MBAM - Scan bricht ständig ab

schrauber · 28.09.2013, 12:10

Und MBAM ist das einzige Problem was der Rechner noch hat? Ich würd einfach sagen lass es weg.

Scheinle · 28.09.2013, 12:16

Naja, die Festplatte hängt ab und an.
Aber das ist schon länger so.

Was MBAM betrifft: es findet ja immerhin noch 2 Bedrohungen.
Nur kann ich nicht sehen welche, da es durch den Programmabsturz kein Log erstellt.

Wenn ich eínen Avira-Scan laufen lasse meldet der mir jedoch, dass keine Bedrohungen gefunden wurden.

schrauber · 28.09.2013, 15:32

Poste mal ein frisches FRST log bitte.

Scheinle · 28.09.2013, 15:46

Bitte sehr.

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 27-09-2013 02
Ran by Admin (administrator) on ***** on 28-09-2013 16:44:47
Running from C:\Users\Admin\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(ASUS) C:\Program Files (x86)\ASUS\SmartLogon\smartlogon.exe
(ASUSTeK Computer Inc.) C:\Windows\system32\FBAgent.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(ASUS) C:\Windows\AsScrPro.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe
() C:\Program Files (x86)\ASUS\ASUS Live Update\ALU.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(ASUS) C:\Program Files (x86)\ASUS\Splendid\ACMON.exe
(Whilokii) C:\Program Files (x86)\Whilokii\updateWhilokii.exe
(ASUSTeK) C:\Windows\SysWOW64\ACEngSvr.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
() C:\Program Files (x86)\XSManager\WTGService.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
() C:\Program Files (x86)\Wireless 5-Mode Oscar Editor\OscarEditor.exe
(Osiris Development) C:\Program Files\BatteryBar\BatteryBar.exe
() C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ATKOSD.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\WDC.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Microsoft Corporation) C:\Program Files (x86)\Windows Live\Mail\wlmail.exe
(Microsoft Corporation) C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_8_800_168.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_8_800_168.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
(ESTWsim) D:\ESTWsim\Vorarlberg\VV\BFZ Bregenz\estw_sim (5.0).exe
(ESTWsim) D:\ESTWsim\Vorarlberg\VV\BFZ Bregenz\Kommunikation\ESTWOnline.exe
(Ipswitch) C:\Program Files (x86)\WS_FTP 12\WsftpCOMHelper.exe
(Nullsoft, Inc.) C:\Program Files (x86)\Winamp\winamp.exe
() D:\ESTWsim\BildFpl\2.x\BildFpl_V2.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RtHDVBg] - C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [2189416 2011-03-01] (Realtek Semiconductor)
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2712360 2011-03-04] (Synaptics Incorporated)
HKLM\...\Run: [IntelTBRunOnce] - C:\Program Files\Intel\TurboBoost\RunTBGadgetOnce.vbs [4526 2010-11-29] ()
HKLM\...\Run: [SynAsusAcpi] - C:\Program Files\Synaptics\SynTP\SynAsusAcpi.exe [97064 2011-03-04] (Synaptics Incorporated)
HKLM\...\Run: [Setwallpaper] - c:\programdata\SetWallpaper.cmd
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKCU\...\Run: [OscarXG] - C:\Program Files (x86)\Wireless 5-Mode Oscar Editor\OscarEditor.exe [3515904 2011-09-02] ()
HKCU\...\Run: [ShowBatteryBar] - "C:\Program Files\BatteryBar\ShowBatteryBar.exe" show
MountPoints2: {f0a13a39-c781-11e1-a12a-14dae9c43afd} - H:\autorun.exe
MountPoints2: {f0a13a6e-c781-11e1-a12a-14dae9c43afd} - H:\AutoRun.exe
MountPoints2: {f0a13a7b-c781-11e1-a12a-14dae9c43afd} - H:\AutoRun.exe
HKLM-x32\...\Run: [Wireless Console 3] - C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe [1601536 2010-09-24] ()
HKLM-x32\...\Run: [] - [x]
HKLM-x32\...\Run: [UCam_Menu] - C:\Program Files (x86)\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe [222504 2009-05-19] (CyberLink Corp.)
HKLM-x32\...\Run: [ATKOSD2] - C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe [5716608 2011-07-21] (ASUS)
HKLM-x32\...\Run: [ATKMEDIA] - C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe [170624 2010-10-07] (ASUS)
HKLM-x32\...\Run: [HControlUser] - C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe [105016 2009-06-19] (ASUS)
HKLM-x32\...\Run: [NWEReboot] - [x]
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-05-11] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [347192 2013-09-27] (Avira Operations GmbH & Co. KG)
HKU\UpdatusUser\...\Run: [ISUSPM] - C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe -scheduler
AppInit_DLLs: C:\Windows\system32\nvinitx.dll [245872 2013-04-08] (NVIDIA Corporation)
AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll [201576 2013-04-08] (NVIDIA Corporation)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.searchgol.com/?babsrc=HP_ss&mntrId=8A5200FF13430B0D&affID=119357&tsp=5018
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://asus.msn.com
SearchScopes: HKCU - {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = hxxp://www.searchgol.com/?q={searchTerms}&babsrc=SP_ss&mntrId=8A5200FF13430B0D&affID=119357&tsp=5018
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Whilokii - {204df522-9a96-4a72-abb0-60f7a216d6d2} - C:\Program Files (x86)\Whilokii\Whilokiibho.dll (Whilokii)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Microsoft-Konto-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: delta Helper Object - {C1AF5FA5-852C-4C90-812E-A7F75E011D87} - C:\Program Files (x86)\Delta\delta\1.8.24.6\bh\delta.dll (Delta-search.com)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: BonanzaDeals - {fe063412-bea4-4d76-8ed3-183be6220d17} - C:\Program Files (x86)\BonanzaDeals\BonanzaDealsIE.dll (BonanzaDeals)
Toolbar: HKLM-x32 - Delta Toolbar - {82E1477C-B154-48D3-9891-33D83C26BCD3} - C:\Program Files (x86)\Delta\delta\1.8.24.6\deltaTlbr.dll (Delta-search.com)
Toolbar: HKCU -  No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} -  No File
DPF: HKLM {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\w3r6udwc.default
FF user.js: detected! => C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\w3r6udwc.default\user.js
FF NewTab: hxxp://www.searchgol.com/?babsrc=NT_ss&mntrId=8A5200FF13430B0D&affID=119357&tsp=5018
FF SearchEngineOrder.1: Ask.com
FF Homepage: chrome://speeddial/content/speeddial.xul|hxxp://www.webradio-bounty.de/hitparade.php|https://www.facebook.com/|hxxp://www.tvinfo.de/sparte/spielfilm
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_8_800_168.dll ()
FF Plugin: @java.com/DTPlugin,version=10.11.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.11.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.0.1 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.0.2 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.0.5 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.0.6 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.0.7 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.0.8 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: adobe.com/AdobeAAMDetect - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll (Adobe Systems)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_168.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\SysWOW64\Adobe\Director\np32dsw_1202122.dll (Adobe Systems, Inc.)
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3505.0912 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.bdupdater.com/BonanzaDealsLive Update;version=3 - C:\Program Files (x86)\BonanzaDealsLive\Update\1.3.23.0\npGoogleUpdate3.dll (BonanzaDeals)
FF Plugin-x32: @tools.bdupdater.com/BonanzaDealsLive Update;version=9 - C:\Program Files (x86)\BonanzaDealsLive\Update\1.3.23.0\npGoogleUpdate3.dll (BonanzaDeals)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.0.4 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin-x32: adobe.com/AdobeAAMDetect - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect32.dll (Adobe Systems)
FF Plugin HKCU: amazon.com/AmazonMP3DownloaderPlugin - C:\Program Files (x86)\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin101727.dll (Amazon.com, Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Delta Toolbar - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\w3r6udwc.default\Extensions\ffxtlbr@delta.com
FF Extension: Forecastfox - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\w3r6udwc.default\Extensions\{0538E3E3-7E9B-4d49-8831-A227C80A7AD3}
FF Extension: FoxClocks - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\w3r6udwc.default\Extensions\{d37dc5d0-431d-44e5-8c91-49419370caa1}
FF Extension: BonanzaDeals - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\w3r6udwc.default\Extensions\{f9d03c26-0575-497e-821d-f7956d23e0ca}
FF Extension: firefox - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\w3r6udwc.default\Extensions\firefox@whilokii.net.xpi
FF Extension: No Name - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\w3r6udwc.default\Extensions\{20a82645-c095-46ed-80e3-08825760534b}.xpi
FF Extension: No Name - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\w3r6udwc.default\Extensions\{64161300-e22b-11db-8314-0800200c9a66}.xpi
FF Extension: No Name - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\w3r6udwc.default\Extensions\{9AA46F4F-4DC7-4c06-97AF-5035170634FE}.xpi
FF Extension: No Name - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\w3r6udwc.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
FF Extension: No Name - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\w3r6udwc.default\Extensions\{D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389}.xpi

Chrome: 
=======
Error reading preferences. Please check "preferences" file for possible corruption. <======= ATTENTION
CHR Extension: (BonanzaDeals) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ieadcoanfjloocmfafkebdnfefmohngj\3.5.0.0_0
CHR HKLM-x32\...\Chrome\Extension: [eooncjejnppfjjklapaamhcdmjbilmde] - C:\Users\Admin\AppData\Roaming\BabSolution\CR\Delta.crx

==================== Services (Whitelisted) =================

S4 AdobeActiveFileMonitor10.0; C:\Program Files (x86)\Adobe\Elements 10 Organizer\PhotoshopElementsFileAgent.exe [169624 2011-09-01] (Adobe Systems Incorporated)
R2 AntiVirMailService; C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe [622648 2013-09-27] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [84024 2013-09-27] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [108088 2013-09-27] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [815160 2013-09-27] (Avira Operations GmbH & Co. KG)
S2 bonanzadealslive; C:\Program Files (x86)\BonanzaDealsLive\Update\BonanzaDealsLive.exe [148976 2013-09-27] (BonanzaDeals)
S3 bonanzadealslivem; C:\Program Files (x86)\BonanzaDealsLive\Update\BonanzaDealsLive.exe [148976 2013-09-27] (BonanzaDeals)
S4 CLKMSVC10_38F51D56; C:\Program Files (x86)\CyberLink\PowerDVD10\NavFilter\kmsvc.exe [243728 2012-08-27] (CyberLink)
S3 RaMediaServer; C:\Program Files (x86)\Ralink\Common\RaMediaServer.exe [619872 2010-12-31] ()
S4 RichVideo; C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe [244904 2009-07-02] ()
R2 Update Whilokii; C:\Program Files (x86)\Whilokii\updateWhilokii.exe [206616 2013-09-26] (Whilokii)
R2 WTGService; C:\Program Files (x86)\XSManager\WTGService.exe [329168 2010-04-12] ()
S4 XS Stick Service; C:\Windows\service4g.exe [145064 2010-04-30] (4G Systems GmbH & Co. KG)
S4 HssSrv; C:\Program Files (x86)\Hotspot Shield\HssWPR\hsssrv.exe [x]

==================== Drivers (Whitelisted) ====================

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [105344 2013-09-27] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132088 2013-09-27] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-09-27] (Avira Operations GmbH & Co. KG)
S3 cmnsusbser; C:\Windows\System32\DRIVERS\cmnsusbser.sys [117888 2012-07-06] (Mobile Connector)
R1 HssDRV6; C:\Windows\System32\DRIVERS\hssdrv6.sys [41704 2012-08-01] (AnchorFree Inc.)
R3 kbfiltr; C:\Windows\System32\DRIVERS\kbfiltr.sys [15416 2009-07-20] ( )
S3 ewusbnet; system32\DRIVERS\ewusbnet.sys [x]
S3 ew_hwusbdev; system32\DRIVERS\ew_hwusbdev.sys [x]
S3 huawei_enumerator; system32\DRIVERS\ew_jubusenum.sys [x]
S3 hwdatacard; system32\DRIVERS\ewusbmdm.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-09-28 16:44 - 2013-09-28 16:44 - 01953880 _____ (Farbar) C:\Users\Admin\Desktop\FRST64.exe
2013-09-28 13:03 - 2013-09-28 15:03 - 98430869 _____ C:\Windows\SysWOW64\ᴳ￸“
2013-09-28 11:03 - 2013-09-28 11:03 - 98372650 _____ C:\Windows\SysWOW64\ᤁ綧N
2013-09-27 21:01 - 2013-09-27 21:01 - 98286374 _____ C:\Windows\SysWOW64\ェ霎œ
2013-09-27 20:20 - 2013-09-28 16:25 - 00000924 _____ C:\Windows\Tasks\BonanzaDealsLiveUpdateTaskMachineUA.job
2013-09-27 20:20 - 2013-09-28 11:27 - 00000920 _____ C:\Windows\Tasks\BonanzaDealsLiveUpdateTaskMachineCore.job
2013-09-27 20:20 - 2013-09-27 20:20 - 00003920 _____ C:\Windows\System32\Tasks\BonanzaDealsLiveUpdateTaskMachineUA
2013-09-27 20:20 - 2013-09-27 20:20 - 00003668 _____ C:\Windows\System32\Tasks\BonanzaDealsLiveUpdateTaskMachineCore
2013-09-27 20:20 - 2013-09-27 20:20 - 00003396 _____ C:\Windows\System32\Tasks\EPUpdater
2013-09-27 20:20 - 2013-09-27 20:20 - 00000000 ____D C:\Users\Admin\AppData\Roaming\BabSolution
2013-09-27 20:20 - 2013-09-27 20:20 - 00000000 ____D C:\ProgramData\DSearchLink
2013-09-27 20:20 - 2013-09-27 20:20 - 00000000 ____D C:\Program Files (x86)\Delta
2013-09-27 20:19 - 2013-09-27 20:20 - 00000000 ____D C:\Program Files (x86)\Whilokii
2013-09-27 20:19 - 2013-09-27 20:19 - 00003386 _____ C:\Windows\System32\Tasks\BonanzaDealsUpdate
2013-09-27 20:19 - 2013-09-27 20:19 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BonanzaDeals
2013-09-27 20:19 - 2013-09-27 20:19 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Babylon
2013-09-27 20:19 - 2013-09-27 20:19 - 00000000 ____D C:\Users\Admin\AppData\Local\BonanzaDealsLive
2013-09-27 20:19 - 2013-09-27 20:19 - 00000000 ____D C:\ProgramData\BonanzaDealsLive
2013-09-27 20:19 - 2013-09-27 20:19 - 00000000 ____D C:\ProgramData\Babylon
2013-09-27 20:19 - 2013-09-27 20:19 - 00000000 ____D C:\Program Files (x86)\BonanzaDealsLive
2013-09-27 20:19 - 2013-09-27 20:19 - 00000000 ____D C:\Program Files (x86)\BonanzaDeals
2013-09-27 19:05 - 2013-09-27 19:05 - 00081112 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2013-09-27 16:46 - 2013-09-27 16:46 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Avira
2013-09-27 16:45 - 2013-09-27 16:45 - 00000000 ____D C:\Program Files (x86)\Avira
2013-09-27 16:45 - 2013-09-27 16:43 - 00132088 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2013-09-27 16:45 - 2013-09-27 16:43 - 00105344 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2013-09-27 16:45 - 2013-09-27 16:43 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2013-09-27 15:46 - 2013-09-27 16:14 - 00181064 _____ (Sysinternals) C:\Windows\PSEXESVC.EXE
2013-09-27 15:44 - 2013-09-27 15:44 - 00000000 ____D C:\RegBackup
2013-09-26 20:38 - 2013-09-26 20:38 - 00080456 _____ (Malwarebytes Corporation) C:\Users\Admin\Desktop\MBAM-Cleaner.exe
2013-09-26 20:18 - 2013-09-26 20:18 - 00002125 _____ C:\Users\Admin\Desktop\Windows Repair (All in One).lnk
2013-09-26 20:18 - 2013-09-26 20:18 - 00000000 ____D C:\Program Files (x86)\Tweaking.com
2013-09-26 15:58 - 2013-09-28 13:22 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-09-23 18:13 - 2013-09-23 18:13 - 00000000 ____D C:\Windows\ERUNT
2013-09-23 18:08 - 2013-09-23 18:09 - 00000000 ____D C:\AdwCleaner
2013-09-23 16:03 - 2013-09-23 16:03 - 00000244 _____ C:\Windows\SysWOW64\defogger_enable.log
2013-09-23 16:02 - 2013-09-23 16:02 - 00000472 _____ C:\Windows\SysWOW64\defogger_disable.log
2013-09-22 22:42 - 2013-09-22 22:42 - 00000000 ____D C:\FRST
2013-09-19 23:13 - 2013-09-26 19:13 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox.bak
2013-09-13 15:31 - 2013-09-13 15:31 - 00001748 _____ C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BatteryBar.lnk
2013-09-12 22:46 - 2013-08-10 07:22 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-09-12 22:46 - 2013-08-10 07:22 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-09-12 22:46 - 2013-08-10 07:22 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-09-12 22:46 - 2013-08-10 07:21 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-09-12 22:46 - 2013-08-10 07:21 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-09-12 22:46 - 2013-08-10 07:20 - 03959296 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-09-12 22:46 - 2013-08-10 07:20 - 02647040 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-09-12 22:46 - 2013-08-10 07:20 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-09-12 22:46 - 2013-08-10 07:20 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-09-12 22:46 - 2013-08-10 07:20 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-09-12 22:46 - 2013-08-10 07:20 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-09-12 22:46 - 2013-08-10 07:20 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-09-12 22:46 - 2013-08-10 05:59 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-09-12 22:46 - 2013-08-10 05:59 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-09-12 22:46 - 2013-08-10 05:58 - 02876928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-09-12 22:46 - 2013-08-10 05:58 - 02048000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-09-12 22:46 - 2013-08-10 05:58 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-09-12 22:46 - 2013-08-10 05:58 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-09-12 22:46 - 2013-08-10 05:58 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-09-12 22:46 - 2013-08-10 05:58 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-09-12 22:46 - 2013-08-10 05:58 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-09-12 22:46 - 2013-08-10 05:58 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-09-12 22:46 - 2013-08-10 05:58 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-09-12 22:46 - 2013-08-10 05:17 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-09-12 22:46 - 2013-08-10 05:07 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-09-12 22:46 - 2013-08-10 04:27 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-09-12 22:46 - 2013-08-10 04:17 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-09-12 22:45 - 2013-08-10 07:21 - 19246592 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-09-12 22:45 - 2013-08-10 07:20 - 15404544 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-09-12 22:45 - 2013-08-10 05:58 - 14332928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-09-12 22:45 - 2013-08-10 05:58 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-09-12 22:30 - 2013-08-08 03:20 - 03155456 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-09-12 22:30 - 2013-08-05 04:25 - 00155584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ataport.sys
2013-09-12 22:30 - 2013-08-02 04:23 - 05550528 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2013-09-12 22:30 - 2013-08-02 04:15 - 01732032 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2013-09-12 22:30 - 2013-08-02 04:15 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2013-09-12 22:30 - 2013-08-02 04:15 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2013-09-12 22:30 - 2013-08-02 04:15 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2013-09-12 22:30 - 2013-08-02 04:14 - 00215040 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2013-09-12 22:30 - 2013-08-02 04:14 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2013-09-12 22:30 - 2013-08-02 04:13 - 01161216 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2013-09-12 22:30 - 2013-08-02 04:13 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2013-09-12 22:30 - 2013-08-02 04:12 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2013-09-12 22:30 - 2013-08-02 04:12 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2013-09-12 22:30 - 2013-08-02 04:12 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 04:12 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 04:12 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 04:12 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 03:59 - 03968960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2013-09-12 22:30 - 2013-08-02 03:59 - 03913664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2013-09-12 22:30 - 2013-08-02 03:51 - 01292192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2013-09-12 22:30 - 2013-08-02 03:50 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2013-09-12 22:30 - 2013-08-02 03:50 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2013-09-12 22:30 - 2013-08-02 03:50 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2013-09-12 22:30 - 2013-08-02 03:48 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2013-09-12 22:30 - 2013-08-02 03:48 - 00005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 03:48 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 03:09 - 00338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2013-09-12 22:30 - 2013-08-02 02:59 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2013-09-12 22:30 - 2013-08-02 02:45 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2013-09-12 22:30 - 2013-08-02 02:45 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2013-09-12 22:30 - 2013-08-02 02:45 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2013-09-12 22:30 - 2013-08-02 02:45 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2013-09-12 22:30 - 2013-08-02 02:43 - 00006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 02:43 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 02:43 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 02:43 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2013-09-12 22:30 - 2013-07-26 04:24 - 14172672 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2013-09-12 22:30 - 2013-07-26 04:24 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\shdocvw.dll
2013-09-12 22:30 - 2013-07-26 03:55 - 12872704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2013-09-12 22:30 - 2013-07-26 03:55 - 00180224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shdocvw.dll
2013-09-09 15:33 - 2013-09-09 15:33 - 96665497 _____ C:\Windows\SysWOW64\�ｕ’
2013-09-07 09:43 - 2013-09-07 09:43 - 96496803 _____ C:\Windows\SysWOW64\⸼츄@

==================== One Month Modified Files and Folders =======

2013-09-28 16:44 - 2013-09-28 16:44 - 01953880 _____ (Farbar) C:\Users\Admin\Desktop\FRST64.exe
2013-09-28 16:44 - 2012-07-06 09:53 - 00000000 ____D C:\Users\Admin\AppData\Roaming\ICQ
2013-09-28 16:30 - 2012-07-05 22:44 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-09-28 16:25 - 2013-09-27 20:20 - 00000924 _____ C:\Windows\Tasks\BonanzaDealsLiveUpdateTaskMachineUA.job
2013-09-28 16:05 - 2012-07-06 17:33 - 00001108 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-09-28 16:04 - 2012-07-06 05:53 - 01613134 _____ C:\Windows\WindowsUpdate.log
2013-09-28 15:03 - 2013-09-28 13:03 - 98430869 _____ C:\Windows\SysWOW64\ᴳ￸“
2013-09-28 13:45 - 2011-02-19 06:24 - 00694420 _____ C:\Windows\system32\perfh007.dat
2013-09-28 13:45 - 2011-02-19 06:24 - 00147716 _____ C:\Windows\system32\perfc007.dat
2013-09-28 13:45 - 2009-07-14 07:13 - 01643244 _____ C:\Windows\system32\PerfStringBackup.INI
2013-09-28 13:22 - 2013-09-26 15:58 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-09-28 12:37 - 2012-07-06 15:47 - 00000010 _____ C:\Program Files\Common Files\systemdate.dat
2013-09-28 11:35 - 2009-07-14 06:45 - 00009696 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-09-28 11:35 - 2009-07-14 06:45 - 00009696 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-09-28 11:27 - 2013-09-27 20:20 - 00000920 _____ C:\Windows\Tasks\BonanzaDealsLiveUpdateTaskMachineCore.job
2013-09-28 11:27 - 2013-06-11 10:06 - 00009946 _____ C:\Windows\setupact.log
2013-09-28 11:27 - 2012-07-06 17:33 - 00001104 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-09-28 11:27 - 2012-07-05 21:27 - 00045056 _____ C:\Windows\system32\acovcnt.exe
2013-09-28 11:27 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-09-28 11:05 - 2012-07-05 22:51 - 00000000 ____D C:\Users\Admin\AppData\Local\Windows Live
2013-09-28 11:03 - 2013-09-28 11:03 - 98372650 _____ C:\Windows\SysWOW64\ᤁ綧N
2013-09-27 22:06 - 2011-04-13 03:39 - 00917598 _____ C:\Windows\PFRO.log
2013-09-27 21:01 - 2013-09-27 21:01 - 98286374 _____ C:\Windows\SysWOW64\ェ霎œ
2013-09-27 20:58 - 2012-07-06 06:09 - 00001727 _____ C:\Windows\system32\ServiceFilter.ini
2013-09-27 20:45 - 2012-07-05 21:26 - 00000000 ___RD C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2013-09-27 20:26 - 2011-04-13 04:35 - 00001719 _____ C:\Windows\DirectX.log
2013-09-27 20:20 - 2013-09-27 20:20 - 00003920 _____ C:\Windows\System32\Tasks\BonanzaDealsLiveUpdateTaskMachineUA
2013-09-27 20:20 - 2013-09-27 20:20 - 00003668 _____ C:\Windows\System32\Tasks\BonanzaDealsLiveUpdateTaskMachineCore
2013-09-27 20:20 - 2013-09-27 20:20 - 00003396 _____ C:\Windows\System32\Tasks\EPUpdater
2013-09-27 20:20 - 2013-09-27 20:20 - 00000000 ____D C:\Users\Admin\AppData\Roaming\BabSolution
2013-09-27 20:20 - 2013-09-27 20:20 - 00000000 ____D C:\ProgramData\DSearchLink
2013-09-27 20:20 - 2013-09-27 20:20 - 00000000 ____D C:\Program Files (x86)\Delta
2013-09-27 20:20 - 2013-09-27 20:19 - 00000000 ____D C:\Program Files (x86)\Whilokii
2013-09-27 20:19 - 2013-09-27 20:19 - 00003386 _____ C:\Windows\System32\Tasks\BonanzaDealsUpdate
2013-09-27 20:19 - 2013-09-27 20:19 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BonanzaDeals
2013-09-27 20:19 - 2013-09-27 20:19 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Babylon
2013-09-27 20:19 - 2013-09-27 20:19 - 00000000 ____D C:\Users\Admin\AppData\Local\BonanzaDealsLive
2013-09-27 20:19 - 2013-09-27 20:19 - 00000000 ____D C:\ProgramData\BonanzaDealsLive
2013-09-27 20:19 - 2013-09-27 20:19 - 00000000 ____D C:\ProgramData\Babylon
2013-09-27 20:19 - 2013-09-27 20:19 - 00000000 ____D C:\Program Files (x86)\BonanzaDealsLive
2013-09-27 20:19 - 2013-09-27 20:19 - 00000000 ____D C:\Program Files (x86)\BonanzaDeals
2013-09-27 20:19 - 2012-07-05 21:59 - 00000000 ____D C:\Users\Admin\AppData\Local\Google
2013-09-27 19:05 - 2013-09-27 19:05 - 00081112 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2013-09-27 16:46 - 2013-09-27 16:46 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Avira
2013-09-27 16:45 - 2013-09-27 16:45 - 00000000 ____D C:\Program Files (x86)\Avira
2013-09-27 16:45 - 2012-07-05 22:34 - 00000000 ____D C:\ProgramData\Avira
2013-09-27 16:43 - 2013-09-27 16:45 - 00132088 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2013-09-27 16:43 - 2013-09-27 16:45 - 00105344 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2013-09-27 16:43 - 2013-09-27 16:45 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2013-09-27 16:35 - 2012-07-05 22:44 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-09-27 16:35 - 2012-07-05 22:44 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-09-27 16:35 - 2012-07-05 22:44 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-09-27 16:17 - 2012-07-05 21:27 - 00105840 _____ C:\Users\Admin\AppData\Local\GDIPFONTCACHEV1.DAT
2013-09-27 16:16 - 2009-07-14 06:45 - 00401472 _____ C:\Windows\system32\FNTCACHE.DAT
2013-09-27 16:14 - 2013-09-27 15:46 - 00181064 _____ (Sysinternals) C:\Windows\PSEXESVC.EXE
2013-09-27 16:14 - 2009-07-14 04:34 - 00000468 _____ C:\Windows\win.ini
2013-09-27 15:44 - 2013-09-27 15:44 - 00000000 ____D C:\RegBackup
2013-09-27 04:55 - 2012-07-05 23:09 - 00000000 ____D C:\Users\Admin\AppData\Local\Adobe
2013-09-26 20:38 - 2013-09-26 20:38 - 00080456 _____ (Malwarebytes Corporation) C:\Users\Admin\Desktop\MBAM-Cleaner.exe
2013-09-26 20:32 - 2012-07-05 22:13 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-09-26 20:18 - 2013-09-26 20:18 - 00002125 _____ C:\Users\Admin\Desktop\Windows Repair (All in One).lnk
2013-09-26 20:18 - 2013-09-26 20:18 - 00000000 ____D C:\Program Files (x86)\Tweaking.com
2013-09-26 19:13 - 2013-09-19 23:13 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox.bak
2013-09-25 17:54 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\LiveKernelReports
2013-09-23 21:59 - 2012-07-06 15:29 - 01621138 _____ C:\Windows\SysWOW64\PerfStringBackup.INI
2013-09-23 19:38 - 2012-10-23 11:02 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Virenscanprogramme
2013-09-23 18:13 - 2013-09-23 18:13 - 00000000 ____D C:\Windows\ERUNT
2013-09-23 18:10 - 2012-07-06 06:09 - 00002820 _____ C:\Windows\system32\AutoRunFilter.ini
2013-09-23 18:09 - 2013-09-23 18:08 - 00000000 ____D C:\AdwCleaner
2013-09-23 16:06 - 2012-07-05 21:26 - 00000000 ____D C:\Users\Admin
2013-09-23 16:03 - 2013-09-23 16:03 - 00000244 _____ C:\Windows\SysWOW64\defogger_enable.log
2013-09-23 16:02 - 2013-09-23 16:02 - 00000472 _____ C:\Windows\SysWOW64\defogger_disable.log
2013-09-22 22:42 - 2013-09-22 22:42 - 00000000 ____D C:\FRST
2013-09-22 14:59 - 2013-04-16 13:00 - 00000000 ____D C:\Users\Admin\Documents\Online-BankingPlus
2013-09-16 15:39 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
2013-09-13 15:33 - 2012-07-05 21:27 - 00000000 ___RD C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-09-13 15:32 - 2013-04-29 12:58 - 00000000 ____D C:\Program Files\BatteryBar
2013-09-13 15:31 - 2013-09-13 15:31 - 00001748 _____ C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BatteryBar.lnk
2013-09-13 15:24 - 2012-07-05 21:27 - 00000000 ___RD C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2013-09-12 22:45 - 2013-08-15 22:22 - 00000000 ____D C:\Windows\system32\MRT
2013-09-12 22:43 - 2012-07-06 14:12 - 79143768 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-09-12 22:43 - 2012-07-05 21:49 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-09-11 20:00 - 2012-09-08 15:45 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\dreamboxEDIT
2013-09-09 15:33 - 2013-09-09 15:33 - 96665497 _____ C:\Windows\SysWOW64\�ｕ’
2013-09-09 15:32 - 2009-07-14 07:08 - 00032640 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-09-08 11:41 - 2012-07-11 12:32 - 00000000 ____D C:\Windows\pss
2013-09-07 09:43 - 2013-09-07 09:43 - 96496803 _____ C:\Windows\SysWOW64\⸼츄@
2013-09-01 16:30 - 2012-07-06 09:50 - 00000000 ____D C:\Users\Admin\AppData\Roaming\vlc
2013-09-01 15:22 - 2012-07-06 17:44 - 00001900 _____ C:\Users\Admin\.java.policy

