Und SystemLook:

SystemLook 30.07.11 by jpshortstuff
Log created at 21:03 on 31/10/2013 by Tobi
Administrator - Elevation successful

========== filefind ==========

Searching for "*hotspot shield*"
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Hotspot Shield\Hotspot Shield Control Panel.url --a---- 54 bytes [12:47 27/06/2012] [12:47 27/06/2012] 37C77C7F58C925AD50AD0540B3E17EBB
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Hotspot Shield\Hotspot Shield Launch.lnk --a---- 1121 bytes [12:47 27/06/2012] [12:47 27/06/2012] A275CD3998DFE3FC736F223BCB4EB4B3
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Hotspot Shield\Uninstall Hotspot Shield.lnk --a---- 844 bytes [12:47 27/06/2012] [12:47 27/06/2012] DA1FED61BBC00D7A69F40DD15002B20E
C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Hotspot Shield\Hotspot Shield Control Panel.url --a---- 54 bytes [12:47 27/06/2012] [12:47 27/06/2012] 37C77C7F58C925AD50AD0540B3E17EBB
C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Hotspot Shield\Hotspot Shield Launch.lnk --a---- 1121 bytes [12:47 27/06/2012] [12:47 27/06/2012] A275CD3998DFE3FC736F223BCB4EB4B3
C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Hotspot Shield\Uninstall Hotspot Shield.lnk --a---- 844 bytes [12:47 27/06/2012] [12:47 27/06/2012] DA1FED61BBC00D7A69F40DD15002B20E

Searching for "*splashtop*"
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Splashtop\Splashtop Remote\Server\STRLOG\splashtop.bl.vir --a---- 3579 bytes [12:45 28/08/2013] [12:45 28/08/2013] 04A827A5AA0CC59C8F38EA5FF8676E36
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Splashtop Remote\Splashtop Streamer.lnk --a---- 2153 bytes [18:40 16/09/2013] [18:40 16/09/2013] 3A16E3F5F14C6E26FEB61D279C45FC5B
C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Splashtop Remote\Splashtop Streamer.lnk --a---- 2153 bytes [18:40 16/09/2013] [18:40 16/09/2013] 3A16E3F5F14C6E26FEB61D279C45FC5B
C:\Users\Tobi\Downloads\Splashtop_Streamer_WIN_v2.4.5.2.EXE --a---- 19439744 bytes [18:37 16/09/2013] [18:37 16/09/2013] 3B9366D1560CEC92ADC65E3D1796F927

