exe [4672920 2014-04-17] (Akamai Technologies, Inc.)
    HKU\S-1-5-21-2920106312-904050420-1618604034-1001\...\Run: [OscarEditor] => C:\Program Files\G9G11_ScreenCapture\ScreenCapture.exe [3538944 2012-05-18] ()
    HKU\S-1-5-21-2920106312-904050420-1618604034-1001\...\Run: [CCleaner Monitoring] => D:\Program Files\1Maint\ccleaner\CCleaner.exe [4811032 2014-09-26] (Piriform Ltd)
    HKU\S-1-5-21-2920106312-904050420-1618604034-1001\...\Policies\Explorer: [NoFavoritesMenu] 1
    HKU\S-1-5-18\...\Run: [Advanced SystemCare 7] => C:\Program Files\IObit\Advanced SystemCare 7\ASCTray.exe [2295584 2014-04-21] (IObit)
    Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Secunia PSI Tray.lnk
    ShortcutTarget: Secunia PSI Tray.lnk -> C:\Program Files\Secunia\PSI\psi_tray.exe (Secunia)
    Startup: C:\Users\Yaakov Laks\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MailWasherPro.lnk
    ShortcutTarget: MailWasherPro.lnk -> D:\Program Files\1AntiVandals\MailWasher Pro654\MailWasher Pro\MailWasher.exe (Firetrust Ltd)
    ShellIconOverlayIdentifiers: [GDriveBlacklistedOverlay] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42} => C:\Program Files\Google\Drive\googledrivesync32.dll (Google)
    ShellIconOverlayIdentifiers: [GDriveSharedEditOverlay] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44} => C:\Program Files\Google\Drive\googledrivesync32.dll (Google)
    ShellIconOverlayIdentifiers: [GDriveSharedViewOverlay] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43} => C:\Program Files\Google\Drive\googledrivesync32.dll (Google)
    ShellIconOverlayIdentifiers: [GDriveSyncedOverlay] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40} => C:\Program Files\Google\Drive\googledrivesync32.dll (Google)
    ShellIconOverlayIdentifiers: [GDriveSyncingOverlay] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41} => C:\Program Files\Google\Drive\googledrivesync32.dll (Google)

    ==================== Internet (Whitelisted) ====================

    (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

    HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/?ocid=iehp
    HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = he-IL
    HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x4C67C112E0E3CF01
    SearchScopes: HKCU - {7DAAAB92-E210-43F8-AA79-83FD3E90890A} URL = http://search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=902615&p={searchTerms}
    BHO: ExplorerWnd Helper -> {10921475-03CE-4E04-90CE-E2E7EF20C814} -> D:\Program Files\1Maint\IObit Uninstaller\UninstallExplorer32.dll No File
    BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
    BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
    BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
    BHO: Ads Removal -> {9D974C8C-6D92-44FB-BEAF-B45A1C0CF17F} -> C:\Program Files\IObit\IObit Malware Fighter\adsremoval\IE\Adblock.dll (Adblock)
    BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
    BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
    Handler: belarc - {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - C:\Program Files\Belarc\Advisor\System\BAVoilaX.dll (Belarc, Inc.)
    Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
    Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
    Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
    Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
    Tcpip\Parameters: [DhcpNameServer] 80.179.52.100 80.179.55.100

    FireFox:
    ========
    FF ProfilePath: C:\Users\Yaakov Laks\AppData\Roaming\Mozilla\Firefox\Profiles\9l7tyrid.default-1405248970516
    FF Homepage: about:home
    FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_15_0_0_152.dll ()
    FF Plugin: @adobe.com/ShockwavePlayer -> C:\Windows\system32\Adobe\Director\np32dsw_1213153.dll (Adobe Systems, Inc.)
    FF Plugin: @Google.com/GoogleEarthPlugin -> C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
    FF Plugin: @java.com/DTPlugin,version=10.67.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
    FF Plugin: @java.com/JavaPlugin,version=10.67.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
    FF Plugin: @microsoft.com/GENUINE -> C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
    FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
    FF Plugin: @microsoft.com/VirtualEarth3D,version=4.0 -> C:\Program Files\Virtual Earth 3D\ ()
    FF Plugin: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
    FF Plugin: @nokia.com/EnablerPlugin -> C:\Program Files\Nokia\Nokia Suite\npNokiaSuiteEnabler.dll ( )
    FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
    FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
    FF Plugin: @videolan.org/vlc,version=2.0.8 -> D:\Program Files\1Viewers\VLC\npvlc.dll (VideoLAN)
    FF Plugin: @videolan.org/vlc,version=2.1.2 -> D:\Program Files\1Viewers\VLC\npvlc.dll (VideoLAN)
    FF Plugin: @videolan.org/vlc,version=2.1.3 -> D:\Program Files\1Viewers\VLC\npvlc.dll (VideoLAN)
    FF Plugin: @videolan.org/vlc,version=2.1.5 -> D:\Program Files\1Viewers\VLC\npvlc.dll (VideoLAN)
    FF Plugin: Adobe Reader -> D:\Program Files\Adobe\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
    FF SearchPlugin: C:\Users\Yaakov Laks\AppData\Roaming\Mozilla\Firefox\Profiles\9l7tyrid.default-1405248970516\searchplugins\nana10-customized-web-search.xml
    FF Extension: Ads Removal - C:\Users\Yaakov Laks\AppData\Roaming\Mozilla\Firefox\Profiles\9l7tyrid.default-1405248970516\Extensions\adremoveext@adremoveext.net [2014-08-25]
    FF Extension: Adblock Plus - C:\Users\Yaakov Laks\AppData\Roaming\Mozilla\Firefox\Profiles\9l7tyrid.default-1405248970516\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-08-21]
    FF StartMenuInternet: FIREFOX.EXE - D:\Program Files\Firefox\firefox.exe

