View Full Version : Win32.Downloader.gen
Hi all,
I ran Spybot and found:
11820
I broused to C:/END and it contained: ConduitOK.
I searched the entire disk for: Conduit; Win32.Downloader.gen; verupd.exe - none found.
I searched services for both: Win32.Downloader.gen; verupd.exe - none found.
I am still a little worried as I might have overlooked something.
Pleaese advise.
cordially
laksi
:snwelcome:
You need to read this , its hard to assist someone without seeing any scans or info on which operating system you use
http://forums.spybot.info/showthread.php?288-quot-BEFORE-You-POST-quot-(Please-read-this-Procedure-Before-Requesting-Assistance)-Updated
http://i.imgur.com/1QYkxTZ.jpg Please download aswMBR (http://public.avast.com/~gmerek/aswMBR.exe) to your desktop.
Double click the aswMBR icon to run it.
Click the Scan button to start scan.
If you are asked to update the Avast Virus database please allow it to do so.
When it finishes, press the save log button, save the logfile to your desktop and post its contents in your next reply.
I just want to see the report....Please Do Not Fix Anything
============================================================================
Please download Farbar Recovery Scan Tool (http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/) and save it to your desktop.
Note: You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.
How to determine whether a computer is running a 32-bit version or 64-bit version of the Windows operating system
A simple way to check your system: Start --> Computer (right click) --> Properties
Right click to run as administrator (XP users click run after receipt of Windows Security Warning - Open File). When the tool opens click Yes to disclaimer.
Please make sure All Users is checked
Do not check
*List BCD
*Drivers MD5
*Shortcut txt
Press Scan button.
It will produce a log called FRST.txt in the same directory the tool is run from.
Please copy and paste log back here.
The first time the tool is run it generates another log (Addition.txt - also located in the same directory as FRST.exe/FRST64.exe). Please also paste that along with the FRST.txt into your reply.
Hi and thanks for prompt reply,
I just read this:
If one has already run tools/fixes before posting please inform your helper, so that s/he is aware changes may have been made to the system and why. Running fixes before being assisted can destroy evidence in an infection, leaving the malware difficult to detect. Please do not attempt to "do it yourself" while waiting for someone to respond to your topic.
Before contacting this forum I ran MalwareBytes and fixed minor issues it found. I also ran MBAR's AntiRootkit Chameleon which found nothing.
I then ran SpyBot which found Win32.Downloader.gen or a shadow of it in C:/End - contnets: ConduitOK
I then fixed all.
I now proceed with your instructions.
Sincerely
laksi
logs are attached
yours
laksi
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 12-10-2014 01
Ran by Yaakov Laks (administrator) on LAPTOSH-PC on 13-10-2014 13:20:46
Running from E:\F\Downloads\DLSoftware 15\SpyBot
Loaded Profile: Yaakov Laks (Available profiles: Yaakov Laks)
Platform: Microsoft Windows 7 Home Premium Service Pack 1 (X86) OS Language: English (United States)
Internet Explorer Version 11
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(IObit) C:\Program Files\IObit\Advanced SystemCare 7\ASCService.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(IObit) C:\Program Files\IObit\IObit Malware Fighter\IMFsrv.exe
(Microsoft Corporation) C:\Program Files\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe
(Microsoft Corporation) C:\Program Files\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe
(Brio) D:\Program Files\1Utils\Folder Size\FolderSizeSvc.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
(Giraffic) C:\Program Files\Giraffic\GirafficWatchdog.exe
(IObit) C:\Program Files\IObit\Smart Defrag 3\SmartDefrag.exe
(Google Inc.) C:\Program Files\Google\Update\1.3.24.15\GoogleCrashHandler.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Synaptics, Inc.) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\VS7DEBUG\mdm.exe
(Safer-Networking Ltd.) D:\Program Files\1AntiVandals\Spybot - Search & Destroy 2\SDTray.exe
(Giraffic) C:\Program Files\Giraffic\Giraffic.exe
(Chicony) C:\Program Files\Camera Assistant Software for Toshiba\traybar.exe
() C:\Program Files\Hosts_Anti_Adwares_PUPs\HOSTS_Anti-Adware_main.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Nokia) C:\Program Files\Nokia\Nokia Suite\NokiaSuite.exe
(Akamai Technologies, Inc.) C:\Users\Yaakov Laks\AppData\Local\Akamai\netsession_win.exe
(Akamai Technologies, Inc.) C:\Users\Yaakov Laks\AppData\Local\Akamai\netsession_win.exe
() C:\Program Files\G9G11_ScreenCapture\ScreenCapture.exe
(Secunia) C:\Program Files\Secunia\PSI\psia.exe
(Secunia) C:\Program Files\Secunia\PSI\sua.exe
(Toshiba Europe GmbH) D:\Program Files\1Maint\Toshiba TEMPRO\TemproSvc.exe
(TOSHIBA Corporation) D:\Program Files\TOSHIBA\TOSHIBA DVD PLAYER\TNaviSrv.exe
(Secunia) C:\Program Files\Secunia\PSI\psi_tray.exe
(IObit) C:\Program Files\IObit\IObit Malware Fighter\IMF.exe
(Firetrust Ltd) D:\Program Files\1AntiVandals\MailWasher Pro654\MailWasher Pro\MailWasher.exe
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
(Piriform Ltd) D:\Program Files\1Maint\ccleaner\CCleaner.exe
(Safer-Networking Ltd.) D:\Program Files\1AntiVandals\Spybot - Search & Destroy 2\SDUpdSvc.exe
(Safer-Networking Ltd.) D:\Program Files\1AntiVandals\Spybot - Search & Destroy 2\SDWSCSvc.exe
(Microsoft Corporation) C:\Windows\System32\wbem\unsecapp.exe
(StorageCraft Technology Corporation) D:\Program Files\1Maint\StorageCraft\vsnapvss.exe
(Nokia) C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
(Safer-Networking Ltd.) D:\Program Files\1AntiVandals\Spybot - Search & Destroy 2\SDFSSvc.exe
(Nokia) C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe
(Nokia) C:\Program Files\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
(Synaptics, Inc.) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(LSI Corporation) C:\Program Files\LSI SoftModem\agrsmsvc.exe
(Adobe Systems Incorporated) D:\Program Files\Adobe\Reader\AcroRd32.exe
(Adobe Systems Incorporated) D:\Program Files\Adobe\Reader\AcroRd32.exe
(Mozilla Corporation) D:\Program Files\Firefox\firefox.exe
(Mozilla Corporation) D:\Program Files\Firefox\plugin-container.exe
(Adobe Systems, Inc.) C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_15_0_0_152.exe
(Adobe Systems, Inc.) C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_15_0_0_152.exe
(Microsoft Corporation) C:\Program Files\Windows Live\Mail\wlmail.exe
(Microsoft Corporation) C:\Program Files\Windows Live\Contacts\wlcomm.exe
(Microsoft Corporation) C:\Windows\System32\Dxpserver.exe
(Microsoft Corporation) C:\Windows\System32\DeviceDisplayObjectProvider.exe
(Microsoft Corporation) C:\Windows\System32\Dxpserver.exe
(AVAST Software) E:\F\Downloads\DLSoftware 15\SpyBot\aswMBR.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [MSC] => C:\Program Files\Microsoft Security Client\msseces.exe [974432 2014-08-22] (Microsoft Corporation)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1348904 2008-08-14] (Synaptics, Inc.)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [12021464 2014-07-21] (Realtek Semiconductor)
HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959176 2014-08-21] (Adobe Systems Incorporated)
HKLM\...\Run: [SDTray] => D:\Program Files\1AntiVandals\Spybot - Search & Destroy 2\SDTray.exe [5624784 2013-07-25] (Safer-Networking Ltd.)
HKLM\...\Run: [Camera Assistant Software] => C:\Program Files\Camera Assistant Software for Toshiba\traybar.exe [417792 2009-04-10] (Chicony)
HKLM\...\Run: [HOSTS Anti-Adware_PUPs] => C:\Program Files\Hosts_Anti_Adwares_PUPs\HOSTS_Anti-Adware_main.exe [302961 2013-10-07] ()
HKLM\...\Run: [] => [X]
HKLM\...\Run: [IObit Malware Fighter] => C:\Program Files\IObit\IObit Malware Fighter\IMF.exe [1601856 2014-05-23] (IObit)
HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [256896 2014-07-25] (Oracle Corporation)
Winlogon\Notify\SDWinLogon: SDWinLogon.dll [X]
HKU\S-1-5-21-2920106312-904050420-1618604034-1001\...\Run: [] => [X]
HKU\S-1-5-21-2920106312-904050420-1618604034-1001\...\Run: [NokiaSuite.exe] => C:\Program Files\Nokia\Nokia Suite\NokiaSuite.exe [1090912 2013-10-02] (Nokia)
HKU\S-1-5-21-2920106312-904050420-1618604034-1001\...\Run: [Akamai NetSession Interface] => C:\Users\Yaakov Laks\AppData\Local\Akamai\netsession_win.exe [4672920 2014-04-17] (Akamai Technologies, Inc.)
HKU\S-1-5-21-2920106312-904050420-1618604034-1001\...\Run: [OscarEditor] => C:\Program Files\G9G11_ScreenCapture\ScreenCapture.exe [3538944 2012-05-18] ()
HKU\S-1-5-21-2920106312-904050420-1618604034-1001\...\Run: [CCleaner Monitoring] => D:\Program Files\1Maint\ccleaner\CCleaner.exe [4811032 2014-09-26] (Piriform Ltd)
HKU\S-1-5-21-2920106312-904050420-1618604034-1001\...\Policies\Explorer: [NoFavoritesMenu] 1
HKU\S-1-5-18\...\Run: [Advanced SystemCare 7] => C:\Program Files\IObit\Advanced SystemCare 7\ASCTray.exe [2295584 2014-04-21] (IObit)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Secunia PSI Tray.lnk
ShortcutTarget: Secunia PSI Tray.lnk -> C:\Program Files\Secunia\PSI\psi_tray.exe (Secunia)
Startup: C:\Users\Yaakov Laks\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MailWasherPro.lnk
ShortcutTarget: MailWasherPro.lnk -> D:\Program Files\1AntiVandals\MailWasher Pro654\MailWasher Pro\MailWasher.exe (Firetrust Ltd)
ShellIconOverlayIdentifiers: [GDriveBlacklistedOverlay] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42} => C:\Program Files\Google\Drive\googledrivesync32.dll (Google)
ShellIconOverlayIdentifiers: [GDriveSharedEditOverlay] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44} => C:\Program Files\Google\Drive\googledrivesync32.dll (Google)
ShellIconOverlayIdentifiers: [GDriveSharedViewOverlay] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43} => C:\Program Files\Google\Drive\googledrivesync32.dll (Google)
ShellIconOverlayIdentifiers: [GDriveSyncedOverlay] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40} => C:\Program Files\Google\Drive\googledrivesync32.dll (Google)
ShellIconOverlayIdentifiers: [GDriveSyncingOverlay] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41} => C:\Program Files\Google\Drive\googledrivesync32.dll (Google)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = he-IL
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x4C67C112E0E3CF01
URLSearchHook: HKCU - IObit Apps Toolbar - {03EB0E9C-7A91-4381-A220-9B52B641CDB1} - C:\Program Files\IObit Apps Toolbar\IE\9.0\iobitappsToolbarIE.dll (Spigot, Inc.)
SearchScopes: HKLM - DefaultScope {BB8E83F6-B1EF-4F91-95FF-ABFFBB9D8DDF} URL =
SearchScopes: HKCU - {7DAAAB92-E210-43F8-AA79-83FD3E90890A} URL = http://search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=902615&p={searchTerms}
BHO: IObit Apps Toolbar -> {03EB0E9C-7A91-4381-A220-9B52B641CDB1} -> C:\Program Files\IObit Apps Toolbar\IE\9.0\iobitappsToolbarIE.dll (Spigot, Inc.)
BHO: ExplorerWnd Helper -> {10921475-03CE-4E04-90CE-E2E7EF20C814} -> D:\Program Files\1Maint\IObit Uninstaller\UninstallExplorer32.dll (IObit)
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Ads Removal -> {9D974C8C-6D92-44FB-BEAF-B45A1C0CF17F} -> C:\Program Files\IObit\IObit Malware Fighter\adsremoval\IE\Adblock.dll (Adblock)
BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
BHO: Advanced SystemCare Browser Protection -> {BA0C978D-D909-49B6-AFE2-8BDE245DC7E6} -> C:\Program Files\IObit\Surfing Protection\BrowerProtect\ASCPlugin_Protection.dll (IObit)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - IObit Apps Toolbar - {03EB0E9C-7A91-4381-A220-9B52B641CDB1} - C:\Program Files\IObit Apps Toolbar\IE\9.0\iobitappsToolbarIE.dll (Spigot, Inc.)
Handler: belarc - {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - C:\Program Files\Belarc\Advisor\System\BAVoilaX.dll (Belarc, Inc.)
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 80.179.52.100 80.179.55.100
FireFox:
========
FF ProfilePath: C:\Users\Yaakov Laks\AppData\Roaming\Mozilla\Firefox\Profiles\9l7tyrid.default-1405248970516
FF Homepage: about:home
FF Keyword.URL: hxxp://trovi.com/ResultsExt.aspx?ctid=CT3202343&SearchSource=2&CUI=UN22221367211835714&UM=4&q=
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_15_0_0_152.dll ()
FF Plugin: @adobe.com/ShockwavePlayer -> C:\Windows\system32\Adobe\Director\np32dsw_1213153.dll (Adobe Systems, Inc.)
FF Plugin: @Google.com/GoogleEarthPlugin -> C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin: @java.com/DTPlugin,version=10.67.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.67.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE -> C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/VirtualEarth3D,version=4.0 -> C:\Program Files\Virtual Earth 3D\ ()
FF Plugin: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @nokia.com/EnablerPlugin -> C:\Program Files\Nokia\Nokia Suite\npNokiaSuiteEnabler.dll ( )
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @videolan.org/vlc,version=2.0.8 -> D:\Program Files\1Viewers\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.2 -> D:\Program Files\1Viewers\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.3 -> D:\Program Files\1Viewers\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.5 -> D:\Program Files\1Viewers\VLC\npvlc.dll (VideoLAN)
FF Plugin: Adobe Reader -> D:\Program Files\Adobe\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\Yaakov Laks\AppData\Roaming\Mozilla\Firefox\Profiles\9l7tyrid.default-1405248970516\searchplugins\nana10-customized-web-search.xml
FF Extension: Ads Removal - C:\Users\Yaakov Laks\AppData\Roaming\Mozilla\Firefox\Profiles\9l7tyrid.default-1405248970516\Extensions\adremoveext@adremoveext.net [2014-08-25]
FF Extension: Advanced SystemCare Surfing Protection - C:\Users\Yaakov Laks\AppData\Roaming\Mozilla\Firefox\Profiles\9l7tyrid.default-1405248970516\Extensions\ascsurfingprotection@iobit.com [2014-08-10]
FF Extension: Adblock Plus - C:\Users\Yaakov Laks\AppData\Roaming\Mozilla\Firefox\Profiles\9l7tyrid.default-1405248970516\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-08-21]
FF Extension: IObit Apps Toolbar - C:\Program Files\IObit Apps Toolbar\FF [2014-04-09]
FF StartMenuInternet: FIREFOX.EXE - D:\Program Files\Firefox\firefox.exe
Chrome:
=======
CHR HomePage: Default ->
CHR StartupUrls: Default -> ""
CHR DefaultSuggestURL: Default -> {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&gs_ri={google:suggestRid}&xssi=t&q={searchTerms}&{google:inputType}{google:cursorPosition}{google:currentPageUrl}{google:pageClassification}{google:searchVersion}{google:sessionToken}{google:prefetchQuery}sugkey={google:suggestAPIKeyParameter}
CHR Profile: C:\Users\Yaakov Laks\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Docs) - C:\Users\Yaakov Laks\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2013-09-08]
CHR Extension: (כונן Google) - C:\Users\Yaakov Laks\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-09-08]
CHR Extension: (Advanced SystemCare Surfing Protection) - C:\Users\Yaakov Laks\AppData\Local\Google\Chrome\User Data\Default\Extensions\bbmegnmpleoagolcnjnejdacakedpcgd [2014-03-20]
CHR Extension: (YouTube) - C:\Users\Yaakov Laks\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-09-08]
CHR Extension: (חיפוש Google) - C:\Users\Yaakov Laks\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-09-08]
CHR Extension: (Ads Removal) - C:\Users\Yaakov Laks\AppData\Local\Google\Chrome\User Data\Default\Extensions\fopdddcinljmpmioaklghcalngfhbaen [2014-02-28]
CHR Extension: (AD Block) - C:\Users\Yaakov Laks\AppData\Local\Google\Chrome\User Data\Default\Extensions\lfgjbmhakaffflkjecineeaadpidgikb [2014-01-15]
CHR Extension: (Advanced SystemCare Surfing Protection) - C:\Users\Yaakov Laks\AppData\Local\Google\Chrome\User Data\Default\Extensions\nfengeggddojhakldhlpjdlddgkkjkdd [2014-03-20]
CHR Extension: (תוספת RSS Subscription (מאת Google)) - C:\Users\Yaakov Laks\AppData\Local\Google\Chrome\User Data\Default\Extensions\nlbjncdgjeocebhnmkbbbdekmmmcbfjd [2014-03-09]
CHR Extension: (Google Wallet) - C:\Users\Yaakov Laks\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-08]
CHR Extension: (Nana10) - C:\Users\Yaakov Laks\AppData\Local\Google\Chrome\User Data\Default\Extensions\okemjkdkkihnhdaanohnleknbaddlddb [2014-10-10]
CHR Extension: (Gmail) - C:\Users\Yaakov Laks\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-09-08]
CHR Profile: C:\Users\Yaakov Laks\AppData\Local\Google\Chrome\User Data\Profile 1
CHR Extension: (Google Docs) - C:\Users\Yaakov Laks\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\aohghmighlieiainnegkcijnfilokake [2014-05-24]
CHR Extension: (Google Drive) - C:\Users\Yaakov Laks\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-05-24]
CHR Extension: (YouTube) - C:\Users\Yaakov Laks\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-05-24]
CHR Extension: (Google Search) - C:\Users\Yaakov Laks\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-05-24]
CHR Extension: (Advanced SystemCare Surfing Protection) - C:\Users\Yaakov Laks\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\nfengeggddojhakldhlpjdlddgkkjkdd [2014-05-24]
CHR Extension: (Google Wallet) - C:\Users\Yaakov Laks\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-05-24]
CHR Extension: (No Name) - C:\Users\Yaakov Laks\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\okemjkdkkihnhdaanohnleknbaddlddb [2014-10-03]
CHR Extension: (Gmail) - C:\Users\Yaakov Laks\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-05-24]
CHR HKLM\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files\Skype\Toolbars\ChromeExtension\skype_chrome_extension.crx [2014-07-14]
CHR HKLM\...\Chrome\Extension: [nfengeggddojhakldhlpjdlddgkkjkdd] - C:\Program Files\IObit\Surfing Protection\BrowerProtect\ASC_GhromePlugin.crx [2013-11-05]
CHR HKLM\...\Chrome\Extension: [okemjkdkkihnhdaanohnleknbaddlddb] - C:\Users\Yaakov Laks\AppData\Local\CRE\okemjkdkkihnhdaanohnleknbaddlddb.crx [2014-06-26]
CHR HKCU\...\Chrome\Extension: [okemjkdkkihnhdaanohnleknbaddlddb] - C:\Users\Yaakov Laks\AppData\Local\CRE\okemjkdkkihnhdaanohnleknbaddlddb.crx [2014-06-26]
========================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 AdvancedSystemCareService7; C:\Program Files\IObit\Advanced SystemCare 7\ASCService.exe [881952 2014-01-14] (IObit)
R2 AgereModemAudio; C:\Program Files\LSI SoftModem\agrsmsvc.exe [14336 2000-01-01] (LSI Corporation)
R2 c2cautoupdatesvc; C:\Program Files\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1390176 2014-07-14] (Microsoft Corporation)
R2 c2cpnrsvc; C:\Program Files\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1767520 2014-07-14] (Microsoft Corporation)
R2 FolderSize; D:\Program Files\1Utils\Folder Size\FolderSizeSvc.exe [116224 2010-04-06] (Brio) [File not signed]
R2 Giraffic; C:\Program Files\Giraffic\GirafficWatchdog.exe [2245232 2013-05-13] (Giraffic)
S2 HOSTS Anti-PUPs; C:\Program Files\Hosts_Anti_Adwares_PUPs\HOSTS_Anti-Adware.exe [285795 2013-10-07] () [File not signed]
R2 IMFservice; C:\Program Files\IObit\IObit Malware Fighter\IMFsrv.exe [342336 2014-05-15] (IObit)
S2 LiveUpdateSvc; C:\Program Files\IObit\LiveUpdate\LiveUpdate.exe [2152736 2014-05-04] (IObit)
R2 MDM; C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe [335872 2006-10-26] (Microsoft Corporation) [File not signed]
R2 MsMpSvc; C:\Program Files\Microsoft Security Client\MsMpEng.exe [22192 2014-08-22] (Microsoft Corporation)
R3 NisSrv; C:\Program Files\Microsoft Security Client\NisSrv.exe [288120 2014-08-22] (Microsoft Corporation)
R2 SDScannerService; D:\Program Files\1AntiVandals\Spybot - Search & Destroy 2\SDFSSvc.exe [1817560 2013-05-16] (Safer-Networking Ltd.)