Searching for "*Conduit*"
C:\AdwCleaner\Quarantine\C\Users\Gast\AppData\LocalLow\Conduit\Community Alerts\Feeds\http___alerts_conduit-services_com__aid=1112366&fid=1108070.xml.vir --a---- 186 bytes [19:28 30/10/2010] [19:28 30/10/2010] 7CCFE21285BDF15A5BD0DA17FA123D7E
C:\AdwCleaner\Quarantine\C\Users\Gast\AppData\LocalLow\Conduit\Toolbar\Facebook\http___facebook_conduit-services_com_Settings_ashx_locale=en&browserType=IE&toolbarVersion=5_7_3_1.xml.vir --a---- 10909 bytes [19:28 30/10/2010] [19:28 30/10/2010] 1B3B574AA349758343D3C80787B9739E
C:\AdwCleaner\Quarantine\C\Users\Tobi\AppData\LocalLow\Conduit\Community Alerts\Feeds\http___alerts_conduit-services_com__aid=1080867&fid=1076571.xml.vir --a---- 182 bytes [21:52 03/11/2010] [22:09 03/11/2010] 305947EF0873FC4A9DC45757FA8D490B
C:\AdwCleaner\Quarantine\C\Users\Tobi\AppData\LocalLow\Conduit\Community Alerts\Feeds\http___alerts_conduit-services_com__aid=1112366&fid=1108070.xml.vir --a---- 186 bytes [08:58 15/09/2010] [22:09 03/11/2010] 7CCFE21285BDF15A5BD0DA17FA123D7E
C:\AdwCleaner\Quarantine\C\Users\Tobi\AppData\LocalLow\Conduit\Toolbar\Facebook\http___facebook_conduit-services_com_Settings_ashx_locale=en&browserType=IE&toolbarVersion=5_7_2_2.xml.vir --a---- 10909 bytes [10:19 19/09/2010] [10:19 19/09/2010] 1B3B574AA349758343D3C80787B9739E
C:\AdwCleaner\Quarantine\C\Users\Tobi\AppData\LocalLow\Conduit\Toolbar\Facebook\http___facebook_conduit-services_com_Settings_ashx_locale=en&browserType=IE&toolbarVersion=5_7_3_1.xml.vir --a---- 10909 bytes [10:34 19/09/2010] [16:42 20/09/2010] 1B3B574AA349758343D3C80787B9739E
C:\AdwCleaner\Quarantine\C\Users\Tobi\AppData\Roaming\Mozilla\Firefox\Profiles\3k9240jg.default\Conduit\cachedIcons\http___storage_conduit_com_BankIma ges_RadioSkins_Bluenote_equalizer_dead.gif.vir --a---- 119 bytes [22:11 09/02/2011] [22:11 09/02/2011] A5220F9E01F826B14FB6E2C3F4ECE421
C:\AdwCleaner\Quarantine\C\Users\Tobi\AppData\Roaming\Mozilla\Firefox\Profiles\3k9240jg.default\Conduit\cachedIcons\http___storage_conduit_com_BankIma ges_RadioSkins_Bluenote_minimize.gif.vir --a---- 590 bytes [22:11 09/02/2011] [22:11 09/02/2011] EFFF305AD2F5AA1DB77F7786B490DC61
C:\AdwCleaner\Quarantine\C\Users\Tobi\AppData\Roaming\Mozilla\Firefox\Profiles\3k9240jg.default\Conduit\cachedIcons\http___storage_conduit_com_BankIma ges_RadioSkins_Bluenote_play.gif.vir --a---- 676 bytes [22:11 09/02/2011] [22:11 09/02/2011] 40A8862A7994FA5600025CFDF7A8B81E
C:\AdwCleaner\Quarantine\C\Users\Tobi\AppData\Roaming\Mozilla\Firefox\Profiles\3k9240jg.default\Conduit\cachedIcons\http___storage_conduit_com_BankIma ges_RadioSkins_Bluenote_stop.gif.vir --a---- 703 bytes [22:11 09/02/2011] [22:11 09/02/2011] 253E89E7D1686D67C40FFB20FF78FEEF
C:\AdwCleaner\Quarantine\C\Users\Tobi\AppData\Roaming\Mozilla\Firefox\Profiles\3k9240jg.default\Conduit\cachedIcons\http___storage_conduit_com_BankIma ges_RadioSkins_Bluenote_vol.gif.vir --a---- 712 bytes [22:11 09/02/2011] [22:11 09/02/2011] 5AB7200023489A910B502A6EEE23674D
C:\AdwCleaner\Quarantine\C\Users\Tobi\AppData\Roaming\Mozilla\Firefox\Profiles\3k9240jg.default\Conduit\cachedIcons\http___storage_conduit_com_BankIma ges_RadioSkins_Cornflower_equalizer_dead.gif.vir --a---- 221 bytes [08:58 15/09/2010] [08:58 15/09/2010] 6F8C304D2A8FDD33C6A0CB6B94EF342A
C:\AdwCleaner\Quarantine\C\Users\Tobi\AppData\Roaming\Mozilla\Firefox\Profiles\3k9240jg.default\Conduit\cachedIcons\http___storage_conduit_com_BankIma ges_RadioSkins_Cornflower_minimize.gif.vir --a---- 385 bytes [08:58 15/09/2010] [08:58 15/09/2010] 8C471FEB2DAB502C9C65297C94A46CA1
C:\AdwCleaner\Quarantine\C\Users\Tobi\AppData\Roaming\Mozilla\Firefox\Profiles\3k9240jg.default\Conduit\cachedIcons\http___storage_conduit_com_BankIma ges_RadioSkins_Cornflower_play.gif.vir --a---- 450 bytes [08:58 15/09/2010] [08:58 15/09/2010] A3D32A3016FEBED303A53F60EAF1460D
C:\AdwCleaner\Quarantine\C\Users\Tobi\AppData\Roaming\Mozilla\Firefox\Profiles\3k9240jg.default\Conduit\cachedIcons\http___storage_conduit_com_BankIma ges_RadioSkins_Cornflower_stop.gif.vir --a---- 488 bytes [08:58 15/09/2010] [08:58 15/09/2010] 7F1F59D56B3DB314B58E8145A3609136
C:\AdwCleaner\Quarantine\C\Users\Tobi\AppData\Roaming\Mozilla\Firefox\Profiles\3k9240jg.default\Conduit\cachedIcons\http___storage_conduit_com_BankIma ges_RadioSkins_Cornflower_vol.gif.vir --a---- 497 bytes [08:58 15/09/2010] [08:58 15/09/2010] 38044D62CB1132027C2F6A89D2AE7E2B
C:\AdwCleaner\Quarantine\C\Users\Tobi\AppData\Roaming\Mozilla\Firefox\Profiles\3k9240jg.default\Extensions\{17464f93-137e-4646-a0c6-0dc13faf0113}\Chrome\CT3306060\content\ConduitAbstractionLayer.js.vir --a---- 36402 bytes [16:51 24/10/2013] [16:51 24/10/2013] 115455E3B5034EA10177D137EE85AFC7
C:\AdwCleaner\Quarantine\C\Users\Tobi\AppData\Roaming\Mozilla\Firefox\Profiles\3k9240jg.default\Extensions\{17464f93-137e-4646-a0c6-0dc13faf0113}\Chrome\CT3306060\content\ConduitAbstractionLayerBack.js.vir --a---- 36402 bytes [16:51 24/10/2013] [16:51 24/10/2013] 115455E3B5034EA10177D137EE85AFC7
C:\AdwCleaner\Quarantine\C\Users\Tobi\AppData\Roaming\Mozilla\Firefox\Profiles\3k9240jg.default\Extensions\{17464f93-137e-4646-a0c6-0dc13faf0113}\Chrome\CT3306060\content\ConduitAbstractionLayerFront.js.vir --a---- 36402 bytes [16:51 24/10/2013] [16:51 24/10/2013] 115455E3B5034EA10177D137EE85AFC7
C:\AdwCleaner\Quarantine\C\Users\Tobi\AppData\Roaming\Mozilla\Firefox\Profiles\3k9240jg.default\Extensions\{17464f93-137e-4646-a0c6-0dc13faf0113}\Chrome\CT3306060\content\tb\al\aboutBox\images\conduit-logo-OLD.png.vir --a---- 1305 bytes [16:51 24/10/2013] [16:51 24/10/2013] 5F8EF9A0B050532B90B2645E9627E3F9
C:\AdwCleaner\Quarantine\C\Users\Tobi\AppData\Roaming\Mozilla\Firefox\Profiles\3k9240jg.default\Extensions\{17464f93-137e-4646-a0c6-0dc13faf0113}\Chrome\CT3306060\content\tb\al\aboutBox\images\conduit-logo.png.vir --a---- 3926 bytes [16:51 24/10/2013] [16:51 24/10/2013] 04EC2FEFD3A417F86E983508778A00DD
C:\AdwCleaner\Quarantine\C\Users\Tobi\AppData\Roaming\Mozilla\Firefox\Profiles\3k9240jg.default\Extensions\{17464f93-137e-4646-a0c6-0dc13faf0113}\Chrome\CT3306060\content\tb\al\options\images\conduit-logo.png.vir --a---- 3926 bytes [16:51 24/10/2013] [16:51 24/10/2013] 04EC2FEFD3A417F86E983508778A00DD
C:\AdwCleaner\Quarantine\C\Users\Tobi\AppData\Roaming\Mozilla\Firefox\Profiles\3k9240jg.default\Extensions\{17464f93-137e-4646-a0c6-0dc13faf0113}\lib\log4conduit.jsm.vir --a---- 760 bytes [16:51 24/10/2013] [16:51 24/10/2013] 93898FE6A232C5FCD838D8168F65D802
C:\AdwCleaner\Quarantine\C\Users\Tobi\AppData\Roaming\Mozilla\Firefox\Profiles\3k9240jg.default\Extensions\{17464f93-137e-4646-a0c6-0dc13faf0113}\Plugins\npConduitFirefoxPlugin.dll.vir --a---- 206624 bytes [16:51 24/10/2013] [16:51 24/10/2013] C041CF22CE21F6ABA9164AC4D648186E
C:\Users\Gast\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\IHD7PUBR\settings_toolbar_conduit-services_com[1].txt --a---- 79072 bytes [19:28 30/10/2010] [19:28 30/10/2010] 00A862D5B49868C0C3D6C10B96D18B45
C:\Users\Gast\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\QNF5146X\alerts_conduit-services_com[1].txt --a---- 186 bytes [19:28 30/10/2010] [19:28 30/10/2010] 7CCFE21285BDF15A5BD0DA17FA123D7E
C:\Users\Gast\AppData\LocalLow\Babylon-English\CacheIcons\http___storage_conduit_com_81_272_CT2720081_Images_14810a6e-7b77-4e13-bc49-0f9a794f1511633832615909662500_gif.gif --a---- 755 bytes [19:28 30/10/2010] [19:28 30/10/2010] 27D1944F1D74B866541C147358CD1E29
C:\Users\Gast\AppData\LocalLow\Babylon-English\CacheIcons\http___storage_conduit_com_81_272_CT2720081_Images_14810a6e-7b77-4e13-bc49-0f9a794f1511633832672109312500_gif.gif --a---- 703 bytes [19:28 30/10/2010] [19:28 30/10/2010] 3D5077091C3C85D4699694BE30731E4A
C:\Users\Gast\AppData\LocalLow\Babylon-English\CacheIcons\http___storage_conduit_com_81_272_CT2720081_Images_14810a6e-7b77-4e13-bc49-0f9a794f1511633832699795093750_gif.gif --a---- 679 bytes [19:28 30/10/2010] [19:28 30/10/2010] 2EA2530E6DF8FA6D8EBE5178203E64EC
C:\Users\Gast\AppData\LocalLow\Babylon-English\CacheIcons\http___storage_conduit_com_81_272_CT2720081_Images_14810a6e-7b77-4e13-bc49-0f9a794f1511633832700359156250_gif.gif --a---- 717 bytes [19:28 30/10/2010] [19:28 30/10/2010] 66A87DE9A20BA6E8AC37D12B05279AFE
C:\Users\Gast\AppData\LocalLow\Babylon-English\CacheIcons\http___storage_conduit_com_81_272_CT2720081_Images_14810a6e-7b77-4e13-bc49-0f9a794f1511633832700624781250_gif.gif --a---- 716 bytes [19:28 30/10/2010] [19:28 30/10/2010] 80A3B3F91265E5274401F1F7714A9A47
C:\Users\Gast\AppData\LocalLow\Babylon-English\CacheIcons\http___storage_conduit_com_81_272_CT2720081_Images_14810a6e-7b77-4e13-bc49-0f9a794f1511633832700996031250_gif.gif --a---- 691 bytes [19:28 30/10/2010] [19:28 30/10/2010] 53D2EB36D16C0EAD28046EF4B6219368
C:\Users\Gast\AppData\LocalLow\Babylon-English\CacheIcons\http___storage_conduit_com_81_272_CT2720081_Images_14810a6e-7b77-4e13-bc49-0f9a794f1511633832701207281250_gif.gif --a---- 755 bytes [19:28 30/10/2010] [19:28 30/10/2010] 8F52EADE7838FB0F0F88D22A1AAE4AEA
C:\Users\Gast\AppData\LocalLow\Babylon-English\CacheIcons\http___storage_conduit_com_81_272_CT2720081_Images_14810a6e-7b77-4e13-bc49-0f9a794f1511633832701926500000_gif.gif --a---- 763 bytes [19:28 30/10/2010] [19:28 30/10/2010] 6CBC93F1536EE36A8ED2AFEE79323750
C:\Users\Gast\AppData\LocalLow\Babylon-English\CacheIcons\http___storage_conduit_com_81_272_CT2720081_Images_14810a6e-7b77-4e13-bc49-0f9a794f1511633832702448218750_gif.gif --a---- 718 bytes [19:28 30/10/2010] [19:28 30/10/2010] 2615087CAC7FF40F21BD2F179A6C1A9B
C:\Users\Gast\AppData\LocalLow\Babylon-English\CacheIcons\http___storage_conduit_com_81_272_CT2720081_Images_14810a6e-7b77-4e13-bc49-0f9a794f1511633832702802906250_gif.gif --a---- 740 bytes [19:28 30/10/2010] [19:28 30/10/2010] B237BCECCE07528F9588DDF2D8821B6A
C:\Users\Gast\AppData\LocalLow\Babylon-English\CacheIcons\http___storage_conduit_com_81_272_CT2720081_Images_14810a6e-7b77-4e13-bc49-0f9a794f1511633832703737125000_gif.gif --a---- 686 bytes [19:28 30/10/2010] [19:28 30/10/2010] AD7F0C85B3137B843505E9813277887A
C:\Users\Gast\AppData\LocalLow\Babylon-English\CacheIcons\http___storage_conduit_com_81_272_CT2720081_Images_14810a6e-7b77-4e13-bc49-0f9a794f1511633832704257437500_gif.gif --a---- 703 bytes [19:28 30/10/2010] [19:28 30/10/2010] 78A1A6F8B3D332399BAFE51810503AE5
C:\Users\Gast\AppData\LocalLow\Babylon-English\CacheIcons\http___storage_conduit_com_81_272_CT2720081_Images_14810a6e-7b77-4e13-bc49-0f9a794f1511633832706469468750_gif.gif --a---- 767 bytes [19:28 30/10/2010] [19:28 30/10/2010] 6512B7DECB2804D27BD65A3F952259C9
C:\Users\Gast\AppData\LocalLow\Babylon-English\CacheIcons\http___storage_conduit_com_81_272_CT2720081_Images_14810a6e-7b77-4e13-bc49-0f9a794f1511633832706861812500_gif.gif --a---- 725 bytes [19:28 30/10/2010] [19:28 30/10/2010] 78C1BE35DB8027A299D919FC745FDAD1
C:\Users\Gast\AppData\LocalLow\Babylon-English\CacheIcons\http___storage_conduit_com_81_272_CT2720081_Images_14810a6e-7b77-4e13-bc49-0f9a794f1511633832707394937500_gif.gif --a---- 740 bytes [19:28 30/10/2010] [19:28 30/10/2010] 49290CF5A000C8269679E47049847993
C:\Users\Gast\AppData\LocalLow\Babylon-English\CacheIcons\http___storage_conduit_com_81_272_CT2720081_Images_14810a6e-7b77-4e13-bc49-0f9a794f1511633832709500562500_gif.gif --a---- 734 bytes [19:28 30/10/2010] [19:28 30/10/2010] A8EBEE82BAD51A32CDE1F75F5CA9870C
C:\Users\Gast\AppData\LocalLow\Babylon-English\CacheIcons\http___storage_conduit_com_81_272_CT2720081_Images_14810a6e-7b77-4e13-bc49-0f9a794f1511633983171207336250_gif.gif --a---- 4733 bytes [19:28 30/10/2010] [19:28 30/10/2010] 007474C5C883B185DDC760AFE994E79D
C:\Users\Gast\AppData\LocalLow\Babylon-English\CacheIcons\http___storage_conduit_com_81_272_CT2720081_Images_14810a6e-7b77-4e13-bc49-0f9a794f1511633983173320076250_gif.gif --a---- 9802 bytes [19:28 30/10/2010] [19:28 30/10/2010] 975505513FFD270AE5845FE17B8FF96F
C:\Users\Gast\AppData\LocalLow\Babylon-English\CacheIcons\http___storage_conduit_com_81_272_CT2720081_Images_14810a6e-7b77-4e13-bc49-0f9a794f1511633983175230701250_gif.gif --a---- 9723 bytes [19:28 30/10/2010] [19:28 30/10/2010] 02548C3E3065697AF0059C3B07841D58
C:\Users\Gast\AppData\LocalLow\Babylon-English\CacheIcons\http___storage_conduit_com_81_272_CT2720081_Images_14810a6e-7b77-4e13-bc49-0f9a794f1511633988278997025000_gif.gif --a---- 9692 bytes [19:28 30/10/2010] [19:28 30/10/2010] 9FFCA6C4B48937107A15EE2AA97949F3
C:\Users\Gast\AppData\LocalLow\Babylon-English\CacheIcons\http___storage_conduit_com_81_272_CT2720081_Images_14810a6e-7b77-4e13-bc49-0f9a794f1511633988279965775000_gif.gif --a---- 9832 bytes [19:28 30/10/2010] [19:28 30/10/2010] 38197D3865B573AD701163C668C83419
C:\Users\Gast\AppData\LocalLow\Babylon-English\CacheIcons\http___storage_conduit_com_81_272_CT2720081_Images_14810a6e-7b77-4e13-bc49-0f9a794f1511633993503452873750_gif.gif --a---- 9890 bytes [19:28 30/10/2010] [19:28 30/10/2010] E8C7B2D165078AD2AE7A700080E49AC2
C:\Users\Gast\AppData\LocalLow\Babylon-English\CacheIcons\http___storage_conduit_com_81_272_CT2720081_Images_14810a6e-7b77-4e13-bc49-0f9a794f1511634072072665922500_gif.gif --a---- 586 bytes [19:28 30/10/2010] [19:28 30/10/2010] 1A03D23ABE00CBD9513051A05A4315CD
C:\Users\Gast\AppData\LocalLow\Babylon-English\CacheIcons\http___storage_conduit_com_81_272_CT2720081_Images_14810a6e-7b77-4e13-bc49-0f9a794f1511634072086799198750_gif.gif --a---- 683 bytes [19:28 30/10/2010] [19:28 30/10/2010] 131B51D086C23A3EB3C816372A0578E8
C:\Users\Gast\AppData\LocalLow\Babylon-English\CacheIcons\http___storage_conduit_com_81_272_CT2720081_Images_14810a6e-7b77-4e13-bc49-0f9a794f1511634103031418373750_gif.gif --a---- 331 bytes [19:28 30/10/2010] [19:28 30/10/2010] 05E0CFFEB7624A1D514B46BD6D269CDA
C:\Users\Gast\AppData\LocalLow\Babylon-English\CacheIcons\http___storage_conduit_com_81_272_CT2720081_Images_14810a6e-7b77-4e13-bc49-0f9a794f1511634103037111498750_gif.gif --a---- 1130 bytes [19:28 30/10/2010] [19:28 30/10/2010] CB47C7A8598286CBB713A2883924C66E
C:\Users\Gast\AppData\LocalLow\Babylon-English\CacheIcons\http___storage_conduit_com_81_272_CT2720081_Images_14810a6e-7b77-4e13-bc49-0f9a794f1511634103050365882500_gif.gif --a---- 1196 bytes [19:28 30/10/2010] [19:28 30/10/2010] A4CF0524F4F4E3B9386DA2CB1939BD6B
C:\Users\Gast\AppData\LocalLow\Babylon-English\CacheIcons\http___storage_conduit_com_81_272_CT2720081_Images_14810a6e-7b77-4e13-bc49-0f9a794f1511634103071830565000_gif.gif --a---- 672 bytes [19:28 30/10/2010] [19:28 30/10/2010] 6F46E73AAFE9F99294C16F14C450CABB
C:\Users\Gast\AppData\LocalLow\Babylon-English\CacheIcons\http___storage_conduit_com_81_272_CT2720081_Images_14810a6e-7b77-4e13-bc49-0f9a794f1511634135806797343750_gif.gif --a---- 605 bytes [19:28 30/10/2010] [19:28 30/10/2010] 10D5BC397D1B01AA66B902FAD1991499
C:\Users\Gast\AppData\LocalLow\Babylon-English\CacheIcons\http___storage_conduit_com_81_272_CT2720081_Images_14810a6e-7b77-4e13-bc49-0f9a794f1511634135810724938750_gif.gif --a---- 862 bytes [19:28 30/10/2010] [19:28 30/10/2010] 12F5EC182CA0A92A9A4951EF050F9E0A
C:\Users\Gast\AppData\LocalLow\Babylon-English\CacheIcons\http___storage_conduit_com_81_272_CT2720081_Images_14810a6e-7b77-4e13-bc49-0f9a794f1511634168761697726250_gif.gif --a---- 1140 bytes [19:28 30/10/2010] [19:28 30/10/2010] F3A50BA314703F88CCC2D71DF359F373
C:\Users\Gast\AppData\LocalLow\Babylon-English\CacheIcons\http___storage_conduit_com_81_272_CT2720081_Images_14810a6e-7b77-4e13-bc49-0f9a794f1511634168766194445000_gif.gif --a---- 589 bytes [19:28 30/10/2010] [19:28 30/10/2010] 6046A6A26A27338AEBED20E800414FBE
C:\Users\Gast\AppData\LocalLow\Babylon-English\CacheIcons\http___storage_conduit_com_81_272_CT2720081_Images_14810a6e-7b77-4e13-bc49-0f9a794f1511634168769212257500_gif.gif --a---- 1151 bytes [19:28 30/10/2010] [19:28 30/10/2010] 941BC2F17BB5CC4989C13E76D2540171
C:\Users\Gast\AppData\LocalLow\Babylon-English\CacheIcons\http___storage_conduit_com_81_272_CT2720081_Images_14810a6e-7b77-4e13-bc49-0f9a794f1511634168784512260000_gif.gif --a---- 1025 bytes [19:28 30/10/2010] [19:28 30/10/2010] 457D628F8D29F36A435E427A0E2D5D23
C:\Users\Gast\AppData\LocalLow\Babylon-English\CacheIcons\http___storage_conduit_com_81_272_CT2720081_Images_14810a6e-7b77-4e13-bc49-0f9a794f1511634168828641946250_gif.gif --a---- 651 bytes [19:28 30/10/2010] [19:28 30/10/2010] 2B0154CE25FC94DB4485469161BA2F54
C:\Users\Gast\AppData\LocalLow\Babylon-English\CacheIcons\http___storage_conduit_com_81_272_CT2720081_Images_14810a6e-7b77-4e13-bc49-0f9a794f1511634168856591477500_gif.gif --a---- 569 bytes [19:28 30/10/2010] [19:28 30/10/2010] 2317564D989DD707677BC606B281F097
C:\Users\Gast\AppData\LocalLow\Babylon-English\CacheIcons\http___storage_conduit_com_81_272_CT2720081_Images_634160178361560000_png.png --a---- 1123 bytes [19:28 30/10/2010] [19:28 30/10/2010] 811CF5F109B8F11015D0E7F6E71DA713
C:\Users\Gast\AppData\LocalLow\Babylon-English\CacheIcons\http___storage_conduit_com_81_272_CT2720081_Images_634160178869998750_gif.gif --a---- 1121 bytes [19:28 30/10/2010] [19:28 30/10/2010] 1B90AA62397E6C168ECA6B96D188F2DD
C:\Users\Gast\AppData\LocalLow\Babylon-English\CacheIcons\http___storage_conduit_com_81_272_CT2720081_Images_634160181724373750_png.png --a---- 1012 bytes [19:28 30/10/2010] [19:28 30/10/2010] D29F88E51A1C84644F66F2BE2963CD86
C:\Users\Gast\AppData\LocalLow\Babylon-English\CacheIcons\http___storage_conduit_com_81_272_CT2720081_Images_634160183080588750_png.png --a---- 1122 bytes [19:28 30/10/2010] [19:28 30/10/2010] D3C08C86F34306B3A1AB22F5CF848627
C:\Users\Gast\AppData\LocalLow\Babylon-English\CacheIcons\http___storage_conduit_com_81_272_CT2720081_Images_634160194102103750_png.png --a---- 789 bytes [19:28 30/10/2010] [19:28 30/10/2010] 62DFFE728CDFA5202BD793E17B2006E0
C:\Users\Gast\AppData\LocalLow\Babylon-English\CacheIcons\http___storage_conduit_com_81_272_CT2720081_Images_634160194619291250_png.png --a---- 1212 bytes [19:28 30/10/2010] [19:28 30/10/2010] F15174C2DA3F1F2659485FAFF2CC8809
C:\Users\Gast\AppData\LocalLow\Babylon-English\CacheIcons\http___storage_conduit_com_81_272_CT2720081_Images_634160194913041250_png.png --a---- 822 bytes [19:28 30/10/2010] [19:28 30/10/2010] C944C390E3FBB036B03C878968F05940
C:\Users\Gast\AppData\LocalLow\Babylon-English\CacheIcons\http___storage_conduit_com_81_272_CT2720081_Images_634160195424916250_png.png --a---- 1107 bytes [19:28 30/10/2010] [19:28 30/10/2010] AC38B794E3E8EE706EB040F91801BFE3
C:\Users\Gast\AppData\LocalLow\Babylon-English\CacheIcons\http___storage_conduit_com_81_272_CT2720081_Images_634160196044916250_png.png --a---- 795 bytes [19:28 30/10/2010] [19:28 30/10/2010] 0E57F2988F62F040367A9C2D562D1030
C:\Users\Gast\AppData\LocalLow\Babylon-English\CacheIcons\http___storage_conduit_com_81_272_CT2720081_Images_634160198550512500_png.png --a---- 1223 bytes [19:28 30/10/2010] [19:28 30/10/2010] B45A0B508BA5856FF45E8CC3E891CBE7
C:\Users\Gast\AppData\LocalLow\Babylon-English\CacheIcons\http___storage_conduit_com_81_272_CT2720081_Images_634160202609641250_gif.gif --a---- 150 bytes [19:28 30/10/2010] [19:28 30/10/2010] 2F03783FC5F6B59D92DFD797A45AFD87
C:\Users\Gast\AppData\LocalLow\Babylon-English\CacheIcons\http___storage_conduit_com_81_272_CT2720081_Images_634162588512508750_png.png --a---- 692 bytes [19:28 30/10/2010] [19:28 30/10/2010] 30084BF454B6BC8AD62CB1F648E886A6
C:\Users\Gast\AppData\LocalLow\Babylon-English\CacheIcons\http___storage_conduit_com_81_272_CT2720081_Images_bbb22561-47e5-4fb1-a0c9-3c5dba71edfc633989144468280000_gif.gif --a---- 356 bytes [19:28 30/10/2010] [19:28 30/10/2010] 9BA8356A00680BB35A90F590EF3CF19A
C:\Users\Gast\AppData\LocalLow\Babylon-English\CacheIcons\http___storage_conduit_com_81_272_CT2720081_Images_bbb22561-47e5-4fb1-a0c9-3c5dba71edfc633989146672495000_gif.gif --a---- 359 bytes [19:28 30/10/2010] [19:28 30/10/2010] E31E0C0F5998705D264AB4A692EFB694