Some content of TEMP:
====================
C:\Users\Admin\AppData\Local\Temp\ICReinstall_Movie-Maker.exe
C:\Users\Admin\AppData\Local\Temp\Quarantine.exe
C:\Users\Admin\AppData\Local\Temp\setup.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-09-21 11:56

==================== End Of Log ============================

--- --- ---

schrauber · 29.09.2013, 05:56

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

ATTFilter

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.searchgol.com/?babsrc=HP_ss&mntrId=8A5200FF13430B0D&affID=119357&tsp=5018
SearchScopes: HKCU - {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = hxxp://www.searchgol.com/?q={searchTerms}&babsrc=SP_ss&mntrId=8A5200FF13430B0D&affID=119357&tsp=5018
FF SearchEngineOrder.1: Ask.com
FF Homepage: chrome://speeddial/content/speeddial.xul|hxxp://www.webradio-bounty.de/hitparade.php|https://www.facebook.com/|hxxp://www.tvinfo.de/sparte/spielfilm
Error reading preferences. Please check "preferences" file for possible corruption. <======= ATTENTION
CHR Extension: (BonanzaDeals) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ieadcoanfjloocmfafkebdnfefmohngj\3.5.0.0_0
CHR HKLM-x32\...\Chrome\Extension: [eooncjejnppfjjklapaamhcdmjbilmde] - C:\Users\Admin\AppData\Roaming\BabSolution\CR\Delta.crx2013-09-27 20:20 - 2013-09-28 16:25 - 00000924 _____ C:\Windows\Tasks\BonanzaDealsLiveUpdateTaskMachineUA.job
2013-09-27 20:20 - 2013-09-28 11:27 - 00000920 _____ C:\Windows\Tasks\BonanzaDealsLiveUpdateTaskMachineCore.job
2013-09-27 20:20 - 2013-09-27 20:20 - 00003920 _____ C:\Windows\System32\Tasks\BonanzaDealsLiveUpdateTaskMachineUA
2013-09-27 20:20 - 2013-09-27 20:20 - 00003668 _____ C:\Windows\System32\Tasks\BonanzaDealsLiveUpdateTaskMachineCore
2013-09-27 20:20 - 2013-09-27 20:20 - 00003396 _____ C:\Windows\System32\Tasks\EPUpdater
2013-09-27 20:20 - 2013-09-27 20:20 - 00000000 ____D C:\Users\Admin\AppData\Roaming\BabSolution
2013-09-27 20:20 - 2013-09-27 20:20 - 00000000 ____D C:\ProgramData\DSearchLink
2013-09-27 20:20 - 2013-09-27 20:20 - 00000000 ____D C:\Program Files (x86)\Delta
2013-09-27 20:19 - 2013-09-27 20:20 - 00000000 ____D C:\Program Files (x86)\Whilokii
2013-09-27 20:19 - 2013-09-27 20:19 - 00003386 _____ C:\Windows\System32\Tasks\BonanzaDealsUpdate
2013-09-27 20:19 - 2013-09-27 20:19 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BonanzaDeals
2013-09-27 20:19 - 2013-09-27 20:19 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Babylon
2013-09-27 20:19 - 2013-09-27 20:19 - 00000000 ____D C:\Users\Admin\AppData\Local\BonanzaDealsLive
2013-09-27 20:19 - 2013-09-27 20:19 - 00000000 ____D C:\ProgramData\BonanzaDealsLive
2013-09-27 20:19 - 2013-09-27 20:19 - 00000000 ____D C:\ProgramData\Babylon
2013-09-27 20:19 - 2013-09-27 20:19 - 00000000 ____D C:\Program Files (x86)\BonanzaDealsLive
2013-09-27 20:19 - 2013-09-27 20:19 - 00000000 ____D C:\Program Files (x86)\BonanzaDeals

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

Starte nun FRST erneut und klicke den Entfernen Button.
Das Tool erstellt eine Fixlog.txt.
Poste mir deren Inhalt.

Scheinle · 29.09.2013, 12:30

Code:

ATTFilter

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 27-09-2013 02
Ran by Admin at 2013-09-29 13:28:05 Run:1
Running from C:\Users\Admin\Desktop
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.searchgol.com/?babsrc=HP_ss&mntrId=8A5200FF13430B0D&affID=119357&tsp=5018
SearchScopes: HKCU - {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = hxxp://www.searchgol.com/?q={searchTerms}&babsrc=SP_ss&mntrId=8A5200FF13430B0D&affID=119357&tsp=5018
FF SearchEngineOrder.1: Ask.com
FF Homepage: chrome://speeddial/content/speeddial.xul|hxxp://www.webradio-bounty.de/hitparade.php|https://www.facebook.com/|hxxp://www.tvinfo.de/sparte/spielfilm
Error reading preferences. Please check "preferences" file for possible corruption. <======= ATTENTION
CHR Extension: (BonanzaDeals) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ieadcoanfjloocmfafkebdnfefmohngj\3.5.0.0_0
CHR HKLM-x32\...\Chrome\Extension: [eooncjejnppfjjklapaamhcdmjbilmde] - C:\Users\Admin\AppData\Roaming\BabSolution\CR\Delta.crx2013-09-27 20:20 - 2013-09-28 16:25 - 00000924 _____ C:\Windows\Tasks\BonanzaDealsLiveUpdateTaskMachineUA.job
2013-09-27 20:20 - 2013-09-28 11:27 - 00000920 _____ C:\Windows\Tasks\BonanzaDealsLiveUpdateTaskMachineCore.job
2013-09-27 20:20 - 2013-09-27 20:20 - 00003920 _____ C:\Windows\System32\Tasks\BonanzaDealsLiveUpdateTaskMachineUA
2013-09-27 20:20 - 2013-09-27 20:20 - 00003668 _____ C:\Windows\System32\Tasks\BonanzaDealsLiveUpdateTaskMachineCore
2013-09-27 20:20 - 2013-09-27 20:20 - 00003396 _____ C:\Windows\System32\Tasks\EPUpdater
2013-09-27 20:20 - 2013-09-27 20:20 - 00000000 ____D C:\Users\Admin\AppData\Roaming\BabSolution
2013-09-27 20:20 - 2013-09-27 20:20 - 00000000 ____D C:\ProgramData\DSearchLink
2013-09-27 20:20 - 2013-09-27 20:20 - 00000000 ____D C:\Program Files (x86)\Delta
2013-09-27 20:19 - 2013-09-27 20:20 - 00000000 ____D C:\Program Files (x86)\Whilokii
2013-09-27 20:19 - 2013-09-27 20:19 - 00003386 _____ C:\Windows\System32\Tasks\BonanzaDealsUpdate
2013-09-27 20:19 - 2013-09-27 20:19 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BonanzaDeals
2013-09-27 20:19 - 2013-09-27 20:19 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Babylon
2013-09-27 20:19 - 2013-09-27 20:19 - 00000000 ____D C:\Users\Admin\AppData\Local\BonanzaDealsLive
2013-09-27 20:19 - 2013-09-27 20:19 - 00000000 ____D C:\ProgramData\BonanzaDealsLive
2013-09-27 20:19 - 2013-09-27 20:19 - 00000000 ____D C:\ProgramData\Babylon
2013-09-27 20:19 - 2013-09-27 20:19 - 00000000 ____D C:\Program Files (x86)\BonanzaDealsLive
2013-09-27 20:19 - 2013-09-27 20:19 - 00000000 ____D C:\Program Files (x86)\BonanzaDeals
         
*****************

HKCU\Software\Microsoft\Internet Explorer\Main\\Start Page => Value was restored successfully.
HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} => Key deleted successfully.
HKCR\CLSID\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} => Key not found.
Firefox SearchEngineOrder.1 deleted successfully.
Firefox homepage deleted successfully.
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ieadcoanfjloocmfafkebdnfefmohngj => Moved successfully.
HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\eooncjejnppfjjklapaamhcdmjbilmde => Key deleted successfully.
"C:\Users\Admin\AppData\Roaming\BabSolution\CR\Delta.crx2013-09-27 20:20 - 2013-09-28 16:25 - 00000924 _____ C:\Windows\Tasks\BonanzaDealsLiveUpdateTaskMachineUA.job" => File/Directory not found.
C:\Windows\Tasks\BonanzaDealsLiveUpdateTaskMachineCore.job => Moved successfully.
C:\Windows\System32\Tasks\BonanzaDealsLiveUpdateTaskMachineUA => Moved successfully.
C:\Windows\System32\Tasks\BonanzaDealsLiveUpdateTaskMachineCore => Moved successfully.
C:\Windows\System32\Tasks\EPUpdater => Moved successfully.
C:\Users\Admin\AppData\Roaming\BabSolution => Moved successfully.
C:\ProgramData\DSearchLink => Moved successfully.
C:\Program Files (x86)\Delta => Moved successfully.

"C:\Program Files (x86)\Whilokii" directory move:

C:\Program Files (x86)\Whilokii\Microsoft.Win32.TaskScheduler.dll => Moved successfully.
C:\Program Files (x86)\Whilokii\updateWhilokii.exe => Moved successfully.
C:\Program Files (x86)\Whilokii\updateWhilokii.InstallState => Moved successfully.
C:\Program Files (x86)\Whilokii\Whilokii.Common.dll => Moved successfully.
C:\Program Files (x86)\Whilokii\Whilokii.ico => Moved successfully.
C:\Program Files (x86)\Whilokii\WhilokiiBHO.dll => Moved successfully.
C:\Program Files (x86)\Whilokii\WhilokiiUninstall.exe => Moved successfully.
"C:\Program Files (x86)\Whilokii" => Directory moved successfully.

C:\Windows\System32\Tasks\BonanzaDealsUpdate => Moved successfully.
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BonanzaDeals => Moved successfully.
C:\Users\Admin\AppData\Roaming\Babylon => Moved successfully.
C:\Users\Admin\AppData\Local\BonanzaDealsLive => Moved successfully.
C:\ProgramData\BonanzaDealsLive => Moved successfully.
C:\ProgramData\Babylon => Moved successfully.
C:\Program Files (x86)\BonanzaDealsLive => Moved successfully.
C:\Program Files (x86)\BonanzaDeals => Moved successfully.


The system needs a manual reboot. 

==== End of Fixlog ====

schrauber · 29.09.2013, 18:27

Manuell neu starten, frisches FRST log bitte.

Scheinle · 29.09.2013, 18:32

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 27-09-2013 02
Ran by Admin (administrator) on ***** on 29-09-2013 19:28:42
Running from C:\Users\Admin\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(ASUS) C:\Program Files (x86)\ASUS\SmartLogon\smartlogon.exe
(ASUSTeK Computer Inc.) C:\Windows\system32\FBAgent.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
() C:\Program Files (x86)\ASUS\ASUS Live Update\ALU.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe
(ASUS) C:\Windows\AsScrPro.exe
(ASUS) C:\Program Files (x86)\ASUS\Splendid\ACMON.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
() C:\Program Files (x86)\XSManager\WTGService.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(ASUSTeK) C:\Windows\SysWOW64\ACEngSvr.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
() C:\Program Files (x86)\Wireless 5-Mode Oscar Editor\OscarEditor.exe
(Osiris Development) C:\Program Files\BatteryBar\BatteryBar.exe
() C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ATKOSD.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\WDC.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE
(Microsoft Corporation) C:\Program Files (x86)\Windows Live\Mail\wlmail.exe
(Microsoft Corporation) C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Nullsoft, Inc.) C:\Program Files (x86)\Winamp\winamp.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_8_800_168.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_8_800_168.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
() D:\ESTWsim\BildFpl\2.x\BildFpl_V2.exe
(ESTWsim) D:\ESTWsim\Vorarlberg\VV\BFZ Bregenz\estw_sim (5.0).exe
(ESTWsim) D:\ESTWsim\Vorarlberg\VV\BFZ Bregenz\Kommunikation\ESTWOnline.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RtHDVBg] - C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [2189416 2011-03-01] (Realtek Semiconductor)
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2712360 2011-03-04] (Synaptics Incorporated)
HKLM\...\Run: [IntelTBRunOnce] - C:\Program Files\Intel\TurboBoost\RunTBGadgetOnce.vbs [4526 2010-11-29] ()
HKLM\...\Run: [SynAsusAcpi] - C:\Program Files\Synaptics\SynTP\SynAsusAcpi.exe [97064 2011-03-04] (Synaptics Incorporated)
HKLM\...\Run: [Setwallpaper] - c:\programdata\SetWallpaper.cmd
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKCU\...\Run: [OscarXG] - C:\Program Files (x86)\Wireless 5-Mode Oscar Editor\OscarEditor.exe [3515904 2011-09-02] ()
HKCU\...\Run: [ShowBatteryBar] - "C:\Program Files\BatteryBar\ShowBatteryBar.exe" show
MountPoints2: {f0a13a39-c781-11e1-a12a-14dae9c43afd} - H:\autorun.exe
MountPoints2: {f0a13a6e-c781-11e1-a12a-14dae9c43afd} - H:\AutoRun.exe
MountPoints2: {f0a13a7b-c781-11e1-a12a-14dae9c43afd} - H:\AutoRun.exe
HKLM-x32\...\Run: [Wireless Console 3] - C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe [1601536 2010-09-24] ()
HKLM-x32\...\Run: [] - [x]
HKLM-x32\...\Run: [UCam_Menu] - C:\Program Files (x86)\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe [222504 2009-05-19] (CyberLink Corp.)
HKLM-x32\...\Run: [ATKOSD2] - C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe [5716608 2011-07-21] (ASUS)
HKLM-x32\...\Run: [ATKMEDIA] - C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe [170624 2010-10-07] (ASUS)
HKLM-x32\...\Run: [HControlUser] - C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe [105016 2009-06-19] (ASUS)
HKLM-x32\...\Run: [NWEReboot] - [x]
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-05-11] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [347192 2013-09-27] (Avira Operations GmbH & Co. KG)
HKU\UpdatusUser\...\Run: [ISUSPM] - C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe -scheduler
AppInit_DLLs: C:\Windows\system32\nvinitx.dll [245872 2013-04-08] (NVIDIA Corporation)
AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll [201576 2013-04-08] (NVIDIA Corporation)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://asus.msn.com
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Whilokii - {204df522-9a96-4a72-abb0-60f7a216d6d2} - C:\Program Files (x86)\Whilokii\Whilokiibho.dll No File
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Microsoft-Konto-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: delta Helper Object - {C1AF5FA5-852C-4C90-812E-A7F75E011D87} - C:\Program Files (x86)\Delta\delta\1.8.24.6\bh\delta.dll No File
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: BonanzaDeals - {fe063412-bea4-4d76-8ed3-183be6220d17} - C:\Program Files (x86)\BonanzaDeals\BonanzaDealsIE.dll No File
Toolbar: HKLM-x32 - Delta Toolbar - {82E1477C-B154-48D3-9891-33D83C26BCD3} - C:\Program Files (x86)\Delta\delta\1.8.24.6\deltaTlbr.dll No File
Toolbar: HKCU -  No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} -  No File
DPF: HKLM {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\w3r6udwc.default
FF user.js: detected! => C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\w3r6udwc.default\user.js
FF NewTab: hxxp://www.searchgol.com/?babsrc=NT_ss&mntrId=8A5200FF13430B0D&affID=119357&tsp=5018
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_8_800_168.dll ()
FF Plugin: @java.com/DTPlugin,version=10.11.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.11.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.0.1 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.0.2 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.0.5 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.0.6 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.0.7 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.0.8 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: adobe.com/AdobeAAMDetect - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll (Adobe Systems)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_168.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\SysWOW64\Adobe\Director\np32dsw_1202122.dll (Adobe Systems, Inc.)
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3505.0912 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.bdupdater.com/BonanzaDealsLive Update;version=3 - C:\Program Files (x86)\BonanzaDealsLive\Update\1.3.23.0\npGoogleUpdate3.dll No File
FF Plugin-x32: @tools.bdupdater.com/BonanzaDealsLive Update;version=9 - C:\Program Files (x86)\BonanzaDealsLive\Update\1.3.23.0\npGoogleUpdate3.dll No File
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.0.4 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin-x32: adobe.com/AdobeAAMDetect - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect32.dll (Adobe Systems)
FF Plugin HKCU: amazon.com/AmazonMP3DownloaderPlugin - C:\Program Files (x86)\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin101727.dll (Amazon.com, Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Delta Toolbar - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\w3r6udwc.default\Extensions\ffxtlbr@delta.com
FF Extension: Forecastfox - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\w3r6udwc.default\Extensions\{0538E3E3-7E9B-4d49-8831-A227C80A7AD3}
FF Extension: FoxClocks - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\w3r6udwc.default\Extensions\{d37dc5d0-431d-44e5-8c91-49419370caa1}
FF Extension: BonanzaDeals - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\w3r6udwc.default\Extensions\{f9d03c26-0575-497e-821d-f7956d23e0ca}
FF Extension: firefox - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\w3r6udwc.default\Extensions\firefox@whilokii.net.xpi
FF Extension: No Name - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\w3r6udwc.default\Extensions\{20a82645-c095-46ed-80e3-08825760534b}.xpi
FF Extension: No Name - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\w3r6udwc.default\Extensions\{64161300-e22b-11db-8314-0800200c9a66}.xpi
FF Extension: No Name - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\w3r6udwc.default\Extensions\{9AA46F4F-4DC7-4c06-97AF-5035170634FE}.xpi
FF Extension: No Name - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\w3r6udwc.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
FF Extension: No Name - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\w3r6udwc.default\Extensions\{D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389}.xpi

Chrome: 
=======
Error reading preferences. Please check "preferences" file for possible corruption. <======= ATTENTION

==================== Services (Whitelisted) =================

S4 AdobeActiveFileMonitor10.0; C:\Program Files (x86)\Adobe\Elements 10 Organizer\PhotoshopElementsFileAgent.exe [169624 2011-09-01] (Adobe Systems Incorporated)
R2 AntiVirMailService; C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe [622648 2013-09-27] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [84024 2013-09-27] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [108088 2013-09-27] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [815160 2013-09-27] (Avira Operations GmbH & Co. KG)
S4 CLKMSVC10_38F51D56; C:\Program Files (x86)\CyberLink\PowerDVD10\NavFilter\kmsvc.exe [243728 2012-08-27] (CyberLink)
S3 RaMediaServer; C:\Program Files (x86)\Ralink\Common\RaMediaServer.exe [619872 2010-12-31] ()
S4 RichVideo; C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe [244904 2009-07-02] ()
R2 WTGService; C:\Program Files (x86)\XSManager\WTGService.exe [329168 2010-04-12] ()
S4 XS Stick Service; C:\Windows\service4g.exe [145064 2010-04-30] (4G Systems GmbH & Co. KG)
S2 bonanzadealslive; C:\Program Files (x86)\BonanzaDealsLive\Update\BonanzaDealsLive.exe /svc [x]
S3 bonanzadealslivem; C:\Program Files (x86)\BonanzaDealsLive\Update\BonanzaDealsLive.exe /medsvc [x]
S4 HssSrv; C:\Program Files (x86)\Hotspot Shield\HssWPR\hsssrv.exe [x]
S2 Update Whilokii; "C:\Program Files (x86)\Whilokii\updateWhilokii.exe" [x]