    Chrome:
    =======
    CHR HomePage: Default ->
    CHR StartupUrls: Default -> ""
    CHR DefaultSuggestURL: Default -> {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&gs_ri={google:suggestRid}&xssi=t&q={searchTerms}&{google:inputType}{google:cursorPosition}{google:currentPageUrl}{google:pageClassification}{google:searchVersion}{google:sessionToken}{google:prefetchQuery}sugkey={google:suggestAPIKeyParameter}
    CHR Profile: C:\Users\Yaakov Laks\AppData\Local\Google\Chrome\User Data\Default
    CHR Extension: (Google Docs) - C:\Users\Yaakov Laks\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2013-09-08]
    CHR Extension: (כונן Google) - C:\Users\Yaakov Laks\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-09-08]
    CHR Extension: (Advanced SystemCare Surfing Protection) - C:\Users\Yaakov Laks\AppData\Local\Google\Chrome\User Data\Default\Extensions\bbmegnmpleoagolcnjnejdacakedpcgd [2014-03-20]
    CHR Extension: (YouTube) - C:\Users\Yaakov Laks\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-09-08]
    CHR Extension: (חיפוש Google) - C:\Users\Yaakov Laks\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-09-08]
    CHR Extension: (AD Block) - C:\Users\Yaakov Laks\AppData\Local\Google\Chrome\User Data\Default\Extensions\lfgjbmhakaffflkjecineeaadpidgikb [2014-01-15]
    CHR Extension: (Advanced SystemCare Surfing Protection) - C:\Users\Yaakov Laks\AppData\Local\Google\Chrome\User Data\Default\Extensions\nfengeggddojhakldhlpjdlddgkkjkdd [2014-03-20]
    CHR Extension: (תוספת RSS Subscription (מאת Google)) - C:\Users\Yaakov Laks\AppData\Local\Google\Chrome\User Data\Default\Extensions\nlbjncdgjeocebhnmkbbbdekmmmcbfjd [2014-03-09]
    CHR Extension: (Google Wallet) - C:\Users\Yaakov Laks\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-08]
    CHR Extension: (Gmail) - C:\Users\Yaakov Laks\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-09-08]
    CHR Profile: C:\Users\Yaakov Laks\AppData\Local\Google\Chrome\User Data\Profile 1
    CHR Extension: (Google Docs) - C:\Users\Yaakov Laks\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\aohghmighlieiainnegkcijnfilokake [2014-05-24]
    CHR Extension: (Google Drive) - C:\Users\Yaakov Laks\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-05-24]
    CHR Extension: (YouTube) - C:\Users\Yaakov Laks\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-05-24]
    CHR Extension: (Google Search) - C:\Users\Yaakov Laks\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-05-24]
    CHR Extension: (Advanced SystemCare Surfing Protection) - C:\Users\Yaakov Laks\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\nfengeggddojhakldhlpjdlddgkkjkdd [2014-05-24]
    CHR Extension: (Google Wallet) - C:\Users\Yaakov Laks\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-05-24]
    CHR Extension: (No Name) - C:\Users\Yaakov Laks\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\okemjkdkkihnhdaanohnleknbaddlddb [2014-10-03]
    CHR Extension: (Gmail) - C:\Users\Yaakov Laks\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-05-24]
    CHR HKLM\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files\Skype\Toolbars\ChromeExtension\skype_chrome_extension.crx [2014-07-14]
    CHR HKLM\...\Chrome\Extension: [nfengeggddojhakldhlpjdlddgkkjkdd] - C:\Program Files\IObit\Surfing Protection\BrowerProtect\ASC_GhromePlugin.crx [2014-07-14]

    ========================== Services (Whitelisted) =================

    (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

    R2 AdvancedSystemCareService7; C:\Program Files\IObit\Advanced SystemCare 7\ASCService.exe [881952 2014-01-14] (IObit)
    R2 AgereModemAudio; C:\Program Files\LSI SoftModem\agrsmsvc.exe [14336 2000-01-01] (LSI Corporation)
    R2 c2cautoupdatesvc; C:\Program Files\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1390176 2014-07-14] (Microsoft Corporation)
    R2 c2cpnrsvc; C:\Program Files\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1767520 2014-07-14] (Microsoft Corporation)
    R2 FolderSize; D:\Program Files\1Utils\Folder Size\FolderSizeSvc.exe [116224 2010-04-06] (Brio) [File not signed]
    R2 Giraffic; C:\Program Files\Giraffic\GirafficWatchdog.exe [2245232 2013-05-13] (Giraffic)
    S2 HOSTS Anti-PUPs; C:\Program Files\Hosts_Anti_Adwares_PUPs\HOSTS_Anti-Adware.exe [285795 2013-10-07] () [File not signed]
    S2 LiveUpdateSvc; C:\Program Files\IObit\LiveUpdate\LiveUpdate.exe [2152736 2014-05-04] (IObit)
    R2 MBAMScheduler; D:\Program Files\1AntiVandals\Malwarebytes Anti-Malware\mbamscheduler.exe [1871160 2014-10-01] (Malwarebytes Corporation)
    R2 MBAMService; D:\Program Files\1AntiVandals\Malwarebytes Anti-Malware\mbamservice.exe [968504 2014-10-01] (Malwarebytes Corporation)
    R2 MDM; C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe [335872 2006-10-26] (Microsoft Corporation) [File not signed]
    R2 MsMpSvc; C:\Program Files\Microsoft Security Client\MsMpEng.exe [22192 2014-08-22] (Microsoft Corporation)
    R3 NisSrv; C:\Program Files\Microsoft Security Client\NisSrv.exe [288120 2014-08-22] (Microsoft Corporation)
    R2 PFNet; D:\Program Files\1AntiVandals\private firewall\pfsvc.exe [374600 2013-12-17] (Privacyware/PWI, Inc.)
    R2 SDScannerService; D:\Program Files\1AntiVandals\Spybot - Search & Destroy 2\SDFSSvc.exe [1817560 2013-05-16] (Safer-Networking Ltd.)
    R2 SDUpdateService; D:\Program Files\1AntiVandals\Spybot - Search & Destroy 2\SDUpdSvc.exe [1033688 2013-05-16] (Safer-Networking Ltd.)
    R2 SDWSCService; D:\Program Files\1AntiVandals\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2013-05-15] (Safer-Networking Ltd.)
    R2 Secunia PSI Agent; C:\Program Files\Secunia\PSI\PSIA.exe [1228504 2013-07-03] (Secunia)
    R2 Secunia Update Agent; C:\Program Files\Secunia\PSI\sua.exe [660184 2013-07-03] (Secunia)
    S2 ShadowProtectSvc; D:\Program Files\1Maint\StorageCraft\ShadowProtectSvc.exe [4672336 2014-10-12] (StorageCraft Technology Corporation)
    R2 TemproMonitoringService; D:\Program Files\1Maint\Toshiba TEMPRO\TemproSvc.exe [112080 2011-02-10] (Toshiba Europe GmbH)
    R2 TNaviSrv; D:\Program Files\TOSHIBA\TOSHIBA DVD PLAYER\TNaviSrv.exe [83312 2008-07-18] (TOSHIBA Corporation)
    R2 VSNAPVSS; D:\Program Files\1Maint\StorageCraft\vsnapvss.exe [71976 2014-10-12] (StorageCraft Technology Corporation)
    S2 HPSLPSVC; C:\Users\Yaakov Laks\AppData\Local\Temp\7zS669C\hpslpsvc32.dll [X]