C:\Users\Gast\AppData\LocalLow\Babylon-English\CacheIcons\http___storage_conduit_com_81_272_CT2720081_Images_bbb22561-47e5-4fb1-a0c9-3c5dba71edfc633989146810776250_gif.gif --a---- 331 bytes [19:28 30/10/2010] [19:28 30/10/2010] A6F968F2CE7BE510FB1D3AF68E272703
C:\Users\Gast\AppData\LocalLow\Babylon-English\CacheIcons\http___storage_conduit_com_81_272_CT2720081_Images_bbb22561-47e5-4fb1-a0c9-3c5dba71edfc633989146918745000_gif.gif --a---- 339 bytes [19:28 30/10/2010] [19:28 30/10/2010] 3AEFA498E60EE6B8D049EC9C12F121E9
C:\Users\Gast\AppData\LocalLow\Babylon-English\CacheIcons\http___storage_conduit_com_81_272_CT2720081_Images_bbb22561-47e5-4fb1-a0c9-3c5dba71edfc633989146990620000_gif.gif --a---- 342 bytes [19:28 30/10/2010] [19:28 30/10/2010] 8838E8D8FD4A91A8C4F7D9E59B3C5388
C:\Users\Gast\AppData\LocalLow\Babylon-English\CacheIcons\http___storage_conduit_com_81_272_CT2720081_Images_bbb22561-47e5-4fb1-a0c9-3c5dba71edfc633989147075307500_gif.gif --a---- 343 bytes [19:28 30/10/2010] [19:28 30/10/2010] 766136FA9B9F4E17EC49EC283324D9DB
C:\Users\Gast\AppData\LocalLow\Babylon-English\CacheIcons\http___storage_conduit_com_81_272_CT2720081_Images_bbb22561-47e5-4fb1-a0c9-3c5dba71edfc633989147191713750_gif.gif --a---- 343 bytes [19:28 30/10/2010] [19:28 30/10/2010] 275404F43DE0814A9F40B9DAB167D434
C:\Users\Gast\AppData\LocalLow\Babylon-English\CacheIcons\http___storage_conduit_com_81_272_CT2720081_Images_bbb22561-47e5-4fb1-a0c9-3c5dba71edfc633989147274370000_gif.gif --a---- 356 bytes [19:28 30/10/2010] [19:28 30/10/2010] D567C4204C7E07AEF6914815A6FF2B14
C:\Users\Gast\AppData\LocalLow\Babylon-English\CacheIcons\http___storage_conduit_com_81_272_CT2720081_Images_bbb22561-47e5-4fb1-a0c9-3c5dba71edfc633989147367651250_gif.gif --a---- 344 bytes [19:28 30/10/2010] [19:28 30/10/2010] 6BA15CDC44E69C75A9C9179D2CB1E972
C:\Users\Gast\AppData\LocalLow\Babylon-English\CacheIcons\http___storage_conduit_com_81_272_CT2720081_Images_bbb22561-47e5-4fb1-a0c9-3c5dba71edfc633989147450932500_gif.gif --a---- 996 bytes [19:28 30/10/2010] [19:28 30/10/2010] 624B5A51C8AB385AF314FD20D39E5786
C:\Users\Gast\AppData\LocalLow\Babylon-English\CacheIcons\http___storage_conduit_com_81_272_CT2720081_Images_bbb22561-47e5-4fb1-a0c9-3c5dba71edfc633989147522963750_gif.gif --a---- 996 bytes [19:28 30/10/2010] [19:28 30/10/2010] 624B5A51C8AB385AF314FD20D39E5786
C:\Users\Gast\AppData\LocalLow\Babylon-English\CacheIcons\http___storage_conduit_com_81_272_CT2720081_Images_bbb22561-47e5-4fb1-a0c9-3c5dba71edfc633989147605463750_gif.gif --a---- 358 bytes [19:28 30/10/2010] [19:28 30/10/2010] 717904ECB1934980CFC5C30D3927D2CD
C:\Users\Gast\AppData\LocalLow\Babylon-English\CacheIcons\http___storage_conduit_com_81_272_CT2720081_Images_bbb22561-47e5-4fb1-a0c9-3c5dba71edfc633989147692963750_gif.gif --a---- 377 bytes [19:28 30/10/2010] [19:28 30/10/2010] 109DE2D6BCF889F011A029F35CA295A0
C:\Users\Gast\AppData\LocalLow\Babylon-English\CacheIcons\http___storage_conduit_com_81_272_CT2720081_Images_bbb22561-47e5-4fb1-a0c9-3c5dba71edfc633989147757963750_gif.gif --a---- 358 bytes [19:28 30/10/2010] [19:28 30/10/2010] 6826FF5167C1830470F4E84D640C95D9
C:\Users\Gast\AppData\LocalLow\Babylon-English\CacheIcons\http___storage_conduit_com_81_272_CT2720081_Images_bbb22561-47e5-4fb1-a0c9-3c5dba71edfc633989147826557500_gif.gif --a---- 588 bytes [19:28 30/10/2010] [19:28 30/10/2010] 2F2A0FF7E3B3DF28CC2051DF7E99797F
C:\Users\Gast\AppData\LocalLow\Babylon-English\CacheIcons\http___storage_conduit_com_81_272_CT2720081_Images_bbb22561-47e5-4fb1-a0c9-3c5dba71edfc633989147909526250_gif.gif --a---- 351 bytes [19:28 30/10/2010] [19:28 30/10/2010] 6639DC467A8C8361B10A12E907180B3A
C:\Users\Gast\AppData\LocalLow\Babylon-English\CacheIcons\http___storage_conduit_com_81_272_CT2720081_Images_bbb22561-47e5-4fb1-a0c9-3c5dba71edfc633989148012651250_gif.gif --a---- 363 bytes [19:28 30/10/2010] [19:28 30/10/2010] 150127E61B951473C5A2DBBEC57A3E50
C:\Users\Gast\AppData\LocalLow\Babylon-English\CacheIcons\http___storage_conduit_com_81_272_CT2720081_Images_bbb22561-47e5-4fb1-a0c9-3c5dba71edfc633989187119998750_gif.gif --a---- 750 bytes [19:28 30/10/2010] [19:28 30/10/2010] F7B36FD887AABCE7371A1994C9FC55C5
C:\Users\Gast\AppData\LocalLow\Babylon-English\CacheIcons\http___storage_conduit_com_81_272_CT2720081_Images_Menu-Bsilkset_information_gif-Silk_2-634160175180457500_gif.gif --a---- 401 bytes [19:28 30/10/2010] [19:28 30/10/2010] D1436027F68BF95B007EF452AF609DD3
C:\Users\Gast\AppData\LocalLow\Babylon-English\CacheIcons\http___storage_conduit_com_81_272_CT2720081_Images_Menu-Bsilkset_page_paste_gif-Silk_2-634160175795145000_gif.gif --a---- 415 bytes [19:28 30/10/2010] [19:28 30/10/2010] 40D82798A1E9E481770C1AEFAB3618CB
C:\Users\Gast\AppData\LocalLow\Babylon-English\CacheIcons\http___storage_conduit_com_bankImages_FaceBook_Events_png.png --a---- 705 bytes [19:28 30/10/2010] [19:28 30/10/2010] 70B83DCDF7A6FA34240E1AA1D23EE535
C:\Users\Gast\AppData\LocalLow\Babylon-English\CacheIcons\http___storage_conduit_com_bankImages_FaceBook_Friends_png.png --a---- 746 bytes [19:28 30/10/2010] [19:28 30/10/2010] 2AE805114215925E00858FD2FEFF1439
C:\Users\Gast\AppData\LocalLow\Babylon-English\CacheIcons\http___storage_conduit_com_bankImages_FaceBook_Groups_png.png --a---- 669 bytes [19:28 30/10/2010] [19:28 30/10/2010] 6CFEA2D0DB786FDB4D72C1C1DE036822
C:\Users\Gast\AppData\LocalLow\Babylon-English\CacheIcons\http___storage_conduit_com_bankImages_FaceBook_Home_png.png --a---- 338 bytes [19:28 30/10/2010] [19:28 30/10/2010] DB45ACA16C515F2FD8CB3B6F5E4FC386
C:\Users\Gast\AppData\LocalLow\Babylon-English\CacheIcons\http___storage_conduit_com_bankImages_FaceBook_Inbox_png.png --a---- 545 bytes [19:28 30/10/2010] [19:28 30/10/2010] 6EB69BFCBFD422247C103705B532BFE1
C:\Users\Gast\AppData\LocalLow\Babylon-English\CacheIcons\http___storage_conduit_com_bankImages_FaceBook_Logout_png.png --a---- 514 bytes [19:28 30/10/2010] [19:28 30/10/2010] 7F396C3A400239B9B66DEC2D503D86BB
C:\Users\Gast\AppData\LocalLow\Babylon-English\CacheIcons\http___storage_conduit_com_bankImages_FaceBook_Photos_png.png --a---- 3355 bytes [19:28 30/10/2010] [19:28 30/10/2010] EC261A170D34BE434129E71B9C2C0408
C:\Users\Gast\AppData\LocalLow\Babylon-English\CacheIcons\http___storage_conduit_com_bankImages_FaceBook_Profile_png.png --a---- 594 bytes [19:28 30/10/2010] [19:28 30/10/2010] 62C86296694EF7F41D380804A58EF5CA
C:\Users\Gast\AppData\LocalLow\Babylon-English\CacheIcons\http___storage_conduit_com_bankImages_FaceBook_Settings_png.png --a---- 415 bytes [19:28 30/10/2010] [19:28 30/10/2010] E42D284CC0436B66C1DB4AAFFCCC1957
C:\Users\Gast\AppData\LocalLow\Babylon-English\CacheIcons\http___storage_conduit_com_bankImages_FaceBook_Share_png.png --a---- 461 bytes [19:28 30/10/2010] [19:28 30/10/2010] B4AEAC6600360BC4148538F716453AAC
C:\Users\Gast\AppData\LocalLow\Babylon-English\CacheIcons\http___storage_conduit_com_bankImages_FaceBook_Status_png.png --a---- 699 bytes [19:28 30/10/2010] [19:28 30/10/2010] 640E17444F44717CA5039BCB7FD3551E
C:\Users\Gast\AppData\LocalLow\Babylon-English\CacheIcons\http___storage_conduit_com_BankImages_RadioSkins_Cornflower_chevron_menu_gif.gif --a---- 884 bytes [19:28 30/10/2010] [19:28 30/10/2010] 872292DE9C3484F16BDA3A0900533398
C:\Users\Gast\AppData\LocalLow\Babylon-English\CacheIcons\http___storage_conduit_com_BankImages_RadioSkins_Cornflower_display_gif.gif --a---- 411 bytes [19:28 30/10/2010] [19:28 30/10/2010] 9FC990685C2325719DF6DA2C2A483F39
C:\Users\Gast\AppData\LocalLow\Babylon-English\CacheIcons\http___storage_conduit_com_BankImages_RadioSkins_Cornflower_equalizer_dead_gif.gif --a---- 221 bytes [19:28 30/10/2010] [19:28 30/10/2010] 6F8C304D2A8FDD33C6A0CB6B94EF342A
C:\Users\Gast\AppData\LocalLow\Babylon-English\CacheIcons\http___storage_conduit_com_BankImages_RadioSkins_Cornflower_Equalizer_GIF.GIF --a---- 653 bytes [19:28 30/10/2010] [19:28 30/10/2010] 9DEC5B68441D85B4078E9FA50B05380E
C:\Users\Gast\AppData\LocalLow\Babylon-English\CacheIcons\http___storage_conduit_com_BankImages_RadioSkins_Cornflower_Error_GIF.GIF --a---- 402 bytes [19:28 30/10/2010] [19:28 30/10/2010] 1A2D4FEBCD6A9D2F0564B977315CDA99
C:\Users\Gast\AppData\LocalLow\Babylon-English\CacheIcons\http___storage_conduit_com_BankImages_RadioSkins_Cornflower_Loading_gif.gif --a---- 905 bytes [19:28 30/10/2010] [19:28 30/10/2010] AC5B715768924A46C358B3B329826F05
C:\Users\Gast\AppData\LocalLow\Babylon-English\CacheIcons\http___storage_conduit_com_BankImages_RadioSkins_Cornflower_maxi_dn_gif.gif --a---- 392 bytes [19:28 30/10/2010] [19:28 30/10/2010] FFD4FD21F414E073C0552984D0A112F6
C:\Users\Gast\AppData\LocalLow\Babylon-English\CacheIcons\http___storage_conduit_com_BankImages_RadioSkins_Cornflower_maxi_gif.gif --a---- 386 bytes [19:28 30/10/2010] [19:28 30/10/2010] 1F80F67E90A0F0622A0916B03939FAA6
C:\Users\Gast\AppData\LocalLow\Babylon-English\CacheIcons\http___storage_conduit_com_BankImages_RadioSkins_Cornflower_maxi_over_gif.gif --a---- 388 bytes [19:28 30/10/2010] [19:28 30/10/2010] C98A08AA7B34853FC6C0CBB5F374A7AA
C:\Users\Gast\AppData\LocalLow\Babylon-English\CacheIcons\http___storage_conduit_com_BankImages_RadioSkins_Cornflower_minimize_dn_gif.gif --a---- 391 bytes [19:28 30/10/2010] [19:28 30/10/2010] D9985483BE213AEE99753E2BD66B7A4E
C:\Users\Gast\AppData\LocalLow\Babylon-English\CacheIcons\http___storage_conduit_com_BankImages_RadioSkins_Cornflower_minimize_gif.gif --a---- 385 bytes [19:28 30/10/2010] [19:28 30/10/2010] 8C471FEB2DAB502C9C65297C94A46CA1
C:\Users\Gast\AppData\LocalLow\Babylon-English\CacheIcons\http___storage_conduit_com_BankImages_RadioSkins_Cornflower_minimize_over_gif.gif --a---- 387 bytes [19:28 30/10/2010] [19:28 30/10/2010] 8FC858D6AE86BC680644BBD917D2954B
C:\Users\Gast\AppData\LocalLow\Babylon-English\CacheIcons\http___storage_conduit_com_BankImages_RadioSkins_Cornflower_pause_dn_gif.gif --a---- 428 bytes [19:28 30/10/2010] [19:28 30/10/2010] 209A35A2889DBC74DE16FA0A18BFED0F
C:\Users\Gast\AppData\LocalLow\Babylon-English\CacheIcons\http___storage_conduit_com_BankImages_RadioSkins_Cornflower_pause_dn_mini_gif.gif --a---- 428 bytes [19:28 30/10/2010] [19:28 30/10/2010] 209A35A2889DBC74DE16FA0A18BFED0F
C:\Users\Gast\AppData\LocalLow\Babylon-English\CacheIcons\http___storage_conduit_com_BankImages_RadioSkins_Cornflower_pause_gif.gif --a---- 446 bytes [19:28 30/10/2010] [19:28 30/10/2010] 89BA7432788D191C5352F01FCC9B76F7
C:\Users\Gast\AppData\LocalLow\Babylon-English\CacheIcons\http___storage_conduit_com_BankImages_RadioSkins_Cornflower_pause_mini_gif.gif --a---- 446 bytes [19:28 30/10/2010] [19:28 30/10/2010] 89BA7432788D191C5352F01FCC9B76F7
C:\Users\Gast\AppData\LocalLow\Babylon-English\CacheIcons\http___storage_conduit_com_BankImages_RadioSkins_Cornflower_pause_over_gif.gif --a---- 452 bytes [19:28 30/10/2010] [19:28 30/10/2010] 8AC6D62A80DEED7E3E7689F8BFA7FF00
C:\Users\Gast\AppData\LocalLow\Babylon-English\CacheIcons\http___storage_conduit_com_BankImages_RadioSkins_Cornflower_pause_over_mini_gif.gif --a---- 452 bytes [19:28 30/10/2010] [19:28 30/10/2010] 8AC6D62A80DEED7E3E7689F8BFA7FF00
C:\Users\Gast\AppData\LocalLow\Babylon-English\CacheIcons\http___storage_conduit_com_BankImages_RadioSkins_Cornflower_play_chevron_gif.gif --a---- 1007 bytes [19:28 30/10/2010] [19:28 30/10/2010] F9897266FC817421D83726AD3F4402FA
C:\Users\Gast\AppData\LocalLow\Babylon-English\CacheIcons\http___storage_conduit_com_BankImages_RadioSkins_Cornflower_play_dn_gif.gif --a---- 434 bytes [19:28 30/10/2010] [19:28 30/10/2010] 34B7BDFB17C57F1AF3B897D46C1EAB51
C:\Users\Gast\AppData\LocalLow\Babylon-English\CacheIcons\http___storage_conduit_com_BankImages_RadioSkins_Cornflower_play_dn_mini_gif.gif --a---- 434 bytes [19:28 30/10/2010] [19:28 30/10/2010] 34B7BDFB17C57F1AF3B897D46C1EAB51
C:\Users\Gast\AppData\LocalLow\Babylon-English\CacheIcons\http___storage_conduit_com_BankImages_RadioSkins_Cornflower_play_gif.gif --a---- 450 bytes [19:28 30/10/2010] [19:28 30/10/2010] A3D32A3016FEBED303A53F60EAF1460D
C:\Users\Gast\AppData\LocalLow\Babylon-English\CacheIcons\http___storage_conduit_com_BankImages_RadioSkins_Cornflower_play_mini_gif.gif --a---- 450 bytes [19:28 30/10/2010] [19:28 30/10/2010] A3D32A3016FEBED303A53F60EAF1460D
C:\Users\Gast\AppData\LocalLow\Babylon-English\CacheIcons\http___storage_conduit_com_BankImages_RadioSkins_Cornflower_play_over_gif.gif --a---- 448 bytes [19:28 30/10/2010] [19:28 30/10/2010] 7EE1BE7636398D3D8787A77157626087
C:\Users\Gast\AppData\LocalLow\Babylon-English\CacheIcons\http___storage_conduit_com_BankImages_RadioSkins_Cornflower_play_over_mini_gif.gif --a---- 448 bytes [19:28 30/10/2010] [19:28 30/10/2010] 7EE1BE7636398D3D8787A77157626087
C:\Users\Gast\AppData\LocalLow\Babylon-English\CacheIcons\http___storage_conduit_com_BankImages_RadioSkins_Cornflower_slider_bg_gif.gif --a---- 268 bytes [19:28 30/10/2010] [19:28 30/10/2010] 6EDFC45D3FB1E513E0FFDC5A56903EE0
C:\Users\Gast\AppData\LocalLow\Babylon-English\CacheIcons\http___storage_conduit_com_BankImages_RadioSkins_Cornflower_slider_dn_gif.gif --a---- 183 bytes [19:28 30/10/2010] [19:28 30/10/2010] D997C1E61CC7E0E65EFD4BC5391626D9
C:\Users\Gast\AppData\LocalLow\Babylon-English\CacheIcons\http___storage_conduit_com_BankImages_RadioSkins_Cornflower_slider_gif.gif --a---- 185 bytes [19:28 30/10/2010] [19:28 30/10/2010] 563D1C9F00DD64AAE12BFCA9F6CB80B6
C:\Users\Gast\AppData\LocalLow\Babylon-English\CacheIcons\http___storage_conduit_com_BankImages_RadioSkins_Cornflower_slider_over_gif.gif --a---- 184 bytes [19:28 30/10/2010] [19:28 30/10/2010] 19429B842FD45C0EAAF14E7CF55152CD
C:\Users\Gast\AppData\LocalLow\Babylon-English\CacheIcons\http___storage_conduit_com_BankImages_RadioSkins_Cornflower_stop_chevron_gif.gif --a---- 1001 bytes [19:28 30/10/2010] [19:28 30/10/2010] 7428C0515D708D7C3520CF78F85B74FE
C:\Users\Gast\AppData\LocalLow\Babylon-English\CacheIcons\http___storage_conduit_com_BankImages_RadioSkins_Cornflower_stop_dn_gif.gif --a---- 472 bytes [19:28 30/10/2010] [19:28 30/10/2010] 061538EC27DD8AD0E1F04C2AB3792341
C:\Users\Gast\AppData\LocalLow\Babylon-English\CacheIcons\http___storage_conduit_com_BankImages_RadioSkins_Cornflower_stop_gif.gif --a---- 488 bytes [19:28 30/10/2010] [19:28 30/10/2010] 7F1F59D56B3DB314B58E8145A3609136
C:\Users\Gast\AppData\LocalLow\Babylon-English\CacheIcons\http___storage_conduit_com_BankImages_RadioSkins_Cornflower_stop_over_gif.gif --a---- 488 bytes [19:28 30/10/2010] [19:28 30/10/2010] 9715535B015F10700766BEA646B1799E
C:\Users\Gast\AppData\LocalLow\Babylon-English\CacheIcons\http___storage_conduit_com_BankImages_RadioSkins_Cornflower_vol_dn_gif.gif --a---- 477 bytes [19:28 30/10/2010] [19:28 30/10/2010] 1E5590BBA3A66CBCD1AC06C26C9C32B2
C:\Users\Gast\AppData\LocalLow\Babylon-English\CacheIcons\http___storage_conduit_com_BankImages_RadioSkins_Cornflower_vol_gif.gif --a---- 497 bytes [19:28 30/10/2010] [19:28 30/10/2010] 38044D62CB1132027C2F6A89D2AE7E2B
C:\Users\Gast\AppData\LocalLow\Babylon-English\CacheIcons\http___storage_conduit_com_BankImages_RadioSkins_Cornflower_vol_over_gif.gif --a---- 500 bytes [19:28 30/10/2010] [19:28 30/10/2010] 33B6B39AFBDCC17690763D47BB968419
C:\Users\Gast\AppData\LocalLow\Babylon-English\CacheIcons\http___storage_conduit_com_images_ClientImages_radio_gif.gif --a---- 419 bytes [19:28 30/10/2010] [19:28 30/10/2010] 01B83C91554738F6AFFB7895BBBA73FB
C:\Users\Gast\AppData\LocalLow\Babylon-English\CacheIcons\http___storage_conduit_com_images_main_menu_about_gif.gif --a---- 403 bytes [19:28 30/10/2010] [19:28 30/10/2010] EC3C2B4E0DEC4D880BAFF88ABBF94188
C:\Users\Gast\AppData\LocalLow\Babylon-English\CacheIcons\http___storage_conduit_com_images_main_menu_clear_history_gif.gif --a---- 414 bytes [19:28 30/10/2010] [19:28 30/10/2010] A9E001CBC00B06B121DFBC80707F5298
C:\Users\Gast\AppData\LocalLow\Babylon-English\CacheIcons\http___storage_conduit_com_images_main_menu_contact_gif.gif --a---- 278 bytes [19:28 30/10/2010] [19:28 30/10/2010] 15DEF39E438E807E2F0E22D44FDC7FB7
C:\Users\Gast\AppData\LocalLow\Babylon-English\CacheIcons\http___storage_conduit_com_images_main_menu_help_gif.gif --a---- 405 bytes [19:28 30/10/2010] [19:28 30/10/2010] 995595D4C685D659E8F03CD0A287EDDF
C:\Users\Gast\AppData\LocalLow\Babylon-English\CacheIcons\http___storage_conduit_com_images_main_menu_home_page_gif.gif --a---- 405 bytes [19:28 30/10/2010] [19:28 30/10/2010] AA39D8A6B65E208901EBA9F3D4728D3E
C:\Users\Gast\AppData\LocalLow\Babylon-English\CacheIcons\http___storage_conduit_com_images_main_menu_options_gif.gif --a---- 361 bytes [19:28 30/10/2010] [19:28 30/10/2010] 464E244E7E2F27FB85E0C3AB69D72104
C:\Users\Gast\AppData\LocalLow\Babylon-English\CacheIcons\http___storage_conduit_com_images_main_menu_privacy_gif.gif --a---- 425 bytes [19:28 30/10/2010] [19:28 30/10/2010] 6427565C7105DC497287866100F260BB
C:\Users\Gast\AppData\LocalLow\Babylon-English\CacheIcons\http___storage_conduit_com_images_main_menu_refresh_gif.gif --a---- 381 bytes [19:28 30/10/2010] [19:28 30/10/2010] AE7C9F67594A84B096D225601ACB0B2A
C:\Users\Gast\AppData\LocalLow\Babylon-English\CacheIcons\http___storage_conduit_com_images_main_menu_shrink_gif.gif --a---- 351 bytes [19:28 30/10/2010] [19:28 30/10/2010] C3EBA0237D68F665AF6D663906221092
C:\Users\Gast\AppData\LocalLow\Babylon-English\CacheIcons\http___storage_conduit_com_images_main_menu_tell_a_friend_gif.gif --a---- 392 bytes [19:28 30/10/2010] [19:28 30/10/2010] 5E7217A3357550F9749A095631F51015
C:\Users\Gast\AppData\LocalLow\Babylon-English\CacheIcons\http___storage_conduit_com_images_SearchEngines_news_icon_gif.gif --a---- 371 bytes [19:28 30/10/2010] [19:28 30/10/2010] 84896837EDB1A78C14DB6A2F3A0AEE3A
C:\Users\Gast\AppData\LocalLow\Babylon-English\CacheIcons\http___storage_conduit_com_images_searchengines_search_icon_gif.gif --a---- 322 bytes [19:28 30/10/2010] [19:28 30/10/2010] 948781E4B6478290050ECA4423B89B1E
C:\Users\Gast\AppData\LocalLow\Babylon-English\CacheIcons\http___storage_conduit_com_images_SearchEngines_site_search_gif.gif --a---- 625 bytes [19:28 30/10/2010] [19:28 30/10/2010] C23D4DB18B6BB4F38ECBA57AD414A5CF
C:\Users\Gast\AppData\LocalLow\Babylon-English\CacheIcons\http___storage_conduit_com_images_SearchEngines_videosurf_gif.gif --a---- 1035 bytes [19:28 30/10/2010] [19:28 30/10/2010] 7BF61D475BF289E4900EBA788DED51C3
C:\Users\Gast\AppData\LocalLow\Babylon-English\CacheIcons\http___weather_conduit_com_images_weather_Default_sunny_night_gif.gif --a---- 204 bytes [19:28 30/10/2010] [19:28 30/10/2010] 5EBD213E8A460652C883CBF68C152B5B
C:\Users\Gast\AppData\LocalLow\Babylon-English\RadioPlayer\Skins\http___storage_conduit_com_BankImages_RadioSkins_Cornflower_display_xml.xml --a---- 4990 bytes [19:28 30/10/2010] [19:28 30/10/2010] D6927A4A6F3D06DEE1ED14262FDBC344
C:\Users\Gast\AppData\Roaming\Microsoft\Windows\Cookies\gast@search.conduit[1].txt --a---- 135 bytes [19:28 30/10/2010] [19:28 30/10/2010] F18D6EABD0B07602333F0D0A5D8AFFD1
C:\Users\Tobi\AppData\Roaming\Microsoft\Windows\Cookies\tobi@apps.conduit[2].txt --a---- 340 bytes [18:55 06/04/2011] [18:55 06/04/2011] EF8E50D07DFCE6A386BD07D79D749B80
C:\Users\Tobi\AppData\Roaming\Mozilla\Firefox\Profiles\3k9240jg.default\CT2269050\radio\Skins\http___storage_conduit_com_BankImages_RadioSkins_Bluenot e_display_xml.xml --a---- 5803 bytes [15:40 25/03/2011] [15:40 25/03/2011] 6BF50FDA3BC02B1E91036766306A9AB6
C:\Users\Tobi\AppData\Roaming\Mozilla\Firefox\Profiles\3k9240jg.default\CT2720081\radio\Skins\http___storage_conduit_com_BankImages_RadioSkins_Cornflo wer_display_xml.xml --a---- 5811 bytes [08:58 15/09/2010] [08:58 15/09/2010] B84CFFAEE251F105A6714C9C023E6EED
C:\Users\Tobi\Downloads\HSS-2.53-install-chip-389-conduit.exe --a---- 6290264 bytes [12:07 27/06/2012] [12:07 27/06/2012] C46441A5FA27C43B358F132152D37936