==================== Drivers (Whitelisted) ====================

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [105344 2013-09-27] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132088 2013-09-27] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-09-27] (Avira Operations GmbH & Co. KG)
S3 cmnsusbser; C:\Windows\System32\DRIVERS\cmnsusbser.sys [117888 2012-07-06] (Mobile Connector)
R1 HssDRV6; C:\Windows\System32\DRIVERS\hssdrv6.sys [41704 2012-08-01] (AnchorFree Inc.)
R3 kbfiltr; C:\Windows\System32\DRIVERS\kbfiltr.sys [15416 2009-07-20] ( )
S3 ewusbnet; system32\DRIVERS\ewusbnet.sys [x]
S3 ew_hwusbdev; system32\DRIVERS\ew_hwusbdev.sys [x]
S3 huawei_enumerator; system32\DRIVERS\ew_jubusenum.sys [x]
S3 hwdatacard; system32\DRIVERS\ewusbmdm.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-09-29 17:20 - 2013-09-29 17:20 - 98466785 _____ C:\Windows\SysWOW64\철䇥™
2013-09-29 15:20 - 2013-09-29 15:20 - 98462899 _____ C:\Windows\SysWOW64\㌚†
2013-09-28 16:44 - 2013-09-28 16:44 - 01953880 _____ (Farbar) C:\Users\Admin\Desktop\FRST64.exe
2013-09-28 13:22 - 2013-09-28 17:31 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-09-28 13:03 - 2013-09-28 15:03 - 98430869 _____ C:\Windows\SysWOW64\ᴳ￸“
2013-09-28 11:03 - 2013-09-28 11:03 - 98372650 _____ C:\Windows\SysWOW64\ᤁ綧N
2013-09-27 21:01 - 2013-09-27 21:01 - 98286374 _____ C:\Windows\SysWOW64\ェ霎œ
2013-09-27 20:20 - 2013-09-29 19:25 - 00000924 _____ C:\Windows\Tasks\BonanzaDealsLiveUpdateTaskMachineUA.job
2013-09-27 19:05 - 2013-09-27 19:05 - 00081112 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2013-09-27 16:46 - 2013-09-27 16:46 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Avira
2013-09-27 16:45 - 2013-09-27 16:45 - 00000000 ____D C:\Program Files (x86)\Avira
2013-09-27 16:45 - 2013-09-27 16:43 - 00132088 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2013-09-27 16:45 - 2013-09-27 16:43 - 00105344 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2013-09-27 16:45 - 2013-09-27 16:43 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2013-09-27 15:46 - 2013-09-27 16:14 - 00181064 _____ (Sysinternals) C:\Windows\PSEXESVC.EXE
2013-09-27 15:44 - 2013-09-27 15:44 - 00000000 ____D C:\RegBackup
2013-09-26 20:38 - 2013-09-26 20:38 - 00080456 _____ (Malwarebytes Corporation) C:\Users\Admin\Desktop\MBAM-Cleaner.exe
2013-09-26 20:18 - 2013-09-26 20:18 - 00002125 _____ C:\Users\Admin\Desktop\Windows Repair (All in One).lnk
2013-09-26 20:18 - 2013-09-26 20:18 - 00000000 ____D C:\Program Files (x86)\Tweaking.com
2013-09-23 18:13 - 2013-09-23 18:13 - 00000000 ____D C:\Windows\ERUNT
2013-09-23 18:08 - 2013-09-23 18:09 - 00000000 ____D C:\AdwCleaner
2013-09-23 16:03 - 2013-09-23 16:03 - 00000244 _____ C:\Windows\SysWOW64\defogger_enable.log
2013-09-23 16:02 - 2013-09-23 16:02 - 00000472 _____ C:\Windows\SysWOW64\defogger_disable.log
2013-09-22 22:42 - 2013-09-29 13:28 - 00000000 ____D C:\FRST
2013-09-13 15:31 - 2013-09-13 15:31 - 00001748 _____ C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BatteryBar.lnk
2013-09-12 22:46 - 2013-08-10 07:22 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-09-12 22:46 - 2013-08-10 07:22 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-09-12 22:46 - 2013-08-10 07:22 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-09-12 22:46 - 2013-08-10 07:21 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-09-12 22:46 - 2013-08-10 07:21 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-09-12 22:46 - 2013-08-10 07:20 - 03959296 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-09-12 22:46 - 2013-08-10 07:20 - 02647040 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-09-12 22:46 - 2013-08-10 07:20 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-09-12 22:46 - 2013-08-10 07:20 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-09-12 22:46 - 2013-08-10 07:20 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-09-12 22:46 - 2013-08-10 07:20 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-09-12 22:46 - 2013-08-10 07:20 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-09-12 22:46 - 2013-08-10 05:59 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-09-12 22:46 - 2013-08-10 05:59 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-09-12 22:46 - 2013-08-10 05:58 - 02876928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-09-12 22:46 - 2013-08-10 05:58 - 02048000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-09-12 22:46 - 2013-08-10 05:58 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-09-12 22:46 - 2013-08-10 05:58 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-09-12 22:46 - 2013-08-10 05:58 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-09-12 22:46 - 2013-08-10 05:58 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-09-12 22:46 - 2013-08-10 05:58 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-09-12 22:46 - 2013-08-10 05:58 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-09-12 22:46 - 2013-08-10 05:58 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-09-12 22:46 - 2013-08-10 05:17 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-09-12 22:46 - 2013-08-10 05:07 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-09-12 22:46 - 2013-08-10 04:27 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-09-12 22:46 - 2013-08-10 04:17 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-09-12 22:45 - 2013-08-10 07:21 - 19246592 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-09-12 22:45 - 2013-08-10 07:20 - 15404544 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-09-12 22:45 - 2013-08-10 05:58 - 14332928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-09-12 22:45 - 2013-08-10 05:58 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-09-12 22:30 - 2013-08-08 03:20 - 03155456 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-09-12 22:30 - 2013-08-05 04:25 - 00155584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ataport.sys
2013-09-12 22:30 - 2013-08-02 04:23 - 05550528 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2013-09-12 22:30 - 2013-08-02 04:15 - 01732032 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2013-09-12 22:30 - 2013-08-02 04:15 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2013-09-12 22:30 - 2013-08-02 04:15 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2013-09-12 22:30 - 2013-08-02 04:15 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2013-09-12 22:30 - 2013-08-02 04:14 - 00215040 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2013-09-12 22:30 - 2013-08-02 04:14 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2013-09-12 22:30 - 2013-08-02 04:13 - 01161216 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2013-09-12 22:30 - 2013-08-02 04:13 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2013-09-12 22:30 - 2013-08-02 04:12 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2013-09-12 22:30 - 2013-08-02 04:12 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2013-09-12 22:30 - 2013-08-02 04:12 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 04:12 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 04:12 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 04:12 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 03:59 - 03968960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2013-09-12 22:30 - 2013-08-02 03:59 - 03913664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2013-09-12 22:30 - 2013-08-02 03:51 - 01292192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2013-09-12 22:30 - 2013-08-02 03:50 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2013-09-12 22:30 - 2013-08-02 03:50 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2013-09-12 22:30 - 2013-08-02 03:50 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2013-09-12 22:30 - 2013-08-02 03:48 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2013-09-12 22:30 - 2013-08-02 03:48 - 00005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 03:48 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 03:09 - 00338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2013-09-12 22:30 - 2013-08-02 02:59 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2013-09-12 22:30 - 2013-08-02 02:45 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2013-09-12 22:30 - 2013-08-02 02:45 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2013-09-12 22:30 - 2013-08-02 02:45 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2013-09-12 22:30 - 2013-08-02 02:45 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2013-09-12 22:30 - 2013-08-02 02:43 - 00006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 02:43 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 02:43 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 02:43 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2013-09-12 22:30 - 2013-07-26 04:24 - 14172672 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2013-09-12 22:30 - 2013-07-26 04:24 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\shdocvw.dll
2013-09-12 22:30 - 2013-07-26 03:55 - 12872704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2013-09-12 22:30 - 2013-07-26 03:55 - 00180224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shdocvw.dll
2013-09-09 15:33 - 2013-09-09 15:33 - 96665497 _____ C:\Windows\SysWOW64\�ｕ’
2013-09-07 09:43 - 2013-09-07 09:43 - 96496803 _____ C:\Windows\SysWOW64\⸼츄@

==================== One Month Modified Files and Folders =======

2013-09-29 19:25 - 2013-09-27 20:20 - 00000924 _____ C:\Windows\Tasks\BonanzaDealsLiveUpdateTaskMachineUA.job
2013-09-29 19:05 - 2012-07-06 17:33 - 00001108 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-09-29 18:30 - 2012-07-05 22:44 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-09-29 17:20 - 2013-09-29 17:20 - 98466785 _____ C:\Windows\SysWOW64\철䇥™
2013-09-29 16:24 - 2012-07-06 15:47 - 00000010 _____ C:\Program Files\Common Files\systemdate.dat
2013-09-29 16:22 - 2009-07-14 06:45 - 00009696 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-09-29 16:22 - 2009-07-14 06:45 - 00009696 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-09-29 16:19 - 2011-02-19 06:24 - 00694420 _____ C:\Windows\system32\perfh007.dat
2013-09-29 16:19 - 2011-02-19 06:24 - 00147716 _____ C:\Windows\system32\perfc007.dat
2013-09-29 16:19 - 2009-07-14 07:13 - 01643244 _____ C:\Windows\system32\PerfStringBackup.INI
2013-09-29 16:15 - 2012-07-06 17:33 - 00001104 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-09-29 16:14 - 2013-06-11 10:06 - 00010170 _____ C:\Windows\setupact.log
2013-09-29 16:14 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-09-29 15:36 - 2012-07-06 05:53 - 01750726 _____ C:\Windows\WindowsUpdate.log
2013-09-29 15:20 - 2013-09-29 15:20 - 98462899 _____ C:\Windows\SysWOW64\㌚†
2013-09-29 15:17 - 2013-04-16 13:00 - 00000000 ____D C:\Users\Admin\Documents\Online-BankingPlus
2013-09-29 14:20 - 2012-07-05 21:27 - 00045056 _____ C:\Windows\system32\acovcnt.exe
2013-09-29 13:28 - 2013-09-22 22:42 - 00000000 ____D C:\FRST
2013-09-29 13:26 - 2012-07-05 22:51 - 00000000 ____D C:\Users\Admin\AppData\Local\Windows Live
2013-09-29 13:19 - 2012-07-05 22:13 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-09-28 21:42 - 2012-10-30 13:18 - 00000000 ____D C:\Program Files (x86)\eRightSoft
2013-09-28 20:12 - 2012-07-06 09:53 - 00000000 ____D C:\Users\Admin\AppData\Roaming\ICQ
2013-09-28 17:31 - 2013-09-28 13:22 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-09-28 16:44 - 2013-09-28 16:44 - 01953880 _____ (Farbar) C:\Users\Admin\Desktop\FRST64.exe
2013-09-28 15:03 - 2013-09-28 13:03 - 98430869 _____ C:\Windows\SysWOW64\ᴳ￸“
2013-09-28 11:03 - 2013-09-28 11:03 - 98372650 _____ C:\Windows\SysWOW64\ᤁ綧N
2013-09-27 22:06 - 2011-04-13 03:39 - 00917598 _____ C:\Windows\PFRO.log
2013-09-27 21:01 - 2013-09-27 21:01 - 98286374 _____ C:\Windows\SysWOW64\ェ霎œ
2013-09-27 20:58 - 2012-07-06 06:09 - 00001727 _____ C:\Windows\system32\ServiceFilter.ini
2013-09-27 20:45 - 2012-07-05 21:26 - 00000000 ___RD C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2013-09-27 20:26 - 2011-04-13 04:35 - 00001719 _____ C:\Windows\DirectX.log
2013-09-27 20:19 - 2012-07-05 21:59 - 00000000 ____D C:\Users\Admin\AppData\Local\Google
2013-09-27 19:05 - 2013-09-27 19:05 - 00081112 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2013-09-27 16:46 - 2013-09-27 16:46 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Avira
2013-09-27 16:45 - 2013-09-27 16:45 - 00000000 ____D C:\Program Files (x86)\Avira
2013-09-27 16:45 - 2012-07-05 22:34 - 00000000 ____D C:\ProgramData\Avira
2013-09-27 16:43 - 2013-09-27 16:45 - 00132088 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2013-09-27 16:43 - 2013-09-27 16:45 - 00105344 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2013-09-27 16:43 - 2013-09-27 16:45 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2013-09-27 16:35 - 2012-07-05 22:44 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-09-27 16:35 - 2012-07-05 22:44 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-09-27 16:35 - 2012-07-05 22:44 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-09-27 16:17 - 2012-07-05 21:27 - 00105840 _____ C:\Users\Admin\AppData\Local\GDIPFONTCACHEV1.DAT
2013-09-27 16:16 - 2009-07-14 06:45 - 00401472 _____ C:\Windows\system32\FNTCACHE.DAT
2013-09-27 16:14 - 2013-09-27 15:46 - 00181064 _____ (Sysinternals) C:\Windows\PSEXESVC.EXE
2013-09-27 16:14 - 2009-07-14 04:34 - 00000468 _____ C:\Windows\win.ini
2013-09-27 15:44 - 2013-09-27 15:44 - 00000000 ____D C:\RegBackup
2013-09-27 04:55 - 2012-07-05 23:09 - 00000000 ____D C:\Users\Admin\AppData\Local\Adobe
2013-09-26 20:38 - 2013-09-26 20:38 - 00080456 _____ (Malwarebytes Corporation) C:\Users\Admin\Desktop\MBAM-Cleaner.exe
2013-09-26 20:18 - 2013-09-26 20:18 - 00002125 _____ C:\Users\Admin\Desktop\Windows Repair (All in One).lnk
2013-09-26 20:18 - 2013-09-26 20:18 - 00000000 ____D C:\Program Files (x86)\Tweaking.com
2013-09-25 17:54 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\LiveKernelReports
2013-09-23 21:59 - 2012-07-06 15:29 - 01621138 _____ C:\Windows\SysWOW64\PerfStringBackup.INI
2013-09-23 19:38 - 2012-10-23 11:02 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Virenscanprogramme
2013-09-23 18:13 - 2013-09-23 18:13 - 00000000 ____D C:\Windows\ERUNT
2013-09-23 18:10 - 2012-07-06 06:09 - 00002820 _____ C:\Windows\system32\AutoRunFilter.ini
2013-09-23 18:09 - 2013-09-23 18:08 - 00000000 ____D C:\AdwCleaner
2013-09-23 16:06 - 2012-07-05 21:26 - 00000000 ____D C:\Users\Admin
2013-09-23 16:03 - 2013-09-23 16:03 - 00000244 _____ C:\Windows\SysWOW64\defogger_enable.log
2013-09-23 16:02 - 2013-09-23 16:02 - 00000472 _____ C:\Windows\SysWOW64\defogger_disable.log
2013-09-16 15:39 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
2013-09-13 15:33 - 2012-07-05 21:27 - 00000000 ___RD C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-09-13 15:32 - 2013-04-29 12:58 - 00000000 ____D C:\Program Files\BatteryBar
2013-09-13 15:31 - 2013-09-13 15:31 - 00001748 _____ C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BatteryBar.lnk
2013-09-13 15:24 - 2012-07-05 21:27 - 00000000 ___RD C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2013-09-12 22:45 - 2013-08-15 22:22 - 00000000 ____D C:\Windows\system32\MRT
2013-09-12 22:43 - 2012-07-06 14:12 - 79143768 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-09-12 22:43 - 2012-07-05 21:49 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-09-11 20:00 - 2012-09-08 15:45 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\dreamboxEDIT
2013-09-09 15:33 - 2013-09-09 15:33 - 96665497 _____ C:\Windows\SysWOW64\�ｕ’
2013-09-09 15:32 - 2009-07-14 07:08 - 00032640 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-09-08 11:41 - 2012-07-11 12:32 - 00000000 ____D C:\Windows\pss
2013-09-07 09:43 - 2013-09-07 09:43 - 96496803 _____ C:\Windows\SysWOW64\⸼츄@
2013-09-01 16:30 - 2012-07-06 09:50 - 00000000 ____D C:\Users\Admin\AppData\Roaming\vlc
2013-09-01 15:22 - 2012-07-06 17:44 - 00001900 _____ C:\Users\Admin\.java.policy

Some content of TEMP:
====================
C:\Users\Admin\AppData\Local\Temp\ICReinstall_Movie-Maker.exe
C:\Users\Admin\AppData\Local\Temp\Quarantine.exe
C:\Users\Admin\AppData\Local\Temp\setup.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-09-21 11:56

==================== End Of Log ============================

--- --- ---

schrauber · 30.09.2013, 08:41

Noch Probleme?

Scheinle · 01.10.2013, 12:12

Welch ein Wunder - MBAM hängt sich weiterhin auf.

Aber: da das immer im gleichen Verzeichnis passiert habe ich es dieses Mal ausgetrickst und den Suchlauf abgebrochen.
Somit habe ich ein Log über die bis dahin erfolgten Funde.

Hier ist es:

Code:

ATTFilter

 Malwarebytes Anti-Malware  (Test) 1.75.0.1300
www.malwarebytes.org

Datenbank Version: v2013.10.01.03

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 10.0.9200.16686
Admin :: ***** [Administrator]

Schutz: Aktiviert

01.10.2013 12:57:43
MBAM-log-2013-10-01 (12-58-59).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 26999
Laufzeit: 45 Sekunde(n) [Abgebrochen]

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 28
HKCR\AppID\{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3} (PUP.Optional.Delta.A) -> Keine Aktion durchgeführt.
HKCR\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3} (PUP.Optional.BrowseFox.A) -> Keine Aktion durchgeführt.
HKCR\CLSID\{204df522-9a96-4a72-abb0-60f7a216d6d2} (Adware.Whilokii) -> Keine Aktion durchgeführt.
HKCR\TypeLib\{0131533c-f056-4e64-8a9d-b7c0ef342efd} (Adware.Whilokii) -> Keine Aktion durchgeführt.
HKCR\Interface\{AB4DA692-F26B-403C-AF8F-FD87D121F8F1} (Adware.Whilokii) -> Keine Aktion durchgeführt.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{204DF522-9A96-4A72-ABB0-60F7A216D6D2} (Adware.Whilokii) -> Keine Aktion durchgeführt.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{204DF522-9A96-4A72-ABB0-60F7A216D6D2} (Adware.Whilokii) -> Keine Aktion durchgeführt.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{204DF522-9A96-4A72-ABB0-60F7A216D6D2} (Adware.Whilokii) -> Keine Aktion durchgeführt.
HKCR\CLSID\{261DD098-8A3E-43D4-87AA-63324FA897D8} (PUP.Optional.Delta) -> Keine Aktion durchgeführt.
HKCR\TypeLib\{39CB8175-E224-4446-8746-00566302DF8D} (PUP.Optional.Delta) -> Keine Aktion durchgeführt.
HKCR\esrv.deltaESrvc.1 (PUP.Optional.Delta) -> Keine Aktion durchgeführt.
HKCR\esrv.deltaESrvc (PUP.Optional.Delta) -> Keine Aktion durchgeführt.
HKCR\CLSID\{4AA46D49-459F-4358-B4D1-169048547C23} (PUP.Optional.BrowseFox.A) -> Keine Aktion durchgeführt.
HKCR\CLSID\{82E1477C-B154-48D3-9891-33D83C26BCD3} (PUP.Optional.Delta.A) -> Keine Aktion durchgeführt.
HKCR\TypeLib\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921} (PUP.Optional.Delta.A) -> Keine Aktion durchgeführt.
HKCR\delta.deltadskBnd.1 (PUP.Optional.Delta.A) -> Keine Aktion durchgeführt.
HKCR\delta.deltadskBnd (PUP.Optional.Delta.A) -> Keine Aktion durchgeführt.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{82E1477C-B154-48D3-9891-33D83C26BCD3} (PUP.Optional.Delta.A) -> Keine Aktion durchgeführt.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{82E1477C-B154-48D3-9891-33D83C26BCD3} (PUP.Optional.Delta.A) -> Keine Aktion durchgeführt.
HKCR\CLSID\{C1AF5FA5-852C-4C90-812E-A7F75E011D87} (PUP.Optional.Delta.A) -> Keine Aktion durchgeführt.
HKCR\delta.deltaHlpr.1 (PUP.Optional.Delta.A) -> Keine Aktion durchgeführt.
HKCR\delta.deltaHlpr (PUP.Optional.Delta.A) -> Keine Aktion durchgeführt.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C1AF5FA5-852C-4C90-812E-A7F75E011D87} (PUP.Optional.Delta.A) -> Keine Aktion durchgeführt.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{C1AF5FA5-852C-4C90-812E-A7F75E011D87} (PUP.Optional.Delta.A) -> Keine Aktion durchgeführt.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{C1AF5FA5-852C-4C90-812E-A7F75E011D87} (PUP.Optional.Delta.A) -> Keine Aktion durchgeführt.
HKCR\Typelib\{4599D05A-D545-4069-BB42-5895B4EAE05B} (PUP.Optional.Delta.A) -> Keine Aktion durchgeführt.
HKCR\Interface\{1231839B-064E-4788-B865-465A1B5266FD} (PUP.Optional.Delta.A) -> Keine Aktion durchgeführt.
HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{348C2DF3-1191-4C3E-92A6-B3A89A9D9C85} (PUP.Optional.Delta.A) -> Keine Aktion durchgeführt.

Infizierte Registrierungswerte: 2
HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar|{82E1477C-B154-48D3-9891-33D83C26BCD3} (PUP.Optional.Delta.A) -> Daten: Delta Toolbar -> Keine Aktion durchgeführt.
HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{82E1477C-B154-48D3-9891-33D83C26BCD3} (PUP.Optional.Delta.A) -> Daten:  -> Keine Aktion durchgeführt.

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)

schrauber · 01.10.2013, 19:05

Poste jetzt mal bitte ein frisches FRST log.

Scheinle · 01.10.2013, 23:23

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 27-09-2013 02
Ran by Admin (administrator) on ***** on 02-10-2013 00:20:24
Running from C:\Users\Admin\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(ASUS) C:\Program Files (x86)\ASUS\SmartLogon\smartlogon.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(ASUSTeK Computer Inc.) C:\Windows\system32\FBAgent.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe
(ASUS) C:\Program Files (x86)\ASUS\Splendid\ACMON.exe
() C:\Program Files (x86)\ASUS\ASUS Live Update\ALU.exe
(ASUSTeK) C:\Windows\SysWOW64\ACEngSvr.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
(ASUS) C:\Windows\AsScrPro.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
() C:\Program Files (x86)\XSManager\WTGService.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ATKOSD.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\WDC.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
() C:\Program Files (x86)\Wireless 5-Mode Oscar Editor\OscarEditor.exe
(Osiris Development) C:\Program Files\BatteryBar\BatteryBar.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
() C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Microsoft Corporation) C:\Program Files (x86)\Windows Live\Mail\wlmail.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Microsoft Corporation) C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_8_800_168.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_8_800_168.exe
(Nullsoft, Inc.) C:\Program Files (x86)\Winamp\winamp.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RtHDVBg] - C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [2189416 2011-03-01] (Realtek Semiconductor)
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2712360 2011-03-04] (Synaptics Incorporated)
HKLM\...\Run: [IntelTBRunOnce] - C:\Program Files\Intel\TurboBoost\RunTBGadgetOnce.vbs [4526 2010-11-29] ()
HKLM\...\Run: [SynAsusAcpi] - C:\Program Files\Synaptics\SynTP\SynAsusAcpi.exe [97064 2011-03-04] (Synaptics Incorporated)
HKLM\...\Run: [Setwallpaper] - c:\programdata\SetWallpaper.cmd
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKCU\...\Run: [OscarXG] - C:\Program Files (x86)\Wireless 5-Mode Oscar Editor\OscarEditor.exe [3515904 2011-09-02] ()
HKCU\...\Run: [ShowBatteryBar] - "C:\Program Files\BatteryBar\ShowBatteryBar.exe" show
MountPoints2: {f0a13a39-c781-11e1-a12a-14dae9c43afd} - H:\autorun.exe
MountPoints2: {f0a13a6e-c781-11e1-a12a-14dae9c43afd} - H:\AutoRun.exe
MountPoints2: {f0a13a7b-c781-11e1-a12a-14dae9c43afd} - H:\AutoRun.exe
HKLM-x32\...\Run: [Wireless Console 3] - C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe [1601536 2010-09-24] ()
HKLM-x32\...\Run: [] - [x]
HKLM-x32\...\Run: [UCam_Menu] - C:\Program Files (x86)\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe [222504 2009-05-19] (CyberLink Corp.)
HKLM-x32\...\Run: [ATKOSD2] - C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe [5716608 2011-07-21] (ASUS)
HKLM-x32\...\Run: [ATKMEDIA] - C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe [170624 2010-10-07] (ASUS)
HKLM-x32\...\Run: [HControlUser] - C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe [105016 2009-06-19] (ASUS)
HKLM-x32\...\Run: [NWEReboot] - [x]
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-05-11] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [681032 2013-10-01] (Avira Operations GmbH & Co. KG)
HKU\UpdatusUser\...\Run: [ISUSPM] - C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe -scheduler
AppInit_DLLs: C:\Windows\system32\nvinitx.dll [245872 2013-04-08] (NVIDIA Corporation)
AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll [201576 2013-04-08] (NVIDIA Corporation)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://asus.msn.com
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Whilokii - {204df522-9a96-4a72-abb0-60f7a216d6d2} - C:\Program Files (x86)\Whilokii\Whilokiibho.dll No File
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Microsoft-Konto-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: delta Helper Object - {C1AF5FA5-852C-4C90-812E-A7F75E011D87} - C:\Program Files (x86)\Delta\delta\1.8.24.6\bh\delta.dll No File
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: BonanzaDeals - {fe063412-bea4-4d76-8ed3-183be6220d17} - C:\Program Files (x86)\BonanzaDeals\BonanzaDealsIE.dll No File
Toolbar: HKLM-x32 - Delta Toolbar - {82E1477C-B154-48D3-9891-33D83C26BCD3} - C:\Program Files (x86)\Delta\delta\1.8.24.6\deltaTlbr.dll No File
Toolbar: HKCU -  No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} -  No File
DPF: HKLM {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\w3r6udwc.default
FF user.js: detected! => C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\w3r6udwc.default\user.js
FF NewTab: hxxp://www.searchgol.com/?babsrc=NT_ss&mntrId=8A5200FF13430B0D&affID=119357&tsp=5018
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_8_800_168.dll ()
FF Plugin: @java.com/DTPlugin,version=10.11.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.11.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.0.1 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.0.2 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.0.5 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.0.6 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.0.7 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.0.8 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: adobe.com/AdobeAAMDetect - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll (Adobe Systems)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_168.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\SysWOW64\Adobe\Director\np32dsw_1202122.dll (Adobe Systems, Inc.)
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3505.0912 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.bdupdater.com/BonanzaDealsLive Update;version=3 - C:\Program Files (x86)\BonanzaDealsLive\Update\1.3.23.0\npGoogleUpdate3.dll No File
FF Plugin-x32: @tools.bdupdater.com/BonanzaDealsLive Update;version=9 - C:\Program Files (x86)\BonanzaDealsLive\Update\1.3.23.0\npGoogleUpdate3.dll No File
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.0.4 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin-x32: adobe.com/AdobeAAMDetect - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect32.dll (Adobe Systems)
FF Plugin HKCU: amazon.com/AmazonMP3DownloaderPlugin - C:\Program Files (x86)\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin101727.dll (Amazon.com, Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Delta Toolbar - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\w3r6udwc.default\Extensions\ffxtlbr@delta.com
FF Extension: Forecastfox - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\w3r6udwc.default\Extensions\{0538E3E3-7E9B-4d49-8831-A227C80A7AD3}
FF Extension: FoxClocks - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\w3r6udwc.default\Extensions\{d37dc5d0-431d-44e5-8c91-49419370caa1}
FF Extension: BonanzaDeals - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\w3r6udwc.default\Extensions\{f9d03c26-0575-497e-821d-f7956d23e0ca}
FF Extension: firefox - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\w3r6udwc.default\Extensions\firefox@whilokii.net.xpi
FF Extension: No Name - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\w3r6udwc.default\Extensions\{20a82645-c095-46ed-80e3-08825760534b}.xpi
FF Extension: No Name - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\w3r6udwc.default\Extensions\{64161300-e22b-11db-8314-0800200c9a66}.xpi
FF Extension: No Name - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\w3r6udwc.default\Extensions\{9AA46F4F-4DC7-4c06-97AF-5035170634FE}.xpi
FF Extension: No Name - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\w3r6udwc.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
FF Extension: No Name - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\w3r6udwc.default\Extensions\{D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389}.xpi