    ==================== Drivers (Whitelisted) ====================

    (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

    R1 Amfilter; C:\Windows\System32\DRIVERS\Amfilter.sys [8704 2009-08-27] (A4Tech Co.,Ltd.) [File not signed]
    S3 Amusbprt; C:\Windows\System32\DRIVERS\Amusbprt.sys [14336 2009-08-27] (A4Tech Co.,Ltd.) [File not signed]
    R3 athr; C:\Windows\System32\DRIVERS\athr.sys [3234304 2014-07-22] (Qualcomm Atheros Communications, Inc.)
    S3 BroadcomWModem; C:\Windows\System32\DRIVERS\bcmww.sys [118400 2005-06-02] (Broadcom Corporation)
    S3 BroadcomWWNIC; C:\Windows\System32\DRIVERS\bcmwwNet.sys [58496 2005-02-09] (Broadcom Corporation)
    R0 giveio; C:\Windows\System32\giveio.sys [5248 1996-04-03] () [File not signed]
    S3 IT9135BDA; C:\Windows\System32\Drivers\IT9135BDA.sys [123008 2010-12-19] (ITE )
    R3 KeyScrambler; C:\Windows\System32\drivers\keyscrambler.sys [209016 2013-05-31] (QFX Software Corporation)
    R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [23256 2014-10-01] (Malwarebytes Corporation)
    R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [114904 2014-10-16] (Malwarebytes Corporation)
    R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [51928 2014-10-01] (Malwarebytes Corporation)
    R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [231800 2014-07-17] (Microsoft Corporation)
    R2 PfFilter; C:\Program Files\IObit\Protected Folder\pffilter.sys [34336 2013-04-03] (IObit Information Technology)
    S3 PSI; C:\Windows\System32\DRIVERS\psi_mf_x86.sys [16024 2013-07-03] (Secunia)
    R1 pwipf6; C:\Windows\System32\DRIVERS\pwipf6.sys [130568 2013-09-29] (Privacyware/PWI, Inc.)
    S3 RTHDMIAzAudService; C:\Windows\System32\drivers\RtHDMIV.sys [141408 2008-02-27] (Realtek Semiconductor Corp.)
    R3 rusb3hub; C:\Windows\System32\DRIVERS\rusb3hub.sys [91016 2012-08-27] (Renesas Electronics Corporation)
    R3 rusb3xhc; C:\Windows\System32\DRIVERS\rusb3xhc.sys [181128 2012-08-27] (Renesas Electronics Corporation)
    R0 SmartDefragDriver; C:\Windows\System32\Drivers\SmartDefragDriver.sys [18624 2014-06-04] (IObit)
    R3 SmbDrvI; C:\Windows\System32\DRIVERS\Smb_driver_Intel.sys [27888 2014-01-26] (Synaptics Incorporated)
    R0 speedfan; C:\Windows\System32\speedfan.sys [24184 2012-12-29] (Almico Software)
    S3 SWDUMon; C:\Windows\System32\DRIVERS\SWDUMon.sys [13464 2014-08-13] ()
    R3 UVCFTR; C:\Windows\System32\Drivers\UVCFTR_S.SYS [17960 2009-04-10] (Chicony Electronics Co., Ltd.)
    S1 BAPIDRV; system32\DRIVERS\BAPIDRV.sys [X]

    ==================== NetSvcs (Whitelisted) ===================


    (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


    ==================== One Month Created Files and Folders ========

    (If an entry is included in the fixlist, the file\folder will be moved.)