Searching for "*PriceGong*"
C:\AdwCleaner\Quarantine\C\ProgramData\Microsoft\Windows\Start Menu\Programs\PriceGong\PriceGong Contact Us.lnk.vir --a---- 990 bytes [19:45 27/10/2013] [19:45 27/10/2013] 44483CA792EF15D57E96B789ABDEB892
C:\AdwCleaner\Quarantine\C\ProgramData\Microsoft\Windows\Start Menu\Programs\PriceGong\PriceGong Help.lnk.vir --a---- 980 bytes [19:45 27/10/2013] [19:45 27/10/2013] 75D73E467BE85764EBA2B78C404CF9E2
C:\AdwCleaner\Quarantine\C\ProgramData\Microsoft\Windows\Start Menu\Programs\PriceGong\PriceGong Homepage.lnk.vir --a---- 960 bytes [19:45 27/10/2013] [19:45 27/10/2013] 55D929065BCA70A02F547CA383C5FE59
C:\AdwCleaner\Quarantine\C\ProgramData\Microsoft\Windows\Start Menu\Programs\PriceGong\Uninstall PriceGong.lnk.vir --a---- 1877 bytes [19:45 27/10/2013] [19:45 27/10/2013] EB8D7BE476963FC3BD236DFCEA94B25E
C:\AdwCleaner\Quarantine\C\Users\Tobi\AppData\Roaming\Mozilla\Firefox\Profiles\3k9240jg.default\Extensions\{17464f93-137e-4646-a0c6-0dc13faf0113}\Chrome\CT3306060\content\logic\priceGongMigration.js.vir --a---- 22528 bytes [16:51 24/10/2013] [16:51 24/10/2013] 25E3686E1228D27ED245F7DC0B524D40