Chrome: 
=======
Error reading preferences. Please check "preferences" file for possible corruption. <======= ATTENTION

==================== Services (Whitelisted) =================

S4 AdobeActiveFileMonitor10.0; C:\Program Files (x86)\Adobe\Elements 10 Organizer\PhotoshopElementsFileAgent.exe [169624 2011-09-01] (Adobe Systems Incorporated)
R2 AntiVirMailService; C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe [948296 2013-10-01] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440392 2013-10-01] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440392 2013-10-01] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [1164360 2013-10-01] (Avira Operations GmbH & Co. KG)
S4 CLKMSVC10_38F51D56; C:\Program Files (x86)\CyberLink\PowerDVD10\NavFilter\kmsvc.exe [243728 2012-08-27] (CyberLink)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
S3 RaMediaServer; C:\Program Files (x86)\Ralink\Common\RaMediaServer.exe [619872 2010-12-31] ()
S4 RichVideo; C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe [244904 2009-07-02] ()
R2 WTGService; C:\Program Files (x86)\XSManager\WTGService.exe [329168 2010-04-12] ()
S4 XS Stick Service; C:\Windows\service4g.exe [145064 2010-04-30] (4G Systems GmbH & Co. KG)
S2 bonanzadealslive; C:\Program Files (x86)\BonanzaDealsLive\Update\BonanzaDealsLive.exe /svc [x]
S3 bonanzadealslivem; C:\Program Files (x86)\BonanzaDealsLive\Update\BonanzaDealsLive.exe /medsvc [x]
S4 HssSrv; C:\Program Files (x86)\Hotspot Shield\HssWPR\hsssrv.exe [x]
S2 Update Whilokii; "C:\Program Files (x86)\Whilokii\updateWhilokii.exe" [x]

==================== Drivers (Whitelisted) ====================

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [105856 2013-10-01] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132600 2013-10-01] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-10-01] (Avira Operations GmbH & Co. KG)
S3 cmnsusbser; C:\Windows\System32\DRIVERS\cmnsusbser.sys [117888 2012-07-06] (Mobile Connector)
R1 HssDRV6; C:\Windows\System32\DRIVERS\hssdrv6.sys [41704 2012-08-01] (AnchorFree Inc.)
R3 kbfiltr; C:\Windows\System32\DRIVERS\kbfiltr.sys [15416 2009-07-20] ( )
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
S3 ewusbnet; system32\DRIVERS\ewusbnet.sys [x]
S3 ew_hwusbdev; system32\DRIVERS\ew_hwusbdev.sys [x]
S3 huawei_enumerator; system32\DRIVERS\ew_jubusenum.sys [x]
S3 hwdatacard; system32\DRIVERS\ewusbmdm.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-10-01 12:56 - 2013-10-01 12:56 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Malwarebytes
2013-10-01 12:56 - 2013-10-01 12:56 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-10-01 12:56 - 2013-10-01 12:56 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-10-01 12:56 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-09-29 15:20 - 2013-09-29 15:20 - 98462899 _____ C:\Windows\SysWOW64\㌚†
2013-09-28 16:44 - 2013-09-28 16:44 - 01953880 _____ (Farbar) C:\Users\Admin\Desktop\FRST64.exe
2013-09-28 13:22 - 2013-09-28 17:31 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-09-28 13:03 - 2013-09-28 15:03 - 98430869 _____ C:\Windows\SysWOW64\ᴳ￸“
2013-09-28 11:03 - 2013-09-28 11:03 - 98372650 _____ C:\Windows\SysWOW64\ᤁ綧N
2013-09-27 21:01 - 2013-09-27 21:01 - 98286374 _____ C:\Windows\SysWOW64\ェ霎œ
2013-09-27 20:20 - 2013-10-01 23:25 - 00000924 _____ C:\Windows\Tasks\BonanzaDealsLiveUpdateTaskMachineUA.job
2013-09-27 19:05 - 2013-10-01 12:06 - 00083160 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2013-09-27 16:46 - 2013-09-27 16:46 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Avira
2013-09-27 16:45 - 2013-10-01 12:06 - 00132600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2013-09-27 16:45 - 2013-10-01 12:06 - 00105856 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2013-09-27 16:45 - 2013-10-01 12:06 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2013-09-27 16:45 - 2013-09-27 16:45 - 00000000 ____D C:\Program Files (x86)\Avira
2013-09-27 15:46 - 2013-09-27 16:14 - 00181064 _____ (Sysinternals) C:\Windows\PSEXESVC.EXE
2013-09-27 15:44 - 2013-09-27 15:44 - 00000000 ____D C:\RegBackup
2013-09-26 20:38 - 2013-09-26 20:38 - 00080456 _____ (Malwarebytes Corporation) C:\Users\Admin\Desktop\MBAM-Cleaner.exe
2013-09-26 20:18 - 2013-09-26 20:18 - 00002125 _____ C:\Users\Admin\Desktop\Windows Repair (All in One).lnk
2013-09-26 20:18 - 2013-09-26 20:18 - 00000000 ____D C:\Program Files (x86)\Tweaking.com
2013-09-23 18:13 - 2013-09-23 18:13 - 00000000 ____D C:\Windows\ERUNT
2013-09-23 18:08 - 2013-09-23 18:09 - 00000000 ____D C:\AdwCleaner
2013-09-23 16:03 - 2013-09-23 16:03 - 00000244 _____ C:\Windows\SysWOW64\defogger_enable.log
2013-09-23 16:02 - 2013-09-23 16:02 - 00000472 _____ C:\Windows\SysWOW64\defogger_disable.log
2013-09-22 22:42 - 2013-09-29 13:28 - 00000000 ____D C:\FRST
2013-09-13 15:31 - 2013-09-13 15:31 - 00001748 _____ C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BatteryBar.lnk
2013-09-12 22:46 - 2013-08-10 07:22 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-09-12 22:46 - 2013-08-10 07:22 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-09-12 22:46 - 2013-08-10 07:22 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-09-12 22:46 - 2013-08-10 07:21 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-09-12 22:46 - 2013-08-10 07:21 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-09-12 22:46 - 2013-08-10 07:20 - 03959296 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-09-12 22:46 - 2013-08-10 07:20 - 02647040 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-09-12 22:46 - 2013-08-10 07:20 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-09-12 22:46 - 2013-08-10 07:20 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-09-12 22:46 - 2013-08-10 07:20 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-09-12 22:46 - 2013-08-10 07:20 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-09-12 22:46 - 2013-08-10 07:20 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-09-12 22:46 - 2013-08-10 05:59 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-09-12 22:46 - 2013-08-10 05:59 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-09-12 22:46 - 2013-08-10 05:58 - 02876928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-09-12 22:46 - 2013-08-10 05:58 - 02048000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-09-12 22:46 - 2013-08-10 05:58 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-09-12 22:46 - 2013-08-10 05:58 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-09-12 22:46 - 2013-08-10 05:58 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-09-12 22:46 - 2013-08-10 05:58 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-09-12 22:46 - 2013-08-10 05:58 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-09-12 22:46 - 2013-08-10 05:58 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-09-12 22:46 - 2013-08-10 05:58 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-09-12 22:46 - 2013-08-10 05:17 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-09-12 22:46 - 2013-08-10 05:07 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-09-12 22:46 - 2013-08-10 04:27 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-09-12 22:46 - 2013-08-10 04:17 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-09-12 22:45 - 2013-08-10 07:21 - 19246592 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-09-12 22:45 - 2013-08-10 07:20 - 15404544 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-09-12 22:45 - 2013-08-10 05:58 - 14332928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-09-12 22:45 - 2013-08-10 05:58 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-09-12 22:30 - 2013-08-08 03:20 - 03155456 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-09-12 22:30 - 2013-08-05 04:25 - 00155584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ataport.sys
2013-09-12 22:30 - 2013-08-02 04:23 - 05550528 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2013-09-12 22:30 - 2013-08-02 04:15 - 01732032 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2013-09-12 22:30 - 2013-08-02 04:15 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2013-09-12 22:30 - 2013-08-02 04:15 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2013-09-12 22:30 - 2013-08-02 04:15 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2013-09-12 22:30 - 2013-08-02 04:14 - 00215040 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2013-09-12 22:30 - 2013-08-02 04:14 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2013-09-12 22:30 - 2013-08-02 04:13 - 01161216 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2013-09-12 22:30 - 2013-08-02 04:13 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2013-09-12 22:30 - 2013-08-02 04:12 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2013-09-12 22:30 - 2013-08-02 04:12 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2013-09-12 22:30 - 2013-08-02 04:12 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 04:12 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 04:12 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 04:12 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 03:59 - 03968960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2013-09-12 22:30 - 2013-08-02 03:59 - 03913664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2013-09-12 22:30 - 2013-08-02 03:51 - 01292192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2013-09-12 22:30 - 2013-08-02 03:50 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2013-09-12 22:30 - 2013-08-02 03:50 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2013-09-12 22:30 - 2013-08-02 03:50 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2013-09-12 22:30 - 2013-08-02 03:48 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2013-09-12 22:30 - 2013-08-02 03:48 - 00005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 03:48 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 03:09 - 00338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2013-09-12 22:30 - 2013-08-02 02:59 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2013-09-12 22:30 - 2013-08-02 02:45 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2013-09-12 22:30 - 2013-08-02 02:45 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2013-09-12 22:30 - 2013-08-02 02:45 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2013-09-12 22:30 - 2013-08-02 02:45 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2013-09-12 22:30 - 2013-08-02 02:43 - 00006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 02:43 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 02:43 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2013-09-12 22:30 - 2013-08-02 02:43 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2013-09-12 22:30 - 2013-07-26 04:24 - 14172672 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2013-09-12 22:30 - 2013-07-26 04:24 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\shdocvw.dll
2013-09-12 22:30 - 2013-07-26 03:55 - 12872704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2013-09-12 22:30 - 2013-07-26 03:55 - 00180224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shdocvw.dll
2013-09-09 15:33 - 2013-09-09 15:33 - 96665497 _____ C:\Windows\SysWOW64\�ｕ’
2013-09-07 09:43 - 2013-09-07 09:43 - 96496803 _____ C:\Windows\SysWOW64\⸼츄@

==================== One Month Modified Files and Folders =======

2013-10-02 00:05 - 2012-07-06 17:33 - 00001108 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-10-02 00:04 - 2012-07-05 22:51 - 00000000 ____D C:\Users\Admin\AppData\Local\Windows Live
2013-10-01 23:30 - 2012-07-05 22:44 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-10-01 23:25 - 2013-09-27 20:20 - 00000924 _____ C:\Windows\Tasks\BonanzaDealsLiveUpdateTaskMachineUA.job
2013-10-01 21:05 - 2012-07-06 17:33 - 00001104 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-10-01 13:22 - 2012-07-06 05:53 - 02072075 _____ C:\Windows\WindowsUpdate.log
2013-10-01 13:13 - 2009-07-14 06:45 - 00009696 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-10-01 13:13 - 2009-07-14 06:45 - 00009696 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-10-01 13:09 - 2011-02-19 06:24 - 00694420 _____ C:\Windows\system32\perfh007.dat
2013-10-01 13:09 - 2011-02-19 06:24 - 00147716 _____ C:\Windows\system32\perfc007.dat
2013-10-01 13:09 - 2009-07-14 07:13 - 01643244 _____ C:\Windows\system32\PerfStringBackup.INI
2013-10-01 13:05 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-10-01 13:03 - 2013-06-11 10:06 - 00010394 _____ C:\Windows\setupact.log
2013-10-01 12:56 - 2013-10-01 12:56 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Malwarebytes
2013-10-01 12:56 - 2013-10-01 12:56 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-10-01 12:56 - 2013-10-01 12:56 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-10-01 12:11 - 2012-07-05 21:27 - 00045056 _____ C:\Windows\system32\acovcnt.exe
2013-10-01 12:06 - 2013-09-27 19:05 - 00083160 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2013-10-01 12:06 - 2013-09-27 16:45 - 00132600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2013-10-01 12:06 - 2013-09-27 16:45 - 00105856 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2013-10-01 12:06 - 2013-09-27 16:45 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2013-09-29 19:59 - 2012-07-06 09:53 - 00000000 ____D C:\Users\Admin\AppData\Roaming\ICQ
2013-09-29 16:24 - 2012-07-06 15:47 - 00000010 _____ C:\Program Files\Common Files\systemdate.dat
2013-09-29 15:20 - 2013-09-29 15:20 - 98462899 _____ C:\Windows\SysWOW64\㌚†
2013-09-29 15:17 - 2013-04-16 13:00 - 00000000 ____D C:\Users\Admin\Documents\Online-BankingPlus
2013-09-29 13:28 - 2013-09-22 22:42 - 00000000 ____D C:\FRST
2013-09-29 13:19 - 2012-07-05 22:13 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-09-28 21:42 - 2012-10-30 13:18 - 00000000 ____D C:\Program Files (x86)\eRightSoft
2013-09-28 17:31 - 2013-09-28 13:22 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-09-28 16:44 - 2013-09-28 16:44 - 01953880 _____ (Farbar) C:\Users\Admin\Desktop\FRST64.exe
2013-09-28 15:03 - 2013-09-28 13:03 - 98430869 _____ C:\Windows\SysWOW64\ᴳ￸“
2013-09-28 11:03 - 2013-09-28 11:03 - 98372650 _____ C:\Windows\SysWOW64\ᤁ綧N
2013-09-27 22:06 - 2011-04-13 03:39 - 00917598 _____ C:\Windows\PFRO.log
2013-09-27 21:01 - 2013-09-27 21:01 - 98286374 _____ C:\Windows\SysWOW64\ェ霎œ
2013-09-27 20:58 - 2012-07-06 06:09 - 00001727 _____ C:\Windows\system32\ServiceFilter.ini
2013-09-27 20:45 - 2012-07-05 21:26 - 00000000 ___RD C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2013-09-27 20:26 - 2011-04-13 04:35 - 00001719 _____ C:\Windows\DirectX.log
2013-09-27 20:19 - 2012-07-05 21:59 - 00000000 ____D C:\Users\Admin\AppData\Local\Google
2013-09-27 16:46 - 2013-09-27 16:46 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Avira
2013-09-27 16:45 - 2013-09-27 16:45 - 00000000 ____D C:\Program Files (x86)\Avira
2013-09-27 16:45 - 2012-07-05 22:34 - 00000000 ____D C:\ProgramData\Avira
2013-09-27 16:35 - 2012-07-05 22:44 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-09-27 16:35 - 2012-07-05 22:44 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-09-27 16:35 - 2012-07-05 22:44 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-09-27 16:17 - 2012-07-05 21:27 - 00105840 _____ C:\Users\Admin\AppData\Local\GDIPFONTCACHEV1.DAT
2013-09-27 16:16 - 2009-07-14 06:45 - 00401472 _____ C:\Windows\system32\FNTCACHE.DAT
2013-09-27 16:14 - 2013-09-27 15:46 - 00181064 _____ (Sysinternals) C:\Windows\PSEXESVC.EXE
2013-09-27 16:14 - 2009-07-14 04:34 - 00000468 _____ C:\Windows\win.ini
2013-09-27 15:44 - 2013-09-27 15:44 - 00000000 ____D C:\RegBackup
2013-09-27 04:55 - 2012-07-05 23:09 - 00000000 ____D C:\Users\Admin\AppData\Local\Adobe
2013-09-26 20:38 - 2013-09-26 20:38 - 00080456 _____ (Malwarebytes Corporation) C:\Users\Admin\Desktop\MBAM-Cleaner.exe
2013-09-26 20:18 - 2013-09-26 20:18 - 00002125 _____ C:\Users\Admin\Desktop\Windows Repair (All in One).lnk
2013-09-26 20:18 - 2013-09-26 20:18 - 00000000 ____D C:\Program Files (x86)\Tweaking.com
2013-09-25 17:54 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\LiveKernelReports
2013-09-23 21:59 - 2012-07-06 15:29 - 01621138 _____ C:\Windows\SysWOW64\PerfStringBackup.INI
2013-09-23 19:38 - 2012-10-23 11:02 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Virenscanprogramme
2013-09-23 18:13 - 2013-09-23 18:13 - 00000000 ____D C:\Windows\ERUNT
2013-09-23 18:10 - 2012-07-06 06:09 - 00002820 _____ C:\Windows\system32\AutoRunFilter.ini
2013-09-23 18:09 - 2013-09-23 18:08 - 00000000 ____D C:\AdwCleaner
2013-09-23 16:06 - 2012-07-05 21:26 - 00000000 ____D C:\Users\Admin
2013-09-23 16:03 - 2013-09-23 16:03 - 00000244 _____ C:\Windows\SysWOW64\defogger_enable.log
2013-09-23 16:02 - 2013-09-23 16:02 - 00000472 _____ C:\Windows\SysWOW64\defogger_disable.log
2013-09-16 15:39 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
2013-09-13 15:33 - 2012-07-05 21:27 - 00000000 ___RD C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-09-13 15:32 - 2013-04-29 12:58 - 00000000 ____D C:\Program Files\BatteryBar
2013-09-13 15:31 - 2013-09-13 15:31 - 00001748 _____ C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BatteryBar.lnk
2013-09-13 15:24 - 2012-07-05 21:27 - 00000000 ___RD C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2013-09-12 22:45 - 2013-08-15 22:22 - 00000000 ____D C:\Windows\system32\MRT
2013-09-12 22:43 - 2012-07-06 14:12 - 79143768 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-09-12 22:43 - 2012-07-05 21:49 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-09-11 20:00 - 2012-09-08 15:45 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\dreamboxEDIT
2013-09-09 15:33 - 2013-09-09 15:33 - 96665497 _____ C:\Windows\SysWOW64\�ｕ’
2013-09-09 15:32 - 2009-07-14 07:08 - 00032640 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-09-08 11:41 - 2012-07-11 12:32 - 00000000 ____D C:\Windows\pss
2013-09-07 09:43 - 2013-09-07 09:43 - 96496803 _____ C:\Windows\SysWOW64\⸼츄@

Some content of TEMP:
====================
C:\Users\Admin\AppData\Local\Temp\avgnt.exe
C:\Users\Admin\AppData\Local\Temp\ICReinstall_Movie-Maker.exe
C:\Users\Admin\AppData\Local\Temp\Quarantine.exe
C:\Users\Admin\AppData\Local\Temp\setup.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-10-01 13:52

==================== End Of Log ============================

--- --- ---

--- --- ---

schrauber · 02.10.2013, 08:09

Lade SystemLook von jpshortstuff von einem der folgenden Spiegel herunter und speichere das Tool auf dem Desktop.
SystemLook (64 bit)

Doppelklicke auf die SystemLook_x64.exe, um das Tool zu starten.
Kopiere den Inhalt der folgenden Codebox in das Textfeld des Tools:
Code:
ATTFilter
```
:filefind
*Bonanza*
*delta*
*Lyrix*
:regfind
Bonanza
delta
Lyrix
         
```
Klicke nun auf den Button Look, um den Scan zu starten.
Der Suchlauf kann einige Zeit dauern.
Wenn der Suchlauf beendet ist, wird sich Dein Editor mit den Ergebnissen öffnen, poste diese in deinen Thread.
Die Ergebnisse werden auf dem Desktop als SystemLook.txt gespeichert.

Scheinle · 02.10.2013, 11:24

Code:

ATTFilter

SystemLook 30.07.11 by jpshortstuff
Log created at 12:08 on 02/10/2013 by Admin
Administrator - Elevation successful

========== filefind ==========

Searching for "*Bonanza*"
C:\FRST\Quarantine\BonanzaDealsLiveUpdateTaskMachineCore	--a---- 3668 bytes	[18:20 27/09/2013]	[18:20 27/09/2013] 0C2B467D6F656260036F31C49DDF8AEC
C:\FRST\Quarantine\BonanzaDealsLiveUpdateTaskMachineCore.job	--a---- 920 bytes	[18:20 27/09/2013]	[11:19 29/09/2013] 5AE5683FC061F38A58A728275075A0F5
C:\FRST\Quarantine\BonanzaDealsLiveUpdateTaskMachineUA	--a---- 3920 bytes	[18:20 27/09/2013]	[18:20 27/09/2013] 941AF7E561987F46CF7F9FE7943A7B63
C:\FRST\Quarantine\BonanzaDealsUpdate	--a---- 3386 bytes	[18:19 27/09/2013]	[18:19 27/09/2013] 360ED67B3CDAB323EDF42E460D09A860
C:\FRST\Quarantine\BonanzaDeals\Bonanza Deals Help.url	--a---- 137 bytes	[18:19 27/09/2013]	[18:19 27/09/2013] 3FEF4F3C125E59C1D7990700F3FB6DF6
C:\FRST\Quarantine\BonanzaDeals\Bonanza Deals.url	--a---- 133 bytes	[18:19 27/09/2013]	[18:19 27/09/2013] D4F1A7B66BA89CF57E32781BA0DD71D4
C:\FRST\Quarantine\BonanzaDeals\Uninstall Bonanza Deals.lnk	--a---- 953 bytes	[18:19 27/09/2013]	[18:19 27/09/2013] 19854C40A32C73455C220AB2BD8DCF6F
C:\FRST\Quarantine\BonanzaDeals\BonanzaDeals\BonanzaDeals.crx	--a---- 39623 bytes	[18:19 27/09/2013]	[17:36 21/08/2013] EA68FE5545F957054B9C4A841317A269
C:\FRST\Quarantine\BonanzaDeals\BonanzaDeals\BonanzaDeals.xpi	--a---- 2833 bytes	[18:19 27/09/2013]	[17:36 21/08/2013] 3E9861376F7D23293182D9697738CD41
C:\FRST\Quarantine\BonanzaDeals\BonanzaDeals\BonanzaDealsIE.dll	--a---- 100336 bytes	[18:19 27/09/2013]	[17:36 21/08/2013] CFE165943AE6CD3DE8213856A1C66016
C:\FRST\Quarantine\BonanzaDeals\BonanzaDeals\BonanzaDealsIE64.dll	--a---- 0 bytes	[18:19 27/09/2013]	[17:37 21/08/2013] D41D8CD98F00B204E9800998ECF8427E
C:\FRST\Quarantine\BonanzaDeals\BonanzaDeals\BonanzaDealsUpdate.exe	--a---- 78384 bytes	[18:19 27/09/2013]	[17:37 21/08/2013] 5826462E5834594A81E0397A097B5D3E
C:\FRST\Quarantine\BonanzaDeals\BonanzaDeals\BonanzaDealsUpdateRun.exe	--a---- 92656 bytes	[18:19 27/09/2013]	[17:37 21/08/2013] B94E0E83BEB5543EF0D68BC0E8958B11
C:\FRST\Quarantine\BonanzaDealsLive\BonanzaDealsLive\Update\BonanzaDealsLive.exe	--a---- 148976 bytes	[18:19 27/09/2013]	[18:19 27/09/2013] 9F2041F1EC121713D0BD9996CE97D03E
C:\FRST\Quarantine\BonanzaDealsLive\BonanzaDealsLive\Update\1.3.23.0\BonanzaDealsLive.exe	--a---- 148976 bytes	[18:19 27/09/2013]	[18:19 27/09/2013] 9F2041F1EC121713D0BD9996CE97D03E
C:\FRST\Quarantine\BonanzaDealsLive\BonanzaDealsLive\Update\1.3.23.0\BonanzaDealsLiveBroker.exe	--a---- 61936 bytes	[18:19 27/09/2013]	[18:19 27/09/2013] 84AE92CA66B1FDAFDB10DE27283785D6
C:\FRST\Quarantine\BonanzaDealsLive\BonanzaDealsLive\Update\1.3.23.0\BonanzaDealsLiveHandler.exe	--a---- 148976 bytes	[18:19 27/09/2013]	[18:19 27/09/2013] 9F2041F1EC121713D0BD9996CE97D03E
C:\FRST\Quarantine\BonanzaDealsLive\BonanzaDealsLive\Update\1.3.23.0\BonanzaDealsLiveHelper.msi	--a---- 40960 bytes	[18:19 27/09/2013]	[18:19 27/09/2013] 9CD5109EF7367DF192989B4D26B0E344
C:\FRST\Quarantine\BonanzaDealsLive\BonanzaDealsLive\Update\1.3.23.0\BonanzaDealsLiveOnDemand.exe	--a---- 61936 bytes	[18:19 27/09/2013]	[18:19 27/09/2013] C16CD18F8825F5C936FDA2CC9D7BD158
C:\FRST\Quarantine\BonanzaDealsLive\BonanzaDealsLive\Update\Log\BonanzaDealsLive.log	--a---- 208216 bytes	[18:19 27/09/2013]	[11:25 29/09/2013] CCDC9AA72550B7373ABEDE4E6C0A58EA
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\w3r6udwc.default\extensions\{f9d03c26-0575-497e-821d-f7956d23e0ca}\content\bonanzadeals.xul	--a---- 747 bytes	[18:19 27/09/2013]	[17:36 21/08/2013] 7603DE5C1B9C1F8DFFBC38DF93E5E0AF
C:\Windows\Tasks\BonanzaDealsLiveUpdateTaskMachineUA.job	--a---- 924 bytes	[18:20 27/09/2013]	[09:25 02/10/2013] 4A9C2267DBFD1C20B1FBD3CCC630D561