    2014-10-15 19:35 - 2014-10-15 19:35 - 00025600 ____C (Gibson Research Corp.) C:\Users\Yaakov Laks\Downloads\leaktest(1).exe
    2014-10-15 19:07 - 2014-10-15 19:07 - 00000000 ___DC () C:\Users\Yaakov Laks\AppData\Local\Privatefirewall
    2014-10-15 09:34 - 2014-10-15 09:34 - 00000000 ___DC () C:\Windows\Tasks\360Disabled
    2014-10-15 09:23 - 2014-10-15 20:10 - 00000146 ____C () C:\Windows\ODBC.INI
    2014-10-15 09:23 - 2014-10-15 20:10 - 00000000 ___DC () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Privatefirewall 7.0
    2014-10-15 09:23 - 2014-10-15 09:23 - 00000000 ___DC () C:\ProgramData\Privacyware
    2014-10-15 09:23 - 2013-09-29 21:24 - 00130568 ____C (Privacyware/PWI, Inc.) C:\Windows\system32\Drivers\pwipf6.sys
    2014-10-15 09:19 - 2014-10-15 19:06 - 00000000 ___DC () C:\Program Files\360
    2014-10-15 00:19 - 2014-10-15 19:50 - 02379264 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
    2014-10-15 00:18 - 2014-10-15 19:46 - 00372736 _____ (Microsoft Corporation) C:\Windows\system32\rastls.dll
    2014-10-15 00:18 - 2014-10-15 19:41 - 17484800 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
    2014-10-15 00:18 - 2014-10-15 19:41 - 11807232 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
    2014-10-15 00:18 - 2014-10-15 19:41 - 04201472 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
    2014-10-15 00:18 - 2014-10-15 19:41 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
    2014-10-15 00:18 - 2014-10-15 19:41 - 02187264 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
    2014-10-15 00:18 - 2014-10-15 19:41 - 02017280 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
    2014-10-15 00:18 - 2014-10-15 19:41 - 01810944 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
    2014-10-15 00:18 - 2014-10-15 19:41 - 01190400 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
    2014-10-15 00:18 - 2014-10-15 19:41 - 01068032 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
    2014-10-15 00:18 - 2014-10-15 19:41 - 00678400 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
    2014-10-15 00:18 - 2014-10-15 19:41 - 00677888 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
    2014-10-15 00:18 - 2014-10-15 19:41 - 00646144 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
    2014-10-15 00:18 - 2014-10-15 19:41 - 00607744 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
    2014-10-15 00:18 - 2014-10-15 19:41 - 00597504 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
    2014-10-15 00:18 - 2014-10-15 19:41 - 00454656 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
    2014-10-15 00:18 - 2014-10-15 19:41 - 00440320 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
    2014-10-15 00:18 - 2014-10-15 19:41 - 00365056 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
    2014-10-15 00:18 - 2014-10-15 19:41 - 00331448 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
    2014-10-15 00:18 - 2014-10-15 19:41 - 00243200 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
    2014-10-15 00:18 - 2014-10-15 19:41 - 00164864 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
    2014-10-15 00:18 - 2014-10-15 19:41 - 00112128 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
    2014-10-15 00:18 - 2014-10-15 19:41 - 00108032 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
    2014-10-15 00:18 - 2014-10-15 19:41 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
    2014-10-15 00:18 - 2014-10-15 19:41 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
    2014-10-15 00:18 - 2014-10-15 19:41 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
    2014-10-15 00:18 - 2014-10-15 19:41 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
    2014-10-15 00:18 - 2014-10-15 19:41 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
    2014-10-15 00:18 - 2014-10-15 19:41 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
    2014-10-15 00:18 - 2014-10-15 19:41 - 00032768 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
    2014-10-15 00:18 - 2014-10-15 19:41 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
    2014-10-15 00:18 - 2014-10-15 19:25 - 01131664 _____ (Microsoft Corporation) C:\Windows\system32\dfshim.dll
    2014-10-15 00:18 - 2014-10-15 19:25 - 00156824 _____ (Microsoft Corporation) C:\Windows\system32\mscorier.dll
    2014-10-15 00:18 - 2014-10-15 19:25 - 00081560 _____ (Microsoft Corporation) C:\Windows\system32\mscories.dll
    2014-10-15 00:18 - 2014-10-15 19:24 - 02744320 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll
    2014-10-15 00:17 - 2014-10-15 19:21 - 05703168 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll
    2014-10-15 00:17 - 2014-10-15 19:21 - 00523264 _____ (Microsoft Corporation) C:\Windows\system32\termsrv.dll
    2014-10-15 00:17 - 2014-10-15 19:21 - 00304128 _____ (Microsoft Corporation) C:\Windows\system32\winlogon.exe
    2014-10-15 00:17 - 2014-10-15 19:21 - 00184320 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rdpwd.sys
    2014-10-15 00:17 - 2014-10-15 19:21 - 00157696 _____ (Microsoft Corporation) C:\Windows\system32\winsta.dll
    2014-10-15 00:17 - 2014-10-15 19:21 - 00130048 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorekmts.dll
    2014-10-15 00:17 - 2014-10-15 19:21 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
    2014-10-15 00:17 - 2014-10-15 19:21 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys
    2014-10-15 00:17 - 2014-10-15 19:21 - 00017408 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
    2014-10-15 00:16 - 2014-10-15 19:19 - 02363904 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
    2014-10-15 00:15 - 2014-10-15 19:18 - 12625408 _____ (Microsoft Corporation) C:\Windows\system32\wmploc.DLL
    2014-10-15 00:15 - 2014-10-15 19:18 - 11411456 _____ (Microsoft Corporation) C:\Windows\system32\wmp.dll
    2014-10-15 00:15 - 2014-10-15 19:18 - 03970488 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe
    2014-10-15 00:15 - 2014-10-15 19:18 - 03914680 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
    2014-10-15 00:15 - 2014-10-15 19:18 - 03208704 _____ (Microsoft Corporation) C:\Windows\system32\mf.dll
    2014-10-15 00:15 - 2014-10-15 19:18 - 01329664 _____ (Microsoft Corporation) C:\Windows\system32\quartz.dll
    2014-10-15 00:15 - 2014-10-15 19:18 - 01174528 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
    2014-10-15 00:15 - 2014-10-15 19:18 - 01005056 _____ (Microsoft Corporation) C:\Windows\system32\cryptui.dll
    2014-10-15 00:15 - 2014-10-15 19:18 - 00988160 _____ (Microsoft Corporation) C:\Windows\system32\drmv2clt.dll
    2014-10-15 00:15 - 2014-10-15 19:18 - 00744960 _____ (Microsoft Corporation) C:\Windows\system32\blackbox.dll
    2014-10-15 00:15 - 2014-10-15 19:18 - 00617984 _____ (Microsoft Corporation) C:\Windows\system32\wmdrmsdk.dll
    2014-10-15 00:15 - 2014-10-15 19:18 - 00593920 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\PEAuth.sys
    2014-10-15 00:15 - 2014-10-15 19:18 - 00521384 _____ (Microsoft Corporation) C:\Windows\system32\winload.exe
    2014-10-15 00:15 - 2014-10-15 19:18 - 00504320 _____ (Microsoft Corporation) C:\Windows\system32\msscp.dll
    2014-10-15 00:15 - 2014-10-15 19:18 - 00489984 _____ (Microsoft Corporation) C:\Windows\system32\evr.dll
    2014-10-15 00:15 - 2014-10-15 19:18 - 00473600 _____ (Microsoft Corporation) C:\Windows\system32\audiosrv.dll
    2014-10-15 00:15 - 2014-10-15 19:18 - 00455752 _____ (Microsoft Corporation) C:\Windows\system32\winresume.exe
    2014-10-15 00:15 - 2014-10-15 19:18 - 00442880 _____ (Microsoft Corporation) C:\Windows\system32\AUDIOKSE.dll