Searching for "*lucky leap*"
C:\Users\Tobi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\lucky leap_iels --a---- 62082 bytes [13:26 28/10/2013] [13:26 28/10/2013] 493791D96EB04257F92952133FC24D52

Searching for "*softonic*"
C:\Users\Tobi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2V65UH42\softonic_de[1].htm --a---- 787 bytes [20:42 09/02/2011] [20:42 09/02/2011] 766E0CBBE0EA52CE8CF2A3F6B3AA4E0D
C:\Users\Tobi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ET1J2FSV\softonic_de[1].htm --a---- 1728 bytes [20:43 09/02/2011] [20:43 09/02/2011] 2EEA8F8CCF2D5B53C91609CFC2F031AF

Searching for "*ParetoLogic*"
No files found.

Searching for "*Searchprotect*"
C:\AdwCleaner\Quarantine\C\Users\Tobi\AppData\LocalLow\Conduit\ChromeExtData\mgfkiacaoocnjfenegjdlccfkkgeeafg\Repository\CT3306060.searchProtectorData .txt.vir --a---- 1236 bytes [21:25 27/10/2013] [21:25 27/10/2013] 38ED8CC1664EEA18C10DDAFD95A4A53D
C:\AdwCleaner\Quarantine\C\Users\Tobi\AppData\Roaming\Mozilla\Firefox\Profiles\3k9240jg.default\Extensions\{17464f93-137e-4646-a0c6-0dc13faf0113}\Chrome\CT3306060\content\tb\al\sp\js\searchProtectorManager.js.vir --a---- 66160 bytes [16:51 24/10/2013] [16:51 24/10/2013] 85806204672BC42993A2A6AD72C7991E
C:\AdwCleaner\Quarantine\C\Users\Tobi\AppData\Roaming\Mozilla\Firefox\Profiles\3k9240jg.default\Extensions\{17464f93-137e-4646-a0c6-0dc13faf0113}\Chrome\CT3306060\content\tb\al\sp\spsd\SearchProtector.css.vir --a---- 3155 bytes [16:51 24/10/2013] [16:51 24/10/2013] 350457057794FF554057A92EBA8BDD4B
C:\Users\Tobi\AppData\Roaming\Mozilla\Firefox\Profiles\3k9240jg.default\CT2269050\Dialogs\SearchProtectorDialog\SearchProtector.css --a---- 6675 bytes [15:40 25/03/2011] [08:21 29/12/2010] F06736BC4ED7B0948AD15F90BE536BB2
C:\Users\Tobi\AppData\Roaming\Mozilla\Firefox\Profiles\3k9240jg.default\CT2269050\Dialogs\SearchProtectorDialog\SearchProtector.js --a---- 8909 bytes [15:40 25/03/2011] [08:21 29/12/2010] CC93F80B7D98BED17116A895E72280C0

Searching for "*facemoods*"
No files found.

========== folderfind ==========

Searching for "*hotspot shield*"
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Hotspot Shield d------ [12:47 27/06/2012]
C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Hotspot Shield d------ [12:47 27/06/2012]
C:\Windows\SysWOW64\Hotspot Shield d------ [16:09 12/07/2012]

Searching for "*splashtop*"
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Splashtop d------ [17:14 31/10/2013]
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Splashtop\Splashtop Remote d------ [17:14 31/10/2013]
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Splashtop\Splashtop Software Updater d------ [17:14 31/10/2013]
C:\AdwCleaner\Quarantine\C\ProgramData\Splashtop d------ [17:14 31/10/2013]
C:\AdwCleaner\Quarantine\C\ProgramData\Splashtop\Splashtop Software Updater d------ [17:14 31/10/2013]
C:\AdwCleaner\Quarantine\C\Users\Tobi\AppData\Local\Splashtop d------ [17:14 31/10/2013]
C:\AdwCleaner\Quarantine\C\Users\Tobi\AppData\Local\Splashtop\Splashtop Remote d------ [17:14 31/10/2013]
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Splashtop Remote d------ [18:40 16/09/2013]
C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Splashtop Remote d------ [18:40 16/09/2013]

Searching for "*Conduit*"
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Conduit d------ [17:14 31/10/2013]
C:\AdwCleaner\Quarantine\C\Users\Gast\AppData\LocalLow\Conduit d------ [17:14 31/10/2013]
C:\AdwCleaner\Quarantine\C\Users\Tobi\AppData\LocalLow\Conduit d------ [17:14 31/10/2013]
C:\AdwCleaner\Quarantine\C\Users\Tobi\AppData\Roaming\Mozilla\Firefox\Profiles\3k9240jg.default\Conduit d------ [17:14 31/10/2013]
C:\Users\Gast\AppData\LocalLow\Babylon-English\Repository\conduit_CT2720081_CT2720081 d------ [19:28 30/10/2010]

Searching for "*PriceGong*"
C:\AdwCleaner\Quarantine\C\ProgramData\Microsoft\Windows\Start Menu\Programs\PriceGong d------ [17:14 31/10/2013]
C:\AdwCleaner\Quarantine\C\Users\Tobi\AppData\LocalLow\PriceGong d------ [17:14 31/10/2013]

Searching for "*lucky leap*"
No folders found.

Searching for "*softonic*"
No folders found.

Searching for "*ParetoLogic*"
C:\AdwCleaner\Quarantine\C\Users\Tobi\AppData\Roaming\ParetoLogic d------ [17:14 31/10/2013]

Searching for "*Searchprotect*"
C:\AdwCleaner\Quarantine\C\Users\Gast\AppData\Roaming\Searchprotect d------ [17:14 31/10/2013]
C:\AdwCleaner\Quarantine\C\Users\Tobi\AppData\Roaming\Searchprotect d------ [17:14 31/10/2013]
C:\Users\Tobi\AppData\Roaming\Mozilla\Firefox\Profiles\3k9240jg.default\CT2269050\Dialogs\SearchProtectorDialog d------ [15:40 25/03/2011]

Searching for "*facemoods*"
No folders found.

========== regfind ==========

Searching for "hotspot shield"
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\LowRegistry\Audio\PolicyConfig\PropertyStore\849969f4_0]
@="{0.0.0.00000000}.{efe3a751-d248-4877-8152-3a4fb36fa9c0}|\Device\HarddiskVolume2\Program Files (x86)\Hotspot Shield\bin\fbw.exe%b{00000000-0000-0000-0000-000000000000}"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\HssIE.HssIEApp]
@="Hotspot Shield Class"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\HssIE.HssIEApp.1]
@="Hotspot Shield Class"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{E69D4A59-73DE-4E38-9FB3-740EC4D9060D}\1.0]
@="Hotspot Shield Class 1.0 Type Library"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{E69D4A59-73DE-4E38-9FB3-740EC4D9060D}\1.0\0\win32]
@="C:\Program Files (x86)\Hotspot Shield\HssIE\HssIE.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{E69D4A59-73DE-4E38-9FB3-740EC4D9060D}\1.0\0\win64]
@="C:\Program Files (x86)\Hotspot Shield\HssIE\HssIE_64.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{E69D4A59-73DE-4E38-9FB3-740EC4D9060D}\1.0\HELPDIR]
@="C:\Program Files (x86)\Hotspot Shield\HssIE"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{E69D4A59-73DE-4E38-9FB3-740EC4D9060D}\1.0]
@="Hotspot Shield Class 1.0 Type Library"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{E69D4A59-73DE-4E38-9FB3-740EC4D9060D}\1.0\0\win32]
@="C:\Program Files (x86)\Hotspot Shield\HssIE\HssIE.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{E69D4A59-73DE-4E38-9FB3-740EC4D9060D}\1.0\0\win64]
@="C:\Program Files (x86)\Hotspot Shield\HssIE\HssIE_64.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{E69D4A59-73DE-4E38-9FB3-740EC4D9060D}\1.0\HELPDIR]
@="C:\Program Files (x86)\Hotspot Shield\HssIE"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\HotspotShield]
"DisplayName"="Hotspot Shield 2.67"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\HotspotShield]
"UninstallString"="C:\Program Files (x86)\Hotspot Shield\Uninstall.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\HotspotShield]
"DisplayIcon"="C:\Program Files (x86)\Hotspot Shield\hss.ico"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\HotspotShield]
"InstallLocation"="C:\Program Files (x86)\Hotspot Shield"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\TypeLib\{E69D4A59-73DE-4E38-9FB3-740EC4D9060D}\1.0]
@="Hotspot Shield Class 1.0 Type Library"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\TypeLib\{E69D4A59-73DE-4E38-9FB3-740EC4D9060D}\1.0\0\win32]
@="C:\Program Files (x86)\Hotspot Shield\HssIE\HssIE.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\TypeLib\{E69D4A59-73DE-4E38-9FB3-740EC4D9060D}\1.0\0\win64]
@="C:\Program Files (x86)\Hotspot Shield\HssIE\HssIE_64.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\TypeLib\{E69D4A59-73DE-4E38-9FB3-740EC4D9060D}\1.0\HELPDIR]
@="C:\Program Files (x86)\Hotspot Shield\HssIE"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Network\{4d36e974-e325-11ce-bfc1-08002be10318}\{8C234F07-8619-461A-8469-743444755330}]
"LocDescription"="@oem111.inf,%hssdrv6_desc%;Hotspot Shield Routing Driver 6"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Network\{4d36e974-e325-11ce-bfc1-08002be10318}\{8C234F07-8619-461A-8469-743444755330}]
"Description"="Hotspot Shield Routing Driver 6"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Network\{4d36e974-e325-11ce-bfc1-08002be10318}\{8C234F07-8619-461A-8469-743444755330}\Ndi]
"HelpText"="Hotspot Shield Routing Driver 6"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_HSSDRV6\0000]
"DeviceDesc"="Hotspot Shield Routing Driver 6"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\eventlog\Application\HssSrv]
"EventMessageFile"="C:\Program Files (x86)\Hotspot Shield\HssWPR\hsssrv.exe"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\eventlog\Application\HssWd]
"EventMessageFile"="C:\Program Files (x86)\Hotspot Shield\bin\hsswd.exe"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\HssDRV6]
"DisplayName"="Hotspot Shield Routing Driver 6"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\HssDRV6]
"Description"="Hotspot Shield Routing Driver 6"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\HssSrv]
"ImagePath"="C:\Program Files (x86)\Hotspot Shield\HssWPR\hsssrv.exe"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\HssSrv]
"DisplayName"="Hotspot Shield Routing Service"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\Network\{4d36e974-e325-11ce-bfc1-08002be10318}\{8C234F07-8619-461A-8469-743444755330}]
"LocDescription"="@oem111.inf,%hssdrv6_desc%;Hotspot Shield Routing Driver 6"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\Network\{4d36e974-e325-11ce-bfc1-08002be10318}\{8C234F07-8619-461A-8469-743444755330}]
"Description"="Hotspot Shield Routing Driver 6"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\Network\{4d36e974-e325-11ce-bfc1-08002be10318}\{8C234F07-8619-461A-8469-743444755330}\Ndi]
"HelpText"="Hotspot Shield Routing Driver 6"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_HSSDRV6\0000]
"DeviceDesc"="Hotspot Shield Routing Driver 6"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\eventlog\Application\HssSrv]
"EventMessageFile"="C:\Program Files (x86)\Hotspot Shield\HssWPR\hsssrv.exe"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\eventlog\Application\HssWd]
"EventMessageFile"="C:\Program Files (x86)\Hotspot Shield\bin\hsswd.exe"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\hshld]
"ImagePath"="C:\Program Files (x86)\Hotspot Shield\bin\openvpnas.exe"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\hshld]
"DisplayName"="Hotspot Shield Service"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\HssDRV6]
"DisplayName"="Hotspot Shield Routing Driver 6"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\HssDRV6]
"Description"="Hotspot Shield Routing Driver 6"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\HssSrv]
"ImagePath"="C:\Program Files (x86)\Hotspot Shield\HssWPR\hsssrv.exe"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\HssSrv]
"DisplayName"="Hotspot Shield Routing Service"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\HssTrayService]
"ImagePath"="C:\Program Files (x86)\Hotspot Shield\bin\HssTrayService.EXE"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\HssTrayService]
"DisplayName"="Hotspot Shield Tray Service"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\HssWd]
"ImagePath"="C:\Program Files (x86)\Hotspot Shield\bin\hsswd.exe"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\HssWd]
"DisplayName"="Hotspot Shield Monitoring Service"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Network\{4d36e974-e325-11ce-bfc1-08002be10318}\{8C234F07-8619-461A-8469-743444755330}]
"LocDescription"="@oem111.inf,%hssdrv6_desc%;Hotspot Shield Routing Driver 6"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Network\{4d36e974-e325-11ce-bfc1-08002be10318}\{8C234F07-8619-461A-8469-743444755330}]
"Description"="Hotspot Shield Routing Driver 6"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Network\{4d36e974-e325-11ce-bfc1-08002be10318}\{8C234F07-8619-461A-8469-743444755330}\Ndi]
"HelpText"="Hotspot Shield Routing Driver 6"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_HSSDRV6\0000]
"DeviceDesc"="Hotspot Shield Routing Driver 6"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\eventlog\Application\HssSrv]
"EventMessageFile"="C:\Program Files (x86)\Hotspot Shield\HssWPR\hsssrv.exe"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\eventlog\Application\HssWd]
"EventMessageFile"="C:\Program Files (x86)\Hotspot Shield\bin\hsswd.exe"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\HssDRV6]
"DisplayName"="Hotspot Shield Routing Driver 6"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\HssDRV6]
"Description"="Hotspot Shield Routing Driver 6"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\HssSrv]
"ImagePath"="C:\Program Files (x86)\Hotspot Shield\HssWPR\hsssrv.exe"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\HssSrv]
"DisplayName"="Hotspot Shield Routing Service"
[HKEY_USERS\S-1-5-21-1788506443-3028426188-325919347-1000\Software\Microsoft\Internet Explorer\LowRegistry\Audio\PolicyConfig\PropertyStore\849969f4_0]
@="{0.0.0.00000000}.{efe3a751-d248-4877-8152-3a4fb36fa9c0}|\Device\HarddiskVolume2\Program Files (x86)\Hotspot Shield\bin\fbw.exe%b{00000000-0000-0000-0000-000000000000}"