R2 SDUpdateService; D:\Program Files\1AntiVandals\Spybot - Search & Destroy 2\SDUpdSvc.exe [1033688 2013-05-16] (Safer-Networking Ltd.)
R2 SDWSCService; D:\Program Files\1AntiVandals\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2013-05-15] (Safer-Networking Ltd.)
R2 Secunia PSI Agent; C:\Program Files\Secunia\PSI\PSIA.exe [1228504 2013-07-03] (Secunia)
R2 Secunia Update Agent; C:\Program Files\Secunia\PSI\sua.exe [660184 2013-07-03] (Secunia)
S2 ShadowProtectSvc; D:\Program Files\1Maint\StorageCraft\ShadowProtectSvc.exe [4672336 2014-10-12] (StorageCraft Technology Corporation)
R2 TemproMonitoringService; D:\Program Files\1Maint\Toshiba TEMPRO\TemproSvc.exe [112080 2011-02-10] (Toshiba Europe GmbH)
R2 TNaviSrv; D:\Program Files\TOSHIBA\TOSHIBA DVD PLAYER\TNaviSrv.exe [83312 2008-07-18] (TOSHIBA Corporation)
R2 VSNAPVSS; D:\Program Files\1Maint\StorageCraft\vsnapvss.exe [71976 2014-10-12] (StorageCraft Technology Corporation)
S2 HPSLPSVC; C:\Users\Yaakov Laks\AppData\Local\Temp\7zS669C\hpslpsvc32.dll [X]
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R1 Amfilter; C:\Windows\System32\DRIVERS\Amfilter.sys [8704 2009-08-27] (A4Tech Co.,Ltd.) [File not signed]
S3 Amusbprt; C:\Windows\System32\DRIVERS\Amusbprt.sys [14336 2009-08-27] (A4Tech Co.,Ltd.) [File not signed]
R3 athr; C:\Windows\System32\DRIVERS\athr.sys [3234304 2014-07-22] (Qualcomm Atheros Communications, Inc.)
S3 BroadcomWModem; C:\Windows\System32\DRIVERS\bcmww.sys [118400 2005-06-02] (Broadcom Corporation)
S3 BroadcomWWNIC; C:\Windows\System32\DRIVERS\bcmwwNet.sys [58496 2005-02-09] (Broadcom Corporation)
R3 FileMonitor; C:\Program Files\IObit\IObit Malware Fighter\Drivers\win7_x86\FileMonitor.sys [21480 2013-03-23] (IObit)
R0 giveio; C:\Windows\System32\giveio.sys [5248 1996-04-03] () [File not signed]
S3 IT9135BDA; C:\Windows\System32\Drivers\IT9135BDA.sys [123008 2010-12-19] (ITE )
R3 KeyScrambler; C:\Windows\System32\drivers\keyscrambler.sys [209016 2013-05-31] (QFX Software Corporation)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [231800 2014-07-17] (Microsoft Corporation)
R1 MpKsl9f7ce270; C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{D1944752-903C-491D-9CA1-06DD0B9B8497}\MpKsl9f7ce270.sys [39464 2014-10-13] (Microsoft Corporation)
R2 PfFilter; C:\Program Files\IObit\Protected Folder\pffilter.sys [34336 2013-04-03] (IObit Information Technology)
S3 PSI; C:\Windows\System32\DRIVERS\psi_mf_x86.sys [16024 2013-07-03] (Secunia)
R3 RegFilter; C:\Program Files\IObit\IObit Malware Fighter\drivers\win7_x86\regfilter.sys [32288 2013-11-19] (IObit.com)
S3 RTHDMIAzAudService; C:\Windows\System32\drivers\RtHDMIV.sys [141408 2008-02-27] (Realtek Semiconductor Corp.)
R3 rusb3hub; C:\Windows\System32\DRIVERS\rusb3hub.sys [91016 2012-08-27] (Renesas Electronics Corporation)
R3 rusb3xhc; C:\Windows\System32\DRIVERS\rusb3xhc.sys [181128 2012-08-27] (Renesas Electronics Corporation)
R0 SmartDefragDriver; C:\Windows\System32\Drivers\SmartDefragDriver.sys [18624 2014-06-04] (IObit)
R3 SmbDrvI; C:\Windows\System32\DRIVERS\Smb_driver_Intel.sys [27888 2014-01-26] (Synaptics Incorporated)
R0 speedfan; C:\Windows\System32\speedfan.sys [24184 2012-12-29] (Almico Software)
S3 SWDUMon; C:\Windows\System32\DRIVERS\SWDUMon.sys [13464 2014-08-13] ()
R3 UrlFilter; C:\Program Files\IObit\IObit Malware Fighter\drivers\win7_x86\UrlFilter.sys [20944 2013-11-19] (IObit.com)
R3 UVCFTR; C:\Windows\System32\Drivers\UVCFTR_S.SYS [17960 2009-04-10] (Chicony Electronics Co., Ltd.)
U3 aswMBR; \??\C:\Users\YAAKOV~1\AppData\Local\Temp\aswMBR.sys [X]
U3 aswVmm; \??\C:\Users\YAAKOV~1\AppData\Local\Temp\aswVmm.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-10-13 13:20 - 2014-10-13 13:21 - 00000000 ___DC () C:\FRST
2014-10-13 13:17 - 2014-10-13 13:17 - 00000582 ____C () C:\Users\Yaakov Laks\Desktop\aswMBR.txt
2014-10-13 12:54 - 2014-10-13 12:54 - 00000000 ___DC () C:\Users\Yaakov Laks\Desktop\RegBackup
2014-10-13 12:53 - 2014-10-13 12:53 - 00000207 ____C () C:\Windows\tweaking.com-regbackup-LAPTOSH-PC-Microsoft-Windows-7-Home-Premium-(32-bit).dat
2014-10-13 12:52 - 2014-10-13 12:52 - 00000000 ___DC () C:\RegBackup
2014-10-13 12:51 - 2014-10-13 12:51 - 00001002 ____C () C:\Users\Public\Desktop\Tweaking.com - Registry Backup.lnk
2014-10-13 12:51 - 2014-10-13 12:51 - 00000000 ___DC () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Tweaking.com
2014-10-12 18:56 - 2014-10-12 18:56 - 00123160 ____C () C:\Users\Yaakov Laks\AppData\Local\GDIPFONTCACHEV1.DAT
2014-10-12 18:55 - 2014-10-12 19:33 - 00000112 ____C () C:\Windows\setupact.log
2014-10-12 18:55 - 2014-10-12 18:55 - 00000000 ____C () C:\Windows\setuperr.log
2014-10-12 18:54 - 2014-10-12 18:55 - 00442096 ____C () C:\Windows\system32\FNTCACHE.DAT
2014-10-12 01:56 - 2014-10-12 01:56 - 00004096 ___SH () C:\VSM000.IDX
2014-10-12 01:45 - 2014-10-12 01:53 - 00000000 ___DC () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StorageCraft
2014-10-11 17:43 - 2014-10-11 18:38 - 00000000 ___DC () C:\Users\Yaakov Laks\Desktop\spybot
2014-10-10 23:29 - 2014-10-10 23:30 - 14349744 ____C (Malwarebytes Corp.) C:\Users\Yaakov Laks\Downloads\mbar-1.07.0.1012.exe
2014-10-10 12:18 - 2014-10-10 12:18 - 00000528 ____C () C:\Users\Yaakov Laks\Desktop\תת עריכה עד 2-1-14.txt
2014-10-09 13:01 - 2014-10-09 13:01 - 00000000 ___HC () C:\Users\Yaakov Laks\Documents\Default.rdp
2014-10-08 18:12 - 2014-10-12 00:03 - 00000000 ___DC () C:\Users\Yaakov Laks\Desktop\מסמך טיוטת מדיניות 201308
2014-10-07 02:19 - 2014-10-07 02:22 - 00020254 ____C () C:\Users\Yaakov Laks\Desktop\גיבוי של בגצ 6396-96.wbk
2014-10-06 22:35 - 2014-10-06 22:35 - 00044932 ____C () C:\Users\Yaakov Laks\Desktop\הנחייה להוריד שלט מחאה.tif
2014-10-06 21:17 - 2014-10-06 21:17 - 00000841 ____C () C:\Users\Yaakov Laks\Desktop\אילתי בפייס.URL
2014-10-06 17:06 - 2014-10-06 17:06 - 00895120 ____C (Google Inc.) C:\Users\Yaakov Laks\Downloads\GoogleEarthSetup(1).exe
2014-10-06 11:22 - 2014-10-06 11:22 - 00895120 ____C (Google Inc.) C:\Users\Yaakov Laks\Downloads\GoogleEarthSetup.exe
2014-10-03 09:03 - 2014-10-03 09:04 - 00000000 ___DC () C:\Users\Yaakov Laks\Desktop\תמונות למיון
2014-10-03 01:45 - 2014-10-03 12:45 - 00000000 ___DC () C:\Program Files\Tbccint
2014-10-03 01:45 - 2014-10-03 01:45 - 00000000 ___DC () C:\ProgramData\Tbccint
2014-10-03 01:44 - 2014-10-03 01:44 - 00000000 ___DC () C:\Users\Yaakov Laks\AppData\Local\TB
2014-10-03 01:44 - 2014-10-03 01:44 - 00000000 ___DC () C:\Users\Yaakov Laks\AppData\Local\NativeMessaging
2014-10-03 01:43 - 2014-10-03 12:45 - 00000000 ___DC () C:\Users\Yaakov Laks\AppData\Local\tbccint
2014-10-03 01:43 - 2014-10-03 01:43 - 00000000 ___DC () C:\Users\Yaakov Laks\AppData\Local\CRE
2014-10-01 09:39 - 2014-10-01 09:45 - 00519680 _____ (Microsoft Corporation) C:\Windows\system32\qdvd.dll
2014-09-30 01:17 - 2014-09-30 01:18 - 04965896 ____C (Piriform Ltd) C:\Users\Yaakov Laks\Downloads\ccsetup418(1).exe
2014-09-30 01:17 - 2014-09-30 01:17 - 04965896 ____C (Piriform Ltd) C:\Users\Yaakov Laks\Downloads\ccsetup418.exe
2014-09-25 18:41 - 2014-09-25 18:41 - 01626568 ____C () C:\Users\Yaakov Laks\Downloads\setup_Pixum_Fotoboek.exe
2014-09-24 19:44 - 2014-09-25 00:03 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2014-09-23 18:59 - 2014-09-23 18:59 - 00000000 ___DC () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2014-09-23 18:59 - 2014-09-23 18:59 - 00000000 ___DC () C:\Program Files\Common Files\Skype
2014-09-22 23:00 - 2014-09-22 23:00 - 00718552 ____C (Realtek ) C:\Windows\system32\Drivers\Rt86win7.sys
2014-09-22 23:00 - 2014-09-22 23:00 - 00076872 ____C (Realtek Semiconductor Corporation) C:\Windows\system32\RtNicProp32.dll
2014-09-22 22:49 - 2014-09-22 22:49 - 00001064 ____C () C:\Users\Public\Desktop\Driver Booster.lnk
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-10-13 12:58 - 2014-03-13 17:44 - 00000000 ___DC () C:\Program Files\Giraffic
2014-10-13 12:44 - 2013-08-29 09:28 - 00000926 ____C () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-10-13 12:42 - 2014-01-26 00:44 - 00000830 ____C () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-10-13 12:00 - 2014-03-13 17:44 - 00000000 ___DC () C:\ProgramData\Giraffic
2014-10-13 11:54 - 2014-06-01 23:20 - 01942688 ____C () C:\Windows\WindowsUpdate.log
2014-10-13 11:54 - 2009-07-14 05:37 - 00000000 ___DC () C:\Windows\system32\NDF
2014-10-13 10:20 - 2013-08-25 17:32 - 00000000 ___DC () C:\Users\Yaakov Laks\AppData\Roaming\MailWasherPro
2014-10-13 06:57 - 2013-08-29 09:28 - 00000922 ____C () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-10-12 23:00 - 2009-07-14 05:37 - 00000000 ___DC () C:\Windows\system32\LogFiles
2014-10-12 20:47 - 2013-08-23 16:41 - 00782470 ____C () C:\Windows\system32\PerfStringBackup.INI
2014-10-12 19:14 - 2013-08-23 18:08 - 00000000 ___DC () C:\Users\Yaakov Laks\AppData\Roaming\Skype
2014-10-12 19:05 - 2009-07-14 07:34 - 00014832 ___HC () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-10-12 19:05 - 2009-07-14 07:34 - 00014832 ___HC () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-10-12 18:55 - 2009-07-14 07:53 - 00000006 ___HC () C:\Windows\Tasks\SA.DAT
2014-10-12 01:59 - 2013-11-05 08:40 - 00000000 ___DC () C:\ProgramData\ProductData
2014-10-12 01:53 - 2014-09-07 02:15 - 00102824 ____C (StorageCraft Technology Corporation) C:\Windows\system32\Drivers\sbmount.sys
2014-10-12 00:22 - 2013-09-07 08:06 - 00000000 ___DC () C:\Users\Yaakov Laks\AppData\Roaming\Notepad++
2014-10-11 05:22 - 2013-08-31 13:37 - 00000000 ___DC () C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2014-10-10 23:33 - 2014-03-29 02:28 - 00113880 ____C (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-10-10 00:48 - 2014-08-16 07:29 - 00000000 ___DC () C:\Users\Yaakov Laks\AppData\Local\Adobe
2014-10-10 00:47 - 2013-12-04 06:33 - 00701104 ____C (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2014-10-10 00:47 - 2013-12-04 06:33 - 00071344 ____C (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2014-10-09 17:52 - 2009-07-14 05:37 - 00000000 ___DC () C:\Windows\Microsoft.NET
2014-10-09 13:29 - 2014-03-20 16:06 - 00000000 ___DC () C:\Users\Yaakov Laks\.gimp-2.8
2014-10-09 13:02 - 2014-04-21 10:18 - 00001259 ____C () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Movie Maker.lnk
2014-10-09 13:02 - 2014-04-21 10:18 - 00000000 __RDC () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live
2014-10-09 13:02 - 2013-08-24 02:55 - 00001328 ____C () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Photo Gallery.lnk
2014-10-09 13:00 - 2013-08-24 02:55 - 00001412 ____C () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live Mail.lnk
2014-10-09 01:18 - 2013-08-24 04:21 - 00000000 ___DC () C:\Users\Yaakov Laks\Desktop\111פוספטים
2014-10-07 22:40 - 2013-09-08 09:39 - 00000000 ___DC () C:\Users\Yaakov Laks\AppData\Roaming\Audacity
2014-10-07 22:40 - 2013-08-24 02:15 - 00000000 ___DC () C:\Users\Yaakov Laks\AppData\Roaming\vlc
2014-10-07 16:04 - 2013-08-24 04:21 - 00000000 ___DC () C:\Users\Yaakov Laks\Desktop\111עבודה שחורה
2014-10-06 11:21 - 2013-12-03 11:17 - 00044569 ____C () C:\Users\Yaakov Laks\Desktop\קליאו.xlsx
2014-09-27 10:58 - 2013-08-24 05:45 - 00000000 ___DC () C:\Users\Yaakov Laks\Desktop\11מפלגת העבודה
2014-09-26 19:34 - 2013-08-26 23:40 - 00000000 ___DC () C:\Windows\rescache
2014-09-24 08:25 - 2013-08-27 19:47 - 00002441 ____C () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2014-09-23 19:01 - 2013-08-23 18:08 - 00000000 __RDC () C:\Program Files\Skype
2014-09-23 18:59 - 2013-08-23 18:08 - 00000000 ___DC () C:\ProgramData\Skype
2014-09-22 23:00 - 2011-06-10 06:34 - 00100896 ____C (Realtek Semiconductor Corporation) C:\Windows\system32\RTNUninst32.dll
2014-09-22 22:49 - 2014-09-06 08:19 - 00000000 ___DC () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Driver Booster
2014-09-22 09:41 - 2013-08-23 17:14 - 00231568 ____C (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
Some content of TEMP:
====================
C:\Users\Yaakov Laks\AppData\Local\Temp\NOSEventMessages.dll
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2014-10-12 04:50
==================== End Of Log ============================
Additional scan result of Farbar Recovery Scan Tool (x86) Version: 12-10-2014 01
Ran by Yaakov Laks at 2014-10-13 13:22:27
Running from E:\F\Downloads\DLSoftware 15\SpyBot
Boot Mode: Normal
==========================================================
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Microsoft Security Essentials (Enabled - Up to date) {4F35CFC4-45A3-FC37-EF17-759A02E39AB1}
AS: Microsoft Security Essentials (Enabled - Up to date) {F4542E20-6399-F3B9-D5A7-4EE87964D00C}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Spybot - Search and Destroy (Enabled - Up to date) {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}
AS: IObit Malware Fighter (Enabled - Up to date) {A751AC20-3B48-5237-898A-78C4436BB78D}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
2007 Microsoft Office Suite Service Pack 3 (SP3) (HKLM\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version: - Microsoft)
2007 Microsoft Office Suite Service Pack 3 (SP3) (Version: - Microsoft) Hidden
7-Zip 9.20 (HKLM\...\7-Zip) (Version: - )
Adobe AIR (HKLM\...\Adobe AIR) (Version: 3.8.0.1430 - Adobe Systems Incorporated)
Adobe AIR (Version: 3.8.0.1430 - Adobe Systems Incorporated) Hidden
Adobe Flash Player 15 Plugin (HKLM\...\Adobe Flash Player Plugin) (Version: 15.0.0.152 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.09) MUI (HKLM\...\{AC76BA86-7AD7-FFFF-7B44-AB0000000001}) (Version: 11.0.09 - Adobe Systems Incorporated)
Adobe Shockwave Player 12.1 (HKLM\...\Adobe Shockwave Player) (Version: 12.1.3.153 - Adobe Systems, Inc.)