Searching for "*delta*"
C:\FRST\Quarantine\BabSolution\CR\Delta.crx	--a---- 17468 bytes	[18:20 27/09/2013]	[13:23 22/09/2013] 9CF883E2E736C5FE81A032834F9874AA
C:\FRST\Quarantine\BabSolution\Shared\Delta.ico	--a---- 5430 bytes	[18:20 27/09/2013]	[15:25 23/04/2013] 97EE720DD3678F23D02D166E522402AC
C:\FRST\Quarantine\Delta\delta\1.8.24.6\deltaApp.dll	--a---- 331160 bytes	[08:08 15/08/2013]	[08:08 15/08/2013] 3AD360DD20C5353D5DCB3C8E18DC786A
C:\FRST\Quarantine\Delta\delta\1.8.24.6\deltaEng.dll	--a---- 610200 bytes	[08:08 15/08/2013]	[08:08 15/08/2013] 23A0125C2F25F37FE6485FDD62D9877A
C:\FRST\Quarantine\Delta\delta\1.8.24.6\deltasrv.exe	--a---- 397208 bytes	[08:08 15/08/2013]	[08:08 15/08/2013] 61EE48261FD29E38253ECFA6CE639327
C:\FRST\Quarantine\Delta\delta\1.8.24.6\deltaTlbr.dll	--a---- 300952 bytes	[08:08 15/08/2013]	[08:08 15/08/2013] 2FDCA357961AAE693A430CD23BE202B2
C:\FRST\Quarantine\Delta\delta\1.8.24.6\bh\delta.dll	--a---- 314264 bytes	[08:08 15/08/2013]	[08:08 15/08/2013] 409F4C3E8158AB85C2F2C30480C67690
C:\Users\Admin\AppData\Local\Temp\AF39E293-BAB0-7891-BA39-B79FC828B39D\Latest\bab138.deltatb_dmn.zpb	--a---- 250 bytes	[18:20 27/09/2013]	[18:20 27/09/2013] E3F94911F62443BB76C2A71BFF1B5D5B
C:\Users\Admin\AppData\Local\Temp\AF39E293-BAB0-7891-BA39-B79FC828B39D\Latest\Delta.crx	--a---- 17468 bytes	[13:23 22/09/2013]	[13:23 22/09/2013] 9CF883E2E736C5FE81A032834F9874AA
C:\Users\Admin\AppData\Local\Temp\AF39E293-BAB0-7891-BA39-B79FC828B39D\Latest\Delta.ico	--a---- 5430 bytes	[15:25 23/04/2013]	[15:25 23/04/2013] 97EE720DD3678F23D02D166E522402AC
C:\Users\Admin\AppData\Local\Temp\AF39E293-BAB0-7891-BA39-B79FC828B39D\Latest\DeltaChromeTB.zpb	--a---- 80348 bytes	[18:20 27/09/2013]	[18:20 27/09/2013] FC8D21A1DC4BAD6ABE2132A4E25BA5E0
C:\Users\Admin\AppData\Local\Temp\AF39E293-BAB0-7891-BA39-B79FC828B39D\Latest\DeltaTB.zpb	--a---- 1681832 bytes	[18:20 27/09/2013]	[18:20 27/09/2013] 3B0C7B0C0E99B6975AF4282A66752C28
C:\Users\Admin\AppData\Local\Temp\AF39E293-BAB0-7891-BA39-B79FC828B39D\Latest\MyDeltaTB.exe	--a---- 1903392 bytes	[06:54 20/08/2013]	[06:54 20/08/2013] C3991BD608566C91F6E70A99468F2916
C:\Users\Admin\AppData\Local\Temp\is1293689599\345046_stp\DeltaTB.exe	--a---- 786416 bytes	[08:42 17/07/2013]	[08:42 17/07/2013] FC21D8E387DBCD2E627B97BFC5B8F5CD
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\Relaxing Music deep Sleep #3   Delta Binaural Waves [Meditation  Relaxation] by Fred Bouchal.lnk	--a---- 774 bytes	[08:55 20/09/2013]	[08:55 20/09/2013] D2701040CB7FA79EA11C330F4E71471C
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\w3r6udwc.default\extensions\ffxtlbr@delta.com\content\delta.css	--a---- 2291 bytes	[22:37 01/11/2012]	[22:37 01/11/2012] 58C7A72DA6517BA5DCB109C0D16E70DC
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\w3r6udwc.default\extensions\ffxtlbr@delta.com\content\delta.xul	--a---- 1095 bytes	[10:13 07/11/2012]	[10:13 07/11/2012] 3B286E04393FE27FC84D097AAF7565C8
C:\Windows\System32\msdelta.dll	--a---- 451584 bytes	[23:22 13/07/2009]	[01:41 14/07/2009] D9A5B279A8D2F8775FA254927F33DA6D
C:\Windows\SysWOW64\msdelta.dll	--a---- 305152 bytes	[23:12 13/07/2009]	[01:15 14/07/2009] 739E51268B4BB79AB4F9E55F0018D0BC
C:\Windows\winsxs\amd64_microsoft-windows-deltacompressionengine_31bf3856ad364e35_6.1.7600.16385_none_9c2159bf9f702069\msdelta.dll	--a---- 451584 bytes	[23:22 13/07/2009]	[01:41 14/07/2009] D9A5B279A8D2F8775FA254927F33DA6D
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_6.1.7600.16385_none_655452efe0fb810b\msdelta.dll	--a---- 451584 bytes	[02:55 14/07/2009]	[02:55 14/07/2009] D9A5B279A8D2F8775FA254927F33DA6D
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_6.1.7601.17514_none_678566b7ddea04a5\msdelta.dll	--a---- 451584 bytes	[02:55 14/07/2009]	[02:55 14/07/2009] D9A5B279A8D2F8775FA254927F33DA6D
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_6.1.7601.17592_none_672ce6c3de2cb17f\msdelta.dll	--a---- 451584 bytes	[02:55 14/07/2009]	[02:55 14/07/2009] D9A5B279A8D2F8775FA254927F33DA6D
C:\Windows\winsxs\FileMaps\$$_media_delta_0f36d7d9b4f7293c.cdf-ms	--a---- 2436 bytes	[02:59 14/07/2009]	[05:32 14/07/2009] 0ED4291DC068EB860AC15A6E5360224C
C:\Windows\winsxs\Manifests\amd64_microsoft-windows-deltacompressionengine_31bf3856ad364e35_6.1.7600.16385_none_9c2159bf9f702069.manifest	--a---- 2888 bytes	[02:33 14/07/2009]	[02:21 14/07/2009] 6B7D6AD4FA771B7D532B7AD67D396853
C:\Windows\winsxs\Manifests\amd64_microsoft-windows-deltapackageexpander_31bf3856ad364e35_6.1.7601.17514_none_c8049b9e4ba7658c.manifest	--a---- 2461 bytes	[19:49 18/02/2011]	[14:21 20/11/2010] 8A388670A7B189FE5CE192B81E6F7401
C:\Windows\winsxs\Manifests\amd64_microsoft-windows-s..l-soundthemes-delta_31bf3856ad364e35_6.1.7600.16385_none_fbf7e0678b64a4b8.manifest	--a---- 27794 bytes	[02:17 14/07/2009]	[02:18 14/07/2009] 2D159244CBBD3875345AFDD9C34B444B
C:\Windows\winsxs\Manifests\x86_microsoft-windows-deltacompressionengine_31bf3856ad364e35_6.1.7600.16385_none_4002be3be712af33.manifest	--a---- 2886 bytes	[02:33 14/07/2009]	[01:54 14/07/2009] 110D843CC1C2B3A02A46D4AD962C04B6
C:\Windows\winsxs\Manifests\x86_microsoft-windows-deltapackageexpander_31bf3856ad364e35_6.1.7601.17514_none_6be6001a9349f456.manifest	--a---- 2459 bytes	[19:49 18/02/2011]	[13:10 20/11/2010] 771093D6028BE8C764993524B6392E70
C:\Windows\winsxs\Temp\PendingRenames\98286ebff4bace018c0a0000700dc016.$$_media_delta_0f36d7d9b4f7293c.cdf-ms	--a---- 2548 bytes	[20:12 26/09/2013]	[20:12 26/09/2013] 6A10DC98C12DDBCA7E312C2CF95F9BD8
C:\Windows\winsxs\Temp\PendingRenames\b1494f56f6bace011a2e0000700dc016.$$_media_delta_0f36d7d9b4f7293c.cdf-ms	--a---- 2436 bytes	[20:24 26/09/2013]	[20:24 26/09/2013] 2A0F4FD1EF0565E155C3639B7C3DABBA
C:\Windows\winsxs\Temp\PendingRenames\dbb87553f5bace01c5170000700dc016.$$_media_delta_0f36d7d9b4f7293c.cdf-ms	--a---- 2436 bytes	[20:16 26/09/2013]	[20:16 26/09/2013] AE7D52B1B930D399CC8D500C6FB1A25C
C:\Windows\winsxs\x86_microsoft-windows-deltacompressionengine_31bf3856ad364e35_6.1.7600.16385_none_4002be3be712af33\msdelta.dll	--a---- 305152 bytes	[23:12 13/07/2009]	[01:15 14/07/2009] 739E51268B4BB79AB4F9E55F0018D0BC
C:\Windows\winsxs\x86_microsoft-windows-servicingstack_31bf3856ad364e35_6.1.7600.16385_none_0935b76c289e0fd5\msdelta.dll	--a---- 305152 bytes	[02:43 14/07/2009]	[02:43 14/07/2009] 739E51268B4BB79AB4F9E55F0018D0BC
C:\Windows\winsxs\x86_microsoft-windows-servicingstack_31bf3856ad364e35_6.1.7601.17514_none_0b66cb34258c936f\msdelta.dll	--a---- 305152 bytes	[02:43 14/07/2009]	[02:43 14/07/2009] 739E51268B4BB79AB4F9E55F0018D0BC
C:\Windows\winsxs\x86_microsoft-windows-servicingstack_31bf3856ad364e35_6.1.7601.17592_none_0b0e4b4025cf4049\msdelta.dll	--a---- 305152 bytes	[02:43 14/07/2009]	[02:43 14/07/2009] 739E51268B4BB79AB4F9E55F0018D0BC

Searching for "*Lyrix*"
No files found.