    2014-10-15 00:15 - 2014-10-15 19:18 - 00409272 _____ (Microsoft Corporation) C:\Windows\system32\ci.dll
    2014-10-15 00:15 - 2014-10-15 19:18 - 00406016 _____ (Microsoft Corporation) C:\Windows\system32\drmmgrtn.dll
    2014-10-15 00:15 - 2014-10-15 19:18 - 00374784 _____ (Microsoft Corporation) C:\Windows\system32\AudioEng.dll
    2014-10-15 00:15 - 2014-10-15 19:18 - 00354816 _____ (Microsoft Corporation) C:\Windows\system32\mfplat.dll
    2014-10-15 00:15 - 2014-10-15 19:18 - 00275968 _____ (Microsoft Corporation) C:\Windows\system32\EncDump.dll
    2014-10-15 00:15 - 2014-10-15 19:18 - 00265216 _____ (Microsoft Corporation) C:\Windows\system32\msnetobj.dll
    2014-10-15 00:15 - 2014-10-15 19:18 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\AudioSes.dll
    2014-10-15 00:15 - 2014-10-15 19:18 - 00179200 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
    2014-10-15 00:15 - 2014-10-15 19:18 - 00157184 _____ (Microsoft Corporation) C:\Windows\system32\pcasvc.dll
    2014-10-15 00:15 - 2014-10-15 19:18 - 00143872 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
    2014-10-15 00:15 - 2014-10-15 19:18 - 00103424 _____ (Microsoft Corporation) C:\Windows\system32\mfps.dll
    2014-10-15 00:15 - 2014-10-15 19:18 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\audiodg.exe
    2014-10-15 00:15 - 2014-10-15 19:18 - 00096768 _____ (Microsoft Corporation) C:\Windows\system32\appidpolicyconverter.exe
    2014-10-15 00:15 - 2014-10-15 19:18 - 00081408 _____ (Microsoft Corporation) C:\Windows\system32\cryptsp.dll
    2014-10-15 00:15 - 2014-10-15 19:18 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\packager.dll
    2014-10-15 00:15 - 2014-10-15 19:18 - 00050688 _____ (Microsoft Corporation) C:\Windows\system32\appidapi.dll
    2014-10-15 00:15 - 2014-10-15 19:18 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\setbcdlocale.dll
    2014-10-15 00:15 - 2014-10-15 19:18 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\rrinstaller.exe
    2014-10-15 00:15 - 2014-10-15 19:18 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\appid.sys
    2014-10-15 00:15 - 2014-10-15 19:18 - 00027648 _____ (Microsoft Corporation) C:\Windows\system32\appidsvc.dll
    2014-10-15 00:15 - 2014-10-15 19:18 - 00023040 _____ (Microsoft Corporation) C:\Windows\system32\mfpmp.exe
    2014-10-15 00:15 - 2014-10-15 19:18 - 00016896 _____ (Microsoft Corporation) C:\Windows\system32\appidcertstorecheck.exe
    2014-10-15 00:15 - 2014-10-15 19:18 - 00008192 _____ (Microsoft Corporation) C:\Windows\system32\spwmp.dll
    2014-10-15 00:15 - 2014-10-15 19:18 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\msdxm.ocx
    2014-10-15 00:15 - 2014-10-15 19:18 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\dxmasf.dll
    2014-10-15 00:15 - 2014-10-15 19:18 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\mferror.dll
    2014-10-14 22:16 - 2014-10-16 07:14 - 00114904 ____C (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
    2014-10-14 22:16 - 2014-10-14 22:16 - 00000892 ____C () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
    2014-10-14 22:16 - 2014-10-14 22:16 - 00000000 ___DC () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
    2014-10-14 22:16 - 2014-10-01 11:11 - 00075480 ____C (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
    2014-10-14 22:16 - 2014-10-01 11:11 - 00051928 ____C (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
    2014-10-14 22:16 - 2014-10-01 11:11 - 00023256 ____C (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
    2014-10-14 21:27 - 2014-10-14 21:27 - 00025600 ___RC (Gibson Research Corp.) C:\Users\Yaakov Laks\Downloads\LeakTest.exe
    2014-10-14 19:04 - 2014-10-14 21:57 - 00001057 ____C () C:\Users\Yaakov Laks\Desktop\mbam20141013.txt
    2014-10-14 17:52 - 2014-10-14 17:52 - 00023556 ____C () C:\Users\Yaakov Laks\Desktop\1501 manual0002.tif
    2014-10-14 17:52 - 2014-10-14 17:52 - 00010438 ____C () C:\Users\Yaakov Laks\Desktop\1501 manual0001.tif
    2014-10-13 22:28 - 2014-10-13 22:29 - 19828376 ____C (Malwarebytes Corporation ) C:\Users\Yaakov Laks\Desktop\mbam-setup-2.0.3.1025.exe
    2014-10-13 17:14 - 2014-10-13 17:14 - 00002209 ____C () C:\Users\Yaakov Laks\Desktop\JRT.txt
    2014-10-13 17:11 - 2014-10-13 17:11 - 00000000 ___DC () C:\Windows\ERUNT
    2014-10-13 16:13 - 2014-10-15 18:58 - 00004958 ____C () C:\Windows\PFRO.log
    2014-10-13 13:20 - 2014-10-16 08:43 - 00000000 ___DC () C:\FRST
    2014-10-13 12:54 - 2014-10-13 12:54 - 00000000 ___DC () C:\Users\Yaakov Laks\Desktop\RegBackup
    2014-10-13 12:53 - 2014-10-13 12:53 - 00000207 ____C () C:\Windows\tweaking.com-regbackup-LAPTOSH-PC-Microsoft-Windows-7-Home-Premium-(32-bit).dat
    2014-10-13 12:52 - 2014-10-13 12:52 - 00000000 ___DC () C:\RegBackup
    2014-10-13 12:51 - 2014-10-13 12:51 - 00001002 ____C () C:\Users\Public\Desktop\Tweaking.com - Registry Backup.lnk
    2014-10-13 12:51 - 2014-10-13 12:51 - 00000000 ___DC () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Tweaking.com
    2014-10-12 18:56 - 2014-10-12 18:56 - 00123160 ____C () C:\Users\Yaakov Laks\AppData\Local\GDIPFONTCACHEV1.DAT
    2014-10-12 18:55 - 2014-10-15 19:59 - 00000728 ____C () C:\Windows\setupact.log
    2014-10-12 18:55 - 2014-10-12 18:55 - 00000000 ____C () C:\Windows\setuperr.log
    2014-10-12 18:54 - 2014-10-15 19:54 - 00442096 ____C () C:\Windows\system32\FNTCACHE.DAT
    2014-10-12 01:56 - 2014-10-12 01:56 - 00004096 ___SH () C:\VSM000.IDX
    2014-10-12 01:45 - 2014-10-12 01:53 - 00000000 ___DC () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StorageCraft
    2014-10-11 17:43 - 2014-10-14 15:25 - 00000000 ___DC () C:\Users\Yaakov Laks\Desktop\spybot
    2014-10-10 23:29 - 2014-10-10 23:30 - 14349744 ____C (Malwarebytes Corp.) C:\Users\Yaakov Laks\Downloads\mbar-1.07.0.1012.exe
    2014-10-10 12:18 - 2014-10-10 12:18 - 00000528 ____C () C:\Users\Yaakov Laks\Desktop\תת עריכה עד 2-1-14.txt
    2014-10-09 13:01 - 2014-10-09 13:01 - 00000000 ___HC () C:\Users\Yaakov Laks\Documents\Default.rdp
    2014-10-08 18:12 - 2014-10-16 02:32 - 00000000 ___DC () C:\Users\Yaakov Laks\Desktop\מסמך טיוטת מדיניות 201308
    2014-10-06 21:17 - 2014-10-06 21:17 - 00000841 ____C () C:\Users\Yaakov Laks\Desktop\אילתי בפייס.URL
    2014-10-06 17:06 - 2014-10-06 17:06 - 00895120 ____C (Google Inc.) C:\Users\Yaakov Laks\Downloads\GoogleEarthSetup(1).exe
    2014-10-06 11:22 - 2014-10-06 11:22 - 00895120 ____C (Google Inc.) C:\Users\Yaakov Laks\Downloads\GoogleEarthSetup.exe
    2014-10-03 09:03 - 2014-10-03 09:04 - 00000000 ___DC () C:\Users\Yaakov Laks\Desktop\תמונות למיון
    2014-10-03 01:44 - 2014-10-03 01:44 - 00000000 ___DC () C:\Users\Yaakov Laks\AppData\Local\TB
    2014-10-01 09:39 - 2014-10-01 09:45 - 00519680 _____ (Microsoft Corporation) C:\Windows\system32\qdvd.dll
    2014-09-30 01:17 - 2014-09-30 01:18 - 04965896 ____C (Piriform Ltd) C:\Users\Yaakov Laks\Downloads\ccsetup418(1).exe
    2014-09-30 01:17 - 2014-09-30 01:17 - 04965896 ____C (Piriform Ltd) C:\Users\Yaakov Laks\Downloads\ccsetup418.exe
    2014-09-25 18:41 - 2014-09-25 18:41 - 01626568 ____C () C:\Users\Yaakov Laks\Downloads\setup_Pixum_Fotoboek.exe
    2014-09-24 19:44 - 2014-09-25 00:03 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
    2014-09-23 18:59 - 2014-09-23 18:59 - 00000000 ___DC () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
    2014-09-23 18:59 - 2014-09-23 18:59 - 00000000 ___DC () C:\Program Files\Common Files\Skype
    2014-09-22 23:00 - 2014-09-22 23:00 - 00718552 ____C (Realtek ) C:\Windows\system32\Drivers\Rt86win7.sys
    2014-09-22 23:00 - 2014-09-22 23:00 - 00076872 ____C (Realtek Semiconductor Corporation) C:\Windows\system32\RtNicProp32.dll