Searching for "splashtop"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\49AE5C7BA69B5F14EB59527DB8846687]
"ProductName"="Splashtop Streamer"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders]
"C:\Program Files (x86)\Splashtop\Splashtop Remote\"="1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders]
"C:\Program Files (x86)\Splashtop\"="1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders]
"C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\"="1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders]
"C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\"="1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders]
"C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\GamePad\"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders]
"C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\GamePad\64bits\"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders]
"C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\GamePad\utils\"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders]
"C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\Monitor\"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders]
"C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\Monitor\64bits\"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders]
"C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\Monitor\utils\"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders]
"C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\plugin\"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders]
"C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\STRLOG\"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders]
"C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\VirtualDriver\"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders]
"C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\VirtualDriver\64bits\"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders]
"C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\VirtualDriver\utils\"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\20CECA54879277493404313CD6890EB7]
"49AE5C7BA69B5F14EB59527DB8846687"="C?\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\Monitor\64bits\stdpms.sys"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2B2414A531724EEC45EDE7690160FA3D]
"49AE5C7BA69B5F14EB59527DB8846687"="C?\Program Files (x86)\Splashtop\Splashtop Remote\Server\plugin\SRAppAnnotation.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3768BF67C4637A52ED2CC3340D43A320]
"49AE5C7BA69B5F14EB59527DB8846687"="C?\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\GamePad\utils\DIFxCmd.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3C7288D337F37DA44902C79A63358C2F]
"49AE5C7BA69B5F14EB59527DB8846687"="C:\Program Files (x86)\Splashtop\Splashtop Remote\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\40235660010496C8DAA0892237640801]
"49AE5C7BA69B5F14EB59527DB8846687"="C?\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\GamePad\64bits\stgamepad.sys"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4607BBDAF114395E9D10AEBCB38A51E4]
"49AE5C7BA69B5F14EB59527DB8846687"="C?\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\GamePad\install_driver.bat"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\5F787B4E4695DF42D16FE5E5BA27F520]
"49AE5C7BA69B5F14EB59527DB8846687"="C?\Program Files (x86)\Splashtop\Splashtop Remote\Server\STRLOG\splashtop.bl"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7AE464B99BB734C35AD576F3E72D438E]
"49AE5C7BA69B5F14EB59527DB8846687"="C?\Program Files (x86)\Splashtop\Splashtop Remote\Server\VirtualDriver\64bits\WdfCoInstaller01009.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\877F2473CAB892795AEB17D29AEB9BA5]
"49AE5C7BA69B5F14EB59527DB8846687"="C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9DC5E90F195992C1C3B07A4804C42124]
"49AE5C7BA69B5F14EB59527DB8846687"="C?\Program Files (x86)\Splashtop\Splashtop Remote\Server\VirtualDriver\utils\DIFxCmd.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A716CE40278A2348249A10CCE2A0EB25]
"49AE5C7BA69B5F14EB59527DB8846687"="C?\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\Monitor\install_driver.bat"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\BA835B16902BB10C9FC50B0A3501452D]
"49AE5C7BA69B5F14EB59527DB8846687"="C?\Program Files (x86)\Splashtop\Splashtop Remote\Server\Acknowledgements.htm"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D1D53133076D525BDDECAB0ADE4EE396]
"49AE5C7BA69B5F14EB59527DB8846687"="C?\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\Monitor\utils\DIFxCmd.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F8C17DEA9BEF980FEDCE8C4666F20A9E]
"49AE5C7BA69B5F14EB59527DB8846687"="C?\Program Files (x86)\Splashtop\Splashtop Remote\Server\VirtualDriver\WdfCoInstaller01009.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\49AE5C7BA69B5F14EB59527DB8846687\InstallProperties]
"HelpLink"="hxxp://www.splashtop.com/remote"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\49AE5C7BA69B5F14EB59527DB8846687\InstallProperties]
"InstallLocation"="C:\Program Files (x86)\Splashtop\Splashtop Remote\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\49AE5C7BA69B5F14EB59527DB8846687\InstallProperties]
"Publisher"="Splashtop Inc."
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\49AE5C7BA69B5F14EB59527DB8846687\InstallProperties]
"URLInfoAbout"="hxxp://www.splashtop.com/remote"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\49AE5C7BA69B5F14EB59527DB8846687\InstallProperties]
"DisplayName"="Splashtop Streamer"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{B7C5EA94-B96A-41F5-BE95-25D78B486678}]
"HelpLink"="hxxp://www.splashtop.com/remote"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{B7C5EA94-B96A-41F5-BE95-25D78B486678}]
"InstallLocation"="C:\Program Files (x86)\Splashtop\Splashtop Remote\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{B7C5EA94-B96A-41F5-BE95-25D78B486678}]
"Publisher"="Splashtop Inc."
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{B7C5EA94-B96A-41F5-BE95-25D78B486678}]
"URLInfoAbout"="hxxp://www.splashtop.com/remote"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{B7C5EA94-B96A-41F5-BE95-25D78B486678}]
"DisplayName"="Splashtop Streamer"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\SplashtopRemoteService]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\SplashtopRemoteService]
"ImagePath"=""C:\Program Files (x86)\Splashtop\Splashtop Remote\SERVER\SRService.exe""
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\SplashtopRemoteService]
"DisplayName"="Splashtop® Remote Service"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\SplashtopRemoteService]
"Description"="Splashtop Remote Streamer"
[HKEY_USERS\Gast\Software\Splashtop Inc.]
[HKEY_USERS\Gast\Software\Splashtop Inc.\Splashtop Remote Server]