Advanced SystemCare 7 (HKLM\...\Advanced SystemCare 7_is1) (Version: 7.3.1 - IObit)
Akamai NetSession Interface (HKCU\...\Akamai) (Version: - Akamai Technologies, Inc)
Alcor Micro USB Card Reader (HKLM\...\AmUStor) (Version: 3.9.145.62246 - Alcor Micro Corp.)
Alcor Micro USB Card Reader (Version: 3.9.145.62246 - Alcor Micro Corp.) Hidden
Application Verifier (HKLM\...\{39556553-8C77-4C5E-8F30-4083274948A2}) (Version: 4.1.1078 - Microsoft Corporation)
Atheros Driver Installation Program (HKLM\...\{C3A32068-8AB1-4327-BB16-BED9C6219DC7}) (Version: 9.2 - Atheros)
Audacity 2.0.5 (HKLM\...\Audacity_is1) (Version: 2.0.5 - Audacity Team)
Belarc Advisor 8.1 (HKLM\...\Belarc Advisor) (Version: - )
Bing Maps 3D (HKLM\...\{2D87E961-577B-492B-AD54-1368680FB9A7}) (Version: 4.0.903.16005 - Microsoft Corporation)
BlazeDTV 6.0 (HKLM\...\BlazeDTV 6.0_is1) (Version: - )
calibre (HKLM\...\{A2A971DE-C864-4CF0-8FCA-FF7F569D8476}) (Version: 1.43.0 - Kovid Goyal)
Camera Assistant Software for Toshiba (HKLM\...\{37C866E4-AA67-4725-9E95-A39968DD7960}) (Version: 1.7.260.0526L - Chicony Electronics Co.,Ltd.)
CCleaner (HKLM\...\CCleaner) (Version: 4.18 - Piriform)
CrystalDiskInfo 6.0.1 Shizuku Edition (HKLM\...\CrystalDiskInfo_is1) (Version: 6.0.1 - Crystal Dew World)
D3DX10 (Version: 15.4.2368.0902 - Microsoft) Hidden
Debugging Tools for Windows (x86) (HKLM\...\{D09605BE-5587-4B0C-86C8-69B5092CB80F}) (Version: 6.12.2.633 - Microsoft Corporation)
Driver Booster (HKLM\...\Driver Booster_is1) (Version: 1.5 - IObit)
FileHippo.com Update Checker (HKLM\...\FileHippo.com) (Version: - )
Folder Size for Windows (HKLM\...\{FC8D21C8-7B29-4104-ADB0-FEE9CA1C7922}) (Version: 2.5 - Brio)
Folder Size Shell Extension v3.2 (HKLM\...\FolderSizePropertyPage) (Version: - )
GIMP 2.8.10 (HKLM\...\GIMP-2_is1) (Version: 2.8.10 - The GIMP Team)
Giraffic Video Accelerator (HKLM\...\Giraffic) (Version: 0.86.412.230 - Giraffic)
Google Chrome (HKLM\...\Google Chrome) (Version: 40.0.2182.3 - Google Inc.)
Google Drive (HKLM\...\{C6640705-7479-4EE5-BC86-879F05F65E74}) (Version: 1.17.7290.4094 - Google, Inc.)
Google Earth (HKLM\...\{4D2A6330-2F8B-11E3-9C40-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)
Google Update Helper (Version: 1.3.24.15 - Google Inc.) Hidden
HP Deskjet 2050 J510 series Basic Device Software (HKLM\...\{90BBACD9-526F-4AD5-8B92-80BB5F5E1A6D}) (Version: 28.0.1313.0 - Hewlett-Packard Co.)
HP Deskjet 2050 J510 series Help (HKLM\...\{7A3DF2E2-CF13-44FB-A93E-F71D5381DB3F}) (Version: 140.0.61.61 - Hewlett Packard)
HP Deskjet 2050 J510 series Product Improvement Study (HKLM\...\{B97BD710-382C-453D-B23C-C0663C6EDFA2}) (Version: 28.0.1313.0 - Hewlett-Packard Co.)
HP Update (HKLM\...\{6F1C00D2-25C2-4CBA-8126-AE9A6E2E9CD5}) (Version: 5.003.003.001 - Hewlett-Packard)
HPDiagnosticAlert (Version: 1.00.0000 - Microsoft) Hidden
Intel(R) Graphics Media Accelerator Driver (HKLM\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 8.15.10.2869 - Intel Corporation)
IObit Apps Toolbar v9.0 (HKLM\...\{48C13178-64E2-4964-9927-B71A04074D08}) (Version: 9.0 - Spigot, Inc.) <==== ATTENTION
IObit Malware Fighter (HKLM\...\IObit Malware Fighter_is1) (Version: 2.4 - IObit)
IObit Uninstaller (HKLM\...\IObitUninstall) (Version: 3.2.10.2466 - IObit)
IrfanView (remove only) (HKLM\...\IrfanView) (Version: 4.37 - Irfan Skiljan)
ISO Opener (HKLM\...\{CE235F00-F8CD-41AF-83D5-236D90E33BFB}_is1) (Version: - www.isoopener.com)
Java 7 Update 67 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83217051FF}) (Version: 7.0.670 - Oracle)
Java Auto Updater (Version: 2.1.67.1 - Oracle, Inc.) Hidden
Junk Mail filter update (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
jv16 PowerTools 2014 (HKLM\...\jv16 PowerTools 2014) (Version: - Macecraft Software)
KeyScrambler (HKLM\...\KeyScrambler) (Version: 3.2.0.3 - QFX Software Corporation)
LAME v3.99.3 (for Windows) (HKLM\...\LAME_is1) (Version: - )
LSI V92 MOH Application (HKLM\...\LTMOH) (Version: - LSI Corporation)
MailWasher Pro (HKLM\...\MailWasher Pro_is1) (Version: - FireTrust Limited)
Malwarebytes Anti-Malware version 2.0.2.1012 (HKLM\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.2.1012 - Malwarebytes Corporation)
MC FolderSize (Uninstall Only) (HKLM\...\MC FolderSize) (Version: - )
Microsoft .NET Framework 4 Multi-Targeting Pack (HKLM\...\{CFEF48A8-BFB8-3EAC-8BA5-DE4F8AA267CE}) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6012.5000 - Microsoft Corporation) Hidden
Microsoft Calculator Plus (HKLM\...\{83073C45-3003-4671-9A86-243AAADD915A}) (Version: 1.0.0 - Microsoft)
Microsoft Help Viewer 1.1 (HKLM\...\Microsoft Help Viewer 1.1) (Version: 1.1.40219 - Microsoft Corporation)
Microsoft Help Viewer 1.1 (Version: 1.1.40219 - Microsoft Corporation) Hidden
Microsoft Office Access MUI (Hebrew) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Enterprise 2007 (HKLM\...\ENTERPRISE) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Enterprise 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Excel MUI (Hebrew) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office File Validation Add-In (HKLM\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Groove MUI (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Groove Setup Metadata MUI (Hebrew) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office InfoPath MUI (Hebrew) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office OneNote MUI (Hebrew) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Outlook Connector (HKLM\...\{95140000-007A-0409-0000-0000000FF1CE}) (Version: 14.0.5118.5000 - Microsoft Corporation)
Microsoft Office Outlook MUI (Hebrew) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (Hebrew) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Arabic) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Hebrew) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Russian) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (Hebrew) 2007 (Version: 12.0.4518.1016 - Microsoft Corporation) Hidden
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) (Version: - Microsoft) Hidden
Microsoft Office Publisher MUI (Hebrew) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (Hebrew) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (Hebrew) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Security Client (Version: 4.6.0305.0 - Microsoft Corporation) Hidden
Microsoft Security Essentials (HKLM\...\Microsoft Security Client) (Version: 4.6.305.0 - Microsoft Corporation)
Microsoft Security Intelligence Report, Volume 14 (HKLM\...\{5794644E-FD67-417A-9792-034FC1D8BF6E}) (Version: 1.00.0000 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft SQL Server 2008 Setup Support Files (HKLM\...\{D441BD04-E548-4F8E-97A4-1B66135BAAA8}) (Version: 10.1.2731.0 - Microsoft Corporation)
Microsoft SQL Server Compact 3.5 SP2 ENU (HKLM\...\{3A9FC03D-C685-4831-94CF-4EDFD3749497}) (Version: 3.5.8080.0 - Microsoft Corporation)
Microsoft Visual C++ Compilers 2010 Standard - enu - x86 (Version: 10.0.40219 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Runtime - 10.0.40219 (HKLM\...\{5D9ED403-94DE-3BA0-B1D6-71F4BDA412E6}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 Express - ENU (HKLM\...\Microsoft Visual C++ 2010 Express - ENU) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 Express - ENU (Version: 10.0.40219 - Microsoft Corporation) Hidden
Microsoft Visual Studio 2010 Service Pack 1 (HKLM\...\Microsoft Visual Studio 2010 Service Pack 1) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual Studio 2010 Service Pack 1 (Version: 10.0.40219 - Microsoft Corporation) Hidden
Microsoft Visual Studio 2010 Tools for Office Runtime (x86) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x86)) (Version: 10.0.50701 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x86) (Version: 10.0.50706 - Microsoft Corporation) Hidden
Microsoft Windows Performance Toolkit (HKLM\...\{E7F9E526-2324-437B-A609-E8C5309465CB}) (Version: 4.8.0 - Microsoft Corporation)
Microsoft Windows SDK for Windows 7 (7.1) (HKLM\...\SDKSetup_7.1.7600.0.30514) (Version: 7.1.7600.0.30514 - Microsoft Corporation)
Microsoft Windows SDK for Windows 7 (7.1) (Version: 7.1.30514 - Microsoft Corporation) Hidden
Microsoft Windows SDK Intellisense and Reference Assemblies (30514) (Version: 7.1.30514 - Microsoft Corporation) Hidden
Microsoft Windows SDK MSHelp (30514) (Version: 7.1.30514 - Microsoft Corporation) Hidden
Microsoft_VC100_CRT_SP1_x86 (Version: 10.0.40219.1 - Nokia) Hidden
Movie Maker (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Mozilla Firefox 23.0.1 (x86 en-US) (HKLM\...\Mozilla Firefox 23.0.1 (x86 en-US)) (Version: 23.0.1 - Mozilla)
Mozilla Firefox 32.0.3 (x86 en-US) (HKCU\...\Mozilla Firefox 32.0.3 (x86 en-US)) (Version: 32.0.3 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 23.0.1 - Mozilla)
MSVC80_x86_v2 (Version: 1.0.3.0 - Nokia) Hidden
MSVC90_x86 (Version: 1.0.1.2 - Nokia) Hidden
MSVCRT (Version: 15.4.2862.0708 - Microsoft) Hidden
MSVCRT110 (Version: 16.4.1108.0727 - Microsoft) Hidden
MSXML 4.0 SP2 (KB954430) (HKLM\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (HKLM\...\{196467F1-C11F-4F76-858B-5812ADC83B94}) (Version: 4.30.2100.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB2758694) (HKLM\...\{1D95BA90-F4F8-47EC-A882-441C99D30C1E}) (Version: 4.30.2117.0 - Microsoft Corporation)
Nokia Connectivity Cable Driver (HKLM\...\{29373274-977E-413C-A4DE-DC0F8E80C429}) (Version: 7.1.172.0 - Nokia)
Nokia Suite (HKLM\...\Nokia Suite) (Version: 3.8.48.0 - Nokia)
Nokia Suite (Version: 3.8.48.0 - Nokia) Hidden
Notepad++ (HKLM\...\Notepad++) (Version: 6.6.9 - Notepad++ Team)
Office Shuttle Software (HKLM\...\InstallShield_{3F87539C-BD1B-4529-8F13-8B3599A51D6C}) (Version: 12.05.0004 - A4TECH)
Office Shuttle Software (Version: 12.05.0004 - A4TECH) Hidden
OpenWith (Enhanced) (HKLM\...\OpenWith Enhanced) (Version: 1.15 - Greg Frieger)
PC Connectivity Solution (HKLM\...\{6D01D1B1-17BD-4F10-BB11-F08F0C47D42B}) (Version: 12.0.109.0 - Nokia)
PDF Split And Merge Enhanced (HKLM\...\{126B830E-16E7-11E2-B42B-92326288709B}) (Version: 2.2.2 - Andrea Vacondio)
Photo Gallery (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Protected Folder (HKLM\...\Protected Folder_is1) (Version: - IObit)
Realtek Card Reader (HKLM\...\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}) (Version: 6.2.9200.29070 - Realtek Semiconductor Corp.)
Realtek High Definition Audio Driver (HKLM\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7246 - Realtek Semiconductor Corp.)
RICOH_Media_Driver_v2.14.18.01 (HKLM\...\{FE041B02-234C-4AAA-9511-80DF6482A458}) (Version: 2.14.18.01 - RICOH)
Secunia PSI (3.0.0.7011) (HKLM\...\Secunia PSI) (Version: 3.0.0.7011 - Secunia)
Shark007 Advanced Codecs (HKLM\...\{8C0CAA7A-3272-4991-A808-2C7559DE3409}) (Version: 4.2.3 - Shark007)
Skype Click to Call (HKLM\...\{6D1221A9-17BF-4EC0-81F2-27D30EC30701}) (Version: 7.3.16540.9015 - Microsoft Corporation)
Skype™ 6.20 (HKLM\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 6.20.104 - Skype Technologies S.A.)
SlimDrivers (HKLM\...\{A5457401-D56A-43F2-9524-78E54A7FC07A}) (Version: 2.2.32705 - SlimWare Utilities, Inc.)
Smart Defrag 3 (HKLM\...\Smart Defrag 3_is1) (Version: 3.2 - IObit)
SpeedFan (remove only) (HKLM\...\SpeedFan) (Version: - )
Spybot - Search & Destroy (HKLM\...\{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1) (Version: 2.1.21 - Safer-Networking Ltd.)