========== regfind ==========

Searching for "Bonanza"
[HKEY_CURRENT_USER\Software\BonanzaDeals]
[HKEY_CURRENT_USER\Software\BonanzaDeals]
"ChromeCrxPath"="C:\Program Files (x86)\BonanzaDeals\BonanzaDeals.crx"
[HKEY_CURRENT_USER\Software\BonanzaDeals]
"FirefoxXpiPath"="C:\Program Files (x86)\BonanzaDeals\BonanzaDeals.xpi"
[HKEY_CURRENT_USER\Software\BonanzaDeals]
"IeDllPath"="C:\Program Files (x86)\BonanzaDeals\BonanzaDealsIE.dll"
[HKEY_CURRENT_USER\Software\BonanzaDeals]
"InstallDir"="C:\Program Files (x86)\BonanzaDeals"
[HKEY_CURRENT_USER\Software\BonanzaDealsLive]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\BonanzaDealsLive.exe]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{9EA8702C-EEDB-4731-BE68-E9A167DD3597}]
"LocalService"="bonanzadealslive"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{D34F391D-4CB7-467F-A543-F583857C63B0}]
"LocalService"="bonanzadealslivem"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BonanzaDealsLive.OneClickCtrl.9]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BonanzaDealsLive.OneClickCtrl.9]
@="BonanzaDealsLive Update Plugin"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BonanzaDealsLive.OneClickProcessLauncherMachine]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BonanzaDealsLive.OneClickProcessLauncherMachine]
@="BonanzaDealsLive.OneClickProcessLauncher"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BonanzaDealsLive.OneClickProcessLauncherMachine\CurVer]
@="BonanzaDealsLive.OneClickProcessLauncherMachine.1.0"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BonanzaDealsLive.OneClickProcessLauncherMachine.1.0]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BonanzaDealsLive.OneClickProcessLauncherMachine.1.0]
@="BonanzaDealsLive.OneClickProcessLauncher"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BonanzaDealsLive.Update3WebControl.3]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BonanzaDealsLive.Update3WebControl.3]
@="BonanzaDealsLive Update Plugin"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BonanzaDealsLiveUpdate.CoCreateAsync]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BonanzaDealsLiveUpdate.CoCreateAsync\CurVer]
@="BonanzaDealsLiveUpdate.CoCreateAsync.1.0"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BonanzaDealsLiveUpdate.CoCreateAsync.1.0]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BonanzaDealsLiveUpdate.CoreClass]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BonanzaDealsLiveUpdate.CoreClass]
@="BonanzaDealsLive Core Class"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BonanzaDealsLiveUpdate.CoreClass\CurVer]
@="BonanzaDealsLiveUpdate.CoreClass.1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BonanzaDealsLiveUpdate.CoreClass.1]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BonanzaDealsLiveUpdate.CoreClass.1]
@="BonanzaDealsLive Core Class"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BonanzaDealsLiveUpdate.CoreMachineClass]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BonanzaDealsLiveUpdate.CoreMachineClass]
@="BonanzaDealsLive Core Class"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BonanzaDealsLiveUpdate.CoreMachineClass\CurVer]
@="BonanzaDealsLiveUpdate.CoreMachineClass.1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BonanzaDealsLiveUpdate.CoreMachineClass.1]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BonanzaDealsLiveUpdate.CoreMachineClass.1]
@="BonanzaDealsLive Core Class"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BonanzaDealsLiveUpdate.CredentialDialogMachine]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BonanzaDealsLiveUpdate.CredentialDialogMachine\CurVer]
@="BonanzaDealsLiveUpdate.CredentialDialogMachine.1.0"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BonanzaDealsLiveUpdate.CredentialDialogMachine.1.0]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BonanzaDealsLiveUpdate.OnDemandCOMClassMachine]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BonanzaDealsLiveUpdate.OnDemandCOMClassMachine]
@="BonanzaDealsLive Broker Class Factory"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BonanzaDealsLiveUpdate.OnDemandCOMClassMachine\CurVer]
@="BonanzaDealsLiveUpdate.OnDemandCOMClassMachine.1.0"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BonanzaDealsLiveUpdate.OnDemandCOMClassMachine.1.0]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BonanzaDealsLiveUpdate.OnDemandCOMClassMachine.1.0]
@="BonanzaDealsLive Broker Class Factory"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BonanzaDealsLiveUpdate.OnDemandCOMClassMachineFallback]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BonanzaDealsLiveUpdate.OnDemandCOMClassMachineFallback]
@="BonanzaDealsLive Legacy On Demand"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BonanzaDealsLiveUpdate.OnDemandCOMClassMachineFallback\CurVer]
@="BonanzaDealsLiveUpdate.OnDemandCOMClassMachineFallback.1.0"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BonanzaDealsLiveUpdate.OnDemandCOMClassMachineFallback.1.0]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BonanzaDealsLiveUpdate.OnDemandCOMClassMachineFallback.1.0]
@="BonanzaDealsLive Legacy On Demand"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BonanzaDealsLiveUpdate.OnDemandCOMClassSvc]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BonanzaDealsLiveUpdate.OnDemandCOMClassSvc]
@="BonanzaDealsLive Legacy On Demand"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BonanzaDealsLiveUpdate.OnDemandCOMClassSvc\CurVer]
@="BonanzaDealsLiveUpdate.OnDemandCOMClassSvc.1.0"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BonanzaDealsLiveUpdate.OnDemandCOMClassSvc.1.0]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BonanzaDealsLiveUpdate.OnDemandCOMClassSvc.1.0]
@="BonanzaDealsLive Legacy On Demand"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BonanzaDealsLiveUpdate.ProcessLauncher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BonanzaDealsLiveUpdate.ProcessLauncher]
@="BonanzaDealsLive Process Launcher Class"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BonanzaDealsLiveUpdate.ProcessLauncher\CurVer]
@="BonanzaDealsLiveUpdate.ProcessLauncher.1.0"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BonanzaDealsLiveUpdate.ProcessLauncher.1.0]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BonanzaDealsLiveUpdate.ProcessLauncher.1.0]
@="BonanzaDealsLive Process Launcher Class"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BonanzaDealsLiveUpdate.Update3COMClassService]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BonanzaDealsLiveUpdate.Update3COMClassService\CurVer]
@="BonanzaDealsLiveUpdate.Update3COMClassService.1.0"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BonanzaDealsLiveUpdate.Update3COMClassService.1.0]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BonanzaDealsLiveUpdate.Update3WebMachine]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BonanzaDealsLiveUpdate.Update3WebMachine]
@="BonanzaDealsLive Broker Class Factory"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BonanzaDealsLiveUpdate.Update3WebMachine\CurVer]
@="BonanzaDealsLiveUpdate.Update3WebMachine.1.0"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BonanzaDealsLiveUpdate.Update3WebMachine.1.0]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BonanzaDealsLiveUpdate.Update3WebMachine.1.0]
@="BonanzaDealsLive Broker Class Factory"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BonanzaDealsLiveUpdate.Update3WebMachineFallback]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BonanzaDealsLiveUpdate.Update3WebMachineFallback\CurVer]
@="BonanzaDealsLiveUpdate.Update3WebMachineFallback.1.0"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BonanzaDealsLiveUpdate.Update3WebMachineFallback.1.0]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BonanzaDealsLiveUpdate.Update3WebSvc]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BonanzaDealsLiveUpdate.Update3WebSvc\CurVer]
@="BonanzaDealsLiveUpdate.Update3WebSvc.1.0"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BonanzaDealsLiveUpdate.Update3WebSvc.1.0]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{118E1BF6-6279-432F-A285-373A77B90C7A}\ProgID]
@="BonanzaDealsLiveUpdate.Update3WebSvc.1.0"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{118E1BF6-6279-432F-A285-373A77B90C7A}\VersionIndependentProgID]
@="BonanzaDealsLiveUpdate.Update3WebSvc"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{14CEEA2F-3D21-46ED-A7D2-89056C520E5E}]
@="BonanzaDealsLive Process Launcher Class"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{14CEEA2F-3D21-46ED-A7D2-89056C520E5E}\LocalServer32]
@=""C:\Program Files (x86)\BonanzaDealsLive\Update\1.3.23.0\BonanzaDealsLiveOnDemand.exe""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{14CEEA2F-3D21-46ED-A7D2-89056C520E5E}\ProgID]
@="BonanzaDealsLiveUpdate.ProcessLauncher.1.0"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{14CEEA2F-3D21-46ED-A7D2-89056C520E5E}\VersionIndependentProgID]
@="BonanzaDealsLiveUpdate.ProcessLauncher"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1CC8D970-F626-4F19-815F-890032BB6606}]
@="BonanzaDealsLive Broker Class Factory"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1CC8D970-F626-4F19-815F-890032BB6606}]
"LocalizedString"="@C:\Program Files (x86)\BonanzaDealsLive\Update\1.3.23.0\goopdate.dll,-3000"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1CC8D970-F626-4F19-815F-890032BB6606}\Elevation]
"IconReference"="@C:\Program Files (x86)\BonanzaDealsLive\Update\1.3.23.0\goopdate.dll,-1004"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1CC8D970-F626-4F19-815F-890032BB6606}\LocalServer32]
@=""C:\Program Files (x86)\BonanzaDealsLive\Update\1.3.23.0\BonanzaDealsLiveBroker.exe""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1CC8D970-F626-4F19-815F-890032BB6606}\ProgID]
@="BonanzaDealsLiveUpdate.Update3WebMachine.1.0"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1CC8D970-F626-4F19-815F-890032BB6606}\VersionIndependentProgID]
@="BonanzaDealsLiveUpdate.Update3WebMachine"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{29494049-211F-4F5C-8545-7DA8BF7A6CF8}]
@="BonanzaDealsLive Update Plugin"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{29494049-211F-4F5C-8545-7DA8BF7A6CF8}\InprocServer32]
@="C:\Program Files (x86)\BonanzaDealsLive\Update\1.3.23.0\npGoogleUpdate3.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{29494049-211F-4F5C-8545-7DA8BF7A6CF8}\ProgID]
@="BonanzaDealsLive.OneClickCtrl.9"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{33BAF587-9647-4281-A34F-F4830CDC1B9F}]
@="BonanzaDealsLive.OneClickProcessLauncher"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{33BAF587-9647-4281-A34F-F4830CDC1B9F}\LocalServer32]
@=""C:\Program Files (x86)\BonanzaDealsLive\Update\1.3.23.0\BonanzaDealsLiveBroker.exe""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{33BAF587-9647-4281-A34F-F4830CDC1B9F}\ProgID]
@="BonanzaDealsLive.OneClickProcessLauncherMachine.1.0"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{33BAF587-9647-4281-A34F-F4830CDC1B9F}\VersionIndependentProgID]
@="BonanzaDealsLive.OneClickProcessLauncherMachine"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5B5E5D0E-7C83-4A32-ADD2-E5F488DD6783}\InprocServer32]
@="C:\Program Files (x86)\BonanzaDealsLive\Update\1.3.23.0\psmachine.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6802463D-636F-41FE-9924-4CAD56906590}]
@="BonanzaDealsLive Broker Class Factory"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6802463D-636F-41FE-9924-4CAD56906590}]
"LocalizedString"="@C:\Program Files (x86)\BonanzaDealsLive\Update\1.3.23.0\goopdate.dll,-3000"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6802463D-636F-41FE-9924-4CAD56906590}\Elevation]
"IconReference"="@C:\Program Files (x86)\BonanzaDealsLive\Update\1.3.23.0\goopdate.dll,-1004"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6802463D-636F-41FE-9924-4CAD56906590}\LocalServer32]
@=""C:\Program Files (x86)\BonanzaDealsLive\Update\1.3.23.0\BonanzaDealsLiveBroker.exe""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6802463D-636F-41FE-9924-4CAD56906590}\ProgID]
@="BonanzaDealsLiveUpdate.OnDemandCOMClassMachine.1.0"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6802463D-636F-41FE-9924-4CAD56906590}\VersionIndependentProgID]
@="BonanzaDealsLiveUpdate.OnDemandCOMClassMachine"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{806785D0-375F-4C2C-92E3-B8EE65D28E83}\InprocHandler32]
@="C:\Program Files (x86)\BonanzaDealsLive\Update\1.3.23.0\psmachine.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{944661E7-67B9-4DF7-BFF2-05388C166D34}]
@="BonanzaDealsLive Core Class"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{944661E7-67B9-4DF7-BFF2-05388C166D34}]
"LocalizedString"="@C:\Program Files (x86)\BonanzaDealsLive\Update\1.3.23.0\goopdate.dll,-3000"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{944661E7-67B9-4DF7-BFF2-05388C166D34}\Elevation]
"IconReference"="@C:\Program Files (x86)\BonanzaDealsLive\Update\1.3.23.0\goopdate.dll,-1004"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{944661E7-67B9-4DF7-BFF2-05388C166D34}\LocalServer32]
@=""C:\Program Files (x86)\BonanzaDealsLive\Update\1.3.23.0\BonanzaDealsLiveOnDemand.exe""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{944661E7-67B9-4DF7-BFF2-05388C166D34}\ProgID]
@="BonanzaDealsLiveUpdate.CoreMachineClass.1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{944661E7-67B9-4DF7-BFF2-05388C166D34}\VersionIndependentProgID]
@="BonanzaDealsLiveUpdate.CoreMachineClass"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9EA8702C-EEDB-4731-BE68-E9A167DD3597}\ProgID]
@="BonanzaDealsLiveUpdate.Update3COMClassService.1.0"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9EA8702C-EEDB-4731-BE68-E9A167DD3597}\VersionIndependentProgID]
@="BonanzaDealsLiveUpdate.Update3COMClassService"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A7CF66EF-4F0D-46B1-AF71-A500378D6C34}]
@="BonanzaDealsLive Core Class"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A7CF66EF-4F0D-46B1-AF71-A500378D6C34}\ProgID]
@="BonanzaDealsLiveUpdate.CoreClass.1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A7CF66EF-4F0D-46B1-AF71-A500378D6C34}\VersionIndependentProgID]
@="BonanzaDealsLiveUpdate.CoreClass"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B71934E5-6B93-448D-9D32-CBAA5150C5D8}]
@="BonanzaDealsLive Legacy On Demand"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B71934E5-6B93-448D-9D32-CBAA5150C5D8}]
"LocalizedString"="@C:\Program Files (x86)\BonanzaDealsLive\Update\1.3.23.0\goopdate.dll,-3000"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B71934E5-6B93-448D-9D32-CBAA5150C5D8}\Elevation]
"IconReference"="@C:\Program Files (x86)\BonanzaDealsLive\Update\1.3.23.0\goopdate.dll,-1004"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B71934E5-6B93-448D-9D32-CBAA5150C5D8}\LocalServer32]
@=""C:\Program Files (x86)\BonanzaDealsLive\Update\1.3.23.0\BonanzaDealsLiveOnDemand.exe""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B71934E5-6B93-448D-9D32-CBAA5150C5D8}\ProgID]
@="BonanzaDealsLiveUpdate.OnDemandCOMClassMachineFallback.1.0"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B71934E5-6B93-448D-9D32-CBAA5150C5D8}\VersionIndependentProgID]
@="BonanzaDealsLiveUpdate.OnDemandCOMClassMachineFallback"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C4BEF720-313C-420A-ACF6-77DD95D8F553}]
@="BonanzaDealsLive Update Plugin"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C4BEF720-313C-420A-ACF6-77DD95D8F553}\InprocServer32]
@="C:\Program Files (x86)\BonanzaDealsLive\Update\1.3.23.0\npGoogleUpdate3.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C4BEF720-313C-420A-ACF6-77DD95D8F553}\ProgID]
@="BonanzaDealsLive.Update3WebControl.3"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D34F391D-4CB7-467F-A543-F583857C63B0}]
@="BonanzaDealsLive Legacy On Demand"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D34F391D-4CB7-467F-A543-F583857C63B0}\ProgID]
@="BonanzaDealsLiveUpdate.OnDemandCOMClassSvc.1.0"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D34F391D-4CB7-467F-A543-F583857C63B0}\VersionIndependentProgID]
@="BonanzaDealsLiveUpdate.OnDemandCOMClassSvc"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E970727E-0508-4BEB-8B72-BBA9D0D047C7}\LocalServer32]
@=""C:\Program Files (x86)\BonanzaDealsLive\Update\1.3.23.0\BonanzaDealsLiveBroker.exe""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E970727E-0508-4BEB-8B72-BBA9D0D047C7}\ProgID]
@="BonanzaDealsLiveUpdate.CoCreateAsync.1.0"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E970727E-0508-4BEB-8B72-BBA9D0D047C7}\VersionIndependentProgID]
@="BonanzaDealsLiveUpdate.CoCreateAsync"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EBF1F869-D2F0-4D31-A877-386C853A9C3D}\LocalServer32]
@=""C:\Program Files (x86)\BonanzaDealsLive\Update\1.3.23.0\BonanzaDealsLiveOnDemand.exe""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EBF1F869-D2F0-4D31-A877-386C853A9C3D}\ProgID]
@="BonanzaDealsLiveUpdate.CredentialDialogMachine.1.0"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EBF1F869-D2F0-4D31-A877-386C853A9C3D}\VersionIndependentProgID]
@="BonanzaDealsLiveUpdate.CredentialDialogMachine"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F3CF4912-CF0A-451B-AF3B-C4F216C715E4}\InProcServer32]
@="C:\Program Files (x86)\BonanzaDealsLive\Update\1.3.23.0\psmachine.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F904AC50-215C-42AB-A532-77E9FDBA9B19}]
"LocalizedString"="@C:\Program Files (x86)\BonanzaDealsLive\Update\1.3.23.0\goopdate.dll,-3000"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F904AC50-215C-42AB-A532-77E9FDBA9B19}\Elevation]
"IconReference"="@C:\Program Files (x86)\BonanzaDealsLive\Update\1.3.23.0\goopdate.dll,-1004"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F904AC50-215C-42AB-A532-77E9FDBA9B19}\LocalServer32]
@=""C:\Program Files (x86)\BonanzaDealsLive\Update\1.3.23.0\BonanzaDealsLiveOnDemand.exe""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F904AC50-215C-42AB-A532-77E9FDBA9B19}\ProgID]
@="BonanzaDealsLiveUpdate.Update3WebMachineFallback.1.0"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F904AC50-215C-42AB-A532-77E9FDBA9B19}\VersionIndependentProgID]
@="BonanzaDealsLiveUpdate.Update3WebMachineFallback"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{fe063412-bea4-4d76-8ed3-183be6220d17}]
@="BonanzaDeals"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{fe063412-bea4-4d76-8ed3-183be6220d17}\InProcServer32]
@="C:\Program Files (x86)\BonanzaDeals\BonanzaDealsIE.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\AppID\BonanzaDealsLive.exe]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\AppID\{9EA8702C-EEDB-4731-BE68-E9A167DD3597}]
"LocalService"="bonanzadealslive"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\AppID\{D34F391D-4CB7-467F-A543-F583857C63B0}]
"LocalService"="bonanzadealslivem"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BonanzaDealsLive.exe]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{03ED4D0A-8A5D-44D8-B138-76361CF10ED5}]
"Path"="\BonanzaDealsLiveUpdateTaskMachineUA"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3B7AEAB6-89D4-47B4-B5CC-F6376D0EE9FD}]
"Path"="\BonanzaDealsUpdate"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{E84C5C76-3C84-4E7A-9DDF-9EAE8F9BBFF7}]
"Path"="\BonanzaDealsLiveUpdateTaskMachineCore"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\BonanzaDealsLiveUpdateTaskMachineCore]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\BonanzaDealsLiveUpdateTaskMachineUA]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\BonanzaDealsUpdate]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\BonanzaDeals]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\BonanzaDeals]
"ChromeCrxPath"="C:\Program Files (x86)\BonanzaDeals\BonanzaDeals.crx"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\BonanzaDeals]
"FirefoxXpiPath"="C:\Program Files (x86)\BonanzaDeals\BonanzaDeals.xpi"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\BonanzaDeals]
"IeDllPath"="C:\Program Files (x86)\BonanzaDeals\BonanzaDealsIE.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\BonanzaDeals]
"InstallDir"="C:\Program Files (x86)\BonanzaDeals"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\BonanzaDealsLive]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\BonanzaDealsLive\Update]
"path"="C:\Program Files (x86)\BonanzaDealsLive\Update\BonanzaDealsLive.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\BonanzaDealsLive\Update\Clients\{ee4e7754-146b-4473-99c9-11ce63619686}]
"name"="BonanzaDealsLive"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{29494049-211F-4F5C-8545-7DA8BF7A6CF8}]
"AppName"="BonanzaDealsLive.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{29494049-211F-4F5C-8545-7DA8BF7A6CF8}]
"AppPath"="C:\Program Files (x86)\BonanzaDealsLive\Update"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C4BEF720-313C-420A-ACF6-77DD95D8F553}]
"AppName"="BonanzaDealsLiveBroker.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C4BEF720-313C-420A-ACF6-77DD95D8F553}]
"AppPath"="C:\Program Files (x86)\BonanzaDealsLive\Update\1.3.23.0"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Bonanza Deals]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Bonanza Deals]
"DisplayName"="Bonanza Deals (remove only)"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Bonanza Deals]
"UninstallString"=""C:\Program Files (x86)\BonanzaDeals\uninst.exe" /uninstall"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Bonanza Deals]
"Publisher"="Bonanza Deals"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Bonanza Deals]
"DisplayIcon"="C:\Program Files (x86)\BonanzaDeals\uninst.exe,0"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Bonanza Deals]
"URLInfoAbout"="hxxp://support.bonanzadeals.net/"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Bonanza Deals]
"HelpLink"="hxxp://www.bonanzadeals.net/"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BonanzaDealsLive.exe]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@tools.bdupdater.com/BonanzaDealsLive Update;version=3]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@tools.bdupdater.com/BonanzaDealsLive Update;version=3]
"Path"="C:\Program Files (x86)\BonanzaDealsLive\Update\1.3.23.0\npGoogleUpdate3.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@tools.bdupdater.com/BonanzaDealsLive Update;version=3]
"Description"="BonanzaDealsLive Update"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@tools.bdupdater.com/BonanzaDealsLive Update;version=3]
"ProductName"="BonanzaDealsLive Update"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@tools.bdupdater.com/BonanzaDealsLive Update;version=3]
"Vendor"="BonanzaDeals"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@tools.bdupdater.com/BonanzaDealsLive Update;version=9]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@tools.bdupdater.com/BonanzaDealsLive Update;version=9]
"Path"="C:\Program Files (x86)\BonanzaDealsLive\Update\1.3.23.0\npGoogleUpdate3.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@tools.bdupdater.com/BonanzaDealsLive Update;version=9]
"Description"="BonanzaDealsLive Update"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@tools.bdupdater.com/BonanzaDealsLive Update;version=9]
"ProductName"="BonanzaDealsLive Update"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@tools.bdupdater.com/BonanzaDealsLive Update;version=9]
"Vendor"="BonanzaDeals"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{118E1BF6-6279-432F-A285-373A77B90C7A}\ProgID]
@="BonanzaDealsLiveUpdate.Update3WebSvc.1.0"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{118E1BF6-6279-432F-A285-373A77B90C7A}\VersionIndependentProgID]
@="BonanzaDealsLiveUpdate.Update3WebSvc"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{14CEEA2F-3D21-46ED-A7D2-89056C520E5E}]
@="BonanzaDealsLive Process Launcher Class"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{14CEEA2F-3D21-46ED-A7D2-89056C520E5E}\LocalServer32]
@=""C:\Program Files (x86)\BonanzaDealsLive\Update\1.3.23.0\BonanzaDealsLiveOnDemand.exe""
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{14CEEA2F-3D21-46ED-A7D2-89056C520E5E}\ProgID]
@="BonanzaDealsLiveUpdate.ProcessLauncher.1.0"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{14CEEA2F-3D21-46ED-A7D2-89056C520E5E}\VersionIndependentProgID]
@="BonanzaDealsLiveUpdate.ProcessLauncher"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{1CC8D970-F626-4F19-815F-890032BB6606}]
@="BonanzaDealsLive Broker Class Factory"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{1CC8D970-F626-4F19-815F-890032BB6606}]
"LocalizedString"="@C:\Program Files (x86)\BonanzaDealsLive\Update\1.3.23.0\goopdate.dll,-3000"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{1CC8D970-F626-4F19-815F-890032BB6606}\Elevation]
"IconReference"="@C:\Program Files (x86)\BonanzaDealsLive\Update\1.3.23.0\goopdate.dll,-1004"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{1CC8D970-F626-4F19-815F-890032BB6606}\LocalServer32]
@=""C:\Program Files (x86)\BonanzaDealsLive\Update\1.3.23.0\BonanzaDealsLiveBroker.exe""
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{1CC8D970-F626-4F19-815F-890032BB6606}\ProgID]
@="BonanzaDealsLiveUpdate.Update3WebMachine.1.0"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{1CC8D970-F626-4F19-815F-890032BB6606}\VersionIndependentProgID]
@="BonanzaDealsLiveUpdate.Update3WebMachine"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{29494049-211F-4F5C-8545-7DA8BF7A6CF8}]
@="BonanzaDealsLive Update Plugin"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{29494049-211F-4F5C-8545-7DA8BF7A6CF8}\InprocServer32]
@="C:\Program Files (x86)\BonanzaDealsLive\Update\1.3.23.0\npGoogleUpdate3.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{29494049-211F-4F5C-8545-7DA8BF7A6CF8}\ProgID]
@="BonanzaDealsLive.OneClickCtrl.9"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{33BAF587-9647-4281-A34F-F4830CDC1B9F}]
@="BonanzaDealsLive.OneClickProcessLauncher"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{33BAF587-9647-4281-A34F-F4830CDC1B9F}\LocalServer32]
@=""C:\Program Files (x86)\BonanzaDealsLive\Update\1.3.23.0\BonanzaDealsLiveBroker.exe""
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{33BAF587-9647-4281-A34F-F4830CDC1B9F}\ProgID]
@="BonanzaDealsLive.OneClickProcessLauncherMachine.1.0"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{33BAF587-9647-4281-A34F-F4830CDC1B9F}\VersionIndependentProgID]
@="BonanzaDealsLive.OneClickProcessLauncherMachine"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{5B5E5D0E-7C83-4A32-ADD2-E5F488DD6783}\InprocServer32]
@="C:\Program Files (x86)\BonanzaDealsLive\Update\1.3.23.0\psmachine.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{6802463D-636F-41FE-9924-4CAD56906590}]
@="BonanzaDealsLive Broker Class Factory"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{6802463D-636F-41FE-9924-4CAD56906590}]
"LocalizedString"="@C:\Program Files (x86)\BonanzaDealsLive\Update\1.3.23.0\goopdate.dll,-3000"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{6802463D-636F-41FE-9924-4CAD56906590}\Elevation]
"IconReference"="@C:\Program Files (x86)\BonanzaDealsLive\Update\1.3.23.0\goopdate.dll,-1004"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{6802463D-636F-41FE-9924-4CAD56906590}\LocalServer32]
@=""C:\Program Files (x86)\BonanzaDealsLive\Update\1.3.23.0\BonanzaDealsLiveBroker.exe""
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{6802463D-636F-41FE-9924-4CAD56906590}\ProgID]
@="BonanzaDealsLiveUpdate.OnDemandCOMClassMachine.1.0"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{6802463D-636F-41FE-9924-4CAD56906590}\VersionIndependentProgID]
@="BonanzaDealsLiveUpdate.OnDemandCOMClassMachine"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{806785D0-375F-4C2C-92E3-B8EE65D28E83}\InprocHandler32]
@="C:\Program Files (x86)\BonanzaDealsLive\Update\1.3.23.0\psmachine.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{944661E7-67B9-4DF7-BFF2-05388C166D34}]
@="BonanzaDealsLive Core Class"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{944661E7-67B9-4DF7-BFF2-05388C166D34}]
"LocalizedString"="@C:\Program Files (x86)\BonanzaDealsLive\Update\1.3.23.0\goopdate.dll,-3000"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{944661E7-67B9-4DF7-BFF2-05388C166D34}\Elevation]
"IconReference"="@C:\Program Files (x86)\BonanzaDealsLive\Update\1.3.23.0\goopdate.dll,-1004"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{944661E7-67B9-4DF7-BFF2-05388C166D34}\LocalServer32]
@=""C:\Program Files (x86)\BonanzaDealsLive\Update\1.3.23.0\BonanzaDealsLiveOnDemand.exe""
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{944661E7-67B9-4DF7-BFF2-05388C166D34}\ProgID]
@="BonanzaDealsLiveUpdate.CoreMachineClass.1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{944661E7-67B9-4DF7-BFF2-05388C166D34}\VersionIndependentProgID]
@="BonanzaDealsLiveUpdate.CoreMachineClass"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{9EA8702C-EEDB-4731-BE68-E9A167DD3597}\ProgID]
@="BonanzaDealsLiveUpdate.Update3COMClassService.1.0"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{9EA8702C-EEDB-4731-BE68-E9A167DD3597}\VersionIndependentProgID]
@="BonanzaDealsLiveUpdate.Update3COMClassService"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{A7CF66EF-4F0D-46B1-AF71-A500378D6C34}]
@="BonanzaDealsLive Core Class"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{A7CF66EF-4F0D-46B1-AF71-A500378D6C34}\ProgID]
@="BonanzaDealsLiveUpdate.CoreClass.1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{A7CF66EF-4F0D-46B1-AF71-A500378D6C34}\VersionIndependentProgID]
@="BonanzaDealsLiveUpdate.CoreClass"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{B71934E5-6B93-448D-9D32-CBAA5150C5D8}]
@="BonanzaDealsLive Legacy On Demand"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{B71934E5-6B93-448D-9D32-CBAA5150C5D8}]
"LocalizedString"="@C:\Program Files (x86)\BonanzaDealsLive\Update\1.3.23.0\goopdate.dll,-3000"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{B71934E5-6B93-448D-9D32-CBAA5150C5D8}\Elevation]
"IconReference"="@C:\Program Files (x86)\BonanzaDealsLive\Update\1.3.23.0\goopdate.dll,-1004"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{B71934E5-6B93-448D-9D32-CBAA5150C5D8}\LocalServer32]
@=""C:\Program Files (x86)\BonanzaDealsLive\Update\1.3.23.0\BonanzaDealsLiveOnDemand.exe""
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{B71934E5-6B93-448D-9D32-CBAA5150C5D8}\ProgID]
@="BonanzaDealsLiveUpdate.OnDemandCOMClassMachineFallback.1.0"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{B71934E5-6B93-448D-9D32-CBAA5150C5D8}\VersionIndependentProgID]
@="BonanzaDealsLiveUpdate.OnDemandCOMClassMachineFallback"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{C4BEF720-313C-420A-ACF6-77DD95D8F553}]
@="BonanzaDealsLive Update Plugin"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{C4BEF720-313C-420A-ACF6-77DD95D8F553}\InprocServer32]
@="C:\Program Files (x86)\BonanzaDealsLive\Update\1.3.23.0\npGoogleUpdate3.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{C4BEF720-313C-420A-ACF6-77DD95D8F553}\ProgID]
@="BonanzaDealsLive.Update3WebControl.3"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{D34F391D-4CB7-467F-A543-F583857C63B0}]
@="BonanzaDealsLive Legacy On Demand"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{D34F391D-4CB7-467F-A543-F583857C63B0}\ProgID]
@="BonanzaDealsLiveUpdate.OnDemandCOMClassSvc.1.0"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{D34F391D-4CB7-467F-A543-F583857C63B0}\VersionIndependentProgID]
@="BonanzaDealsLiveUpdate.OnDemandCOMClassSvc"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{E970727E-0508-4BEB-8B72-BBA9D0D047C7}\LocalServer32]
@=""C:\Program Files (x86)\BonanzaDealsLive\Update\1.3.23.0\BonanzaDealsLiveBroker.exe""
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{E970727E-0508-4BEB-8B72-BBA9D0D047C7}\ProgID]
@="BonanzaDealsLiveUpdate.CoCreateAsync.1.0"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{E970727E-0508-4BEB-8B72-BBA9D0D047C7}\VersionIndependentProgID]
@="BonanzaDealsLiveUpdate.CoCreateAsync"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{EBF1F869-D2F0-4D31-A877-386C853A9C3D}\LocalServer32]
@=""C:\Program Files (x86)\BonanzaDealsLive\Update\1.3.23.0\BonanzaDealsLiveOnDemand.exe""
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{EBF1F869-D2F0-4D31-A877-386C853A9C3D}\ProgID]
@="BonanzaDealsLiveUpdate.CredentialDialogMachine.1.0"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{EBF1F869-D2F0-4D31-A877-386C853A9C3D}\VersionIndependentProgID]
@="BonanzaDealsLiveUpdate.CredentialDialogMachine"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{F3CF4912-CF0A-451B-AF3B-C4F216C715E4}\InProcServer32]
@="C:\Program Files (x86)\BonanzaDealsLive\Update\1.3.23.0\psmachine.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{F904AC50-215C-42AB-A532-77E9FDBA9B19}]
"LocalizedString"="@C:\Program Files (x86)\BonanzaDealsLive\Update\1.3.23.0\goopdate.dll,-3000"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{F904AC50-215C-42AB-A532-77E9FDBA9B19}\Elevation]
"IconReference"="@C:\Program Files (x86)\BonanzaDealsLive\Update\1.3.23.0\goopdate.dll,-1004"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{F904AC50-215C-42AB-A532-77E9FDBA9B19}\LocalServer32]
@=""C:\Program Files (x86)\BonanzaDealsLive\Update\1.3.23.0\BonanzaDealsLiveOnDemand.exe""
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{F904AC50-215C-42AB-A532-77E9FDBA9B19}\ProgID]
@="BonanzaDealsLiveUpdate.Update3WebMachineFallback.1.0"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{F904AC50-215C-42AB-A532-77E9FDBA9B19}\VersionIndependentProgID]
@="BonanzaDealsLiveUpdate.Update3WebMachineFallback"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{fe063412-bea4-4d76-8ed3-183be6220d17}]
@="BonanzaDeals"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{fe063412-bea4-4d76-8ed3-183be6220d17}\InProcServer32]
@="C:\Program Files (x86)\BonanzaDeals\BonanzaDealsIE.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\AppID\BonanzaDealsLive.exe]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\AppID\{9EA8702C-EEDB-4731-BE68-E9A167DD3597}]
"LocalService"="bonanzadealslive"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\AppID\{D34F391D-4CB7-467F-A543-F583857C63B0}]
"LocalService"="bonanzadealslivem"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\bonanzadealslive]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\bonanzadealslive]
"ImagePath"="C:\Program Files (x86)\BonanzaDealsLive\Update\BonanzaDealsLive.exe /svc"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\bonanzadealslive]
"DisplayName"="BonanzaDealsLive-Dienst (bonanzadealslive)"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\bonanzadealslivem]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\bonanzadealslivem]
"ImagePath"="C:\Program Files (x86)\BonanzaDealsLive\Update\BonanzaDealsLive.exe /medsvc"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\bonanzadealslivem]
"DisplayName"="BonanzaDealsLive-Dienst (bonanzadealslivem)"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\bonanzadealslive]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\bonanzadealslive]
"ImagePath"="C:\Program Files (x86)\BonanzaDealsLive\Update\BonanzaDealsLive.exe /svc"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\bonanzadealslive]
"DisplayName"="BonanzaDealsLive-Dienst (bonanzadealslive)"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\bonanzadealslivem]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\bonanzadealslivem]
"ImagePath"="C:\Program Files (x86)\BonanzaDealsLive\Update\BonanzaDealsLive.exe /medsvc"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\bonanzadealslivem]
"DisplayName"="BonanzaDealsLive-Dienst (bonanzadealslivem)"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\bonanzadealslive]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\bonanzadealslive]
"ImagePath"="C:\Program Files (x86)\BonanzaDealsLive\Update\BonanzaDealsLive.exe /svc"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\bonanzadealslive]
"DisplayName"="BonanzaDealsLive-Dienst (bonanzadealslive)"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\bonanzadealslivem]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\bonanzadealslivem]
"ImagePath"="C:\Program Files (x86)\BonanzaDealsLive\Update\BonanzaDealsLive.exe /medsvc"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\bonanzadealslivem]
"DisplayName"="BonanzaDealsLive-Dienst (bonanzadealslivem)"
[HKEY_USERS\S-1-5-21-2905741483-1569714287-2078003378-1001\Software\BonanzaDeals]
[HKEY_USERS\S-1-5-21-2905741483-1569714287-2078003378-1001\Software\BonanzaDeals]
"ChromeCrxPath"="C:\Program Files (x86)\BonanzaDeals\BonanzaDeals.crx"
[HKEY_USERS\S-1-5-21-2905741483-1569714287-2078003378-1001\Software\BonanzaDeals]
"FirefoxXpiPath"="C:\Program Files (x86)\BonanzaDeals\BonanzaDeals.xpi"
[HKEY_USERS\S-1-5-21-2905741483-1569714287-2078003378-1001\Software\BonanzaDeals]
"IeDllPath"="C:\Program Files (x86)\BonanzaDeals\BonanzaDealsIE.dll"
[HKEY_USERS\S-1-5-21-2905741483-1569714287-2078003378-1001\Software\BonanzaDeals]
"InstallDir"="C:\Program Files (x86)\BonanzaDeals"
[HKEY_USERS\S-1-5-21-2905741483-1569714287-2078003378-1001\Software\BonanzaDealsLive]