Searching for "Conduit"
[HKEY_LOCAL_MACHINE\SOFTWARE\DivX\Install\Setup\WizardLayout\ConduitToolbar]
[HKEY_LOCAL_MACHINE\SOFTWARE\DivX\Install\Setup\WizardLayout\ConduitToolbar]
"PageId"="ConduitToolbar"
[HKEY_USERS\Gast\Software\AppDataLow\Software\Babylon-English\toolbar]
"Server"="users.conduit.com"
[HKEY_USERS\Gast\Software\AppDataLow\Software\Babylon-English\toolbar]
"GroupingServerURL"="hxxp://grouping.services.conduit.com/"
[HKEY_USERS\Gast\Software\AppDataLow\Software\Babylon-English\toolbar]
"PrivacyPageURL"="hxxp://www.conduit.com/privacy/Default.aspx"
[HKEY_USERS\Gast\Software\AppDataLow\Software\Babylon-English\toolbar]
"UsageURL"="hxxp://usage.users.conduit.com/UsersWebService.asmx/UsersRequests"
[HKEY_USERS\Gast\Software\AppDataLow\Software\Babylon-English\toolbar]
"ClientLogURL"="hxxp://clientlog.users.conduit.com/ClientDiagnostics.asmx/ReportDiagnosticsEvent"
[HKEY_USERS\Gast\Software\AppDataLow\Software\Babylon-English\toolbar]
"UninstallURL"="hxxp://uninstall.users.conduit.com/Uninstall.asmx/RegisterToolbarUninstallation"
[HKEY_USERS\Gast\Software\AppDataLow\Software\Babylon-English\toolbar]
"SearchServerUrl"="hxxp://search.conduit.com"
[HKEY_USERS\Gast\Software\AppDataLow\Software\Babylon-English\toolbar\Repository\conduit_CT2720081]
[HKEY_USERS\Gast\Software\AppDataLow\Software\Babylon-English\toolbar\Repository\conduit_CT2720081\AppsMetaData]
"ServiceUrl"="hxxp://appsmetadata.toolbar.conduit-services.com/?ctid=EB_TOOLBAR_ID"
[HKEY_USERS\Gast\Software\AppDataLow\Software\Babylon-English\toolbar\Repository\conduit_CT2720081\AppTrackingFirstTime]
"ServiceUrl"="hxxp://tracking.usage.app.conduit-services.com/FirstTime.ashx"
[HKEY_USERS\Gast\Software\AppDataLow\Software\Babylon-English\toolbar\Repository\conduit_CT2720081\AppTrackingUsage]
"ServiceUrl"="hxxp://tracking.usage.app.conduit-services.com/Usage.ashx"
[HKEY_USERS\Gast\Software\AppDataLow\Software\Babylon-English\toolbar\Repository\conduit_CT2720081\BrowserToolbarsInfo]
"ServiceUrl"="hxxp://counting.usage.toolbar.conduit-services.com/usage.ashx"
[HKEY_USERS\Gast\Software\AppDataLow\Software\Babylon-English\toolbar\Repository\conduit_CT2720081\DynamicDialogs]
"ServiceUrl"="hxxp://dynamicdialogs.toolbar.conduit-services.com/EB_BROWSER_TYPE/DLG.pkg?ver=EB_TOOLBAR_VERSION"
[HKEY_USERS\Gast\Software\AppDataLow\Software\Babylon-English\toolbar\Repository\conduit_CT2720081\GottenAppsContextMenu]
"ServiceUrl"="hxxp://contextmenu.toolbar.conduit-services.com/?name=GottenApps&locale=EB_LOCALE"
[HKEY_USERS\Gast\Software\AppDataLow\Software\Babylon-English\toolbar\Repository\conduit_CT2720081\OtherAppsContextMenu]
"ServiceUrl"="hxxp://contextmenu.toolbar.conduit-services.com/?name=OtherApps&locale=EB_LOCALE"
[HKEY_USERS\Gast\Software\AppDataLow\Software\Babylon-English\toolbar\Repository\conduit_CT2720081\SharedAppsContextMenu]
"ServiceUrl"="hxxp://contextmenu.toolbar.conduit-services.com/?name=SharedApps&locale=EB_LOCALE"
[HKEY_USERS\Gast\Software\AppDataLow\Software\Babylon-English\toolbar\Repository\conduit_CT2720081\ToolbarAppComponentUsage]
"ServiceUrl"="hxxp://component.usage.toolbar.conduit-services.com/ToolbarComponentUsage.ashx"
[HKEY_USERS\Gast\Software\AppDataLow\Software\Babylon-English\toolbar\Repository\conduit_CT2720081\ToolbarAppUsage]
"ServiceUrl"="hxxp://usage.toolbar.conduit-services.com/ToolbarUsage.ashx"
[HKEY_USERS\Gast\Software\AppDataLow\Software\Babylon-English\toolbar\Repository\conduit_CT2720081\ToolbarComponentUsage]
"ServiceUrl"="hxxp://component.usage.toolbar.conduit-services.com/ToolbarComponentUsage.ashx"
[HKEY_USERS\Gast\Software\AppDataLow\Software\Babylon-English\toolbar\Repository\conduit_CT2720081\ToolbarContextMenu]
"ServiceUrl"="hxxp://contextmenu.toolbar.conduit-services.com/?name=Toolbar&locale=EB_LOCALE"
[HKEY_USERS\Gast\Software\AppDataLow\Software\Babylon-English\toolbar\Repository\conduit_CT2720081\ToolbarLogin]
"ServiceUrl"="hxxp://login.toolbar.conduit-services.com/Login.ashx"
[HKEY_USERS\Gast\Software\AppDataLow\Software\Babylon-English\toolbar\Repository\conduit_CT2720081\ToolbarSettings]
"ServiceUrl"="hxxp://settings.toolbar.conduit-services.com/?ctid=EB_TOOLBAR_ID&octid=EB_ORIGINAL_CTID"
[HKEY_USERS\Gast\Software\AppDataLow\Software\Babylon-English\toolbar\Repository\conduit_CT2720081\ToolbarSettingsForPublisher]
"ServiceUrl"="hxxp://settings.publisher.toolbar.conduit-services.com/?ctid=EB_TOOLBAR_ID&octid=EB_ORIGINAL_CTID"
[HKEY_USERS\Gast\Software\AppDataLow\Software\Babylon-English\toolbar\Repository\conduit_CT2720081\ToolbarTranslation]
"ServiceUrl"="hxxp://translation.toolbar.conduit-services.com/?locale=EB_LOCALE"
[HKEY_USERS\Gast\Software\AppDataLow\Software\Babylon-English\toolbar\Repository\conduit_CT2720081\ToolbarUsage]
"ServiceUrl"="hxxp://usage.toolbar.conduit-services.com/ToolbarUsage.ashx"
[HKEY_USERS\Gast\Software\AppDataLow\Software\Babylon-English\toolbar\Repository\conduit_CT2720081_CT2720081]
[HKEY_USERS\Gast\Software\AppDataLow\Software\Babylon-English\toolbar\Repository\MetaData\1139185862]
"dbname"="conduit_CT2720081_CT2720081"
[HKEY_USERS\Gast\Software\AppDataLow\Software\Babylon-English\toolbar\Repository\MetaData\2401896474]
"dbname"="conduit_CT2720081_CT2720081"
[HKEY_USERS\Gast\Software\AppDataLow\Software\Babylon-English\toolbar\Repository\MetaData\3710352569]
"dbname"="conduit_CT2720081_CT2720081"
[HKEY_USERS\Gast\Software\AppDataLow\Software\Babylon-English\toolbar\settings]
"HomePageUrl"="hxxp://search.babylon.com/?babsrc=conduit"
[HKEY_USERS\Gast\Software\AppDataLow\Software\Babylon-English\toolbar\settings]
"SearchFromAdressUrl"="hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2720081&q=MYSEARCHTERM"
[HKEY_USERS\Gast\Software\AppDataLow\Software\Babylon-English\toolbar\settings\LanguagePack]
"LanguagePackServerUrl"="hxxp://translation.users.conduit.com/Translation.ashx"
[HKEY_USERS\Gast\Software\AppDataLow\Software\Babylon-English\toolbar\settings\MyStuff]
"ServiceURL"="hxxp://mystuff.conduit-services.com/MyStuffService.ashx?ComponentId=EB_MY_STUFF_INSTANCE_GUID&lut=EB_MY_STUFF_LUT"
[HKEY_USERS\Gast\Software\AppDataLow\Software\Babylon-English\toolbar\settings\MyStuff]
"AddStuffLink"="hxxp://Apps.conduit.com/search?q=SEARCH_TERM&SearchSourceOrigin=29&ctid=EB_TOOLBAR_ID&octid=EB_ORIGINAL_CTID"
[HKEY_USERS\Gast\Software\AppDataLow\Software\Babylon-English\toolbar\settings\MyStuff]
"ConduitEnable"="TRUE"
[HKEY_USERS\Gast\Software\AppDataLow\Software\Babylon-English\toolbar\settings\RadioPlayer]
"ServerUrl"="hxxp://radio.services.conduit.com/RadioRequest.ctp"
[HKEY_USERS\Gast\Software\AppDataLow\Software\Babylon-English\toolbar\settings\Search\Settings]
"ContextMenuSearchUrl"="hxxp://search.conduit.com/ResultsExt.aspx?q=MYSEARCHTERM&ctid=EB_CTID&octid=EB_ORIGINAL_CTID&SearchSource=8"
[HKEY_USERS\Gast\Software\AppDataLow\Software\Babylon-English\toolbar\settings\SearchInNewTab]
"AboutTabsDataUrlConduit"="hxxp://newtab.conduit-hosting.com/newtab/?ctid=EB_TOOLBAR_ID"
[HKEY_USERS\Gast\Software\AppDataLow\Software\Babylon-English\toolbar\settings\SearchInNewTab]
"AboutTabsEnabledByConduit"="TRUE"
[HKEY_USERS\Gast\Software\AppDataLow\Software\Babylon-English\toolbar\settings\SearchInNewTab]
"AboutTabsUsageUrl"="hxxp://Usage.Hosting.conduit-services.com/UsageService.asmx/UsersRequests?ctid=EB_TOOLBAR_ID"
[HKEY_USERS\Gast\Software\AppDataLow\Software\Babylon-English\toolbar\settings\Update]
"ModuleURL"="hxxp://ieupdate.conduit.com/ver5.7.3.1/tbedrs.dll"
[HKEY_USERS\Gast\Software\AppDataLow\Software\Babylon-English\toolbar\settings\Upgrade]
"ModuleURL"="hxxp://ieupgrade.conduit-download.com/IEUpgrade/ver5.7.3.1/tbedrs.dll"
[HKEY_USERS\Gast\Software\AppDataLow\Software\Babylon-English\toolbar\settings\Weather]
"SearchServerUrl"="hxxp://search.conduit.com/"
[HKEY_USERS\Gast\Software\AppDataLow\Software\Babylon-English\toolbar\settings\Weather\en]
"Forecast"="<FORECAST><LOCATION_ID>UKXX0085</LOCATION_ID><DAYS><DAY1><DATE>20101030</DATE><DAY>Saturday</DAY><F_MIN>51</F_MIN><F_MAX>55</F_MAX><C_MIN>10</C_MIN><C_MAX>12</C_MAX><UV_DESCRIPTION>Low</UV_DESCRIPTION><UV_INDEX>1</UV_INDEX><SUNSET>5:37 pm</SUNSET><SUNRISE>7:50 am</SUNRISE><MOONRISE>11:59 pm</MOONRISE><MOONSET>2:23 pm</MOONSET><MOON_PHASE>Last Quarter</MOON_PHASE><CONDITION_DESCRIPTION>Partly Cloudy</CONDITION_DESCRIPTION><CONDITION_ICON>hxxp://weather.conduit.com/images/weather/Default/partly_cloudy_big.gif</CONDITION_ICON></DAY1><DAY2><DATE>20101031</DATE><DAY>Sunday</DAY><F_MIN>48</F_MIN><F_MAX>55</F_MAX><C_MIN>8</C_MIN><C_MAX>12</C_MAX><UV_DESCRIPTION>Low</UV_DESCRIPTION><UV_INDEX>1</UV_INDEX><SUNSET>5:35 pm</SUNSET><SUNRISE>7:51 am</SUNRISE><MOONRISE>12:10 am</MOONRISE><MOONSET>2:46 pm</MOONSET><MOON_PHASE>Waning Crescent</MOON_PHASE><CONDITION_DESCRIPTION>Showers</CONDITION_DESCRIPTION><CONDITION_ICON>
[HKEY_USERS\Gast\Software\AppDataLow\Software\Conduit]
[HKEY_USERS\Gast\Software\AppDataLow\Software\Conduit\Community Alerts\Data\Feeds\1076571]
"Url"="hxxp://alerts.conduit-services.com/?aid=1080867&fid=1076571"
[HKEY_USERS\Gast\Software\AppDataLow\Software\Conduit\Community Alerts\Data\Feeds\1108070]
"Url"="hxxp://alerts.conduit-services.com/?aid=1112366&fid=1108070"
[HKEY_USERS\Gast\Software\AppDataLow\Software\Conduit\Community Alerts\Settings]
"ALPServicesServerName"="hxxp://alert.services.conduit.com"
[HKEY_USERS\Gast\Software\AppDataLow\Software\Conduit\Community Alerts\Settings]
"ALPClientsServerName"="hxxp://alert.client.conduit.com"
[HKEY_USERS\Gast\Software\AppDataLow\Software\Conduit\Community Alerts\Settings]
"AutoUpdateServerName"="hxxp://alert.storage.conduit.com"
[HKEY_USERS\Gast\Software\AppDataLow\Software\Conduit\Toolbar\Facebook\InfoService\hxxp://facebook.conduit-services.com/Settings.ashx?locale=en&browserType=IE&toolbarVersion=5.7.2.2]
[HKEY_USERS\Gast\Software\AppDataLow\Software\Conduit\Toolbar\Facebook\InfoService\hxxp://facebook.conduit-services.com/Settings.ashx?locale=en&browserType=IE&toolbarVersion=5.7.3.1]
[HKEY_USERS\Gast\Software\AppDataLow\Software\conduitEngine]
[HKEY_USERS\Gast\Software\AppDataLow\Software\conduitEngine\toolbar]
"ToolbarDllName"="ConduitEngine.dll"
[HKEY_USERS\Gast\Software\AppDataLow\Software\conduitEngine\toolbar\Repository\conduit_ConduitEngine]
[HKEY_USERS\Gast\Software\AppDataLow\Software\DVDVideoSoftTB\toolbar]
"Server"="users.conduit.com"
[HKEY_USERS\Gast\Software\AppDataLow\Software\DVDVideoSoftTB\toolbar]
"UsageURL"="hxxp://usage.users.conduit.com/UsersWebService.asmx/UsersRequests"
[HKEY_USERS\Gast\Software\AppDataLow\Software\DVDVideoSoftTB\toolbar]
"GroupingServerURL"="hxxp://services.conduit.com/"
[HKEY_USERS\Gast\Software\AppDataLow\Software\DVDVideoSoftTB\toolbar]
"SearchServerUrl"="hxxp://search.conduit.com"
[HKEY_USERS\Gast\Software\AppDataLow\Software\DVDVideoSoftTB\toolbar\Repository\conduit_CT2269050]
[HKEY_USERS\Gast\Software\AppDataLow\Software\DVDVideoSoftTB\toolbar\settings]
"SearchFromAdressUrl"="hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2269050&amp;q=MYSEARCHTERM"
[HKEY_USERS\Gast\Software\AppDataLow\Software\DVDVideoSoftTB\toolbar\settings]
"SocialDomains"="hxxp://apps.conduit.com; hxxp://social.conduit.com"
[HKEY_USERS\Gast\Software\AppDataLow\Software\DVDVideoSoftTB\toolbar\settings\LanguagePack]
"LanguagePackServerUrl"="hxxp://translation.users.conduit.com/Translation.ashx"
[HKEY_USERS\Gast\Software\AppDataLow\Software\softonic-de3\toolbar]
"GroupingServerURL"="hxxp://grouping.services.conduit.com/"
[HKEY_USERS\Gast\Software\AppDataLow\Software\softonic-de3\toolbar]
"SearchServerUrl"="hxxp://search.conduit.com"
[HKEY_USERS\Gast\Software\AppDataLow\Software\softonic-de3\toolbar]
"Server"="users.conduit.com"
[HKEY_USERS\Gast\Software\AppDataLow\Software\softonic-de3\toolbar]
"UsageURL"="hxxp://usage.users.conduit.com/UsersWebService.asmx/UsersRequests"
[HKEY_USERS\Gast\Software\AppDataLow\Software\softonic-de3\toolbar\Repository\conduit_CT2431245]
[HKEY_USERS\Gast\Software\AppDataLow\Software\softonic-de3\toolbar\settings]
"SearchFromAdressUrl"="hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2431245&amp;q=MYSEARCHTERM"
[HKEY_USERS\Gast\Software\AppDataLow\Software\softonic-de3\toolbar\settings\LanguagePack]
"LanguagePackServerUrl"="hxxp://translation.users.conduit.com/Translation.ashx"
[HKEY_USERS\Gast\Software\Conduit]
[HKEY_USERS\Gast\Software\SearchProtect\ffprotect]
"ffSettings"="{"dialogDelaySec":"10", "preventDialogDisplayTimeSec":"259200", "homepage" : {"enabled" : true, "maxProtectionCount": 83},"aggressiveTakeoverWindowSec": 60,"gaTrackingId": "UA-29372977-3" ,"usageUrl": "hxxp://sp-usage.conduit-data.com","aliveUsageUrl": "hxxp://sp-alive-msg.conduit-data.com","aliveUsageIntervalInSec": 7200, "profiles" : {"C:\\Users\\Gast\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\ph2vv4tt.default":1} , "usageData" : {"SP_ID" : "SPA25EDD87-D5F7-4858-B532-E969A8C5C9B3","SP_version" : "1.7.0.72","owner_type" : "ctid","owner_ID" : "","owner_version" : "","owner_userid" : "","OS" : "Microsoft Windows 7 Home Premium Edition Service Pack 1 (build 7601) 64-bit","OS_version" : "6.1","browser" : "Firefox","browser_version" : "24.0 (de)","install_DATE" : "20131025", "environment" : ""}}"

Searching for "PriceGong"
No data found.

Searching for "lucky leap"
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-1788506443-3028426188-325919347-1000\Software\lucky leap]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\eventlog\Application\Update lucky leap]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\eventlog\Application\Util lucky leap]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\eventlog\Application\Update lucky leap]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\eventlog\Application\Util lucky leap]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\eventlog\Application\Update lucky leap]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\eventlog\Application\Util lucky leap]
[HKEY_USERS\S-1-5-21-1788506443-3028426188-325919347-1000\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-1788506443-3028426188-325919347-1000\Software\lucky leap]

Searching for "softonic"
[HKEY_USERS\Gast\Software\AppDataLow\Software\softonic-de3]
[HKEY_USERS\Gast\Software\AppDataLow\Software\softonic-de3\toolbar]
"WebServerUrl"="hxxp://softonicde3.OurToolbar.com/"
[HKEY_USERS\Gast\Software\AppDataLow\Software\softonic-de3\toolbar]
"Write us link"="toolbar@softonic.de"
[HKEY_USERS\Gast\Software\AppDataLow\Software\softonic-de3\toolbar]
"DisplayName"="softonic-de3"

Searching for "ParetoLogic"
No data found.

Searching for "Searchprotect"
[HKEY_USERS\Gast\Software\Microsoft\Windows\CurrentVersion\Run]
"SearchProtect"="C:\Users\Gast\AppData\Roaming\SearchProtect\bin\cltmng.exe"
[HKEY_USERS\Gast\Software\SearchProtect]

Searching for "facemoods"
No data found.