StorageCraft ShadowProtect (HKLM\...\ShadowProtect) (Version: 4.2.7.19756 - StorageCraft Technology Corporation (STC))
Surfing Protection (HKLM\...\IObit Surfing Protection_is1) (Version: 1.0 - IObit)
swMSM (Version: 12.0.0.1 - Adobe Systems, Inc) Hidden
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 11.2.4.0 - Synaptics)
System Requirements Lab for Intel (HKLM\...\{C7CA731B-BF9A-46D9-92CF-8A8737AE9240}) (Version: 4.5.13.0 - Husdawg, LLC)
TOSHIBA Assist (HKLM\...\{12B3A009-A080-4619-9A2A-C6DB151D8D67}) (Version: 2.01.11 - TOSHIBA)
TOSHIBA DVD PLAYER (HKLM\...\{6C5F3BDC-0A1B-4436-A696-5939629D5C31}) (Version: 1.31.14 - TOSHIBA Corporation)
TOSHIBA Manuals (HKLM\...\{E7271ABF-69D3-4E9D-AA0A-2DE34C10A93D}) (Version: 7.40 - TOSHIBA)
TOSHIBA Software Modem (HKLM\...\TOSHIBA Software Modem) (Version: 2.2.97 - LSI Corporation)
TOSHIBA Supervisor Password (HKLM\...\{401879D1-AC26-43CD-BDDE-E0D5D5608083}) (Version: 2.00.03PLV - )
TOSHIBA TEMPRO (HKLM\...\{F082CB11-4794-4259-99A1-D91BA762AD15}) (Version: 3.35 - Toshiba Europe GmbH)
TreeSize Free V3.0.1 (HKLM\...\TreeSize Free_is1) (Version: 3.0.1 - JAM Software)
Tweak UI Control Panel entry (HKLM\...\Tweak UI Control Panel entry_is1) (Version: - Ruby Software)
Tweaking.com - Registry Backup (HKLM\...\Tweaking.com - Registry Backup) (Version: 1.10.0 - Tweaking.com)
Update for 2007 Microsoft Office System (KB967642) (HKLM\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version: - Microsoft)
Update for Microsoft Office 2007 Help for Common Features (KB963673) (HKLM\...\{90120000-006E-0409-0000-0000000FF1CE}_ENTERPRISE_{AB365889-0395-4FAD-B702-CA5985D53D42}) (Version: - Microsoft)
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition (HKLM\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{A024FC7B-77DE-45DE-A058-1C049A17BFB3}) (Version: - Microsoft)
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (HKLM\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{CB68A5B0-3508-4193-AEB9-AF636DAECE0F}) (Version: - Microsoft)
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition (HKLM\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{E9A82945-BA29-4EE8-8F2A-2F49545E9CF2}) (Version: - Microsoft)
Update for Microsoft Office Outlook 2007 (KB2687404) 32-Bit Edition (HKLM\...\{90120000-001A-040D-0000-0000000FF1CE}_ENTERPRISE_{F70AA73C-2F85-4B32-A765-6EFA08F9C3D2}) (Version: - Microsoft)
Update for Microsoft Office Outlook 2007 (KB2863811) 32-Bit Edition (HKLM\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{53DEC068-4690-4F6B-9946-7D21EF02236B}) (Version: - Microsoft)
Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2889914) 32-Bit Edition (HKLM\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{F3F83933-75FC-4B60-84F2-3F8FA63D042E}) (Version: - Microsoft)
Update for Microsoft Office Script Editor Help (KB963671) (HKLM\...\{90120000-006E-0409-0000-0000000FF1CE}_ENTERPRISE_{CD11C6A2-FFC6-4271-8EAB-79C3582F505C}) (Version: - Microsoft)
VLC media player (HKLM\...\VLC media player) (Version: 2.1.5 - VideoLAN)
Windows Driver Package - Chicony (usbvideo) Image (05/12/2009 6.3.251.0512) (HKLM\...\84BA15BD1DFEAA8A233F801B29BDC48DEE17B71F) (Version: 05/12/2009 6.3.251.0512 - Chicony)
Windows Driver Package - Nokia pccsmcfd “LegacyDriver” (05/31/2012 7.1.2.0) (HKLM\...\17D063A0A9F5D5A225B76B1D9BCB5ADBE85C8382) (Version: 05/31/2012 7.1.2.0 - Nokia)
Windows Live Communications Platform (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Windows Live Essentials (HKLM\...\WinLiveSuite) (Version: 16.4.3528.0331 - Microsoft Corporation)
Windows Live Essentials (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Windows Live ID Sign-in Assistant (Version: 7.250.4311.0 - Microsoft Corporation) Hidden
Windows Live Installer (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Windows Live Mail (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Windows Live MIME IFilter (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Windows Live Photo Common (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Windows Live PIMT Platform (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Windows Live SOXE (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Windows Live SOXE Definitions (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Windows Live UX Platform (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Windows Live UX Platform Language Pack (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Windows Live Writer (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Windows Live Writer Resources (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Windows Media Player Firefox Plugin (HKLM\...\{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}) (Version: 1.0.0.8 - Microsoft Corp)
Windows Movie Maker 6.1 (HKLM\...\{3CC29C1A-B5FE-457B-8F22-32A2557A92C7}}_is1) (Version: - windows-movie-maker.org)
YoutubeMovieMaker (HKLM\...\{E084C471-FA8F-4468-93F1-25B3A13ED942}) (Version: 8.06 - Youtube Movie Maker)
עדכון עבור מסנן דואר הזבל של Microsoft Office Excel 2007 Help (KB963678) (HKLM\...\{90120000-0016-040D-0000-0000000FF1CE}_ENTERPRISE_{18E2D7BF-CC18-4CE8-B875-D2934B6086E2}) (Version: - Microsoft)
עדכון עבור מסנן דואר הזבל של Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM\...\{90120000-0018-040D-0000-0000000FF1CE}_ENTERPRISE_{54B50AC9-2088-4F43-B39A-0F10F53D425E}) (Version: - Microsoft)
עדכון עבור מסנן דואר הזבל של Microsoft Office Word 2007 Help (KB963665) (HKLM\...\{90120000-001B-040D-0000-0000000FF1CE}_ENTERPRISE_{CAB664CE-BBA4-4A81-A358-6CC6F7852FC9}) (Version: - Microsoft)
==================== Custom CLSID (selected items): ==========================
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
CustomCLSID: HKU\S-1-5-21-2920106312-904050420-1618604034-1001_Classes\CLSID\{1BBF13E0-551E-42DD-91F4-1A547443FFDA}\InprocServer32 -> C:\Users\Yaakov Laks\AppData\Local\Tbccint\Community Alerts\Alert.dll (ClientConnect Ltd.)
==================== Restore Points =========================
11-10-2014 00:01:49 Windows Backup
11-10-2014 22:46:00 Device Driver Package Install: StorageCraft Technology Corporation System devices
12-10-2014 00:01:01 Windows Backup
12-10-2014 16:15:51 Windows Update
13-10-2014 00:00:17 Windows Backup
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2009-07-14 05:04 - 2014-08-12 22:50 - 01174442 ___RC C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 www.007guard.com
127.0.0.1 007guard.com
127.0.0.1 008i.com
127.0.0.1 www.008k.com
127.0.0.1 008k.com
127.0.0.1 www.00hq.com
127.0.0.1 00hq.com
127.0.0.1 010402.com
127.0.0.1 www.032439.com
127.0.0.1 032439.com
127.0.0.1 www.0scan.com
127.0.0.1 0scan.com
127.0.0.1 1000gratisproben.com
127.0.0.1 www.1000gratisproben.com
127.0.0.1 1001namen.com
127.0.0.1 www.1001namen.com
127.0.0.1 100888290cs.com
127.0.0.1 www.100888290cs.com
127.0.0.1 www.100sexlinks.com
127.0.0.1 100sexlinks.com
127.0.0.1 10sek.com
127.0.0.1 www.10sek.com
127.0.0.1 www.1-2005-search.com
127.0.0.1 1-2005-search.com
127.0.0.1 123fporn.info
127.0.0.1 www.123fporn.info
127.0.0.1 123haustiereundmehr.com
127.0.0.1 www.123haustiereundmehr.com
127.0.0.1 123moviedownload.com
There are 1000 more lines.
==================== Scheduled Tasks (whitelisted) =============
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
Task: {03F1B913-D13F-4AE5-8FF6-714690775E74} - System32\Tasks\SlimDrivers Startup => C:\Program Files\SlimDrivers\SlimDrivers.exe [2013-09-24] (SlimWare Utilities, Inc.)
Task: {0CCDCBA6-4CCB-4553-A909-96CDE0DB8D90} - System32\Tasks\CCleanerSkipUAC => D:\Program Files\1Maint\ccleaner\CCleaner.exe [2014-09-26] (Piriform Ltd)
Task: {1B9271CE-0D33-476E-B7B0-C2DF24C51C43} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2014-10-10] (Adobe Systems Incorporated)
Task: {1EDB03BF-68ED-4139-9EB5-8AB31E4C3E6E} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2013-08-29] (Google Inc.)
Task: {22E7CAFD-204F-4241-9690-CF391713F5A8} - System32\Tasks\SmartDefrag3_Update => C:\Program Files\IObit\Smart Defrag 3\AutoUpdate.exe [2014-07-03] (IObit)
Task: {6B9331CE-3BFB-4AAC-BA73-C32EFDF32301} - System32\Tasks\Driver Booster Update => C:\Program Files\IObit\Driver Booster\AutoUpdate.exe [2014-08-01] (IObit)
Task: {79EEBE41-0CE7-4645-8A55-B60342BF4D0F} - System32\Tasks\{D47934EB-E025-4F1D-BDC4-35EB3BEC74D1} => D:\Program Files\A4Tech\Mouse\DevInst.exe
Task: {7CB5BB1C-E39D-418D-88A1-225EE0A57758} - System32\Tasks\Driver Booster Scan => C:\Program Files\IObit\Driver Booster\Scheduler.exe [2014-08-01] (IObit)
Task: {7D5495B3-CDF7-403E-A44C-C268713F5E44} - System32\Tasks\HPCustParticipation HP Deskjet 2050 J510 series => C:\Program Files\HP\HP Deskjet 2050 J510 series\Bin\HPCustPartic.exe [2012-10-02] (Hewlett-Packard Co.)
Task: {91BED418-7ED6-4F46-A414-6861CF3B8AEA} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => Rundll32.exe /d sdengin2.dll,ExecuteScheduledBackup
Task: {93854466-00E7-4E7D-8F16-2A6F59186783} - System32\Tasks\Driver Booster SkipUAC (Yaakov Laks) => C:\Program Files\IObit\Driver Booster\DriverBooster.exe [2014-08-06] (IObit)
Task: {BAD370E6-0C9E-43E3-BA3C-7E15B5F7CAF3} - System32\Tasks\SmartDefrag3_Startup => C:\Program Files\IObit\Smart Defrag 3\SmartDefrag.exe [2014-07-02] (IObit)
Task: {D33DB28C-F9D4-4B8C-BD8E-28E27BB594A1} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2013-08-29] (Google Inc.)
Task: {D813746A-2799-4837-9DF2-CB42F33576E7} - System32\Tasks\Driver Booster SkipUAC (SYSTEM) => C:\Program Files\IObit\Driver Booster\DriverBooster.exe [2014-08-06] (IObit)
Task: {DDBC0950-20BB-43A1-85CE-F57DACB08C1F} - System32\Tasks\ASC7_SkipUac_Yaakov Laks => C:\Program Files\IObit\Advanced SystemCare 7\ASC.exe [2014-05-29] (IObit)
Task: {EB20213D-780A-4F6D-BC85-17181C811567} - System32\Tasks\Uninstaller_SkipUac_Administrator => D:\Program Files\1Maint\IObit Uninstaller\IObitUninstaler.exe [2014-05-06] (IObit)
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\SlimDrivers Startup.job => C:\Program Files\SlimDrivers\SlimDrivers.exe
==================== Loaded Modules (whitelisted) =============
2014-03-20 10:12 - 2013-10-25 12:08 - 00517408 ____C () C:\Program Files\IObit\Advanced SystemCare 7\sqlite3.dll
2011-04-06 16:06 - 2011-04-06 16:06 - 00067072 ____C () C:\Program Files\G9G11_ScreenCapture\DLL\DLL_PenSuit.dll
2014-01-21 19:37 - 2014-06-04 15:17 - 00892288 ____C () C:\Program Files\IObit\Smart Defrag 3\webres.dll
2013-08-31 21:24 - 2013-05-16 10:55 - 00113496 ____C () D:\Program Files\1AntiVandals\Spybot - Search & Destroy 2\snlThirdParty150.bpl
2013-08-31 21:24 - 2013-05-16 10:55 - 00416600 ____C () D:\Program Files\1AntiVandals\Spybot - Search & Destroy 2\DEC150.bpl
2014-05-12 12:49 - 2014-05-12 12:49 - 00260608 ____C () D:\Program Files\Notepad++\NppShell_06.dll
2013-10-07 11:00 - 2013-10-07 11:00 - 00302961 ____C () C:\Program Files\Hosts_Anti_Adwares_PUPs\HOSTS_Anti-Adware_main.exe
2013-10-02 20:29 - 2013-10-02 20:29 - 08507232 ____C () C:\Program Files\Nokia\Nokia Suite\QtGui4.dll
2013-10-02 20:29 - 2013-10-02 20:29 - 02354016 ____C () C:\Program Files\Nokia\Nokia Suite\QtCore4.dll
2013-10-02 20:29 - 2013-10-02 20:29 - 01014624 ____C () C:\Program Files\Nokia\Nokia Suite\QtNetwork4.dll
2013-10-02 20:29 - 2013-10-02 20:29 - 00364384 ____C () C:\Program Files\Nokia\Nokia Suite\QtXml4.dll
2013-10-02 20:29 - 2013-10-02 20:29 - 02480992 ____C () C:\Program Files\Nokia\Nokia Suite\QtDeclarative4.dll
2013-10-02 20:29 - 2013-10-02 20:29 - 01346912 ____C () C:\Program Files\Nokia\Nokia Suite\QtScript4.dll
2013-10-02 20:29 - 2013-10-02 20:29 - 00206176 ____C () C:\Program Files\Nokia\Nokia Suite\QtSql4.dll
2013-10-02 20:29 - 2013-10-02 20:29 - 02653024 ____C () C:\Program Files\Nokia\Nokia Suite\QtXmlPatterns4.dll
2013-10-02 20:29 - 2013-10-02 20:29 - 00033120 ____C () C:\Program Files\Nokia\Nokia Suite\imageformats\qgif4.dll
2013-10-02 20:29 - 2013-10-02 20:29 - 00035680 ____C () C:\Program Files\Nokia\Nokia Suite\imageformats\qico4.dll
2013-10-02 20:29 - 2013-10-02 20:29 - 00207200 ____C () C:\Program Files\Nokia\Nokia Suite\imageformats\qjpeg4.dll
2013-10-02 20:29 - 2013-10-02 20:29 - 11166560 ____C () C:\Program Files\Nokia\Nokia Suite\QtWebKit4.dll
2013-10-02 20:30 - 2013-10-02 20:30 - 00276832 ____C () C:\Program Files\Nokia\Nokia Suite\phonon4.dll
2013-04-15 13:26 - 2013-04-15 13:26 - 00391600 ____C () C:\Program Files\Nokia\Nokia Suite\ssoengine.dll
2013-04-15 13:26 - 2013-04-15 13:26 - 00059280 ____C () C:\Program Files\Nokia\Nokia Suite\securestorage.dll
2013-10-02 20:28 - 2013-10-02 20:28 - 00438624 ____C () C:\Program Files\Nokia\Nokia Suite\NService.dll
2013-10-02 20:29 - 2013-10-02 20:29 - 00446304 ____C () C:\Program Files\Nokia\Nokia Suite\sqldrivers\qsqlite4.dll
2013-10-02 20:29 - 2013-10-02 20:29 - 00520544 ____C () C:\Program Files\Nokia\Nokia Suite\QtMultimediaKit1.dll
2013-10-02 20:29 - 2013-10-02 20:29 - 00720736 ____C () C:\Program Files\Nokia\Nokia Suite\QtOpenGL4.dll
2013-10-02 20:28 - 2013-10-02 20:28 - 00606560 ____C () C:\Program Files\Nokia\Nokia Suite\CommonUpdateChecker.dll
2013-10-02 20:30 - 2013-10-02 20:30 - 00093024 ____C () C:\Program Files\Nokia\Nokia Suite\qjson.dll
2012-05-18 19:59 - 2012-05-18 19:59 - 03538944 ____C () C:\Program Files\G9G11_ScreenCapture\ScreenCapture.exe
2010-12-02 17:56 - 2010-12-02 17:56 - 00815104 ____C () C:\Program Files\G9G11_ScreenCapture\Data\G11_ScreenCapture\Forms\OSD_Text\OSD_Text.dll
2011-01-09 20:45 - 2011-01-09 20:45 - 00088064 ____C () C:\Program Files\G9G11_ScreenCapture\DLL\DLL_MouseDeviceManager.dll
2012-02-07 11:20 - 2012-02-07 11:20 - 02413568 ____C () C:\Program Files\G9G11_ScreenCapture\Data\G11_ScreenCapture\Forms\ScreenCapture\ScreenCapture.dll
2011-03-21 19:33 - 2011-03-21 19:33 - 00999424 ____C () C:\Program Files\G9G11_ScreenCapture\Data\G11_ScreenCapture\Forms\TrayIconWebAdvertisement\TrayIconWebAdvertisement.dll
2011-05-20 16:52 - 2011-05-20 16:52 - 00901632 ____C () C:\Program Files\G9G11_ScreenCapture\Data\G11_ScreenCapture\Forms\ProfileHint\ProfileHint.dll
2010-09-20 14:18 - 2010-09-20 14:18 - 00085504 ____C () C:\Program Files\G9G11_ScreenCapture\DLL\DLL_ZoomControl.dll
2010-09-20 14:18 - 2010-09-20 14:18 - 00054272 ____C () C:\Program Files\G9G11_ScreenCapture\DLL\DLL_ScrollbarControl.dll
2011-04-12 15:14 - 2011-04-12 15:14 - 00063488 ____C () C:\Program Files\G9G11_ScreenCapture\DLL\DLL_AnalyzeGesturesInRight.dll
2010-11-01 20:16 - 2010-11-01 20:16 - 00062976 ____C () C:\Program Files\G9G11_ScreenCapture\DLL\DLL_AnalyzeGesturesInOne.dll
2012-04-27 11:40 - 2012-04-27 11:40 - 00118272 ____C () C:\Program Files\G9G11_ScreenCapture\DLL\DLL_Wheel4D.dll
2012-05-11 19:46 - 2012-05-11 19:46 - 00891904 ____C () C:\Program Files\G9G11_ScreenCapture\Data\G11_ScreenCapture\Forms\KeyboardLEDForm\KeyboardLEDForm.dll
2013-11-06 10:42 - 2013-01-15 18:48 - 00348992 ____C () C:\Program Files\IObit\IObit Malware Fighter\madExcept_.bpl
2013-11-06 10:42 - 2013-01-15 18:48 - 00183616 ____C () C:\Program Files\IObit\IObit Malware Fighter\madBasic_.bpl
2013-11-06 10:42 - 2013-01-15 18:48 - 00051008 ____C () C:\Program Files\IObit\IObit Malware Fighter\madDisAsm_.bpl
2013-11-06 10:42 - 2013-12-12 18:46 - 08001344 ____C () C:\Program Files\IObit\IObit Malware Fighter\WebUI.dll
2013-11-06 10:42 - 2013-05-16 19:26 - 00182080 ____C () C:\Program Files\IObit\IObit Malware Fighter\unrar.dll
2013-12-04 23:02 - 2013-10-16 22:17 - 00185168 ____C () C:\Program Files\IObit\IObit Malware Fighter\libcurl-4.dll
2013-11-06 10:42 - 2013-05-16 19:26 - 00145216 ____C () C:\Program Files\IObit\IObit Malware Fighter\zlibwapi.dll
2013-08-25 17:31 - 2010-05-28 13:57 - 00801976 ____C () D:\Program Files\1AntiVandals\MailWasher Pro654\MailWasher Pro\ContactsLib.dll
2013-08-25 17:31 - 2009-06-25 15:40 - 00977080 ____C () D:\Program Files\1AntiVandals\MailWasher Pro654\MailWasher Pro\MCORE.DLL
2013-08-25 17:31 - 2010-04-19 08:48 - 00277904 ____C () D:\Program Files\1AntiVandals\MailWasher Pro654\MailWasher Pro\sqlite3.dll
2013-08-25 17:31 - 2009-08-25 17:51 - 00155320 ____C () D:\Program Files\1AntiVandals\MailWasher Pro654\MailWasher Pro\MailPrefs.dll
2013-08-25 17:32 - 2008-09-12 17:39 - 00611936 ____C () D:\Program Files\1AntiVandals\MailWasher Pro654\MailWasher Pro\MailAnalysis.DLL
2013-08-25 17:31 - 2006-03-09 15:38 - 00684032 ____C () D:\Program Files\1AntiVandals\MailWasher Pro654\MailWasher Pro\libeay32.dll
2013-08-25 17:31 - 2006-03-09 15:38 - 00155648 ____C () D:\Program Files\1AntiVandals\MailWasher Pro654\MailWasher Pro\ssleay32.dll
2013-08-25 17:31 - 2008-09-12 17:40 - 00441440 ____C () D:\Program Files\1AntiVandals\MailWasher Pro654\MailWasher Pro\CFSSignatureAlgorithm.DLL
2013-08-31 21:24 - 2013-05-16 10:55 - 00161112 ____C () D:\Program Files\1AntiVandals\Spybot - Search & Destroy 2\snlFileFormats150.bpl
2013-08-31 21:24 - 2012-08-23 10:38 - 00574840 ____C () D:\Program Files\1AntiVandals\Spybot - Search & Destroy 2\sqlite3.dll
2013-08-31 21:24 - 2012-04-03 17:06 - 00565640 ____C () D:\Program Files\1AntiVandals\Spybot - Search & Destroy 2\av\BDSmartDB.dll
2012-09-23 20:43 - 2012-09-23 20:43 - 00313992 ____C () D:\Program Files\Adobe\Reader\sqlite.dll
2014-09-25 09:25 - 2014-09-25 09:26 - 03715184 ____C () D:\Program Files\Firefox\mozjs.dll
2014-09-11 17:59 - 2014-10-10 00:47 - 16825520 ____C () C:\Windows\system32\Macromed\Flash\NPSWF32_15_0_0_152.dll
2014-03-31 21:35 - 2014-03-31 21:35 - 00270016 ____C () C:\Program Files\Windows Live\Writer\en\WindowsLive.Writer.Localization.resources.dll
==================== Alternate Data Streams (whitelisted) =========
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
AlternateDataStreams: C:\ProgramData\TEMP:618D0840
==================== Safe Mode (whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\IMFservice => ""="Service"
==================== EXE Association (whitelisted) =============
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
==================== MSCONFIG/TASK MANAGER disabled items =========
(Currently there is no automatic fix for this section.)
MSCONFIG\startupfolder: C:^Users^Yaakov Laks^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^גוזר מסך של OneNote 2007 ו- Launcher.lnk => C:\Windows\pss\גוזר מסך של OneNote 2007 ו- Launcher.lnk.Startup
MSCONFIG\startupreg: (default) =>
MSCONFIG\startupreg: BlazeServoTool => "D:\Program Files\1Viewers\BlazeDTV 6.0\MediaDetector.exe"
MSCONFIG\startupreg: GrooveMonitor => "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
MSCONFIG\startupreg: IObit Malware Fighter => "C:\Program Files\IObit\IObit Malware Fighter\IMF.exe" /autostart
MSCONFIG\startupreg: Skype => "C:\Program Files\Skype\Phone\Skype.exe" /minimized /regrun
MSCONFIG\startupreg: Toshiba TEMPRO => D:\Program Files\1Maint\Toshiba TEMPRO\TemproTray.exe
========================= Accounts: ==========================
Administrator (S-1-5-21-2920106312-904050420-1618604034-500 - Administrator - Disabled)
Guest (S-1-5-21-2920106312-904050420-1618604034-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-2920106312-904050420-1618604034-1002 - Limited - Enabled)
Yaakov Laks (S-1-5-21-2920106312-904050420-1618604034-1001 - Administrator - Enabled) => C:\Users\Yaakov Laks
==================== Faulty Device Manager Devices =============
Name:
Description:
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
==================== Event log errors: =========================
Application errors:
==================
Error: (10/13/2014 01:13:08 PM) (Source: .NET Runtime) (EventID: 1022) (User: )
Description: .NET Runtime version 4.0.30319.18444 - There was a failure initializing profiling API attach infrastructure. This process will not allow a profiler to attach. HRESULT: 0x80004005. Process ID (decimal): 26164. Message ID: [0x2509].
Error: (10/13/2014 11:38:59 AM) (Source: .NET Runtime) (EventID: 1022) (User: )
Description: .NET Runtime version 4.0.30319.18444 - There was a failure initializing profiling API attach infrastructure. This process will not allow a profiler to attach. HRESULT: 0x80004005. Process ID (decimal): 22080. Message ID: [0x2509].
Error: (10/13/2014 11:35:33 AM) (Source: .NET Runtime) (EventID: 1022) (User: )
Description: .NET Runtime version 4.0.30319.18444 - There was a failure initializing profiling API attach infrastructure. This process will not allow a profiler to attach. HRESULT: 0x80004005. Process ID (decimal): 8612. Message ID: [0x2509].
Error: (10/13/2014 10:41:45 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: wlmail.exe, version: 16.4.3528.331, time stamp: 0x533a3fce
Faulting module name: unknown, version: 0.0.0.0, time stamp: 0x00000000
Exception code: 0xc0000005
Fault offset: 0x00000000
Faulting process id: 0x%9
Faulting application start time: 0xwlmail.exe0
Faulting application path: wlmail.exe1
Faulting module path: wlmail.exe2
Report Id: wlmail.exe3
Error: (10/13/2014 00:00:53 AM) (Source: .NET Runtime) (EventID: 1022) (User: )
Description: .NET Runtime version 4.0.30319.18444 - There was a failure initializing profiling API attach infrastructure. This process will not allow a profiler to attach. HRESULT: 0x80004005. Process ID (decimal): 10536. Message ID: [0x2509].
Error: (10/13/2014 00:00:07 AM) (Source: .NET Runtime) (EventID: 1022) (User: )
Description: .NET Runtime version 4.0.30319.18444 - There was a failure initializing profiling API attach infrastructure. This process will not allow a profiler to attach. HRESULT: 0x80004005. Process ID (decimal): 11948. Message ID: [0x2509].
Error: (10/12/2014 11:23:07 PM) (Source: .NET Runtime) (EventID: 1022) (User: )
Description: .NET Runtime version 4.0.30319.18444 - There was a failure initializing profiling API attach infrastructure. This process will not allow a profiler to attach. HRESULT: 0x80004005. Process ID (decimal): 9756. Message ID: [0x2509].
Error: (10/12/2014 11:21:02 PM) (Source: .NET Runtime) (EventID: 1022) (User: )
Description: .NET Runtime version 4.0.30319.18444 - There was a failure initializing profiling API attach infrastructure. This process will not allow a profiler to attach. HRESULT: 0x80004005. Process ID (decimal): 9352. Message ID: [0x2509].
Error: (10/12/2014 11:17:24 PM) (Source: .NET Runtime) (EventID: 1022) (User: )
Description: .NET Runtime version 4.0.30319.18444 - There was a failure initializing profiling API attach infrastructure. This process will not allow a profiler to attach. HRESULT: 0x80004005. Process ID (decimal): 6400. Message ID: [0x2509].
Error: (10/12/2014 11:14:54 PM) (Source: .NET Runtime) (EventID: 1022) (User: )
Description: .NET Runtime version 4.0.30319.18444 - There was a failure initializing profiling API attach infrastructure. This process will not allow a profiler to attach. HRESULT: 0x80004005. Process ID (decimal): 9008. Message ID: [0x2509].
System errors:
=============
Error: (10/13/2014 00:30:15 PM) (Source: Disk) (EventID: 11) (User: )
Description: The driver detected a controller error on \Device\Harddisk1\DR1.
Error: (10/13/2014 00:30:14 PM) (Source: Disk) (EventID: 11) (User: )
Description: The driver detected a controller error on \Device\Harddisk1\DR1.
Error: (10/13/2014 00:30:14 PM) (Source: Disk) (EventID: 11) (User: )
Description: The driver detected a controller error on \Device\Harddisk1\DR1.
Error: (10/13/2014 00:30:13 PM) (Source: Disk) (EventID: 11) (User: )
Description: The driver detected a controller error on \Device\Harddisk1\DR1.
Error: (10/13/2014 11:56:47 AM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: A timeout (30000 milliseconds) was reached while waiting for a transaction response from the Dnscache service.
Error: (10/13/2014 11:56:17 AM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: A timeout (30000 milliseconds) was reached while waiting for a transaction response from the Dnscache service.
Error: (10/13/2014 11:55:47 AM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: A timeout (30000 milliseconds) was reached while waiting for a transaction response from the Dnscache service.
Error: (10/13/2014 11:55:17 AM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: A timeout (30000 milliseconds) was reached while waiting for a transaction response from the LanmanWorkstation service.
Error: (10/13/2014 11:54:47 AM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: A timeout (30000 milliseconds) was reached while waiting for a transaction response from the Dnscache service.
Error: (10/13/2014 11:54:29 AM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: The Peer Name Resolution Protocol service terminated with the following error:
%%-2140993535
Microsoft Office Sessions:
=========================
Error: (10/08/2014 05:49:34 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 3, Application Name: Microsoft Office PowerPoint, Application Version: 12.0.6600.1000, Microsoft Office Version: 12.0.6612.1000. This session lasted 18991 seconds with 60 seconds of active time. This session ended with a crash.
Error: (01/11/2014 10:59:07 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 1, Application Name: Microsoft Office Excel, Application Version: 12.0.6683.5002, Microsoft Office Version: 12.0.6612.1000. This session lasted 10326 seconds with 5520 seconds of active time. This session ended with a crash.
CodeIntegrity Errors:
===================================
Date: 2014-01-30 22:00:30.889
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume6\Windows.old\Windows\winsxs\x86_microsoft-windows-appid_31bf3856ad364e35_6.1.7601.22318_none_59e0fbb029838c63\appidapi.dll because the set of per-page image hashes could not be found on the system.
Date: 2014-01-30 22:00:30.556
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume6\Windows.old\Windows\winsxs\x86_microsoft-windows-appid_31bf3856ad364e35_6.1.7601.22318_none_59e0fbb029838c63\appidapi.dll because the set of per-page image hashes could not be found on the system.
Date: 2014-01-30 22:00:29.885
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume6\Windows.old\Windows\winsxs\x86_microsoft-windows-appid_31bf3856ad364e35_6.1.7601.22318_none_59e0fbb029838c63\appid.sys because the set of per-page image hashes could not be found on the system.
Date: 2014-01-30 22:00:29.601
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume6\Windows.old\Windows\winsxs\x86_microsoft-windows-appid_31bf3856ad364e35_6.1.7601.22318_none_59e0fbb029838c63\appid.sys because the set of per-page image hashes could not be found on the system.
Date: 2014-01-11 16:33:33.186
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume6\Windows.old\Windows\winsxs\x86_microsoft-windows-appid_31bf3856ad364e35_6.1.7601.22318_none_59e0fbb029838c63\appidapi.dll because the set of per-page image hashes could not be found on the system.
Date: 2014-01-11 16:33:32.959
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume6\Windows.old\Windows\winsxs\x86_microsoft-windows-appid_31bf3856ad364e35_6.1.7601.22318_none_59e0fbb029838c63\appidapi.dll because the set of per-page image hashes could not be found on the system.
Date: 2014-01-11 16:33:32.536
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume6\Windows.old\Windows\winsxs\x86_microsoft-windows-appid_31bf3856ad364e35_6.1.7601.22318_none_59e0fbb029838c63\appid.sys because the set of per-page image hashes could not be found on the system.
Date: 2014-01-11 16:33:32.320
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume6\Windows.old\Windows\winsxs\x86_microsoft-windows-appid_31bf3856ad364e35_6.1.7601.22318_none_59e0fbb029838c63\appid.sys because the set of per-page image hashes could not be found on the system.
Date: 2013-12-18 10:07:39.737
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume6\Windows.old\Windows\winsxs\x86_microsoft-windows-appid_31bf3856ad364e35_6.1.7601.22318_none_59e0fbb029838c63\appidapi.dll because the set of per-page image hashes could not be found on the system.
Date: 2013-12-18 10:07:39.571
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume6\Windows.old\Windows\winsxs\x86_microsoft-windows-appid_31bf3856ad364e35_6.1.7601.22318_none_59e0fbb029838c63\appidapi.dll because the set of per-page image hashes could not be found on the system.
==================== Memory info ===========================
Processor: Intel(R) Pentium(R) Dual CPU T3400 @ 2.16GHz
Percentage of memory in use: 85%
Total physical RAM: 2939.99 MB
Available physical RAM: 414.02 MB
Total Pagefile: 11758.26 MB
Available Pagefile: 7750.18 MB
Total Virtual: 2047.88 MB
Available Virtual: 1900.43 MB
==================== Drives ================================
Drive c: (Windows7) (Fixed) (Total:133.41 GB) (Free:75.31 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: (Programs) (Fixed) (Total:141.32 GB) (Free:69.22 GB) NTFS
Drive e: (Data) (Fixed) (Total:189.56 GB) (Free:92.89 GB) NTFS
Drive g: (FreeAgent Drive) (Fixed) (Total:931.51 GB) (Free:174.03 GB) NTFS
Drive i: (STORE N GO) (Removable) (Total:3.73 GB) (Free:0.01 GB) FAT32
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: 305AD34B)
Partition 1: (Not Active) - (Size=1.5 GB) - (Type=27)
Partition 2: (Active) - (Size=133.4 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=141.3 GB) - (Type=05)
Partition 4: (Not Active) - (Size=189.6 GB) - (Type=07 NTFS)
========================================================
Disk: 1 (Size: 3.7 GB) (Disk ID: 00000000)
Partition: GPT Partition Type.
========================================================
Disk: 2 (Size: 931.5 GB) (Disk ID: B1D2A137)
Partition 1: (Not Active) - (Size=931.5 GB) - (Type=07 NTFS)
==================== End Of Log ============================
Hi,
IObit
http://blogs.computerworld.com/15026/iobit_accused_of_stealing_from_malwarebytes
-AdwCleaner-by Xplode
Click on this link to download : ADWCleaner (http://www.bleepingcomputer.com/download/adwcleaner/)
Click on ONE of the Two Blue Download Now buttons That have a blue arrow beside them and save it to your desktop.
Do not click on any links in the top Advertisment.
Close all open programs and internet browsers.
Double click on AdwCleaner.exe to run the tool.
Click on Scan.
After the scan is complete click on "Clean"
Confirm each time with Ok.
Your computer will be rebooted automatically. A text file will open after the restart.
Please post the content of that logfile with your next reply.
You can find the logfile at C:\AdwCleaner[S1].txt as well.
===============================================================================
http://imageshack.us/a/img841/7292/thisisujrt.gif Please download Junkware Removal Tool (http://thisisudax.org/downloads/JRT.exe) to your desktop.
Shut down your protection software now to avoid potential conflicts.
Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
The tool will open and start scanning your system.
Please be patient as this can take a while to complete depending on your system's specifications.
On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
Post the contents of JRT.txt into your next message.
===============================================================================
Download Malwarebytes' Anti-Malware (http://www.malwarebytes.org/mbam-download.php) to your desktop.
Windows XP : Double click on the icon to run it.
Windows Vista, Windows 7 & 8 : Right click and select "Run as Administrator"
http://i1269.photobucket.com/albums/jj590/OCD-WTT/MBAMDashboard_zpsddef9b5f.gif (http://s1269.photobucket.com/user/OCD-WTT/media/MBAMDashboard_zpsddef9b5f.gif.html)
On the Dashboard click on Update Now
Go to the Setting Tab
Under Setting go to Detection and Protection
Under PUP and PUM make sure both are set to show Treat Detections as Malware
Go to Advanced setting and make sure Automatically Quarantine Detected Items is checked
Then on the Dashboard click on Scan
Make sure to select THREAT SCAN
Then click on Scan
When the scan is finished and the log pops up...select Copy to Clipboard
Please paste the log back into this thread for review
Exit Malwarebytes
Hi Ken 545,
1. logs attached.
2. In AdwCleaner under Quarantine/c/Program Data/Tbccint/Multi/CT3202343 I found these: configutaion.json.vir; SetupIcon.ico and UninstallerUI.exe.vir.
I now proceed with your other recommendations/
yours
laksi
Hi Ken545,
log is attached.
sincerely
laksi
OK, just waiting for you to run Malwarebytes and post the log
I attach a snip of the Quarantine "log" from within mbam
Try this as per instructions for Malwarebytes
1. Open up Malwarebytes
2. Go to the History Tab
3. Click on Application Logs
4. Click on the last Scan Log you just ran
5. Click on View
6. Then on the Bottom click on Copy to Clipboard
7. Then paste it into this thread
Hi 545,
I guess I don't have to worry now.:thanks:
Thanks "from the bottom of my heart" as the saying goes.
Really thank you.
And here we say
SHALOM
laksi - Yaakov Laks - Arad, Israel
Malwarebytes Anti-Malware
www.malwarebytes.org
Scan Date: 13/10/2014
Scan Time: 22:44:11
Logfile:
Administrator: Yes
Version: 2.00.3.1025
Malware Database: v2014.10.13.07
Rootkit Database: v2014.10.11.01
License: Trial
Malware Protection: Enabled
Malicious Website Protection: Enabled
Self-protection: Disabled
OS: Windows 7 Service Pack 1
CPU: x86
File System: NTFS
User: Yaakov Laks
Scan Type: Threat Scan
Result: Completed
Objects Scanned: 315942
Time Elapsed: 1 hr, 1 min, 25 sec
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Enabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled
Processes: 0
(No malicious items detected)
Modules: 0
(No malicious items detected)
Registry Keys: 0
(No malicious items detected)
Registry Values: 0
(No malicious items detected)
Registry Data: 0
(No malicious items detected)
Folders: 0
(No malicious items detected)
Files: 0
(No malicious items detected)
Physical Sectors: 0
(No malicious items detected)
(end)
Shalom Yaakov
Did you ever uninstall IObit ?
Why don't you go ahead and run a new scan with FRST , be sure to checkmark Additions, post both new logs please and let me take one final look
Shalom Ken,
I uninstalled iobit alright, but I'll run a search on the registry and wipe off any remains.
Shalom, yours
laksi
If you post a new FRST log along with the Additions I can help you remove leftovers if we find them
Shalom Ken,
Logs are attached,
thanks
laksi
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 15-10-2014 02
Ran by Yaakov Laks (administrator) on LAPTOSH-PC on 16-10-2014 08:42:56
Running from E:\F\Downloads\DLSoftware 15\SpyBot
Loaded Profile: Yaakov Laks (Available profiles: Yaakov Laks)
Platform: Microsoft Windows 7 Home Premium Service Pack 1 (X86) OS Language: English (United States)
Internet Explorer Version 11
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(IObit) C:\Program Files\IObit\Advanced SystemCare 7\ASCService.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(Microsoft Corporation) C:\Program Files\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe
(Microsoft Corporation) C:\Program Files\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe
(Brio) D:\Program Files\1Utils\Folder Size\FolderSizeSvc.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
(Giraffic) C:\Program Files\Giraffic\GirafficWatchdog.exe
(Malwarebytes Corporation) D:\Program Files\1AntiVandals\Malwarebytes Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) D:\Program Files\1AntiVandals\Malwarebytes Anti-Malware\mbamservice.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\VS7DEBUG\mdm.exe
(Giraffic) C:\Program Files\Giraffic\Giraffic.exe
(Secunia) C:\Program Files\Secunia\PSI\psia.exe
(Secunia) C:\Program Files\Secunia\PSI\sua.exe
(Toshiba Europe GmbH) D:\Program Files\1Maint\Toshiba TEMPRO\TemproSvc.exe
(TOSHIBA Corporation) D:\Program Files\TOSHIBA\TOSHIBA DVD PLAYER\TNaviSrv.exe
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
(Safer-Networking Ltd.) D:\Program Files\1AntiVandals\Spybot - Search & Destroy 2\SDUpdSvc.exe
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
(Safer-Networking Ltd.) D:\Program Files\1AntiVandals\Spybot - Search & Destroy 2\SDWSCSvc.exe
(StorageCraft Technology Corporation) D:\Program Files\1Maint\StorageCraft\vsnapvss.exe
(Safer-Networking Ltd.) D:\Program Files\1AntiVandals\Spybot - Search & Destroy 2\SDFSSvc.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
(Malwarebytes Corporation) D:\Program Files\1AntiVandals\Malwarebytes Anti-Malware\mbam.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Synaptics, Inc.) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
(IObit) C:\Program Files\IObit\Smart Defrag 3\SmartDefrag.exe
(Safer-Networking Ltd.) D:\Program Files\1AntiVandals\Spybot - Search & Destroy 2\SDTray.exe
(Chicony) C:\Program Files\Camera Assistant Software for Toshiba\traybar.exe
() C:\Program Files\Hosts_Anti_Adwares_PUPs\HOSTS_Anti-Adware_main.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Google Inc.) C:\Program Files\Google\Update\1.3.24.15\GoogleCrashHandler.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(Synaptics, Inc.) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Nokia) C:\Program Files\Nokia\Nokia Suite\NokiaSuite.exe
(Akamai Technologies, Inc.) C:\Users\Yaakov Laks\AppData\Local\Akamai\netsession_win.exe
() C:\Program Files\G9G11_ScreenCapture\ScreenCapture.exe
(Akamai Technologies, Inc.) C:\Users\Yaakov Laks\AppData\Local\Akamai\netsession_win.exe
(Secunia) C:\Program Files\Secunia\PSI\psi_tray.exe
(Firetrust Ltd) D:\Program Files\1AntiVandals\MailWasher Pro654\MailWasher Pro\MailWasher.exe
(Piriform Ltd) D:\Program Files\1Maint\ccleaner\CCleaner.exe
(LSI Corporation) C:\Program Files\LSI SoftModem\agrsmsvc.exe
(Microsoft Corporation) C:\Windows\System32\wbem\unsecapp.exe
(Nokia) C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
(Nokia) C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe
(Nokia) C:\Program Files\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe
(Privacyware/PWI, Inc.) D:\Program Files\1AntiVandals\private firewall\pfsvc.exe
(Privacyware/PWI, Inc.) D:\Program Files\1AntiVandals\private firewall\PFGUI.exe
(Microsoft Corporation) C:\Program Files\Windows Live\Mail\wlmail.exe
(Microsoft Corporation) C:\Program Files\Windows Live\Contacts\wlcomm.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office12\WINWORD.EXE
(StorageCraft Technology Corporation) D:\Program Files\1Maint\StorageCraft\ShadowProtect.exe
(StorageCraft Technology Corporation) D:\Program Files\1Maint\StorageCraft\ShadowProtectSvc.exe
(Microsoft Corporation) C:\Program Files\Microsoft Games\FreeCell\FreeCell.exe
(Mozilla Corporation) D:\Program Files\Firefox\firefox.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [MSC] => C:\Program Files\Microsoft Security Client\msseces.exe [974432 2014-08-22] (Microsoft Corporation)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1348904 2008-08-14] (Synaptics, Inc.)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [12021464 2014-07-21] (Realtek Semiconductor)
HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959176 2014-08-21] (Adobe Systems Incorporated)
HKLM\...\Run: [SDTray] => D:\Program Files\1AntiVandals\Spybot - Search & Destroy 2\SDTray.exe [5624784 2013-07-25] (Safer-Networking Ltd.)
HKLM\...\Run: [Camera Assistant Software] => C:\Program Files\Camera Assistant Software for Toshiba\traybar.exe [417792 2009-04-10] (Chicony)
HKLM\...\Run: [HOSTS Anti-Adware_PUPs] => C:\Program Files\Hosts_Anti_Adwares_PUPs\HOSTS_Anti-Adware_main.exe [302961 2013-10-07] ()
HKLM\...\Run: [] => [X]
HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [256896 2014-07-25] (Oracle Corporation)
HKLM\...\Run: [Privatefirewall] => D:\Program Files\1AntiVandals\private firewall\PFGUI.exe [3048480 2013-12-17] (Privacyware/PWI, Inc.)
Winlogon\Notify\SDWinLogon: SDWinLogon.dll [X]
HKU\S-1-5-21-2920106312-904050420-1618604034-1001\...\Run: [] => [X]
HKU\S-1-5-21-2920106312-904050420-1618604034-1001\...\Run: [NokiaSuite.exe] => C:\Program Files\Nokia\Nokia Suite\NokiaSuite.exe [1090912 2013-10-02] (Nokia)
HKU\S-1-5-21-2920106312-904050420-1618604034-1001\...\Run: [Akamai NetSession Interface] => C:\Users\Yaakov Laks\AppData\Local\Akamai\netsession_win.exe [4672920 2014-04-17] (Akamai Technologies, Inc.)
HKU\S-1-5-21-2920106312-904050420-1618604034-1001\...\Run: [OscarEditor] => C:\Program Files\G9G11_ScreenCapture\ScreenCapture.exe [3538944 2012-05-18] ()
HKU\S-1-5-21-2920106312-904050420-1618604034-1001\...\Run: [CCleaner Monitoring] => D:\Program Files\1Maint\ccleaner\CCleaner.exe [4811032 2014-09-26] (Piriform Ltd)
HKU\S-1-5-21-2920106312-904050420-1618604034-1001\...\Policies\Explorer: [NoFavoritesMenu] 1
HKU\S-1-5-18\...\Run: [Advanced SystemCare 7] => C:\Program Files\IObit\Advanced SystemCare 7\ASCTray.exe [2295584 2014-04-21] (IObit)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Secunia PSI Tray.lnk
ShortcutTarget: Secunia PSI Tray.lnk -> C:\Program Files\Secunia\PSI\psi_tray.exe (Secunia)
Startup: C:\Users\Yaakov Laks\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MailWasherPro.lnk
ShortcutTarget: MailWasherPro.lnk -> D:\Program Files\1AntiVandals\MailWasher Pro654\MailWasher Pro\MailWasher.exe (Firetrust Ltd)
ShellIconOverlayIdentifiers: [GDriveBlacklistedOverlay] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42} => C:\Program Files\Google\Drive\googledrivesync32.dll (Google)
ShellIconOverlayIdentifiers: [GDriveSharedEditOverlay] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44} => C:\Program Files\Google\Drive\googledrivesync32.dll (Google)
ShellIconOverlayIdentifiers: [GDriveSharedViewOverlay] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43} => C:\Program Files\Google\Drive\googledrivesync32.dll (Google)
ShellIconOverlayIdentifiers: [GDriveSyncedOverlay] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40} => C:\Program Files\Google\Drive\googledrivesync32.dll (Google)
ShellIconOverlayIdentifiers: [GDriveSyncingOverlay] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41} => C:\Program Files\Google\Drive\googledrivesync32.dll (Google)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = he-IL
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x4C67C112E0E3CF01
SearchScopes: HKCU - {7DAAAB92-E210-43F8-AA79-83FD3E90890A} URL = http://search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=902615&p={searchTerms}
BHO: ExplorerWnd Helper -> {10921475-03CE-4E04-90CE-E2E7EF20C814} -> D:\Program Files\1Maint\IObit Uninstaller\UninstallExplorer32.dll No File
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Ads Removal -> {9D974C8C-6D92-44FB-BEAF-B45A1C0CF17F} -> C:\Program Files\IObit\IObit Malware Fighter\adsremoval\IE\Adblock.dll (Adblock)
BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Handler: belarc - {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - C:\Program Files\Belarc\Advisor\System\BAVoilaX.dll (Belarc, Inc.)
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 80.179.52.100 80.179.55.100
FireFox:
========
FF ProfilePath: C:\Users\Yaakov Laks\AppData\Roaming\Mozilla\Firefox\Profiles\9l7tyrid.default-1405248970516
FF Homepage: about:home
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_15_0_0_152.dll ()
FF Plugin: @adobe.com/ShockwavePlayer -> C:\Windows\system32\Adobe\Director\np32dsw_1213153.dll (Adobe Systems, Inc.)
FF Plugin: @Google.com/GoogleEarthPlugin -> C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin: @java.com/DTPlugin,version=10.67.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.67.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE -> C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/VirtualEarth3D,version=4.0 -> C:\Program Files\Virtual Earth 3D\ ()
FF Plugin: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @nokia.com/EnablerPlugin -> C:\Program Files\Nokia\Nokia Suite\npNokiaSuiteEnabler.dll ( )
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @videolan.org/vlc,version=2.0.8 -> D:\Program Files\1Viewers\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.2 -> D:\Program Files\1Viewers\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.3 -> D:\Program Files\1Viewers\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.5 -> D:\Program Files\1Viewers\VLC\npvlc.dll (VideoLAN)
FF Plugin: Adobe Reader -> D:\Program Files\Adobe\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\Yaakov Laks\AppData\Roaming\Mozilla\Firefox\Profiles\9l7tyrid.default-1405248970516\searchplugins\nana10-customized-web-search.xml
FF Extension: Ads Removal - C:\Users\Yaakov Laks\AppData\Roaming\Mozilla\Firefox\Profiles\9l7tyrid.default-1405248970516\Extensions\adremoveext@adremoveext.net [2014-08-25]
FF Extension: Adblock Plus - C:\Users\Yaakov Laks\AppData\Roaming\Mozilla\Firefox\Profiles\9l7tyrid.default-1405248970516\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-08-21]
FF StartMenuInternet: FIREFOX.EXE - D:\Program Files\Firefox\firefox.exe
Chrome:
=======
CHR HomePage: Default ->
CHR StartupUrls: Default -> ""
CHR DefaultSuggestURL: Default -> {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&gs_ri={google:suggestRid}&xssi=t&q={searchTerms}&{google:inputType}{google:cursorPosition}{google:currentPageUrl}{google:pageClassification}{google:searchVersion}{google:sessionToken}{google:prefetchQuery}sugkey={google:suggestAPIKeyParameter}
CHR Profile: C:\Users\Yaakov Laks\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Docs) - C:\Users\Yaakov Laks\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2013-09-08]
CHR Extension: (כונן Google) - C:\Users\Yaakov Laks\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-09-08]
CHR Extension: (Advanced SystemCare Surfing Protection) - C:\Users\Yaakov Laks\AppData\Local\Google\Chrome\User Data\Default\Extensions\bbmegnmpleoagolcnjnejdacakedpcgd [2014-03-20]
CHR Extension: (YouTube) - C:\Users\Yaakov Laks\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-09-08]
CHR Extension: (חיפוש Google) - C:\Users\Yaakov Laks\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-09-08]
CHR Extension: (AD Block) - C:\Users\Yaakov Laks\AppData\Local\Google\Chrome\User Data\Default\Extensions\lfgjbmhakaffflkjecineeaadpidgikb [2014-01-15]
CHR Extension: (Advanced SystemCare Surfing Protection) - C:\Users\Yaakov Laks\AppData\Local\Google\Chrome\User Data\Default\Extensions\nfengeggddojhakldhlpjdlddgkkjkdd [2014-03-20]
CHR Extension: (תוספת RSS Subscription (מאת Google)) - C:\Users\Yaakov Laks\AppData\Local\Google\Chrome\User Data\Default\Extensions\nlbjncdgjeocebhnmkbbbdekmmmcbfjd [2014-03-09]
CHR Extension: (Google Wallet) - C:\Users\Yaakov Laks\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-08]
CHR Extension: (Gmail) - C:\Users\Yaakov Laks\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-09-08]
CHR Profile: C:\Users\Yaakov Laks\AppData\Local\Google\Chrome\User Data\Profile 1
CHR Extension: (Google Docs) - C:\Users\Yaakov Laks\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\aohghmighlieiainnegkcijnfilokake [2014-05-24]
CHR Extension: (Google Drive) - C:\Users\Yaakov Laks\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-05-24]
CHR Extension: (YouTube) - C:\Users\Yaakov Laks\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-05-24]
CHR Extension: (Google Search) - C:\Users\Yaakov Laks\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-05-24]
CHR Extension: (Advanced SystemCare Surfing Protection) - C:\Users\Yaakov Laks\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\nfengeggddojhakldhlpjdlddgkkjkdd [2014-05-24]
CHR Extension: (Google Wallet) - C:\Users\Yaakov Laks\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-05-24]
CHR Extension: (No Name) - C:\Users\Yaakov Laks\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\okemjkdkkihnhdaanohnleknbaddlddb [2014-10-03]
CHR Extension: (Gmail) - C:\Users\Yaakov Laks\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-05-24]
CHR HKLM\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files\Skype\Toolbars\ChromeExtension\skype_chrome_extension.crx [2014-07-14]
CHR HKLM\...\Chrome\Extension: [nfengeggddojhakldhlpjdlddgkkjkdd] - C:\Program Files\IObit\Surfing Protection\BrowerProtect\ASC_GhromePlugin.crx [2014-07-14]
========================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 AdvancedSystemCareService7; C:\Program Files\IObit\Advanced SystemCare 7\ASCService.exe [881952 2014-01-14] (IObit)
R2 AgereModemAudio; C:\Program Files\LSI SoftModem\agrsmsvc.exe [14336 2000-01-01] (LSI Corporation)
R2 c2cautoupdatesvc; C:\Program Files\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1390176 2014-07-14] (Microsoft Corporation)
R2 c2cpnrsvc; C:\Program Files\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1767520 2014-07-14] (Microsoft Corporation)
R2 FolderSize; D:\Program Files\1Utils\Folder Size\FolderSizeSvc.exe [116224 2010-04-06] (Brio) [File not signed]
R2 Giraffic; C:\Program Files\Giraffic\GirafficWatchdog.exe [2245232 2013-05-13] (Giraffic)
S2 HOSTS Anti-PUPs; C:\Program Files\Hosts_Anti_Adwares_PUPs\HOSTS_Anti-Adware.exe [285795 2013-10-07] () [File not signed]
S2 LiveUpdateSvc; C:\Program Files\IObit\LiveUpdate\LiveUpdate.exe [2152736 2014-05-04] (IObit)
R2 MBAMScheduler; D:\Program Files\1AntiVandals\Malwarebytes Anti-Malware\mbamscheduler.exe [1871160 2014-10-01] (Malwarebytes Corporation)
R2 MBAMService; D:\Program Files\1AntiVandals\Malwarebytes Anti-Malware\mbamservice.exe [968504 2014-10-01] (Malwarebytes Corporation)
R2 MDM; C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe [335872 2006-10-26] (Microsoft Corporation) [File not signed]
R2 MsMpSvc; C:\Program Files\Microsoft Security Client\MsMpEng.exe [22192 2014-08-22] (Microsoft Corporation)
R3 NisSrv; C:\Program Files\Microsoft Security Client\NisSrv.exe [288120 2014-08-22] (Microsoft Corporation)
R2 PFNet; D:\Program Files\1AntiVandals\private firewall\pfsvc.exe [374600 2013-12-17] (Privacyware/PWI, Inc.)
R2 SDScannerService; D:\Program Files\1AntiVandals\Spybot - Search & Destroy 2\SDFSSvc.exe [1817560 2013-05-16] (Safer-Networking Ltd.)
R2 SDUpdateService; D:\Program Files\1AntiVandals\Spybot - Search & Destroy 2\SDUpdSvc.exe [1033688 2013-05-16] (Safer-Networking Ltd.)
R2 SDWSCService; D:\Program Files\1AntiVandals\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2013-05-15] (Safer-Networking Ltd.)
R2 Secunia PSI Agent; C:\Program Files\Secunia\PSI\PSIA.exe [1228504 2013-07-03] (Secunia)
R2 Secunia Update Agent; C:\Program Files\Secunia\PSI\sua.exe [660184 2013-07-03] (Secunia)
S2 ShadowProtectSvc; D:\Program Files\1Maint\StorageCraft\ShadowProtectSvc.exe [4672336 2014-10-12] (StorageCraft Technology Corporation)
R2 TemproMonitoringService; D:\Program Files\1Maint\Toshiba TEMPRO\TemproSvc.exe [112080 2011-02-10] (Toshiba Europe GmbH)
R2 TNaviSrv; D:\Program Files\TOSHIBA\TOSHIBA DVD PLAYER\TNaviSrv.exe [83312 2008-07-18] (TOSHIBA Corporation)
R2 VSNAPVSS; D:\Program Files\1Maint\StorageCraft\vsnapvss.exe [71976 2014-10-12] (StorageCraft Technology Corporation)
S2 HPSLPSVC; C:\Users\Yaakov Laks\AppData\Local\Temp\7zS669C\hpslpsvc32.dll [X]
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R1 Amfilter; C:\Windows\System32\DRIVERS\Amfilter.sys [8704 2009-08-27] (A4Tech Co.,Ltd.) [File not signed]
S3 Amusbprt; C:\Windows\System32\DRIVERS\Amusbprt.sys [14336 2009-08-27] (A4Tech Co.,Ltd.) [File not signed]
R3 athr; C:\Windows\System32\DRIVERS\athr.sys [3234304 2014-07-22] (Qualcomm Atheros Communications, Inc.)
S3 BroadcomWModem; C:\Windows\System32\DRIVERS\bcmww.sys [118400 2005-06-02] (Broadcom Corporation)
S3 BroadcomWWNIC; C:\Windows\System32\DRIVERS\bcmwwNet.sys [58496 2005-02-09] (Broadcom Corporation)
R0 giveio; C:\Windows\System32\giveio.sys [5248 1996-04-03] () [File not signed]
S3 IT9135BDA; C:\Windows\System32\Drivers\IT9135BDA.sys [123008 2010-12-19] (ITE )
R3 KeyScrambler; C:\Windows\System32\drivers\keyscrambler.sys [209016 2013-05-31] (QFX Software Corporation)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [23256 2014-10-01] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [114904 2014-10-16] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [51928 2014-10-01] (Malwarebytes Corporation)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [231800 2014-07-17] (Microsoft Corporation)
R2 PfFilter; C:\Program Files\IObit\Protected Folder\pffilter.sys [34336 2013-04-03] (IObit Information Technology)
S3 PSI; C:\Windows\System32\DRIVERS\psi_mf_x86.sys [16024 2013-07-03] (Secunia)
R1 pwipf6; C:\Windows\System32\DRIVERS\pwipf6.sys [130568 2013-09-29] (Privacyware/PWI, Inc.)
S3 RTHDMIAzAudService; C:\Windows\System32\drivers\RtHDMIV.sys [141408 2008-02-27] (Realtek Semiconductor Corp.)
R3 rusb3hub; C:\Windows\System32\DRIVERS\rusb3hub.sys [91016 2012-08-27] (Renesas Electronics Corporation)
R3 rusb3xhc; C:\Windows\System32\DRIVERS\rusb3xhc.sys [181128 2012-08-27] (Renesas Electronics Corporation)
R0 SmartDefragDriver; C:\Windows\System32\Drivers\SmartDefragDriver.sys [18624 2014-06-04] (IObit)
R3 SmbDrvI; C:\Windows\System32\DRIVERS\Smb_driver_Intel.sys [27888 2014-01-26] (Synaptics Incorporated)
R0 speedfan; C:\Windows\System32\speedfan.sys [24184 2012-12-29] (Almico Software)
S3 SWDUMon; C:\Windows\System32\DRIVERS\SWDUMon.sys [13464 2014-08-13] ()
R3 UVCFTR; C:\Windows\System32\Drivers\UVCFTR_S.SYS [17960 2009-04-10] (Chicony Electronics Co., Ltd.)
S1 BAPIDRV; system32\DRIVERS\BAPIDRV.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-10-15 19:35 - 2014-10-15 19:35 - 00025600 ____C (Gibson Research Corp.) C:\Users\Yaakov Laks\Downloads\leaktest(1).exe
2014-10-15 19:07 - 2014-10-15 19:07 - 00000000 ___DC () C:\Users\Yaakov Laks\AppData\Local\Privatefirewall
2014-10-15 09:34 - 2014-10-15 09:34 - 00000000 ___DC () C:\Windows\Tasks\360Disabled
2014-10-15 09:23 - 2014-10-15 20:10 - 00000146 ____C () C:\Windows\ODBC.INI
2014-10-15 09:23 - 2014-10-15 20:10 - 00000000 ___DC () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Privatefirewall 7.0
2014-10-15 09:23 - 2014-10-15 09:23 - 00000000 ___DC () C:\ProgramData\Privacyware
2014-10-15 09:23 - 2013-09-29 21:24 - 00130568 ____C (Privacyware/PWI, Inc.) C:\Windows\system32\Drivers\pwipf6.sys
2014-10-15 09:19 - 2014-10-15 19:06 - 00000000 ___DC () C:\Program Files\360
2014-10-15 00:19 - 2014-10-15 19:50 - 02379264 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-10-15 00:18 - 2014-10-15 19:46 - 00372736 _____ (Microsoft Corporation) C:\Windows\system32\rastls.dll
2014-10-15 00:18 - 2014-10-15 19:41 - 17484800 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-10-15 00:18 - 2014-10-15 19:41 - 11807232 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-10-15 00:18 - 2014-10-15 19:41 - 04201472 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-10-15 00:18 - 2014-10-15 19:41 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-10-15 00:18 - 2014-10-15 19:41 - 02187264 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-10-15 00:18 - 2014-10-15 19:41 - 02017280 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-10-15 00:18 - 2014-10-15 19:41 - 01810944 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-10-15 00:18 - 2014-10-15 19:41 - 01190400 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-10-15 00:18 - 2014-10-15 19:41 - 01068032 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-10-15 00:18 - 2014-10-15 19:41 - 00678400 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-10-15 00:18 - 2014-10-15 19:41 - 00677888 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-10-15 00:18 - 2014-10-15 19:41 - 00646144 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-10-15 00:18 - 2014-10-15 19:41 - 00607744 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-10-15 00:18 - 2014-10-15 19:41 - 00597504 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-10-15 00:18 - 2014-10-15 19:41 - 00454656 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-10-15 00:18 - 2014-10-15 19:41 - 00440320 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-10-15 00:18 - 2014-10-15 19:41 - 00365056 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-10-15 00:18 - 2014-10-15 19:41 - 00331448 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-10-15 00:18 - 2014-10-15 19:41 - 00243200 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-10-15 00:18 - 2014-10-15 19:41 - 00164864 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-10-15 00:18 - 2014-10-15 19:41 - 00112128 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-10-15 00:18 - 2014-10-15 19:41 - 00108032 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-10-15 00:18 - 2014-10-15 19:41 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-10-15 00:18 - 2014-10-15 19:41 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-10-15 00:18 - 2014-10-15 19:41 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-10-15 00:18 - 2014-10-15 19:41 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-10-15 00:18 - 2014-10-15 19:41 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-10-15 00:18 - 2014-10-15 19:41 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-10-15 00:18 - 2014-10-15 19:41 - 00032768 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-10-15 00:18 - 2014-10-15 19:41 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-10-15 00:18 - 2014-10-15 19:25 - 01131664 _____ (Microsoft Corporation) C:\Windows\system32\dfshim.dll
2014-10-15 00:18 - 2014-10-15 19:25 - 00156824 _____ (Microsoft Corporation) C:\Windows\system32\mscorier.dll
2014-10-15 00:18 - 2014-10-15 19:25 - 00081560 _____ (Microsoft Corporation) C:\Windows\system32\mscories.dll
2014-10-15 00:18 - 2014-10-15 19:24 - 02744320 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll
2014-10-15 00:17 - 2014-10-15 19:21 - 05703168 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll
2014-10-15 00:17 - 2014-10-15 19:21 - 00523264 _____ (Microsoft Corporation) C:\Windows\system32\termsrv.dll
2014-10-15 00:17 - 2014-10-15 19:21 - 00304128 _____ (Microsoft Corporation) C:\Windows\system32\winlogon.exe
2014-10-15 00:17 - 2014-10-15 19:21 - 00184320 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rdpwd.sys
2014-10-15 00:17 - 2014-10-15 19:21 - 00157696 _____ (Microsoft Corporation) C:\Windows\system32\winsta.dll
2014-10-15 00:17 - 2014-10-15 19:21 - 00130048 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorekmts.dll
2014-10-15 00:17 - 2014-10-15 19:21 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2014-10-15 00:17 - 2014-10-15 19:21 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys
2014-10-15 00:17 - 2014-10-15 19:21 - 00017408 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2014-10-15 00:16 - 2014-10-15 19:19 - 02363904 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2014-10-15 00:15 - 2014-10-15 19:18 - 12625408 _____ (Microsoft Corporation) C:\Windows\system32\wmploc.DLL
2014-10-15 00:15 - 2014-10-15 19:18 - 11411456 _____ (Microsoft Corporation) C:\Windows\system32\wmp.dll
2014-10-15 00:15 - 2014-10-15 19:18 - 03970488 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe
2014-10-15 00:15 - 2014-10-15 19:18 - 03914680 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2014-10-15 00:15 - 2014-10-15 19:18 - 03208704 _____ (Microsoft Corporation) C:\Windows\system32\mf.dll
2014-10-15 00:15 - 2014-10-15 19:18 - 01329664 _____ (Microsoft Corporation) C:\Windows\system32\quartz.dll
2014-10-15 00:15 - 2014-10-15 19:18 - 01174528 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2014-10-15 00:15 - 2014-10-15 19:18 - 01005056 _____ (Microsoft Corporation) C:\Windows\system32\cryptui.dll
2014-10-15 00:15 - 2014-10-15 19:18 - 00988160 _____ (Microsoft Corporation) C:\Windows\system32\drmv2clt.dll
2014-10-15 00:15 - 2014-10-15 19:18 - 00744960 _____ (Microsoft Corporation) C:\Windows\system32\blackbox.dll
2014-10-15 00:15 - 2014-10-15 19:18 - 00617984 _____ (Microsoft Corporation) C:\Windows\system32\wmdrmsdk.dll
2014-10-15 00:15 - 2014-10-15 19:18 - 00593920 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\PEAuth.sys
2014-10-15 00:15 - 2014-10-15 19:18 - 00521384 _____ (Microsoft Corporation) C:\Windows\system32\winload.exe
2014-10-15 00:15 - 2014-10-15 19:18 - 00504320 _____ (Microsoft Corporation) C:\Windows\system32\msscp.dll
2014-10-15 00:15 - 2014-10-15 19:18 - 00489984 _____ (Microsoft Corporation) C:\Windows\system32\evr.dll
2014-10-15 00:15 - 2014-10-15 19:18 - 00473600 _____ (Microsoft Corporation) C:\Windows\system32\audiosrv.dll
2014-10-15 00:15 - 2014-10-15 19:18 - 00455752 _____ (Microsoft Corporation) C:\Windows\system32\winresume.exe
2014-10-15 00:15 - 2014-10-15 19:18 - 00442880 _____ (Microsoft Corporation) C:\Windows\system32\AUDIOKSE.dll
2014-10-15 00:15 - 2014-10-15 19:18 - 00409272 _____ (Microsoft Corporation) C:\Windows\system32\ci.dll
2014-10-15 00:15 - 2014-10-15 19:18 - 00406016 _____ (Microsoft Corporation) C:\Windows\system32\drmmgrtn.dll
2014-10-15 00:15 - 2014-10-15 19:18 - 00374784 _____ (Microsoft Corporation) C:\Windows\system32\AudioEng.dll
2014-10-15 00:15 - 2014-10-15 19:18 - 00354816 _____ (Microsoft Corporation) C:\Windows\system32\mfplat.dll
2014-10-15 00:15 - 2014-10-15 19:18 - 00275968 _____ (Microsoft Corporation) C:\Windows\system32\EncDump.dll
2014-10-15 00:15 - 2014-10-15 19:18 - 00265216 _____ (Microsoft Corporation) C:\Windows\system32\msnetobj.dll
2014-10-15 00:15 - 2014-10-15 19:18 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\AudioSes.dll
2014-10-15 00:15 - 2014-10-15 19:18 - 00179200 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2014-10-15 00:15 - 2014-10-15 19:18 - 00157184 _____ (Microsoft Corporation) C:\Windows\system32\pcasvc.dll
2014-10-15 00:15 - 2014-10-15 19:18 - 00143872 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2014-10-15 00:15 - 2014-10-15 19:18 - 00103424 _____ (Microsoft Corporation) C:\Windows\system32\mfps.dll
2014-10-15 00:15 - 2014-10-15 19:18 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\audiodg.exe
2014-10-15 00:15 - 2014-10-15 19:18 - 00096768 _____ (Microsoft Corporation) C:\Windows\system32\appidpolicyconverter.exe
2014-10-15 00:15 - 2014-10-15 19:18 - 00081408 _____ (Microsoft Corporation) C:\Windows\system32\cryptsp.dll
2014-10-15 00:15 - 2014-10-15 19:18 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\packager.dll
2014-10-15 00:15 - 2014-10-15 19:18 - 00050688 _____ (Microsoft Corporation) C:\Windows\system32\appidapi.dll
2014-10-15 00:15 - 2014-10-15 19:18 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\setbcdlocale.dll
2014-10-15 00:15 - 2014-10-15 19:18 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\rrinstaller.exe
2014-10-15 00:15 - 2014-10-15 19:18 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\appid.sys
2014-10-15 00:15 - 2014-10-15 19:18 - 00027648 _____ (Microsoft Corporation) C:\Windows\system32\appidsvc.dll
2014-10-15 00:15 - 2014-10-15 19:18 - 00023040 _____ (Microsoft Corporation) C:\Windows\system32\mfpmp.exe
2014-10-15 00:15 - 2014-10-15 19:18 - 00016896 _____ (Microsoft Corporation) C:\Windows\system32\appidcertstorecheck.exe
2014-10-15 00:15 - 2014-10-15 19:18 - 00008192 _____ (Microsoft Corporation) C:\Windows\system32\spwmp.dll
2014-10-15 00:15 - 2014-10-15 19:18 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\msdxm.ocx
2014-10-15 00:15 - 2014-10-15 19:18 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\dxmasf.dll
2014-10-15 00:15 - 2014-10-15 19:18 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\mferror.dll
2014-10-14 22:16 - 2014-10-16 07:14 - 00114904 ____C (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-10-14 22:16 - 2014-10-14 22:16 - 00000892 ____C () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-10-14 22:16 - 2014-10-14 22:16 - 00000000 ___DC () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-10-14 22:16 - 2014-10-01 11:11 - 00075480 ____C (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-10-14 22:16 - 2014-10-01 11:11 - 00051928 ____C (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-10-14 22:16 - 2014-10-01 11:11 - 00023256 ____C (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-10-14 21:27 - 2014-10-14 21:27 - 00025600 ___RC (Gibson Research Corp.) C:\Users\Yaakov Laks\Downloads\LeakTest.exe
2014-10-14 19:04 - 2014-10-14 21:57 - 00001057 ____C () C:\Users\Yaakov Laks\Desktop\mbam20141013.txt
2014-10-14 17:52 - 2014-10-14 17:52 - 00023556 ____C () C:\Users\Yaakov Laks\Desktop\1501 manual0002.tif
2014-10-14 17:52 - 2014-10-14 17:52 - 00010438 ____C () C:\Users\Yaakov Laks\Desktop\1501 manual0001.tif
2014-10-13 22:28 - 2014-10-13 22:29 - 19828376 ____C (Malwarebytes Corporation ) C:\Users\Yaakov Laks\Desktop\mbam-setup-2.0.3.1025.exe
2014-10-13 17:14 - 2014-10-13 17:14 - 00002209 ____C () C:\Users\Yaakov Laks\Desktop\JRT.txt
2014-10-13 17:11 - 2014-10-13 17:11 - 00000000 ___DC () C:\Windows\ERUNT
2014-10-13 16:13 - 2014-10-15 18:58 - 00004958 ____C () C:\Windows\PFRO.log
2014-10-13 13:20 - 2014-10-16 08:43 - 00000000 ___DC () C:\FRST
2014-10-13 12:54 - 2014-10-13 12:54 - 00000000 ___DC () C:\Users\Yaakov Laks\Desktop\RegBackup
2014-10-13 12:53 - 2014-10-13 12:53 - 00000207 ____C () C:\Windows\tweaking.com-regbackup-LAPTOSH-PC-Microsoft-Windows-7-Home-Premium-(32-bit).dat
2014-10-13 12:52 - 2014-10-13 12:52 - 00000000 ___DC () C:\RegBackup
2014-10-13 12:51 - 2014-10-13 12:51 - 00001002 ____C () C:\Users\Public\Desktop\Tweaking.com - Registry Backup.lnk
2014-10-13 12:51 - 2014-10-13 12:51 - 00000000 ___DC () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Tweaking.com
2014-10-12 18:56 - 2014-10-12 18:56 - 00123160 ____C () C:\Users\Yaakov Laks\AppData\Local\GDIPFONTCACHEV1.DAT
2014-10-12 18:55 - 2014-10-15 19:59 - 00000728 ____C () C:\Windows\setupact.log
2014-10-12 18:55 - 2014-10-12 18:55 - 00000000 ____C () C:\Windows\setuperr.log
2014-10-12 18:54 - 2014-10-15 19:54 - 00442096 ____C () C:\Windows\system32\FNTCACHE.DAT
2014-10-12 01:56 - 2014-10-12 01:56 - 00004096 ___SH () C:\VSM000.IDX
2014-10-12 01:45 - 2014-10-12 01:53 - 00000000 ___DC () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StorageCraft
2014-10-11 17:43 - 2014-10-14 15:25 - 00000000 ___DC () C:\Users\Yaakov Laks\Desktop\spybot
2014-10-10 23:29 - 2014-10-10 23:30 - 14349744 ____C (Malwarebytes Corp.) C:\Users\Yaakov Laks\Downloads\mbar-1.07.0.1012.exe
2014-10-10 12:18 - 2014-10-10 12:18 - 00000528 ____C () C:\Users\Yaakov Laks\Desktop\תת עריכה עד 2-1-14.txt
2014-10-09 13:01 - 2014-10-09 13:01 - 00000000 ___HC () C:\Users\Yaakov Laks\Documents\Default.rdp
2014-10-08 18:12 - 2014-10-16 02:32 - 00000000 ___DC () C:\Users\Yaakov Laks\Desktop\מסמך טיוטת מדיניות 201308
2014-10-06 21:17 - 2014-10-06 21:17 - 00000841 ____C () C:\Users\Yaakov Laks\Desktop\אילתי בפייס.URL
2014-10-06 17:06 - 2014-10-06 17:06 - 00895120 ____C (Google Inc.) C:\Users\Yaakov Laks\Downloads\GoogleEarthSetup(1).exe
2014-10-06 11:22 - 2014-10-06 11:22 - 00895120 ____C (Google Inc.) C:\Users\Yaakov Laks\Downloads\GoogleEarthSetup.exe
2014-10-03 09:03 - 2014-10-03 09:04 - 00000000 ___DC () C:\Users\Yaakov Laks\Desktop\תמונות למיון
2014-10-03 01:44 - 2014-10-03 01:44 - 00000000 ___DC () C:\Users\Yaakov Laks\AppData\Local\TB
2014-10-01 09:39 - 2014-10-01 09:45 - 00519680 _____ (Microsoft Corporation) C:\Windows\system32\qdvd.dll
2014-09-30 01:17 - 2014-09-30 01:18 - 04965896 ____C (Piriform Ltd) C:\Users\Yaakov Laks\Downloads\ccsetup418(1).exe
2014-09-30 01:17 - 2014-09-30 01:17 - 04965896 ____C (Piriform Ltd) C:\Users\Yaakov Laks\Downloads\ccsetup418.exe
2014-09-25 18:41 - 2014-09-25 18:41 - 01626568 ____C () C:\Users\Yaakov Laks\Downloads\setup_Pixum_Fotoboek.exe
2014-09-24 19:44 - 2014-09-25 00:03 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2014-09-23 18:59 - 2014-09-23 18:59 - 00000000 ___DC () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2014-09-23 18:59 - 2014-09-23 18:59 - 00000000 ___DC () C:\Program Files\Common Files\Skype
2014-09-22 23:00 - 2014-09-22 23:00 - 00718552 ____C (Realtek ) C:\Windows\system32\Drivers\Rt86win7.sys
2014-09-22 23:00 - 2014-09-22 23:00 - 00076872 ____C (Realtek Semiconductor Corporation) C:\Windows\system32\RtNicProp32.dll
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-10-16 08:44 - 2013-08-29 09:28 - 00000926 ____C () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-10-16 08:42 - 2014-01-26 00:44 - 00000830 ____C () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-10-16 08:31 - 2014-03-13 17:44 - 00000000 ___DC () C:\Program Files\Giraffic
2014-10-16 08:22 - 2013-08-25 17:32 - 00000000 ___DC () C:\Users\Yaakov Laks\AppData\Roaming\MailWasherPro
2014-10-16 06:44 - 2013-08-29 09:28 - 00000922 ____C () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-10-16 05:05 - 2009-07-14 05:37 - 00000000 ___DC () C:\Windows\Microsoft.NET
2014-10-16 03:24 - 2014-06-01 23:20 - 01843658 ____C () C:\Windows\WindowsUpdate.log
2014-10-16 02:01 - 2013-08-24 04:21 - 00000000 ___DC () C:\Users\Yaakov Laks\Desktop\111פוספטים
2014-10-15 20:12 - 2009-07-14 07:34 - 00014832 ___HC () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-10-15 20:12 - 2009-07-14 07:34 - 00014832 ___HC () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-10-15 20:01 - 2014-03-13 17:44 - 00000000 ___DC () C:\ProgramData\Giraffic
2014-10-15 19:59 - 2009-07-14 07:53 - 00000006 ___HC () C:\Windows\Tasks\SA.DAT
2014-10-15 19:50 - 2013-08-24 01:10 - 00000000 ___DC () C:\ProgramData\Microsoft Help
2014-10-15 19:41 - 2013-08-23 17:47 - 00000000 ___DC () C:\Windows\system32\MRT
2014-10-15 19:25 - 2013-08-23 17:47 - 100290944 ____C (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-10-15 19:23 - 2009-07-14 05:37 - 00000000 ___DC () C:\Program Files\Common Files\microsoft shared
2014-10-15 19:18 - 2008-08-28 12:51 - 00391640 __RSH () C:\bootmgr
2014-10-15 18:59 - 2013-08-23 16:41 - 00000000 ___DC () C:\Users\Yaakov Laks
2014-10-15 18:58 - 2013-09-06 02:32 - 00000000 ___DC () C:\Windows\Minidump
2014-10-15 18:58 - 2012-03-24 20:52 - 00179521 ____N () C:\Windows\Minidump\101514-29905-01.dmp
2014-10-14 22:04 - 2013-11-05 08:40 - 00000000 ___DC () C:\ProgramData\ProductData
2014-10-14 09:24 - 2009-07-14 05:37 - 00000000 ___DC () C:\Windows\system32\LogFiles
2014-10-13 16:05 - 2013-10-07 10:46 - 00000000 ___DC () C:\AdwCleaner
2014-10-13 11:54 - 2009-07-14 05:37 - 00000000 ___DC () C:\Windows\system32\NDF
2014-10-12 20:47 - 2013-08-23 16:41 - 00782470 ____C () C:\Windows\system32\PerfStringBackup.INI
2014-10-12 19:14 - 2013-08-23 18:08 - 00000000 ___DC () C:\Users\Yaakov Laks\AppData\Roaming\Skype
2014-10-12 01:53 - 2014-09-07 02:15 - 00102824 ____C (StorageCraft Technology Corporation) C:\Windows\system32\Drivers\sbmount.sys
2014-10-12 00:22 - 2013-09-07 08:06 - 00000000 ___DC () C:\Users\Yaakov Laks\AppData\Roaming\Notepad++
2014-10-11 05:22 - 2013-08-31 13:37 - 00000000 ___DC () C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2014-10-10 00:48 - 2014-08-16 07:29 - 00000000 ___DC () C:\Users\Yaakov Laks\AppData\Local\Adobe
2014-10-10 00:47 - 2013-12-04 06:33 - 00701104 ____C (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2014-10-10 00:47 - 2013-12-04 06:33 - 00071344 ____C (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2014-10-09 13:29 - 2014-03-20 16:06 - 00000000 ___DC () C:\Users\Yaakov Laks\.gimp-2.8
2014-10-09 13:02 - 2014-04-21 10:18 - 00001259 ____C () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Movie Maker.lnk
2014-10-09 13:02 - 2014-04-21 10:18 - 00000000 __RDC () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live
2014-10-09 13:02 - 2013-08-24 02:55 - 00001328 ____C () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Photo Gallery.lnk
2014-10-09 13:00 - 2013-08-24 02:55 - 00001412 ____C () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live Mail.lnk
2014-10-07 22:40 - 2013-09-08 09:39 - 00000000 ___DC () C:\Users\Yaakov Laks\AppData\Roaming\Audacity
2014-10-07 22:40 - 2013-08-24 02:15 - 00000000 ___DC () C:\Users\Yaakov Laks\AppData\Roaming\vlc
2014-10-07 16:04 - 2013-08-24 04:21 - 00000000 ___DC () C:\Users\Yaakov Laks\Desktop\111עבודה שחורה
2014-10-06 11:21 - 2013-12-03 11:17 - 00044569 ____C () C:\Users\Yaakov Laks\Desktop\קליאו.xlsx
2014-09-27 10:58 - 2013-08-24 05:45 - 00000000 ___DC () C:\Users\Yaakov Laks\Desktop\11מפלגת העבודה
2014-09-26 19:34 - 2013-08-26 23:40 - 00000000 ___DC () C:\Windows\rescache
2014-09-24 08:25 - 2013-08-27 19:47 - 00002441 ____C () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2014-09-23 19:01 - 2013-08-23 18:08 - 00000000 __RDC () C:\Program Files\Skype
2014-09-23 18:59 - 2013-08-23 18:08 - 00000000 ___DC () C:\ProgramData\Skype
2014-09-22 23:00 - 2011-06-10 06:34 - 00100896 ____C (Realtek Semiconductor Corporation) C:\Windows\system32\RTNUninst32.dll
2014-09-22 09:41 - 2013-08-23 17:14 - 00231568 ____C (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
Some content of TEMP:
====================
C:\Users\Yaakov Laks\AppData\Local\Temp\BackupSetup.exe
C:\Users\Yaakov Laks\AppData\Local\Temp\NOSEventMessages.dll
C:\Users\Yaakov Laks\AppData\Local\Temp\PF7_87d4.exe
C:\Users\Yaakov Laks\AppData\Local\Temp\Quarantine.exe
C:\Users\Yaakov Laks\AppData\Local\Temp\sqlite3.dll
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2014-10-12 04:50
==================== End Of Log ============================
Open notepad (Start --> All Programs --> Accessories --> Notepad).
Please copy the entire contents of the code box below.
(To do this highlight the contents of the box, right click on it and select copy. Right-click in the open notepad and select Paste).
Save it to the same directory as FRST or FRST64 as fixlist.txt. (it has to be right next to FRST or FRST64) either in a directory you saved FRST or FRST64 or on your desktop if thats where you saved it.
You can use your mouse to drag Fixlist right next to FRST or FRST64, either above or below it but not on top of it.
Start
CloseProcesses:
(IObit) C:\Program Files\IObit\Advanced SystemCare 7\ASCService.exe
(IObit) C:\Program Files\IObit\Smart Defrag 3\SmartDefrag.exe
C:\Program Files\IObit
HKU\S-1-5-18\...\Run: [Advanced SystemCare 7] => C:\Program Files\IObit\Advanced SystemCare 7\ASCTray.exe [2295584 2014-04-21] (IObit)
BHO: ExplorerWnd Helper -> {10921475-03CE-4E04-90CE-E2E7EF20C814} -> D:\Program Files\1Maint\IObit Uninstaller\UninstallExplorer32.dll No File
CHR HKLM\...\Chrome\Extension: [nfengeggddojhakldhlpjdlddgkkjkdd] - C:\Program Files\IObit\Surfing Protection\BrowerProtect\ASC_GhromePlugin.crx [2014-07-14]
R2 AdvancedSystemCareService7; C:\Program Files\IObit\Advanced SystemCare 7\ASCService.exe [881952 2014-01-14] (IObit)
S2 LiveUpdateSvc; C:\Program Files\IObit\LiveUpdate\LiveUpdate.exe [2152736 2014-05-04] (IObit)
R2 PfFilter; C:\Program Files\IObit\Protected Folder\pffilter.sys [34336 2013-04-03] (IObit Information Technology)
R0 SmartDefragDriver; C:\Windows\System32\Drivers\SmartDefragDriver.sys [18624 2014-06-04] (IObit)
IObit Apps Toolbar v9.0 (HKLM\...\{48C13178-64E2-4964-9927-B71A04074D08}) (Version: 9.0 - Spigot, Inc.) <==== ATTENTION
Task: {10E97F4F-0DFB-45D8-900F-E382E39C8576} - System32\Tasks\LaunchSignup => C:\Program Files\MyPC Backup\Signup Wizard.exe <==== ATTENTION
C:\Program Files\MyPC Backup
Task: {22E7CAFD-204F-4241-9690-CF391713F5A8} - System32\Tasks\SmartDefrag3_Update => C:\Program Files\IObit\Smart Defrag 3\AutoUpdate.exe [2014-07-03] (IObit)
Task: {93854466-00E7-4E7D-8F16-2A6F59186783} - \Driver Booster SkipUAC (Yaakov Laks) No Task File <==== ATTENTION
Task: {BAD370E6-0C9E-43E3-BA3C-7E15B5F7CAF3} - System32\Tasks\SmartDefrag3_Startup => C:\Program Files\IObit\Smart Defrag 3\SmartDefrag.exe [2014-07-02] (IObit)
Task: {D813746A-2799-4837-9DF2-CB42F33576E7} - \Driver Booster SkipUAC (SYSTEM) No Task File <==== ATTENTION
Task: {DDBC0950-20BB-43A1-85CE-F57DACB08C1F} - System32\Tasks\ASC7_SkipUac_Yaakov Laks => C:\Program Files\IObit\Advanced SystemCare 7\ASC.exe [2014-05-29] (IObit)
2014-03-20 10:12 - 2013-10-25 12:08 - 00517408 ____C () C:\Program Files\IObit\Advanced SystemCare 7\sqlite3.dll
Hosts:
EmptyTemp:
End
NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system
Then open FRST or FRST64 and click on fix
When finished FRST will generate a log on the Desktop (Fixlog.txt). Please post it to your reply.
Shalom Ken,
Frst fixed using the script you sent.
I looked at the log and found the following which I'll try correct manually.
At least one looks like a typo: ghrome instead of chrome.
I 'll use find in regedit to locate the spigot and try to get a special sytem permit in case i'll have no access.
When finished I'll tell you.
The log file was too large, I zipped it.:angel:
yours
laksi
C:\Program Files\IObit\Surfing Protection\BrowerProtect\ASC_GhromePlugin.crx" => File/Directory not found.
IObit Apps Toolbar v9.0 (HKLM\...\{48C13178-64E2-4964-9927-B71A04074D08}) (Version: 9.0 - Spigot, Inc.) <==== ATTENTION => Error: No automatic fix found for this entry.
"C:\Program Files\MyPC Backup" => File/Directory not found.
"C:\Program Files\IObit\Advanced SystemCare 7\sqlite3.dll" => File/Directory not found.
Good, looks like your good to go.
Shalom Ken,
I found and deleted two Iobit folders under c:/users/yaakov laks/AppData/LocalLow
One of them contained 5 Files, 3 Folders, The Other one "IObit Apps" contained 1 File, 2 Folders
c:/users/yaakov laks/AppData/roaming also had an IObit folder 123 Files, 25 Folders - all deleted
c:/users/all users/IObit 42 Files, 9 Folders - all deleted for these I had to use admin auth.
users/default had them under AppData/Roaming I forgot to check number of folders and files - deleted using admin.
These guys really get under your (comuter's) skin :-)
MyPC Backup was found under Program Data Quarantined by... Spybot CHEERS :-)
Spigot was found also under HKLM/.../HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\34B66CF356D744245B0C8EDE24AC03DC.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\62F013B2CCF0DEE4EB7CB83D7A21280C
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\8740C21CF79D2514E94A247F4DEFE091
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E83F13912F1FBF64390A163E8464B6C7
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F3157AA407841454BB0C9BE8D1982BC9
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\87131C842E46469499727BA14070D480\InstallProperties
HKEY_USERS\S-1-5-21-2920106312-904050420-1618604034-1001\Software\Microsoft\Internet Explorer\SearchScopes\{7DAAAB92-E210-43F8-AA79-83FD3E90890A}
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes
I didn't delete them, waiting for your instructions
I deleted this one: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{48C13178-64E2-4964-9927-B71A04074D08}
While searching for spigot I saw IObit in the registry, searched the registry, found and deleted a few dozen.
I'll now use my Jv16 or ccleaner to wipe the rest of them.
yours
laksi
Go ahead and clean them the best you can, when your done open FRST and copy and paste this in
Iobit
Then click on Search Files
When its done
Iobit
Search Registry
shalom Ken'
Go ahead and clean them the best you can, searched using find in regedit, deleted all I found except the one FRST found, on that later...
when your done open FRST and copy and paste this in
Iobit
Then click on Search Files
did that found none :-)
When its done
Iobit
Search Registry
did that found the following:
Farbar Recovery Scan Tool (x86) Version: 15-10-2014 02
Ran by Yaakov Laks at 2014-10-18 00:00:51
Running from E:\F\Downloads\DLSoftware 15\FRST
Boot Mode: Normal
================== Search Registry: "IObit" ===========
[HKEY_USERS\S-1-5-21-2920106312-904050420-1618604034-1001\Software\PWI, Inc.\Privatefirewall 7.0\General Settings]
"Publishers"="AVAST Software a.s.
Adobe Systems Incorporated
Adobe Systems, Incorporated
Agere Systems
Alps Electric Co., LTD.
Apple Inc.
Blizzard Entertainment
Broadcom Corporation
CA
CANON INC.
Cisco Systems, Inc.
Conexant Systems, Inc.
CyberLink
DivX, Inc.
Electronic Arts
Firetrust Limited
GEAR Software Inc.
GIRAFFIC TECHNOLOGIES LTD
Gibson Research Corporation
Google Inc
Google Inc.
Hewlett-Packard
Hewlett-Packard Company
IObit Information Technology
InstallShield Software Corporation
Intel Corporation
InterActual Technologies INC
Intuit Inc.
Intuit, Inc.
Irfan Skiljan
Logitech
Macrovision Corporation
MainConcept AG
Malwarebytes Corporation
McAfee, Inc.
Microsoft Corp. and Executive Software International, Inc.
Microsoft Corporation
Microsoft Dynamic Code Publisher
Microsoft Windows
Microsoft Windows Component Publisher
Microsoft Windows Publisher
Microsoft Windows XP Publisher
Mozilla Corporation
NVIDIA Corporation
Nokia
PWI, Inc.
Piriform Ltd
RealNetworks, Inc.
SRS Labs, Inc
SoftThinks
SoftwareShield Technologies Inc.
Sonic Solutions
StorageCraft Technology Corporation
Sun Microsystems, Inc.
Symantec Corporation
VANTAGE TECHNOLOGIES SYSTEMS INTEGRATION LLC
WebEx Communications Inc.
Webroot Software, Inc.
WildTangent Inc.
Xceed Software Inc.
muvee Technologies Pte Ltd"
====== End Of Search ======
should I remove IObit Information Technology?
Reg. find located this line when I searched the reg. yesterday but I didn't know how to deal with it.
What do you say?
Thanks again
laksi
Try this
REGEDIT4
[HKEY_USERS\S-1-5-21-2920106312-904050420-1618604034-1001\Software\PWI, Inc.\Privatefirewall 7.0\General Settings]
"IObit Information Technology"=-
Copy the entire contents inside the Quote box and Paste it into Notepad ( this will only work with Notepad ) name the file Regfix.reg and in the drop down box, save it as All Files. Save it to your desktop. Then Rightclick on the Regfix.reg file and click on Merge, when it asks you to merge with the Registry, say yes.
If you saved the file correctly it should look like this http://i24.photobucket.com/albums/c30/ken545/reg.jpg
How are you coming along, how is your system behaving now ????
-----------------------------------------------------
Admin Edit
Thank you Ken. :)