    ==================== One Month Modified Files and Folders =======

    (If an entry is included in the fixlist, the file\folder will be moved.)

    2014-10-16 08:44 - 2013-08-29 09:28 - 00000926 ____C () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
    2014-10-16 08:42 - 2014-01-26 00:44 - 00000830 ____C () C:\Windows\Tasks\Adobe Flash Player Updater.job
    2014-10-16 08:31 - 2014-03-13 17:44 - 00000000 ___DC () C:\Program Files\Giraffic
    2014-10-16 08:22 - 2013-08-25 17:32 - 00000000 ___DC () C:\Users\Yaakov Laks\AppData\Roaming\MailWasherPro
    2014-10-16 06:44 - 2013-08-29 09:28 - 00000922 ____C () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
    2014-10-16 05:05 - 2009-07-14 05:37 - 00000000 ___DC () C:\Windows\Microsoft.NET
    2014-10-16 03:24 - 2014-06-01 23:20 - 01843658 ____C () C:\Windows\WindowsUpdate.log
    2014-10-16 02:01 - 2013-08-24 04:21 - 00000000 ___DC () C:\Users\Yaakov Laks\Desktop\111פוספטים
    2014-10-15 20:12 - 2009-07-14 07:34 - 00014832 ___HC () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
    2014-10-15 20:12 - 2009-07-14 07:34 - 00014832 ___HC () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
    2014-10-15 20:01 - 2014-03-13 17:44 - 00000000 ___DC () C:\ProgramData\Giraffic
    2014-10-15 19:59 - 2009-07-14 07:53 - 00000006 ___HC () C:\Windows\Tasks\SA.DAT
    2014-10-15 19:50 - 2013-08-24 01:10 - 00000000 ___DC () C:\ProgramData\Microsoft Help
    2014-10-15 19:41 - 2013-08-23 17:47 - 00000000 ___DC () C:\Windows\system32\MRT
    2014-10-15 19:25 - 2013-08-23 17:47 - 100290944 ____C (Microsoft Corporation) C:\Windows\system32\MRT.exe
    2014-10-15 19:23 - 2009-07-14 05:37 - 00000000 ___DC () C:\Program Files\Common Files\microsoft shared
    2014-10-15 19:18 - 2008-08-28 12:51 - 00391640 __RSH () C:\bootmgr
    2014-10-15 18:59 - 2013-08-23 16:41 - 00000000 ___DC () C:\Users\Yaakov Laks
    2014-10-15 18:58 - 2013-09-06 02:32 - 00000000 ___DC () C:\Windows\Minidump
    2014-10-15 18:58 - 2012-03-24 20:52 - 00179521 ____N () C:\Windows\Minidump\101514-29905-01.dmp
    2014-10-14 22:04 - 2013-11-05 08:40 - 00000000 ___DC () C:\ProgramData\ProductData
    2014-10-14 09:24 - 2009-07-14 05:37 - 00000000 ___DC () C:\Windows\system32\LogFiles
    2014-10-13 16:05 - 2013-10-07 10:46 - 00000000 ___DC () C:\AdwCleaner
    2014-10-13 11:54 - 2009-07-14 05:37 - 00000000 ___DC () C:\Windows\system32\NDF
    2014-10-12 20:47 - 2013-08-23 16:41 - 00782470 ____C () C:\Windows\system32\PerfStringBackup.INI
    2014-10-12 19:14 - 2013-08-23 18:08 - 00000000 ___DC () C:\Users\Yaakov Laks\AppData\Roaming\Skype
    2014-10-12 01:53 - 2014-09-07 02:15 - 00102824 ____C (StorageCraft Technology Corporation) C:\Windows\system32\Drivers\sbmount.sys
    2014-10-12 00:22 - 2013-09-07 08:06 - 00000000 ___DC () C:\Users\Yaakov Laks\AppData\Roaming\Notepad++
    2014-10-11 05:22 - 2013-08-31 13:37 - 00000000 ___DC () C:\ProgramData\Malwarebytes' Anti-Malware (portable)
    2014-10-10 00:48 - 2014-08-16 07:29 - 00000000 ___DC () C:\Users\Yaakov Laks\AppData\Local\Adobe
    2014-10-10 00:47 - 2013-12-04 06:33 - 00701104 ____C (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
    2014-10-10 00:47 - 2013-12-04 06:33 - 00071344 ____C (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
    2014-10-09 13:29 - 2014-03-20 16:06 - 00000000 ___DC () C:\Users\Yaakov Laks\.gimp-2.8
    2014-10-09 13:02 - 2014-04-21 10:18 - 00001259 ____C () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Movie Maker.lnk
    2014-10-09 13:02 - 2014-04-21 10:18 - 00000000 __RDC () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live
    2014-10-09 13:02 - 2013-08-24 02:55 - 00001328 ____C () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Photo Gallery.lnk
    2014-10-09 13:00 - 2013-08-24 02:55 - 00001412 ____C () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live Mail.lnk
    2014-10-07 22:40 - 2013-09-08 09:39 - 00000000 ___DC () C:\Users\Yaakov Laks\AppData\Roaming\Audacity
    2014-10-07 22:40 - 2013-08-24 02:15 - 00000000 ___DC () C:\Users\Yaakov Laks\AppData\Roaming\vlc
    2014-10-07 16:04 - 2013-08-24 04:21 - 00000000 ___DC () C:\Users\Yaakov Laks\Desktop\111עבודה שחורה
    2014-10-06 11:21 - 2013-12-03 11:17 - 00044569 ____C () C:\Users\Yaakov Laks\Desktop\קליאו.xlsx
    2014-09-27 10:58 - 2013-08-24 05:45 - 00000000 ___DC () C:\Users\Yaakov Laks\Desktop\11מפלגת העבודה
    2014-09-26 19:34 - 2013-08-26 23:40 - 00000000 ___DC () C:\Windows\rescache
    2014-09-24 08:25 - 2013-08-27 19:47 - 00002441 ____C () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
    2014-09-23 19:01 - 2013-08-23 18:08 - 00000000 __RDC () C:\Program Files\Skype
    2014-09-23 18:59 - 2013-08-23 18:08 - 00000000 ___DC () C:\ProgramData\Skype
    2014-09-22 23:00 - 2011-06-10 06:34 - 00100896 ____C (Realtek Semiconductor Corporation) C:\Windows\system32\RTNUninst32.dll
    2014-09-22 09:41 - 2013-08-23 17:14 - 00231568 ____C (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe

    Some content of TEMP:
    ====================
    C:\Users\Yaakov Laks\AppData\Local\Temp\BackupSetup.exe
    C:\Users\Yaakov Laks\AppData\Local\Temp\NOSEventMessages.dll
    C:\Users\Yaakov Laks\AppData\Local\Temp\PF7_87d4.exe
    C:\Users\Yaakov Laks\AppData\Local\Temp\Quarantine.exe
    C:\Users\Yaakov Laks\AppData\Local\Temp\sqlite3.dll


    ==================== Bamital & volsnap Check =================

    (There is no automatic fix for files that do not pass verification.)

    C:\Windows\explorer.exe => File is digitally signed
    C:\Windows\system32\winlogon.exe => File is digitally signed
    C:\Windows\system32\wininit.exe => File is digitally signed
    C:\Windows\system32\svchost.exe => File is digitally signed
    C:\Windows\system32\services.exe => File is digitally signed
    C:\Windows\system32\User32.dll => File is digitally signed
    C:\Windows\system32\userinit.exe => File is digitally signed
    C:\Windows\system32\rpcss.dll => File is digitally signed
    C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


    LastRegBack: 2014-10-12 04:50

    ==================== End Of Log ============================
    Attached Files Attached Files
    Last edited by ken545; 2014-10-16 at 12:44. Reason: Pasted FRST Log

  6. #16
    Emeritus-Security Expert
    Join Date
    Nov 2005
    Location
    Florida's SpaceCoast
    Posts
    15,208

    Default

    Open notepad (Start --> All Programs --> Accessories --> Notepad).
    Please copy the entire contents of the code box below.
    (To do this highlight the contents of the box, right click on it and select copy. Right-click in the open notepad and select Paste).
    Save it to the same directory as FRST or FRST64 as fixlist.txt. (it has to be right next to FRST or FRST64) either in a directory you saved FRST or FRST64 or on your desktop if thats where you saved it.
    You can use your mouse to drag Fixlist right next to FRST or FRST64, either above or below it but not on top of it.