Searching for " "
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Skype"=""C:\Program Files (x86)\Skype\\Phone\Skype.exe" /nosplash /minimized "
[HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache]
"C:\Users\Tobi\Desktop\arial32.exe"="Win32 Cabinet Self-Extractor "
[HKEY_LOCAL_MACHINE\SOFTWARE\DivX\Install\ASPEncoder]
"Description"="
<h3>Das Kernstück Ihres HD-Videoerlebnisses</h3>
<p>Der Codec, der die Videowelt revolutioniert hat, wurde weiter optimiert. Wir bezeichnen diese Version als „Pro“, da sie zudem fantastische fortschrittliche Encoding-Einstellungen bietet, mit denen Sie mit Drittanbietersoftware hochwertige DivX-Video generieren können, die auf jedem beliebigen DivX Certified®-Gerät wiedergegeben werden können.</p>
<h3>Gute Gründe für den DivX Codec</h3>
<ul>
<li>Erstellen Sie mit Drittanbietersoftware oder mit dem DivX Converter hochwertige, stark komprimierte DivX-Videos.</li>
<li>Wir garantieren, dass Ihre Videos abgesehen von Deinem PC auch auf DivX Certified-DVD-Playern, Mobiltelefonen, Spielekonsolen uvm. abgespielt werden können.</li>
<li>Optimieren Sie Ihre Videos mit den fortschrittlichen Encoding-Einstellungen, um hochwertigere Dateien zu erhalten.</li>
</ul>"
[HKEY_LOCAL_MACHINE\SOFTWARE\DivX\Install\Converter]
"Description"="
<p>Die erste benutzerfreundliche Software für die Erstellung von hochwertigen DivX HEVC*-Videos</p>
<ul>
<li>Erstelle DivX-Videos und schaue Sie Dir auf jedem Computer und auf mehr als 1 Milliarde</li>
<li>Drehe Deine Videos, kombiniere Deine Videos, füge mehrere Untertitel und Audio hinzu</li>
<li>Nutze benutzerdefinierte Voreinstellungen und führe Batch-Encoding aus</li>
</ul>
<br/>
<p><i>*DivX HEVC-Plugin erforderlich</i></p>
"
[HKEY_LOCAL_MACHINE\SOFTWARE\DivX\Install\Player]
"Description"="
<p>Hochwertige Wiedergabe von DivX-, DivX Plus- und den neuen DivX HEVC*-Videos</p>
<ul>
<li>Optimiert für die Wiedergabe der gängigsten Formate im Internet – AVI, DIVX, MKV, MP4</li>
<li>Mit dem integrierten DivX Media Server können Videos zu Geräten gestreamt werden, wie z. B. PS3 und Xbox</li>
<li>Problemlose Wiedergabe des FF/RW-Formats, Kapiteln, Unterstützung mehrerer Untertitel und Tonspuren</li>
</ul>
<br/>
<p><i>*DivX HEVC-Plugin erforderlich</i></p>
"
[HKEY_LOCAL_MACHINE\SOFTWARE\DivX\Install\Setup\BundleGroups\divx.com]
"BundleGroupDescription"="
<p>Eine All-in-One-Lösung zum Wiedergeben, Erstellen und Streamen von hochwertigen DivX HEVC-Videos bis zu 1080p HD. DivX 10 bietet die neuste Videotechnologie kostenlos an. Das beste DivX Video-Erlebnis erhältst Du, <i>wenn Du alle Komponenten installierst.</i></p>
<ul>
<li>Neue DivX HEVC-Profile für die Erstellung von HEVC-Videos </li>
<li>Optimierte Wiedergabe von DivX- (MPEG), DivX Plus- (H.264), DivX HEVC (H.265)*-Videos</li>
<li>Effizientes HEVC-Streaming in Deinem Browser</li>
<li>Streame MKVs auf DLNA-Geräte, wie z. B. PS3 und XBOX</li>
</ul>
<br/>
<p><a href="hxxp://go.divx.com/WhatsNew/de" target="_blank">Erfahre, was bei dieser Version noch neu ist</a></p>
<br/>
<p><i>*DivX HEVC-Plugin erforderlich</i></p>
"
[HKEY_LOCAL_MACHINE\SOFTWARE\DivX\Install\Setup\InstallGroups\FiltersAndCodecs]
"Description"="
<p>Mit dem DivX® Codec Pack kannst Du DivX®-Videos mit Deinen Lieblingsanwendungen abspielen und erstellen.</p>
<ul>
<li>DivX- und DivX-Videos auf jedem beliebigen Media-Player abspielen (wie beispielsweise Windows Media Player, QuickTime, Media Player Classic)</li>
<li>Ausgabe von AVI-Videos mit Deiner Lieblingsbearbeitungssoftware (z. B. Sony Vegas, Virtual Dub)</li>
<li>Konvertieren in DivX und MKV mithilfe von DivX Converter und Tools von Drittanbietern – unbegrenzt und kostenlos</li>
</ul>
"
[HKEY_LOCAL_MACHINE\SOFTWARE\DivX\Install\Setup\InstallGroups\SharedLibraries]
"Description"="
<ul>
<li>Das DivX VOD-Plug-in sorgt für besseres Erlebnis für Kunden, die Filme von DivX VOD - Shops beziehen.</li>
</ul>
"
[HKEY_LOCAL_MACHINE\SOFTWARE\DivX\Install\WebPlayer]
"Description"="
<p>Effizientes, hochwertiges MKV-Streaming in Deinem Browser mit DivX HEVC-Video</p>
<ul>
<li>Problemlose Videowiedergabe mit DivX Plus Streaming™ und DivX HEVC</li>
<li>Adaptives und progressives Streaming der gängigsten Formate im Internet – AVI, DIVX, MKV, MP4, MOV</li>
<li>Die Funktionen umfassen eine problemlose Wiedergabe des FF/RW-Formats, Kapiteln, sowie Unterstützung mehrerer Untertitel und Tonspuren</li>
<li>Weniger CPU- und Akkuverbrauch mit H.264-DXVA-Hardwarebeschleunigung</li>
</ul>
<br/>
<p><i>*DivX HEVC-Plugin erforderlich</i></p>
"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\GameUX\Games\{AA977598-F981-4AC8-8EE3-17B8E98DACFF}]
"RatingsInfo"="<Ratings xmlns="urn:schemas-microsoft-com:GameDescription.v1">
<Rating ratingSystemID="{768BD93D-63BE-46A9-8994-0B53C4B5248F}" ratingID="{18CD34B7-7AA3-42b9-A303-5A729B2FF228}"/>
<Rating ratingSystemID="{36798944-B235-48ac-BF21-E25671F597EE}" ratingID="{044D131F-D763-4975-9BB4-8C24CC331063}"/>
<Rating ratingSystemID="{5B39D1B8-ED49-4055-8A47-04B29A579AD6}" ratingID="{79F6B936-0C8F-4d67-90A6-B7B2E0F37973}"/>
<Rating ratingSystemID="{C705DCF4-6AFE-4f4f-BC51-21807E4E5CFB}" ratingID="{B3F8E60B-DF77-4104-88AC-F5919C64649A}"/>
<Rating ratingSystemID="{EC290BBB-D618-4cb9-9963-1CAAE515443E}" ratingID="{997B7D18-2AFA-49dc-847B-0E8A69723040}"/>
</Ratings>"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN\Plugin\Microsoft.PowerShell]
"ConfigXML"=" <PlugInConfiguration xmlns="hxxp://schemas.microsoft.com/wbem/wsman/1/config/PluginConfiguration" Name="microsoft.powershell" Filename="%windir%\system32\pwrshplugin.dll" SDKVersion="1" XmlRenderingType="text" > <InitializationParameters> <Param Name="PSVersion" Value="2.0"/> </InitializationParameters> <Resources> <Resource ResourceUri="hxxp://schemas.microsoft.com/powershell/microsoft.powershell" SupportsOptions="true" ExactMatch="true"> <Security xmlns="hxxp://schemas.microsoft.com/wbem/wsman/1/config/PluginConfiguration" Uri="hxxp://schemas.microsoft.com/powershell/microsoft.powershell" ExactMatch="true" Sddl="O:NSG:BAD:P(A;;GA;;;BA)S:P(AU;FA;GA;;;WD)(AU;SA;GXGW;;;WD)"/> <Capability Type="Shell"/> </Resource> </Res
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"QlbCtrl.exe"="C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start "
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"UpdatePRCShortCut"=""C:\Program Files (x86)\Hewlett-Packard\Recovery\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\Hewlett-Packard\Recovery" UpdateWithCreateOnce "Software\CyberLink\PowerRecover" "
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"LogMeIn Hamachi Ui"=""C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe" --auto-start "
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\WSMAN\Plugin\Microsoft.PowerShell32]
"ConfigXML"="<PlugInConfiguration xmlns="hxxp://schemas.microsoft.com/wbem/wsman/1/config/PluginConfiguration" Name="microsoft.powershell32" Filename="%windir%\system32\pwrshplugin.dll" SDKVersion="1" XmlRenderingType="text" Architecture="32" > <InitializationParameters> <Param Name="PSVersion" Value="2.0"/> </InitializationParameters> <Resources> <Resource ResourceUri="hxxp://schemas.microsoft.com/powershell/microsoft.powershell32" SupportsOptions="true" ExactMatch="true"> <Security xmlns="hxxp://schemas.microsoft.com/wbem/wsman/1/config/PluginConfiguration" Uri="hxxp://schemas.microsoft.com/powershell/microsoft.powershell32" ExactMatch="true" Sddl="O:NSG:BAD:P(A;;GA;;;BA)S:P(AU;FA;GA;;;WD)(AU;SA;GXGW;;;WD)"/>
[HKEY_USERS\S-1-5-21-1788506443-3028426188-325919347-1000\Software\Microsoft\Windows\CurrentVersion\Run]
"Skype"=""C:\Program Files (x86)\Skype\\Phone\Skype.exe" /nosplash /minimized "
[HKEY_USERS\S-1-5-21-1788506443-3028426188-325919347-1000\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache]
"C:\Users\Tobi\Desktop\arial32.exe"="Win32 Cabinet Self-Extractor "
[HKEY_USERS\S-1-5-21-1788506443-3028426188-325919347-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache]
"C:\Users\Tobi\Desktop\arial32.exe"="Win32 Cabinet Self-Extractor "

-= EOF =-

Die Geschwindigkeit ist wieder da, sonst macht auch alles einen guten Eindruck. Wie mir bei dem ganzen Rumtesten aber aufgefallen ist, scheint meine Firewall außer Gefecht zu sein: Error Code 0x80070424. Gibt es da einen Zusammenhang?

Servus,

Zitat von captaincaro

Wie mir bei dem ganzen Rumtesten aber aufgefallen ist, scheint meine Firewall außer Gefecht zu sein: Error Code 0x80070424. Gibt es da einen Zusammenhang?

Um die Firewall kümmern wir uns, wenn alles sauber ist.





Wir entfernen die letzten Reste und kontrollieren nochmal alles. ESET kann länger (> 2 h) dauern. Anschließend kontrollieren wir die Firewall und sicherheitsrelevante Dienste an, da seint nämlich was verbogen zu sein.




Schritt 1

• Mit laufendem TeaTimer von Spybot Search&Destroy lässt sich keine Reinigung durchführen, da er alle gelöschten Einträge wiederherstellt.
• Der Teatimer muss also während der Reinigungsarbeiten abgestellt werden (lasse den Teatimer so lange ausgeschaltet, bis wir mit der Reinigung fertig sind):
• Starte Spybot S&D => stelle im Menü "Modus" den "Erweiterten Modus" ein => klicke dann links unten auf "Werkzeuge" => klicke auf "Resident" => das Häkchen entfernen bei Resident "TeaTimer" (Schutz aller Systemeinstellungen) => Spybot Search&Destroy schließen => Rechner neu starten. Bebilderte Anleitung.

Schritt 2
Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

start
HKU\Gast\...\Run: [SearchProtect] - C:\Users\Gast\AppData\Roaming\SearchProtect\bin\cltmng.exe
C:\Users\Gast\AppData\Roaming\SearchProtect
S4 HssSrv; C:\Program Files (x86)\Hotspot Shield\HssWPR\hsssrv.exe [x]
C:\Program Files (x86)\Hotspot Shield
C:\Windows\assembly\tmp
C:\Users\Tobi\AppData\Local\4c34a529
C:\Users\Tobi\vcredist.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Hotspot Shield
C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Hotspot Shield
C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Hotspot Shield
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Splashtop Remote
C:\Users\Gast\AppData\LocalLow\Babylon-English
C:\Users\Tobi\AppData\Roaming\Mozilla\Firefox\Profiles\3k9240jg.default\CT2269050
C:\Windows\SysWOW64\Hotspot Shield
C:\Users\Tobi\Desktop\cbsidlm-cbsi134-Download_App-PBF-75864009.exe
Reg: reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\HssIE.HssIEApp" /f
Reg: reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\HssIE.HssIEApp.1" /f
Reg: reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{E69D4A59-73DE-4E38-9FB3-740EC4D9060D}" /f
Reg: reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\HotspotShield" /f
Reg: reg delete "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\eventlog\Application\HssSrv" /f
Reg: reg delete "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\eventlog\Application\HssWd" /f
Reg: reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\49AE5C7BA69B5F14EB59527DB8846687" /f
Reg: reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{B7C5EA94-B96A-41F5-BE95-25D78B486678}" /f
Reg: reg delete "HKEY_USERS\Gast\Software\Splashtop Inc." /f
Reg: reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\DivX\Install\Setup\WizardLayout\ConduitToolbar" /f
Reg: reg delete "HKEY_USERS\Gast\Software\AppDataLow\Software\Babylon-English" /f
Reg: reg delete "HKEY_USERS\Gast\Software\AppDataLow\Software\Conduit" /f
Reg: reg delete "HKEY_USERS\Gast\Software\AppDataLow\Software\conduitEngine" /f
Reg: reg delete "HKEY_USERS\Gast\Software\AppDataLow\Software\DVDVideoSoftTB" /f
Reg: reg delete "HKEY_USERS\Gast\Software\AppDataLow\Software\softonic-de3" /f
Reg: reg delete "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-1788506443-3028426188-325919347-1000\Software\lucky leap" /f
Reg: reg delete "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\eventlog\Application\Update lucky leap" /f
Reg: reg delete "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\eventlog\Application\Util lucky leap" /f
Reg: reg delete "HKEY_USERS\Gast\Software\AppDataLow\Software\softonic-de3" /f
Reg: reg delete "HKEY_USERS\Gast\Software\SearchProtect" /f
end
         

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

• Starte nun FRST erneut und klicke den Entfernen Button.
• Das Tool erstellt eine Fixlog.txt.
• Poste mir deren Inhalt.

Schritt 3
Downloade Dir bitte Malwarebytes Anti-Malware

• Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
• Starte Malwarebytes' Anti-Malware (MBAM).
• Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
• Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
• Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
• Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
• Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
• Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

Schritt 4

ESET Online Scanner

• Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
• Lade und starte Eset Online Scanner
• Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
• Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
• Klicke auf Starten.
• Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
• Klicke am Ende des Suchlaufs auf Fertig stellen.
• Schließe das Fenster von ESET.
• Explorer öffnen.
• C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
• Logfile hier posten.
• Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
• Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Schritt 5
Downloade Dir bitte SecurityCheck und:

• Speichere es auf dem Desktop.
• Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
• Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.

Poste den Inhalt bitte hier.






Bitte poste mit deiner nächsten Antwort

• die Logdatei von FRST,
• die Logdatei von MBAM,
• die Logdatei von ESET,
• die Logdatei von SecurityCheck.