Searching for "delta"
[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\.Default\.Default\Delta]
[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\.Default\.Default\Delta]
@="C:\Windows\Media\Delta\Windows Ding.wav"
[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\.Default\ChangeTheme\Delta]
[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\.Default\ChangeTheme\Delta]
@="C:\Windows\Media\Delta\Windows Logon Sound.wav"
[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\.Default\CriticalBatteryAlarm\Delta]
[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\.Default\CriticalBatteryAlarm\Delta]
@="C:\Windows\Media\Delta\Windows Battery Critical.wav"
[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\.Default\DeviceConnect\Delta]
[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\.Default\DeviceConnect\Delta]
@="C:\Windows\Media\Delta\Windows Hardware Insert.wav"
[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\.Default\DeviceDisconnect\Delta]
[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\.Default\DeviceDisconnect\Delta]
@="C:\Windows\Media\Delta\Windows Hardware Remove.wav"
[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\.Default\DeviceFail\Delta]
[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\.Default\DeviceFail\Delta]
@="C:\Windows\Media\Delta\Windows Hardware Fail.wav"
[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\.Default\FaxBeep\Delta]
[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\.Default\FaxBeep\Delta]
@="C:\Windows\Media\Delta\Windows Notify.wav"
[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\.Default\LowBatteryAlarm\Delta]
[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\.Default\LowBatteryAlarm\Delta]
@="C:\Windows\Media\Delta\Windows Battery Low.wav"
[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\.Default\MailBeep\Delta]
[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\.Default\MailBeep\Delta]
@="C:\Windows\Media\Delta\Windows Notify.wav"
[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\.Default\PrintComplete\Delta]
[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\.Default\PrintComplete\Delta]
@="C:\Windows\Media\Delta\Windows Print complete.wav"
[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\.Default\SystemAsterisk\Delta]
[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\.Default\SystemAsterisk\Delta]
@="C:\Windows\Media\Delta\Windows Error.wav"
[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\.Default\SystemExclamation\Delta]
[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\.Default\SystemExclamation\Delta]
@="C:\Windows\Media\Delta\Windows Exclamation.wav"
[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\.Default\SystemExit\Delta]
[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\.Default\SystemHand\Delta]
[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\.Default\SystemHand\Delta]
@="C:\Windows\Media\Delta\Windows Critical Stop.wav"
[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\.Default\SystemNotification\Delta]
[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\.Default\SystemNotification\Delta]
@="C:\Windows\Media\Delta\Windows Balloon.wav"
[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\.Default\WindowsLogoff\Delta]
[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\.Default\WindowsLogoff\Delta]
@="C:\Windows\Media\Delta\Windows Logoff Sound.wav"
[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\.Default\WindowsLogon\Delta]
[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\.Default\WindowsLogon\Delta]
@="C:\Windows\Media\Delta\Windows Logon Sound.wav"
[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\.Default\WindowsUAC\Delta]
[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\.Default\WindowsUAC\Delta]
@="C:\Windows\Media\Delta\Windows User Account Control.wav"
[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\Explorer\BlockedPopup\Delta]
[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\Explorer\BlockedPopup\Delta]
@="C:\Windows\Media\Delta\Windows Pop-up Blocked.wav"
[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\Explorer\EmptyRecycleBin\Delta]
[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\Explorer\FaxError\Delta]
[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\Explorer\FaxLineRings\Delta]
[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\Explorer\FaxSent\Delta]
[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\Explorer\FeedDiscovered\Delta]
[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\Explorer\FeedDiscovered\Delta]
@="C:\Windows\Media\Delta\Windows Feed Discovered.wav"
[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\Explorer\Navigating\Delta]
[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\Explorer\Navigating\Delta]
@="C:\Windows\Media\Delta\Windows Navigation Start.wav"
[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\Explorer\SecurityBand\Delta]
[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\Explorer\SecurityBand\Delta]
@="C:\Windows\Media\Delta\Windows Information Bar.wav"
[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\sapisvr\DisNumbersSound\Delta]
[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\sapisvr\HubOffSound\Delta]
[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\sapisvr\HubOnSound\Delta]
[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\sapisvr\HubSleepSound\Delta]
[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\sapisvr\MisrecoSound\Delta]
[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\sapisvr\PanelSound\Delta]
[HKEY_CURRENT_USER\AppEvents\Schemes\Names\Delta]
[HKEY_CURRENT_USER\Software\BabSolution\Updater\Instances\Delta Chrome Toolbar]
[HKEY_CURRENT_USER\Software\BabSolution\Updater\Instances\Delta Chrome Toolbar]
"UninstKey"="Delta Chrome Toolbar"
[HKEY_CURRENT_USER\Software\BabSolution\Updater\Instances\delta toolbar]
[HKEY_CURRENT_USER\Software\Delta]
[HKEY_CURRENT_USER\Software\Delta\delta]
[HKEY_CURRENT_USER\Software\Delta\delta\iestrg]
"prdct"="delta"
[HKEY_CURRENT_USER\Software\Delta\delta\iestrg]
"prtnrid"="delta"
[HKEY_CURRENT_USER\Software\Microsoft\Windows Media\WMSDK\Namespace]
"LocalDelta"="C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNSD.XML"
[HKEY_CURRENT_USER\Software\Microsoft\Windows Media\WMSDK\Namespace]
"RemoteDelta"="C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNSR.XML"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*]
"ContentViewModeLayoutPatternForBrowse"="delta"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*]
"ContentViewModeLayoutPatternForSearch"="delta"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}\Instl\Data]
"dsFFX"="Delta Search"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}\Instl\Data]
"uninstaller"="C:\Program Files (x86)\Delta\delta\1.8.24.6\uninstall.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\delta.deltaappCore]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\delta.deltaappCore\CurVer]
@="delta.deltaappCore.1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\delta.deltaappCore.1]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\delta.deltadskBnd]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\delta.deltadskBnd\CurVer]
@="delta.deltadskBnd.1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\delta.deltadskBnd.1]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\delta.deltaHlpr]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\delta.deltaHlpr\CurVer]
@="delta.deltaHlpr.1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\delta.deltaHlpr.1]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive]
"ContentViewModeLayoutPatternForBrowse"="delta"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\esrv.deltaESrvc]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\esrv.deltaESrvc\CurVer]
@="esrv.deltaESrvc.1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\esrv.deltaESrvc.1]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder]
"ContentViewModeLayoutPatternForBrowse"="delta"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Kind.Document]
"ContentViewModeLayoutPatternForBrowse"="delta"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Kind.Email]
"ContentViewModeLayoutPatternForBrowse"="delta"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Kind.Music]
"ContentViewModeLayoutPatternForBrowse"="delta"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Kind.Music]
"ContentViewModeLayoutPatternForSearch"="delta"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Kind.Picture]
"ContentViewModeLayoutPatternForBrowse"="delta"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Kind.Picture]
"ContentViewModeLayoutPatternForSearch"="delta"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Kind.Video]
"ContentViewModeLayoutPatternForBrowse"="delta"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Kind.Video]
"ContentViewModeLayoutPatternForSearch"="delta"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MAPI/IPM.Appointment]
"ContentViewModeLayoutPatternForBrowse"="delta"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MAPI/IPM.Appointment]
"ContentViewModeLayoutPatternForSearch"="delta"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MAPI/IPM.Contact]
"ContentViewModeLayoutPatternForBrowse"="delta"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MAPI/IPM.Contact]
"ContentViewModeLayoutPatternForSearch"="delta"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MAPI/IPM.Schedule.Meeting]
"ContentViewModeLayoutPatternForBrowse"="delta"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MAPI/IPM.Schedule.Meeting]
"ContentViewModeLayoutPatternForSearch"="delta"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Record\{8F6D68FF-81A4-3F8A-AD32-8E8DDDA7FC41}\2.0.0.0]
"Class"="System.Diagnostics.SymbolStore.SymbolLineDelta"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Record\{8F6D68FF-81A4-3F8A-AD32-8E8DDDA7FC41}\4.0.0.0]
"Class"="System.Diagnostics.SymbolStore.SymbolLineDelta"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.msg]
"ContentViewModeLayoutPatternForBrowse"="delta"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.msg]
"ContentViewModeLayoutPatternForSearch"="delta"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{39CB8175-E224-4446-8746-00566302DF8D}\1.0\0\win32]
@="C:\Program Files (x86)\Delta\delta\1.8.24.6\deltasrv.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{39CB8175-E224-4446-8746-00566302DF8D}\1.0\HELPDIR]
@="C:\Program Files (x86)\Delta\delta\1.8.24.6"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{4599D05A-D545-4069-BB42-5895B4EAE05B}\1.0]
@="deltaCmn 1.0 Type Library"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{4599D05A-D545-4069-BB42-5895B4EAE05B}\1.0\0\win32]
@="C:\Program Files (x86)\Delta\delta\1.8.24.6\deltaEng.dll\2"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{4599D05A-D545-4069-BB42-5895B4EAE05B}\1.0\HELPDIR]
@="C:\Program Files (x86)\Delta\delta\1.8.24.6"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}\1.0\0\win32]
@="C:\Program Files (x86)\Delta\delta\1.8.24.6\deltaTlbr.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}\1.0\HELPDIR]
@="C:\Program Files (x86)\Delta\delta\1.8.24.6"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}\1.0\0\win32]
@="C:\Program Files (x86)\Delta\delta\1.8.24.6\deltaApp.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}\1.0\HELPDIR]
@="C:\Program Files (x86)\Delta\delta\1.8.24.6"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{261DD098-8A3E-43D4-87AA-63324FA897D8}\LocalServer32]
@=""C:\Program Files (x86)\Delta\delta\1.8.24.6\deltasrv.exe""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{261DD098-8A3E-43D4-87AA-63324FA897D8}\ProgID]
@="esrv.deltaESrvc.1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{261DD098-8A3E-43D4-87AA-63324FA897D8}\VersionIndependentProgID]
@="esrv.deltaESrvc"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4FCB4630-2A1C-4AA1-B422-345E8DC8A6DE}\InprocServer32]
@="C:\Program Files (x86)\Delta\delta\1.8.24.6\bh\delta.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{82E1477C-B154-48D3-9891-33D83C26BCD3}]
@="Delta Toolbar"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{82E1477C-B154-48D3-9891-33D83C26BCD3}\InprocServer32]
@="C:\Program Files (x86)\Delta\delta\1.8.24.6\deltaTlbr.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{82E1477C-B154-48D3-9891-33D83C26BCD3}\ProgID]
@="delta.deltadskBnd.1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{82E1477C-B154-48D3-9891-33D83C26BCD3}\VersionIndependentProgID]
@="delta.deltadskBnd"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{86838207-681D-469D-9511-D0DCC6F19F9B}\InprocServer32]
@="C:\Program Files (x86)\Delta\delta\1.8.24.6\deltaEng.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C1AF5FA5-852C-4C90-812E-A7F75E011D87}]
@="delta Helper Object"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C1AF5FA5-852C-4C90-812E-A7F75E011D87}\InprocServer32]
@="C:\Program Files (x86)\Delta\delta\1.8.24.6\bh\delta.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C1AF5FA5-852C-4C90-812E-A7F75E011D87}\ProgID]
@="delta.deltaHlpr.1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C1AF5FA5-852C-4C90-812E-A7F75E011D87}\VersionIndependentProgID]
@="delta.deltaHlpr"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E97A663B-81A6-49C5-A6D3-BCB05BA1DE26}\InprocServer32]
@="C:\Program Files (x86)\Delta\delta\1.8.24.6\deltaApp.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E97A663B-81A6-49C5-A6D3-BCB05BA1DE26}\ProgID]
@="delta.deltaappCore.1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E97A663B-81A6-49C5-A6D3-BCB05BA1DE26}\VersionIndependentProgID]
@="delta.deltaappCore"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\AppID\{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}\Instl\Data]
"dsFFX"="Delta Search"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\AppID\{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}\Instl\Data]
"uninstaller"="C:\Program Files (x86)\Delta\delta\1.8.24.6\uninstall.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{39CB8175-E224-4446-8746-00566302DF8D}\1.0\0\win32]
@="C:\Program Files (x86)\Delta\delta\1.8.24.6\deltasrv.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{39CB8175-E224-4446-8746-00566302DF8D}\1.0\HELPDIR]
@="C:\Program Files (x86)\Delta\delta\1.8.24.6"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{4599D05A-D545-4069-BB42-5895B4EAE05B}\1.0]
@="deltaCmn 1.0 Type Library"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{4599D05A-D545-4069-BB42-5895B4EAE05B}\1.0\0\win32]
@="C:\Program Files (x86)\Delta\delta\1.8.24.6\deltaEng.dll\2"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{4599D05A-D545-4069-BB42-5895B4EAE05B}\1.0\HELPDIR]
@="C:\Program Files (x86)\Delta\delta\1.8.24.6"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}\1.0\0\win32]
@="C:\Program Files (x86)\Delta\delta\1.8.24.6\deltaTlbr.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}\1.0\HELPDIR]
@="C:\Program Files (x86)\Delta\delta\1.8.24.6"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}\1.0\0\win32]
@="C:\Program Files (x86)\Delta\delta\1.8.24.6\deltaApp.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}\1.0\HELPDIR]
@="C:\Program Files (x86)\Delta\delta\1.8.24.6"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Winners\amd64_microsoft-windows-deltacompressionengine_31bf3856ad364e35_none_9afd56f432219a2e]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Winners\amd64_microsoft-windows-deltapackageexpander_31bf3856ad364e35_none_0a20a2633b1984ad]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Winners\amd64_microsoft-windows-s..l-soundthemes-delta_31bf3856ad364e35_none_f2cfa9dc6d3f5297]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Winners\x86_microsoft-windows-deltacompressionengine_31bf3856ad364e35_none_3edebb7079c428f8]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Winners\x86_microsoft-windows-deltapackageexpander_31bf3856ad364e35_none_ae0206df82bc1377]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Input Formats\Half SD]
"WinSAT_CPU Delta"="-1.0"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Input Formats\HD Default]
"WinSAT_CPU Delta"="2.0"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Input Formats\SD AVC-MP4]
"WinSAT_CPU Delta"="0.2"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Input Formats\SD AVC-MPG-ISO]
"WinSAT_CPU Delta"="0.2"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Input Formats\SD AVC-MPG-TTS]
"WinSAT_CPU Delta"="0.2"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Input Formats\SD Default]
"WinSAT_CPU Delta"="0.1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Input Formats\SD WMV]
"WinSAT_CPU Delta"="0"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib\009]
"Help"="3 The System performance object consists of counters that apply to more than one instance of a component processors on the computer. 5 The Memory performance object  consists of counters that describe the behavior of physical and virtual memory on the computer.  Physical memory is the amount of random access memory on the computer.  Virtual memory consists of the space in physical memory and on disk.  Many of the memory counters monitor paging, which is the movement of pages of code and data between disk and physical memory.  Excessive paging, a symptom of a memory shortage, can cause delays which interfere with all system processes. 7 % Processor Time is the percentage of elapsed time that the processor spends to execute a non-Idle thread. It is calculated by measuring the percentage of time that the processor spends executing the idle thread and then subtracting that value from 100%. (Each processor has an idle thread tha
[HKEY_LOCAL_MACHINE\SOFTWARE\Realtek\AECBF\icrcAudioProcessingDemo\GSCBeamformer\PostFiltering]
"delta"="0.000100"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Adobe\Shockwave 12\uicontrol\sw3dbaddriverlist1]
@="*2k*savage/ix!^5.12.01.7012199x=stbnvidiatnt16mb!=4.10.01.9131$o2k=diamondstealthiiis530!=5.12.01.8007-8.30.24$72k=m!=5.00.2180.3711$***=atigraphicsproturbopci(atim64-gx)!^9999.0.0.0$ont=nvidiageforce256!=4.00.1381.0327$****virge!^9999.0.0.0$*9x=ibmthinkpad(cyber9397dvd)!=4.10.01.2173$79x=mach64:ragepro!=4.11.2560$*2k=m!^5.12.01.1200$o9x=intel(r)82810graphicscontroller!=4.12.01.2656$o**=m!^5.12.01.1509$o2k=3dfxvoodooseries!=5.00.2195.0197$ont=3dfxvoodooseries!=4.00.1381.0229$o2k=diamondstealthiiis540!=5.12.01.8007-8.30.24$*9x*permedia2!^4.10.01.2359$****mystique!^9999.0.0.0$*9x*g400!^4.12.1.1710$***=2164w!^9999.0.0.0$*9x=mach64:ragepro!^4.10.1720$ont*3dblasterriva!^4.03.00.2100$ont*nvidia!^4.00.1381.0508$79x*nvidia!^4.12.01.0513$o9x*diamondviperv770!^4.11.01.0402$****g100!^9999.0.0.0$59x*nvidiariva128!=4.10.1713$ont*radeon!^4.3.3109$o2k*voodoobanshee!=5.00.2195.2b$o***permedia3!^4.12.01.2107$o***ragefury!^4.3.139$o**
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Delta]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Delta\delta]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Delta\delta\Instl]
"InstallDir"="C:\Program Files (x86)\Delta\delta\1.8.24.6"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{348C2DF3-1191-4C3E-92A6-B3A89A9D9C85}]
"AppName"="deltasrv.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{348C2DF3-1191-4C3E-92A6-B3A89A9D9C85}]
"AppPath"="C:\Program Files (x86)\Delta\delta\1.8.24.6"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]
"{82E1477C-B154-48D3-9891-33D83C26BCD3}"="Delta Toolbar"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{C1AF5FA5-852C-4C90-812E-A7F75E011D87}]
@="delta Helper Object"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\delta]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\delta]
"DisplayName"="Delta toolbar  "
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\delta]
"UninstallString"=""C:\Program Files (x86)\Delta\delta\1.8.24.6\GUninstaller.exe" -uprtc -ask -rmbus "Delta toolbar" -nontfy -bname=dlt -key "delta""
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\delta]
"DisplayIcon"=""C:\Program Files (x86)\Delta\delta\1.8.24.6\deltasrv.exe""
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\delta]
"Comments"="Delta toolbar  "
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\delta]
"Publisher"="Delta"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\delta]
"OrigUninstString"=""C:\Program Files (x86)\Delta\delta\1.8.24.6\uninstall.exe""
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Delta Chrome Toolbar]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Delta Chrome Toolbar]
"UninstallString"=""C:\Users\Admin\AppData\Roaming\BabSolution\Shared\GUninstaller.exe" -key "Delta Chrome Toolbar" -rmkey -rmbus "Delta Chrome Toolbar" -ask -plgdll enhancedNT -nontfy"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Delta Chrome Toolbar]
"DisplayIcon"="C:\Users\Admin\AppData\Roaming\BabSolution\Shared\Delta.ico"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Delta Chrome Toolbar]
"DisplayName"="Delta Chrome Toolbar"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Media Player NSS\3.0\Input Formats\Half SD]
"WinSAT_CPU Delta"="-1.0"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Media Player NSS\3.0\Input Formats\HD Default]
"WinSAT_CPU Delta"="2.0"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Media Player NSS\3.0\Input Formats\SD AVC-MP4]
"WinSAT_CPU Delta"="0.2"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Media Player NSS\3.0\Input Formats\SD AVC-MPG-ISO]
"WinSAT_CPU Delta"="0.2"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Media Player NSS\3.0\Input Formats\SD AVC-MPG-TTS]
"WinSAT_CPU Delta"="0.2"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Media Player NSS\3.0\Input Formats\SD Default]
"WinSAT_CPU Delta"="0.1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Media Player NSS\3.0\Input Formats\SD WMV]
"WinSAT_CPU Delta"="0"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Perflib\009]
"Help"="3 The System performance object consists of counters that apply to more than one instance of a component processors on the computer. 5 The Memory performance object  consists of counters that describe the behavior of physical and virtual memory on the computer.  Physical memory is the amount of random access memory on the computer.  Virtual memory consists of the space in physical memory and on disk.  Many of the memory counters monitor paging, which is the movement of pages of code and data between disk and physical memory.  Excessive paging, a symptom of a memory shortage, can cause delays which interfere with all system processes. 7 % Processor Time is the percentage of elapsed time that the processor spends to execute a non-Idle thread. It is calculated by measuring the percentage of time that the processor spends executing the idle thread and then subtracting that value from 100%. (Each processor has an idl
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{261DD098-8A3E-43D4-87AA-63324FA897D8}\LocalServer32]
@=""C:\Program Files (x86)\Delta\delta\1.8.24.6\deltasrv.exe""
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{261DD098-8A3E-43D4-87AA-63324FA897D8}\ProgID]
@="esrv.deltaESrvc.1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{261DD098-8A3E-43D4-87AA-63324FA897D8}\VersionIndependentProgID]
@="esrv.deltaESrvc"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{4FCB4630-2A1C-4AA1-B422-345E8DC8A6DE}\InprocServer32]
@="C:\Program Files (x86)\Delta\delta\1.8.24.6\bh\delta.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{82E1477C-B154-48D3-9891-33D83C26BCD3}]
@="Delta Toolbar"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{82E1477C-B154-48D3-9891-33D83C26BCD3}\InprocServer32]
@="C:\Program Files (x86)\Delta\delta\1.8.24.6\deltaTlbr.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{82E1477C-B154-48D3-9891-33D83C26BCD3}\ProgID]
@="delta.deltadskBnd.1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{82E1477C-B154-48D3-9891-33D83C26BCD3}\VersionIndependentProgID]
@="delta.deltadskBnd"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{86838207-681D-469D-9511-D0DCC6F19F9B}\InprocServer32]
@="C:\Program Files (x86)\Delta\delta\1.8.24.6\deltaEng.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{C1AF5FA5-852C-4C90-812E-A7F75E011D87}]
@="delta Helper Object"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{C1AF5FA5-852C-4C90-812E-A7F75E011D87}\InprocServer32]
@="C:\Program Files (x86)\Delta\delta\1.8.24.6\bh\delta.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{C1AF5FA5-852C-4C90-812E-A7F75E011D87}\ProgID]
@="delta.deltaHlpr.1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{C1AF5FA5-852C-4C90-812E-A7F75E011D87}\VersionIndependentProgID]
@="delta.deltaHlpr"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{E97A663B-81A6-49C5-A6D3-BCB05BA1DE26}\InprocServer32]
@="C:\Program Files (x86)\Delta\delta\1.8.24.6\deltaApp.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{E97A663B-81A6-49C5-A6D3-BCB05BA1DE26}\ProgID]
@="delta.deltaappCore.1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{E97A663B-81A6-49C5-A6D3-BCB05BA1DE26}\VersionIndependentProgID]
@="delta.deltaappCore"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\AppID\{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}\Instl\Data]
"dsFFX"="Delta Search"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\AppID\{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}\Instl\Data]
"uninstaller"="C:\Program Files (x86)\Delta\delta\1.8.24.6\uninstall.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\TypeLib\{39CB8175-E224-4446-8746-00566302DF8D}\1.0\0\win32]
@="C:\Program Files (x86)\Delta\delta\1.8.24.6\deltasrv.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\TypeLib\{39CB8175-E224-4446-8746-00566302DF8D}\1.0\HELPDIR]
@="C:\Program Files (x86)\Delta\delta\1.8.24.6"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\TypeLib\{4599D05A-D545-4069-BB42-5895B4EAE05B}\1.0]
@="deltaCmn 1.0 Type Library"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\TypeLib\{4599D05A-D545-4069-BB42-5895B4EAE05B}\1.0\0\win32]
@="C:\Program Files (x86)\Delta\delta\1.8.24.6\deltaEng.dll\2"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\TypeLib\{4599D05A-D545-4069-BB42-5895B4EAE05B}\1.0\HELPDIR]
@="C:\Program Files (x86)\Delta\delta\1.8.24.6"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\TypeLib\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}\1.0\0\win32]
@="C:\Program Files (x86)\Delta\delta\1.8.24.6\deltaTlbr.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\TypeLib\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}\1.0\HELPDIR]
@="C:\Program Files (x86)\Delta\delta\1.8.24.6"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\TypeLib\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}\1.0\0\win32]
@="C:\Program Files (x86)\Delta\delta\1.8.24.6\deltaApp.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\TypeLib\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}\1.0\HELPDIR]
@="C:\Program Files (x86)\Delta\delta\1.8.24.6"
[HKEY_USERS\S-1-5-19\AppEvents\Schemes\Apps\.Default\.Default\Delta]
[HKEY_USERS\S-1-5-19\AppEvents\Schemes\Apps\.Default\.Default\Delta]
@="C:\Windows\Media\Delta\Windows Ding.wav"
[HKEY_USERS\S-1-5-19\AppEvents\Schemes\Apps\.Default\ChangeTheme\Delta]
[HKEY_USERS\S-1-5-19\AppEvents\Schemes\Apps\.Default\ChangeTheme\Delta]
@="C:\Windows\Media\Delta\Windows Logon Sound.wav"
[HKEY_USERS\S-1-5-19\AppEvents\Schemes\Apps\.Default\CriticalBatteryAlarm\Delta]
[HKEY_USERS\S-1-5-19\AppEvents\Schemes\Apps\.Default\CriticalBatteryAlarm\Delta]
@="C:\Windows\Media\Delta\Windows Battery Critical.wav"
[HKEY_USERS\S-1-5-19\AppEvents\Schemes\Apps\.Default\DeviceConnect\Delta]
[HKEY_USERS\S-1-5-19\AppEvents\Schemes\Apps\.Default\DeviceConnect\Delta]
@="C:\Windows\Media\Delta\Windows Hardware Insert.wav"
[HKEY_USERS\S-1-5-19\AppEvents\Schemes\Apps\.Default\DeviceDisconnect\Delta]
[HKEY_USERS\S-1-5-19\AppEvents\Schemes\Apps\.Default\DeviceDisconnect\Delta]
@="C:\Windows\Media\Delta\Windows Hardware Remove.wav"
[HKEY_USERS\S-1-5-19\AppEvents\Schemes\Apps\.Default\DeviceFail\Delta]
[HKEY_USERS\S-1-5-19\AppEvents\Schemes\Apps\.Default\DeviceFail\Delta]
@="C:\Windows\Media\Delta\Windows Hardware Fail.wav"
[HKEY_USERS\S-1-5-19\AppEvents\Schemes\Apps\.Default\FaxBeep\Delta]
[HKEY_USERS\S-1-5-19\AppEvents\Schemes\Apps\.Default\FaxBeep\Delta]
@="C:\Windows\Media\Delta\Windows Notify.wav"
[HKEY_USERS\S-1-5-19\AppEvents\Schemes\Apps\.Default\LowBatteryAlarm\Delta]
[HKEY_USERS\S-1-5-19\AppEvents\Schemes\Apps\.Default\LowBatteryAlarm\Delta]
@="C:\Windows\Media\Delta\Windows Battery Low.wav"
[HKEY_USERS\S-1-5-19\AppEvents\Schemes\Apps\.Default\MailBeep\Delta]
[HKEY_USERS\S-1-5-19\AppEvents\Schemes\Apps\.Default\MailBeep\Delta]
@="C:\Windows\Media\Delta\Windows Notify.wav"
[HKEY_USERS\S-1-5-19\AppEvents\Schemes\Apps\.Default\PrintComplete\Delta]
[HKEY_USERS\S-1-5-19\AppEvents\Schemes\Apps\.Default\PrintComplete\Delta]
@="C:\Windows\Media\Delta\Windows Print complete.wav"
[HKEY_USERS\S-1-5-19\AppEvents\Schemes\Apps\.Default\SystemAsterisk\Delta]
[HKEY_USERS\S-1-5-19\AppEvents\Schemes\Apps\.Default\SystemAsterisk\Delta]
@="C:\Windows\Media\Delta\Windows Error.wav"
[HKEY_USERS\S-1-5-19\AppEvents\Schemes\Apps\.Default\SystemExclamation\Delta]
[HKEY_USERS\S-1-5-19\AppEvents\Schemes\Apps\.Default\SystemExclamation\Delta]
@="C:\Windows\Media\Delta\Windows Exclamation.wav"
[HKEY_USERS\S-1-5-19\AppEvents\Schemes\Apps\.Default\SystemExit\Delta]
[HKEY_USERS\S-1-5-19\AppEvents\Schemes\Apps\.Default\SystemHand\Delta]
[HKEY_USERS\S-1-5-19\AppEvents\Schemes\Apps\.Default\SystemHand\Delta]
@="C:\Windows\Media\Delta\Windows Critical Stop.wav"
[HKEY_USERS\S-1-5-19\AppEvents\Schemes\Apps\.Default\SystemNotification\Delta]
[HKEY_USERS\S-1-5-19\AppEvents\Schemes\Apps\.Default\SystemNotification\Delta]
@="C:\Windows\Media\Delta\Windows Balloon.wav"
[HKEY_USERS\S-1-5-19\AppEvents\Schemes\Apps\.Default\WindowsLogoff\Delta]
[HKEY_USERS\S-1-5-19\AppEvents\Schemes\Apps\.Default\WindowsLogoff\Delta]
@="C:\Windows\Media\Delta\Windows Logoff Sound.wav"
[HKEY_USERS\S-1-5-19\AppEvents\Schemes\Apps\.Default\WindowsLogon\Delta]
[HKEY_USERS\S-1-5-19\AppEvents\Schemes\Apps\.Default\WindowsLogon\Delta]
@="C:\Windows\Media\Delta\Windows Logon Sound.wav"
[HKEY_USERS\S-1-5-19\AppEvents\Schemes\Apps\.Default\WindowsUAC\Delta]
[HKEY_USERS\S-1-5-19\AppEvents\Schemes\Apps\.Default\WindowsUAC\Delta]
@="C:\Windows\Media\Delta\Windows User Account Control.wav"
[HKEY_USERS\S-1-5-19\AppEvents\Schemes\Apps\Explorer\BlockedPopup\Delta]
[HKEY_USERS\S-1-5-19\AppEvents\Schemes\Apps\Explorer\BlockedPopup\Delta]
@="C:\Windows\Media\Delta\Windows Pop-up Blocked.wav"
[HKEY_USERS\S-1-5-19\AppEvents\Schemes\Apps\Explorer\EmptyRecycleBin\Delta]
[HKEY_USERS\S-1-5-19\AppEvents\Schemes\Apps\Explorer\FaxError\Delta]
[HKEY_USERS\S-1-5-19\AppEvents\Schemes\Apps\Explorer\FaxLineRings\Delta]
[HKEY_USERS\S-1-5-19\AppEvents\Schemes\Apps\Explorer\FaxSent\Delta]
[HKEY_USERS\S-1-5-19\AppEvents\Schemes\Apps\Explorer\FeedDiscovered\Delta]
[HKEY_USERS\S-1-5-19\AppEvents\Schemes\Apps\Explorer\FeedDiscovered\Delta]
@="C:\Windows\Media\Delta\Windows Feed Discovered.wav"
[HKEY_USERS\S-1-5-19\AppEvents\Schemes\Apps\Explorer\Navigating\Delta]
[HKEY_USERS\S-1-5-19\AppEvents\Schemes\Apps\Explorer\Navigating\Delta]
@="C:\Windows\Media\Delta\Windows Navigation Start.wav"
[HKEY_USERS\S-1-5-19\AppEvents\Schemes\Apps\Explorer\SecurityBand\Delta]
[HKEY_USERS\S-1-5-19\AppEvents\Schemes\Apps\Explorer\SecurityBand\Delta]
@="C:\Windows\Media\Delta\Windows Information Bar.wav"
[HKEY_USERS\S-1-5-19\AppEvents\Schemes\Apps\sapisvr\DisNumbersSound\Delta]
[HKEY_USERS\S-1-5-19\AppEvents\Schemes\Apps\sapisvr\HubOffSound\Delta]
[HKEY_USERS\S-1-5-19\AppEvents\Schemes\Apps\sapisvr\HubOnSound\Delta]
[HKEY_USERS\S-1-5-19\AppEvents\Schemes\Apps\sapisvr\HubSleepSound\Delta]
[HKEY_USERS\S-1-5-19\AppEvents\Schemes\Apps\sapisvr\MisrecoSound\Delta]
[HKEY_USERS\S-1-5-19\AppEvents\Schemes\Apps\sapisvr\PanelSound\Delta]
[HKEY_USERS\S-1-5-19\AppEvents\Schemes\Names\Delta]
[HKEY_USERS\S-1-5-20\AppEvents\Schemes\Apps\.Default\.Default\Delta]
[HKEY_USERS\S-1-5-20\AppEvents\Schemes\Apps\.Default\.Default\Delta]
@="C:\Windows\Media\Delta\Windows Ding.wav"
[HKEY_USERS\S-1-5-20\AppEvents\Schemes\Apps\.Default\ChangeTheme\Delta]
[HKEY_USERS\S-1-5-20\AppEvents\Schemes\Apps\.Default\ChangeTheme\Delta]
@="C:\Windows\Media\Delta\Windows Logon Sound.wav"
[HKEY_USERS\S-1-5-20\AppEvents\Schemes\Apps\.Default\CriticalBatteryAlarm\Delta]
[HKEY_USERS\S-1-5-20\AppEvents\Schemes\Apps\.Default\CriticalBatteryAlarm\Delta]
@="C:\Windows\Media\Delta\Windows Battery Critical.wav"
[HKEY_USERS\S-1-5-20\AppEvents\Schemes\Apps\.Default\DeviceConnect\Delta]
[HKEY_USERS\S-1-5-20\AppEvents\Schemes\Apps\.Default\DeviceConnect\Delta]
@="C:\Windows\Media\Delta\Windows Hardware Insert.wav"
[HKEY_USERS\S-1-5-20\AppEvents\Schemes\Apps\.Default\DeviceDisconnect\Delta]
[HKEY_USERS\S-1-5-20\AppEvents\Schemes\Apps\.Default\DeviceDisconnect\Delta]
@="C:\Windows\Media\Delta\Windows Hardware Remove.wav"
[HKEY_USERS\S-1-5-20\AppEvents\Schemes\Apps\.Default\DeviceFail\Delta]
[HKEY_USERS\S-1-5-20\AppEvents\Schemes\Apps\.Default\DeviceFail\Delta]
@="C:\Windows\Media\Delta\Windows Hardware Fail.wav"
[HKEY_USERS\S-1-5-20\AppEvents\Schemes\Apps\.Default\FaxBeep\Delta]
[HKEY_USERS\S-1-5-20\AppEvents\Schemes\Apps\.Default\FaxBeep\Delta]
@="C:\Windows\Media\Delta\Windows Notify.wav"
[HKEY_USERS\S-1-5-20\AppEvents\Schemes\Apps\.Default\LowBatteryAlarm\Delta]
[HKEY_USERS\S-1-5-20\AppEvents\Schemes\Apps\.Default\LowBatteryAlarm\Delta]
@="C:\Windows\Media\Delta\Windows Battery Low.wav"
[HKEY_USERS\S-1-5-20\AppEvents\Schemes\Apps\.Default\MailBeep\Delta]
[HKEY_USERS\S-1-5-20\AppEvents\Schemes\Apps\.Default\MailBeep\Delta]
@="C:\Windows\Media\Delta\Windows Notify.wav"
[HKEY_USERS\S-1-5-20\AppEvents\Schemes\Apps\.Default\PrintComplete\Delta]
[HKEY_USERS\S-1-5-20\AppEvents\Schemes\Apps\.Default\PrintComplete\Delta]
@="C:\Windows\Media\Delta\Windows Print complete.wav"
[HKEY_USERS\S-1-5-20\AppEvents\Schemes\Apps\.Default\SystemAsterisk\Delta]
[HKEY_USERS\S-1-5-20\AppEvents\Schemes\Apps\.Default\SystemAsterisk\Delta]
@="C:\Windows\Media\Delta\Windows Error.wav"
[HKEY_USERS\S-1-5-20\AppEvents\Schemes\Apps\.Default\SystemExclamation\Delta]
[HKEY_USERS\S-1-5-20\AppEvents\Schemes\Apps\.Default\SystemExclamation\Delta]
@="C:\Windows\Media\Delta\Windows Exclamation.wav"
[HKEY_USERS\S-1-5-20\AppEvents\Schemes\Apps\.Default\SystemExit\Delta]
[HKEY_USERS\S-1-5-20\AppEvents\Schemes\Apps\.Default\SystemHand\Delta]
[HKEY_USERS\S-1-5-20\AppEvents\Schemes\Apps\.Default\SystemHand\Delta]
@="C:\Windows\Media\Delta\Windows Critical Stop.wav"
[HKEY_USERS\S-1-5-20\AppEvents\Schemes\Apps\.Default\SystemNotification\Delta]
[HKEY_USERS\S-1-5-20\AppEvents\Schemes\Apps\.Default\SystemNotification\Delta]
@="C:\Windows\Media\Delta\Windows Balloon.wav"
[HKEY_USERS\S-1-5-20\AppEvents\Schemes\Apps\.Default\WindowsLogoff\Delta]
[HKEY_USERS\S-1-5-20\AppEvents\Schemes\Apps\.Default\WindowsLogoff\Delta]
@="C:\Windows\Media\Delta\Windows Logoff Sound.wav"
[HKEY_USERS\S-1-5-20\AppEvents\Schemes\Apps\.Default\WindowsLogon\Delta]
[HKEY_USERS\S-1-5-20\AppEvents\Schemes\Apps\.Default\WindowsLogon\Delta]
@="C:\Windows\Media\Delta\Windows Logon Sound.wav"
[HKEY_USERS\S-1-5-20\AppEvents\Schemes\Apps\.Default\WindowsUAC\Delta]
[HKEY_USERS\S-1-5-20\AppEvents\Schemes\Apps\.Default\WindowsUAC\Delta]
@="C:\Windows\Media\Delta\Windows User Account Control.wav"
[HKEY_USERS\S-1-5-20\AppEvents\Schemes\Apps\Explorer\BlockedPopup\Delta]
[HKEY_USERS\S-1-5-20\AppEvents\Schemes\Apps\Explorer\BlockedPopup\Delta]
@="C:\Windows\Media\Delta\Windows Pop-up Blocked.wav"
[HKEY_USERS\S-1-5-20\AppEvents\Schemes\Apps\Explorer\EmptyRecycleBin\Delta]
[HKEY_USERS\S-1-5-20\AppEvents\Schemes\Apps\Explorer\FaxError\Delta]
[HKEY_USERS\S-1-5-20\AppEvents\Schemes\Apps\Explorer\FaxLineRings\Delta]
[HKEY_USERS\S-1-5-20\AppEvents\Schemes\Apps\Explorer\FaxSent\Delta]
[HKEY_USERS\S-1-5-20\AppEvents\Schemes\Apps\Explorer\FeedDiscovered\Delta]
[HKEY_USERS\S-1-5-20\AppEvents\Schemes\Apps\Explorer\FeedDiscovered\Delta]
@="C:\Windows\Media\Delta\Windows Feed Discovered.wav"
[HKEY_USERS\S-1-5-20\AppEvents\Schemes\Apps\Explorer\Navigating\Delta]
[HKEY_USERS\S-1-5-20\AppEvents\Schemes\Apps\Explorer\Navigating\Delta]
@="C:\Windows\Media\Delta\Windows Navigation Start.wav"
[HKEY_USERS\S-1-5-20\AppEvents\Schemes\Apps\Explorer\SecurityBand\Delta]
[HKEY_USERS\S-1-5-20\AppEvents\Schemes\Apps\Explorer\SecurityBand\Delta]
@="C:\Windows\Media\Delta\Windows Information Bar.wav"
[HKEY_USERS\S-1-5-20\AppEvents\Schemes\Apps\sapisvr\DisNumbersSound\Delta]
[HKEY_USERS\S-1-5-20\AppEvents\Schemes\Apps\sapisvr\HubOffSound\Delta]
[HKEY_USERS\S-1-5-20\AppEvents\Schemes\Apps\sapisvr\HubOnSound\Delta]
[HKEY_USERS\S-1-5-20\AppEvents\Schemes\Apps\sapisvr\HubSleepSound\Delta]
[HKEY_USERS\S-1-5-20\AppEvents\Schemes\Apps\sapisvr\MisrecoSound\Delta]
[HKEY_USERS\S-1-5-20\AppEvents\Schemes\Apps\sapisvr\PanelSound\Delta]
[HKEY_USERS\S-1-5-20\AppEvents\Schemes\Names\Delta]
[HKEY_USERS\S-1-5-20\Software\Microsoft\Windows Media\WMSDK\Namespace]
"LocalDelta"="C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNSD.XML"
[HKEY_USERS\S-1-5-20\Software\Microsoft\Windows Media\WMSDK\Namespace]
"RemoteDelta"="C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNSR.XML"
[HKEY_USERS\S-1-5-21-2905741483-1569714287-2078003378-1001\AppEvents\Schemes\Apps\.Default\.Default\Delta]
[HKEY_USERS\S-1-5-21-2905741483-1569714287-2078003378-1001\AppEvents\Schemes\Apps\.Default\.Default\Delta]
@="C:\Windows\Media\Delta\Windows Ding.wav"
[HKEY_USERS\S-1-5-21-2905741483-1569714287-2078003378-1001\AppEvents\Schemes\Apps\.Default\ChangeTheme\Delta]
[HKEY_USERS\S-1-5-21-2905741483-1569714287-2078003378-1001\AppEvents\Schemes\Apps\.Default\ChangeTheme\Delta]
@="C:\Windows\Media\Delta\Windows Logon Sound.wav"
[HKEY_USERS\S-1-5-21-2905741483-1569714287-2078003378-1001\AppEvents\Schemes\Apps\.Default\CriticalBatteryAlarm\Delta]
[HKEY_USERS\S-1-5-21-2905741483-1569714287-2078003378-1001\AppEvents\Schemes\Apps\.Default\CriticalBatteryAlarm\Delta]
@="C:\Windows\Media\Delta\Windows Battery Critical.wav"
[HKEY_USERS\S-1-5-21-2905741483-1569714287-2078003378-1001\AppEvents\Schemes\Apps\.Default\DeviceConnect\Delta]
[HKEY_USERS\S-1-5-21-2905741483-1569714287-2078003378-1001\AppEvents\Schemes\Apps\.Default\DeviceConnect\Delta]
@="C:\Windows\Media\Delta\Windows Hardware Insert.wav"
[HKEY_USERS\S-1-5-21-2905741483-1569714287-2078003378-1001\AppEvents\Schemes\Apps\.Default\DeviceDisconnect\Delta]
[HKEY_USERS\S-1-5-21-2905741483-1569714287-2078003378-1001\AppEvents\Schemes\Apps\.Default\DeviceDisconnect\Delta]
@="C:\Windows\Media\Delta\Windows Hardware Remove.wav"
[HKEY_USERS\S-1-5-21-2905741483-1569714287-2078003378-1001\AppEvents\Schemes\Apps\.Default\DeviceFail\Delta]
[HKEY_USERS\S-1-5-21-2905741483-1569714287-2078003378-1001\AppEvents\Schemes\Apps\.Default\DeviceFail\Delta]
@="C:\Windows\Media\Delta\Windows Hardware Fail.wav"
[HKEY_USERS\S-1-5-21-2905741483-1569714287-2078003378-1001\AppEvents\Schemes\Apps\.Default\FaxBeep\Delta]
[HKEY_USERS\S-1-5-21-2905741483-1569714287-2078003378-1001\AppEvents\Schemes\Apps\.Default\FaxBeep\Delta]
@="C:\Windows\Media\Delta\Windows Notify.wav"
[HKEY_USERS\S-1-5-21-2905741483-1569714287-2078003378-1001\AppEvents\Schemes\Apps\.Default\LowBatteryAlarm\Delta]
[HKEY_USERS\S-1-5-21-2905741483-1569714287-2078003378-1001\AppEvents\Schemes\Apps\.Default\LowBatteryAlarm\Delta]
@="C:\Windows\Media\Delta\Windows Battery Low.wav"
[HKEY_USERS\S-1-5-21-2905741483-1569714287-2078003378-1001\AppEvents\Schemes\Apps\.Default\MailBeep\Delta]
[HKEY_USERS\S-1-5-21-2905741483-1569714287-2078003378-1001\AppEvents\Schemes\Apps\.Default\MailBeep\Delta]
@="C:\Windows\Media\Delta\Windows Notify.wav"
[HKEY_USERS\S-1-5-21-2905741483-1569714287-2078003378-1001\AppEvents\Schemes\Apps\.Default\PrintComplete\Delta]
[HKEY_USERS\S-1-5-21-2905741483-1569714287-2078003378-1001\AppEvents\Schemes\Apps\.Default\PrintComplete\Delta]
@="C:\Windows\Media\Delta\Windows Print complete.wav"
[HKEY_USERS\S-1-5-21-2905741483-1569714287-2078003378-1001\AppEvents\Schemes\Apps\.Default\SystemAsterisk\Delta]
[HKEY_USERS\S-1-5-21-2905741483-1569714287-2078003378-1001\AppEvents\Schemes\Apps\.Default\SystemAsterisk\Delta]
@="C:\Windows\Media\Delta\Windows Error.wav"
[HKEY_USERS\S-1-5-21-2905741483-1569714287-2078003378-1001\AppEvents\Schemes\Apps\.Default\SystemExclamation\Delta]
[HKEY_USERS\S-1-5-21-2905741483-1569714287-2078003378-1001\AppEvents\Schemes\Apps\.Default\SystemExclamation\Delta]
@="C:\Windows\Media\Delta\Windows Exclamation.wav"
[HKEY_USERS\S-1-5-21-2905741483-1569714287-2078003378-1001\AppEvents\Schemes\Apps\.Default\SystemExit\Delta]
[HKEY_USERS\S-1-5-21-2905741483-1569714287-2078003378-1001\AppEvents\Schemes\Apps\.Default\SystemHand\Delta]
[HKEY_USERS\S-1-5-21-2905741483-1569714287-2078003378-1001\AppEvents\Schemes\Apps\.Default\SystemHand\Delta]
@="C:\Windows\Media\Delta\Windows Critical Stop.wav"
[HKEY_USERS\S-1-5-21-2905741483-1569714287-2078003378-1001\AppEvents\Schemes\Apps\.Default\SystemNotification\Delta]
[HKEY_USERS\S-1-5-21-2905741483-1569714287-2078003378-1001\AppEvents\Schemes\Apps\.Default\SystemNotification\Delta]
@="C:\Windows\Media\Delta\Windows Balloon.wav"
[HKEY_USERS\S-1-5-21-2905741483-1569714287-2078003378-1001\AppEvents\Schemes\Apps\.Default\WindowsLogoff\Delta]
[HKEY_USERS\S-1-5-21-2905741483-1569714287-2078003378-1001\AppEvents\Schemes\Apps\.Default\WindowsLogoff\Delta]
@="C:\Windows\Media\Delta\Windows Logoff Sound.wav"
[HKEY_USERS\S-1-5-21-2905741483-1569714287-2078003378-1001\AppEvents\Schemes\Apps\.Default\WindowsLogon\Delta]
[HKEY_USERS\S-1-5-21-2905741483-1569714287-2078003378-1001\AppEvents\Schemes\Apps\.Default\WindowsLogon\Delta]
@="C:\Windows\Media\Delta\Windows Logon Sound.wav"
[HKEY_USERS\S-1-5-21-2905741483-1569714287-2078003378-1001\AppEvents\Schemes\Apps\.Default\WindowsUAC\Delta]
[HKEY_USERS\S-1-5-21-2905741483-1569714287-2078003378-1001\AppEvents\Schemes\Apps\.Default\WindowsUAC\Delta]
@="C:\Windows\Media\Delta\Windows User Account Control.wav"
[HKEY_USERS\S-1-5-21-2905741483-1569714287-2078003378-1001\AppEvents\Schemes\Apps\Explorer\BlockedPopup\Delta]
[HKEY_USERS\S-1-5-21-2905741483-1569714287-2078003378-1001\AppEvents\Schemes\Apps\Explorer\BlockedPopup\Delta]
@="C:\Windows\Media\Delta\Windows Pop-up Blocked.wav"
[HKEY_USERS\S-1-5-21-2905741483-1569714287-2078003378-1001\AppEvents\Schemes\Apps\Explorer\EmptyRecycleBin\Delta]
[HKEY_USERS\S-1-5-21-2905741483-1569714287-2078003378-1001\AppEvents\Schemes\Apps\Explorer\FaxError\Delta]
[HKEY_USERS\S-1-5-21-2905741483-1569714287-2078003378-1001\AppEvents\Schemes\Apps\Explorer\FaxLineRings\Delta]
[HKEY_USERS\S-1-5-21-2905741483-1569714287-2078003378-1001\AppEvents\Schemes\Apps\Explorer\FaxSent\Delta]
[HKEY_USERS\S-1-5-21-2905741483-1569714287-2078003378-1001\AppEvents\Schemes\Apps\Explorer\FeedDiscovered\Delta]
[HKEY_USERS\S-1-5-21-2905741483-1569714287-2078003378-1001\AppEvents\Schemes\Apps\Explorer\FeedDiscovered\Delta]
@="C:\Windows\Media\Delta\Windows Feed Discovered.wav"
[HKEY_USERS\S-1-5-21-2905741483-1569714287-2078003378-1001\AppEvents\Schemes\Apps\Explorer\Navigating\Delta]
[HKEY_USERS\S-1-5-21-2905741483-1569714287-2078003378-1001\AppEvents\Schemes\Apps\Explorer\Navigating\Delta]
@="C:\Windows\Media\Delta\Windows Navigation Start.wav"
[HKEY_USERS\S-1-5-21-2905741483-1569714287-2078003378-1001\AppEvents\Schemes\Apps\Explorer\SecurityBand\Delta]
[HKEY_USERS\S-1-5-21-2905741483-1569714287-2078003378-1001\AppEvents\Schemes\Apps\Explorer\SecurityBand\Delta]
@="C:\Windows\Media\Delta\Windows Information Bar.wav"
[HKEY_USERS\S-1-5-21-2905741483-1569714287-2078003378-1001\AppEvents\Schemes\Apps\sapisvr\DisNumbersSound\Delta]
[HKEY_USERS\S-1-5-21-2905741483-1569714287-2078003378-1001\AppEvents\Schemes\Apps\sapisvr\HubOffSound\Delta]
[HKEY_USERS\S-1-5-21-2905741483-1569714287-2078003378-1001\AppEvents\Schemes\Apps\sapisvr\HubOnSound\Delta]
[HKEY_USERS\S-1-5-21-2905741483-1569714287-2078003378-1001\AppEvents\Schemes\Apps\sapisvr\HubSleepSound\Delta]
[HKEY_USERS\S-1-5-21-2905741483-1569714287-2078003378-1001\AppEvents\Schemes\Apps\sapisvr\MisrecoSound\Delta]
[HKEY_USERS\S-1-5-21-2905741483-1569714287-2078003378-1001\AppEvents\Schemes\Apps\sapisvr\PanelSound\Delta]
[HKEY_USERS\S-1-5-21-2905741483-1569714287-2078003378-1001\AppEvents\Schemes\Names\Delta]
[HKEY_USERS\S-1-5-21-2905741483-1569714287-2078003378-1001\Software\BabSolution\Updater\Instances\Delta Chrome Toolbar]
[HKEY_USERS\S-1-5-21-2905741483-1569714287-2078003378-1001\Software\BabSolution\Updater\Instances\Delta Chrome Toolbar]
"UninstKey"="Delta Chrome Toolbar"
[HKEY_USERS\S-1-5-21-2905741483-1569714287-2078003378-1001\Software\BabSolution\Updater\Instances\delta toolbar]
[HKEY_USERS\S-1-5-21-2905741483-1569714287-2078003378-1001\Software\Delta]
[HKEY_USERS\S-1-5-21-2905741483-1569714287-2078003378-1001\Software\Delta\delta]
[HKEY_USERS\S-1-5-21-2905741483-1569714287-2078003378-1001\Software\Delta\delta\iestrg]
"prdct"="delta"
[HKEY_USERS\S-1-5-21-2905741483-1569714287-2078003378-1001\Software\Delta\delta\iestrg]
"prtnrid"="delta"
[HKEY_USERS\S-1-5-21-2905741483-1569714287-2078003378-1001\Software\Microsoft\Windows Media\WMSDK\Namespace]
"LocalDelta"="C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNSD.XML"
[HKEY_USERS\S-1-5-21-2905741483-1569714287-2078003378-1001\Software\Microsoft\Windows Media\WMSDK\Namespace]
"RemoteDelta"="C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNSR.XML"

Searching for "Lyrix"
No data found.

Searching for "         "
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN\Plugin\Microsoft.PowerShell]
"ConfigXML"="             <PlugInConfiguration xmlns="hxxp://schemas.microsoft.com/wbem/wsman/1/config/PluginConfiguration" Name="microsoft.powershell" Filename="%windir%\system32\pwrshplugin.dll" SDKVersion="1" XmlRenderingType="text" >                 <InitializationParameters>                     <Param Name="PSVersion" Value="2.0"/>                 </InitializationParameters>                 <Resources>                     <Resource ResourceUri="hxxp://schemas.microsoft.com/powershell/microsoft.powershell" SupportsOptions="true" ExactMatch="true">                         <Security xmlns="hxxp://schemas.microsoft.com/wbem/wsman/1/config/PluginConfiguration" Uri="hxxp://schemas.microsoft.com/powershell/microsoft.powershell" ExactMatch="true" Sddl="O:NSG:BAD:P(A;;GA;;;BA)S:P(AU;FA;GA;;;WD)(AU;SA;GXGW;;;WD)"/>                         <Capability Type="Shell"/>                     </Resource>                 </Res
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\WSMAN\Plugin\Microsoft.PowerShell32]
"ConfigXML"="<PlugInConfiguration xmlns="hxxp://schemas.microsoft.com/wbem/wsman/1/config/PluginConfiguration" Name="microsoft.powershell32" Filename="%windir%\system32\pwrshplugin.dll" SDKVersion="1" XmlRenderingType="text" Architecture="32" >                         <InitializationParameters>                             <Param Name="PSVersion" Value="2.0"/>                         </InitializationParameters>                         <Resources>                             <Resource ResourceUri="hxxp://schemas.microsoft.com/powershell/microsoft.powershell32" SupportsOptions="true" ExactMatch="true">                                 <Security xmlns="hxxp://schemas.microsoft.com/wbem/wsman/1/config/PluginConfiguration" Uri="hxxp://schemas.microsoft.com/powershell/microsoft.powershell32" ExactMatch="true" Sddl="O:NSG:BAD:P(A;;GA;;;BA)S:P(AU;FA;GA;;;WD)(AU;SA;GXGW;;;WD)"/>                                
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\WpdBusEnumRoot\UMB\2&37c186b&1&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_NOKIA&PROD_S60&REV_1.0#351979043348838&0#]
"DeviceDesc"="S60             "
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\WpdBusEnumRoot\UMB\2&37c186b&1&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_NOKIA&PROD_S60&REV_1.0#351979043348838&1#]
"DeviceDesc"="S60             "
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\WpdBusEnumRoot\UMB\2&37c186b&1&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_USBMODEM&PROD_DISK&REV_2.31#8&EACC83&0&1234567890ABCDEF&0#]
"DeviceDesc"="Disk            "
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\WpdBusEnumRoot\UMB\2&37c186b&1&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_NOKIA&PROD_S60&REV_1.0#351979043348838&0#]
"DeviceDesc"="S60             "
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\WpdBusEnumRoot\UMB\2&37c186b&1&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_NOKIA&PROD_S60&REV_1.0#351979043348838&1#]
"DeviceDesc"="S60             "
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\WpdBusEnumRoot\UMB\2&37c186b&1&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_USBMODEM&PROD_DISK&REV_2.31#8&EACC83&0&1234567890ABCDEF&0#]
"DeviceDesc"="Disk            "
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\WpdBusEnumRoot\UMB\2&37c186b&1&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_NOKIA&PROD_S60&REV_1.0#351979043348838&0#]
"DeviceDesc"="S60             "
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\WpdBusEnumRoot\UMB\2&37c186b&1&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_NOKIA&PROD_S60&REV_1.0#351979043348838&1#]
"DeviceDesc"="S60             "
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\WpdBusEnumRoot\UMB\2&37c186b&1&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_USBMODEM&PROD_DISK&REV_2.31#8&EACC83&0&1234567890ABCDEF&0#]
"DeviceDesc"="Disk            "

-= EOF =-

schrauber · 02.10.2013, 21:31

Poste jetzt mal bitte noch ein frisches FRST logfile.

28.09.2013, 12:10	#16
schrauber /// the machine /// TB-Ausbilder	MBAM - Scan bricht ständig ab Und MBAM ist das einzige Problem was der Rechner noch hat? Ich würd einfach sagen lass es weg. __________________ gruß, schrauber *Proud Member of UNITE and ASAP since 2009* Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM!

28.09.2013, 15:32	#18
schrauber /// the machine /// TB-Ausbilder	MBAM - Scan bricht ständig ab Poste mal ein frisches FRST log bitte. __________________ __________________

29.09.2013, 18:27	#22
schrauber /// the machine /// TB-Ausbilder	MBAM - Scan bricht ständig ab Manuell neu starten, frisches FRST log bitte. __________________ gruß, schrauber *Proud Member of UNITE and ASAP since 2009* Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM!

30.09.2013, 08:41	#24
schrauber /// the machine /// TB-Ausbilder	MBAM - Scan bricht ständig ab Noch Probleme? __________________ gruß, schrauber *Proud Member of UNITE and ASAP since 2009* Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM!

01.10.2013, 19:05	#26
schrauber /// the machine /// TB-Ausbilder	MBAM - Scan bricht ständig ab Poste jetzt mal bitte ein frisches FRST log. __________________ gruß, schrauber *Proud Member of UNITE and ASAP since 2009* Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM!

MBAM - Scan bricht ständig ab

Log-Analyse und Auswertung: MBAM - Scan bricht ständig ab