    Code:
    Start
    CloseProcesses:
    (IObit) C:\Program Files\IObit\Advanced SystemCare 7\ASCService.exe
    (IObit) C:\Program Files\IObit\Smart Defrag 3\SmartDefrag.exe
    C:\Program Files\IObit
    HKU\S-1-5-18\...\Run: [Advanced SystemCare 7] => C:\Program Files\IObit\Advanced SystemCare 7\ASCTray.exe [2295584 2014-04-21] (IObit)
    BHO: ExplorerWnd Helper -> {10921475-03CE-4E04-90CE-E2E7EF20C814} -> D:\Program Files\1Maint\IObit Uninstaller\UninstallExplorer32.dll No File
    CHR HKLM\...\Chrome\Extension: [nfengeggddojhakldhlpjdlddgkkjkdd] - C:\Program Files\IObit\Surfing Protection\BrowerProtect\ASC_GhromePlugin.crx [2014-07-14]
    R2 AdvancedSystemCareService7; C:\Program Files\IObit\Advanced SystemCare 7\ASCService.exe [881952 2014-01-14] (IObit)
    S2 LiveUpdateSvc; C:\Program Files\IObit\LiveUpdate\LiveUpdate.exe [2152736 2014-05-04] (IObit)
    R2 PfFilter; C:\Program Files\IObit\Protected Folder\pffilter.sys [34336 2013-04-03] (IObit Information Technology)
    R0 SmartDefragDriver; C:\Windows\System32\Drivers\SmartDefragDriver.sys [18624 2014-06-04] (IObit)
    IObit Apps Toolbar v9.0 (HKLM\...\{48C13178-64E2-4964-9927-B71A04074D08}) (Version: 9.0 - Spigot, Inc.) <==== ATTENTION
    Task: {10E97F4F-0DFB-45D8-900F-E382E39C8576} - System32\Tasks\LaunchSignup => C:\Program Files\MyPC Backup\Signup Wizard.exe <==== ATTENTION
    C:\Program Files\MyPC Backup
    Task: {22E7CAFD-204F-4241-9690-CF391713F5A8} - System32\Tasks\SmartDefrag3_Update => C:\Program Files\IObit\Smart Defrag 3\AutoUpdate.exe [2014-07-03] (IObit)
    Task: {93854466-00E7-4E7D-8F16-2A6F59186783} - \Driver Booster SkipUAC (Yaakov Laks) No Task File <==== ATTENTION
    Task: {BAD370E6-0C9E-43E3-BA3C-7E15B5F7CAF3} - System32\Tasks\SmartDefrag3_Startup => C:\Program Files\IObit\Smart Defrag 3\SmartDefrag.exe [2014-07-02] (IObit)
    Task: {D813746A-2799-4837-9DF2-CB42F33576E7} - \Driver Booster SkipUAC (SYSTEM) No Task File <==== ATTENTION
    Task: {DDBC0950-20BB-43A1-85CE-F57DACB08C1F} - System32\Tasks\ASC7_SkipUac_Yaakov Laks => C:\Program Files\IObit\Advanced SystemCare 7\ASC.exe [2014-05-29] (IObit)
    2014-03-20 10:12 - 2013-10-25 12:08 - 00517408 ____C () C:\Program Files\IObit\Advanced SystemCare 7\sqlite3.dll
    Hosts:
    EmptyTemp:
    End
    NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

    Then open FRST or FRST64 and click on fix
    When finished FRST will generate a log on the Desktop (Fixlog.txt). Please post it to your reply.
    Microsoft MVP Consumer Security 2007-2008-2009-2010-2011-2012-2013-2014

    ERROR MESSAGE 386
    No KeyBoard Detected
    Press F1 To Continue

    Just a reminder that threads will be closed if no reply in 3 days.

  7. #17
    Junior Member
    Join Date
    Oct 2014
    Posts
    12

    Default frst fix log

    Shalom Ken,
    Frst fixed using the script you sent.

    I looked at the log and found the following which I'll try correct manually.
    At least one looks like a typo: ghrome instead of chrome.
    I 'll use find in regedit to locate the spigot and try to get a special sytem permit in case i'll have no access.
    When finished I'll tell you.
    The log file was too large, I zipped it.
    yours
    laksi

    C:\Program Files\IObit\Surfing Protection\BrowerProtect\ASC_GhromePlugin.crx" => File/Directory not found.
    IObit Apps Toolbar v9.0 (HKLM\...\{48C13178-64E2-4964-9927-B71A04074D08}) (Version: 9.0 - Spigot, Inc.) <==== ATTENTION => Error: No automatic fix found for this entry.
    "C:\Program Files\MyPC Backup" => File/Directory not found.
    "C:\Program Files\IObit\Advanced SystemCare 7\sqlite3.dll" => File/Directory not found.
    Attached Files Attached Files

  8. #18
    Emeritus-Security Expert
    Join Date
    Nov 2005
    Location
    Florida's SpaceCoast
    Posts
    15,208

    Default

    Good, looks like your good to go.
    Microsoft MVP Consumer Security 2007-2008-2009-2010-2011-2012-2013-2014

    ERROR MESSAGE 386
    No KeyBoard Detected
    Press F1 To Continue

    Just a reminder that threads will be closed if no reply in 3 days.

  9. #19
    Junior Member
    Join Date
    Oct 2014
    Posts
    12

    Default Manual cleaning

    Shalom Ken,
    I found and deleted two Iobit folders under c:/users/yaakov laks/AppData/LocalLow
    One of them contained 5 Files, 3 Folders, The Other one "IObit Apps" contained 1 File, 2 Folders
    c:/users/yaakov laks/AppData/roaming also had an IObit folder 123 Files, 25 Folders - all deleted
    c:/users/all users/IObit 42 Files, 9 Folders - all deleted for these I had to use admin auth.
    users/default had them under AppData/Roaming I forgot to check number of folders and files - deleted using admin.
    These guys really get under your (comuter's) skin :-)
    MyPC Backup was found under Program Data Quarantined by... Spybot CHEERS :-)


    Spigot was found also under HKLM/.../HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\34B66CF356D744245B0C8EDE24AC03DC.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\62F013B2CCF0DEE4EB7CB83D7A21280C
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\8740C21CF79D2514E94A247F4DEFE091
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E83F13912F1FBF64390A163E8464B6C7
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F3157AA407841454BB0C9BE8D1982BC9
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\87131C842E46469499727BA14070D480\InstallProperties
    HKEY_USERS\S-1-5-21-2920106312-904050420-1618604034-1001\Software\Microsoft\Internet Explorer\SearchScopes\{7DAAAB92-E210-43F8-AA79-83FD3E90890A}
    HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes
    I didn't delete them, waiting for your instructions
    I deleted this one: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{48C13178-64E2-4964-9927-B71A04074D08}

    While searching for spigot I saw IObit in the registry, searched the registry, found and deleted a few dozen.
    I'll now use my Jv16 or ccleaner to wipe the rest of them.

    yours
    laksi

  10. #20
    Emeritus-Security Expert
    Join Date
    Nov 2005
    Location
    Florida's SpaceCoast
    Posts
    15,208

    Default

    Go ahead and clean them the best you can, when your done open FRST and copy and paste this in

    Iobit
    Then click on Search Files



    When its done


    Iobit
    Search Registry
    Last edited by ken545; 2014-10-16 at 22:38.
    Microsoft MVP Consumer Security 2007-2008-2009-2010-2011-2012-2013-2014

    ERROR MESSAGE 386
    No KeyBoard Detected
    Press F1 To Continue

    Just a reminder that threads will be closed if no reply in 3 days.

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •