| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Malwarebytes mehrere Funde, auch Trojaner?Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
28.07.2014, 10:52
| #1 |
 |  Malwarebytes mehrere Funde, auch Trojaner? Hallo, Mein Opa hat mich drum gebeten, dass ich ihm seinen Laptop "säuber", weil es sich einige Viren auf dem Laptop befinden. Weil mir selber schonmal erfolgreich in diesem Forum geholfen wurde, hoffe ich das Funktioniert erneut so gut und deshalb wende ich mich jetzt an Sie! Zum Problem: Ich habe gestern bei ihm einen Scan mit Malwarebytes durchgeführt und einige Funde als Resultat erhalten. Unter anderem fand ich dort einen Trojaner. Ich frage mich woher diese Funde kommen, weil der Laptop sehr selten benutzt wird. Falls man das herausfinden würde, wäre das sehr toll. Hier die angeforderten Logdateien bzw. was ich bereits gemacht habe: -Defogger erfolgreich benutzt. -FRST.txt Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 26-07-2014 Ran by Heinz (administrator) on HEINZ-PC on 27-07-2014 23:39:51 Running from C:\Users\Heinz\Documents\TBoard Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland) Internet Explorer Version 11 Boot Mode: Normal The only official download link for FRST: Download link for 32-Bit version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/ Download link for 64-Bit Version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/ Download link from any site other than Bleeping Computer is unpermitted or outdated. See tutorial for FRST: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (ASUSTeK Computer Inc.) C:\Windows\System32\FBAgent.exe (ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\AsLdrSrv.exe (ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (ASUS) C:\Program Files (x86)\ASUS\InstantOn for NB\InsOnSrv.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe (McAfee, Inc.) C:\Windows\System32\mfevtps.exe (Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (McAfee, Inc.) C:\Program Files\Common Files\mcafee\systemcore\mcshield.exe (McAfee, Inc.) C:\Program Files\Common Files\mcafee\systemcore\mfefire.exe (Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE (ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe (ASUS) C:\Program Files (x86)\ASUS\InstantOn for NB\InsOnWMI.exe (ASUS) C:\Program Files\ASUS\P4G\BatteryLife.exe (ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\FaceLogon\sensorsrv.exe (ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe (ASUS) C:\Program Files (x86)\ASUS\Splendid\ACMON.exe (ASUSTeK) C:\Windows\SysWOW64\ACEngSvr.exe (ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ATKOSD.exe (ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe (ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\WDC.exe (ASUS) C:\Windows\AsScrPro.exe (Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE (Intel Corporation) C:\Windows\System32\hkcmd.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (Alcor Micro Corp.) C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe (Virage Logic Corporation / Sonic Focus) C:\Program Files (x86)\ASUS\Sonic Focus\SonicFocusTray.exe (CyberLink) C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe (ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe (ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe (ASUS) C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avwebgrd.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe (Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Adobe Systems Incorporated) C:\Windows\System32\Macromed\Flash\FlashUtil64_14_0_0_145_ActiveX.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe (Microsoft Corporation) C:\Windows\System32\dllhost.exe (Microsoft Corporation) C:\Program Files\Windows NT\Accessories\wordpad.exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2785064 2011-05-05] (Synaptics Incorporated) HKLM\...\Run: [AmIcoSinglun64] => C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe [361984 2011-03-21] (Alcor Micro Corp.) HKLM\...\Run: [SynAsusAcpi] => C:\Program Files\Synaptics\SynTP\SynAsusAcpi.exe [97064 2011-05-05] (Synaptics Incorporated) HKLM\...\Run: [RtHDVBg] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [2277480 2011-08-16] (Realtek Semiconductor) HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated) HKLM-x32\...\Run: [ASUSPRP] => C:\Program Files (x86)\ASUS\APRP\APRP.EXE [3331312 2012-02-24] (ASUSTek Computer Inc.) HKLM-x32\...\Run: [ASUSWebStorage] => C:\Program Files (x86)\ASUS\ASUS WebStorage\3.0.108.222\AsusWSPanel.exe [737104 2011-07-29] (ecareme) HKLM-x32\...\Run: [SonicMasterTray] => C:\Program Files (x86)\ASUS\Sonic Focus\SonicFocusTray.exe [984400 2010-07-10] (Virage Logic Corporation / Sonic Focus) HKLM-x32\...\Run: [ATKOSD2] => C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe [318080 2011-12-23] (ASUSTek Computer Inc.) HKLM-x32\...\Run: [ATKMEDIA] => C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe [174720 2011-10-25] (ASUS) HKLM-x32\...\Run: [HControlUser] => C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe [105016 2009-06-19] (ASUS) HKLM-x32\...\Run: [Wireless Console 3] => C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe [2319536 2011-10-19] (ASUS) HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [750160 2014-07-05] (Avira Operations GmbH & Co. KG) Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation) HKU\S-1-5-19\...\RunOnce: [mctadmin] => C:\Windows\System32\mctadmin.exe [97280 2009-07-14] (Microsoft Corporation) HKU\S-1-5-20\...\RunOnce: [mctadmin] => C:\Windows\System32\mctadmin.exe [97280 2009-07-14] (Microsoft Corporation) HKU\S-1-5-21-3534363647-1427521627-2892733247-1000\...\Run: [Optimizer Pro] => C:\Program Files (x86)\Optimizer Pro\OptProLauncher.exe Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 26-07-2014
Ran by Heinz at 2014-07-27 23:41:12
Running from C:\Users\Heinz\Documents\TBoard
Boot Mode: Normal
==========================================================
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Avira Desktop (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Desktop (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
Adobe Flash Player 10 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 10.0.32.18 - Adobe Systems Incorporated)
Adobe Flash Player 14 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 14.0.0.145 - Adobe Systems Incorporated)
Adobe Reader X (10.1.10) MUI (HKLM-x32\...\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}) (Version: 10.1.10 - Adobe Systems Incorporated)
Alcor Micro USB Card Reader (HKLM-x32\...\AmUStor) (Version: 1.2.0117.08443 - Alcor Micro Corp.)
Alcor Micro USB Card Reader (x32 Version: 1.2.0117.08443 - Alcor Micro Corp.) Hidden
Antivirus Pro (HKLM-x32\...\Avira AntiVir Desktop) (Version: 14.0.5.464 - Avira)
Asmedia ASM104x USB 3.0 Host Controller Driver (HKLM-x32\...\{E4FB0B39-C991-4EE7-95DD-1A1A7857D33D}) (Version: 1.14.4.0 - Asmedia Technology)
ASUS AI Recovery (HKLM-x32\...\{D39F0676-163E-4595-A917-E28F99BBD4D2}) (Version: 1.0.23 - ASUS)
ASUS FaceLogon (HKLM-x32\...\{64452561-169F-4A36-A2FF-B5E118EC65F5}) (Version: 1.0.0014 - ASUS)
ASUS FancyStart (HKLM-x32\...\{C944B4C5-1C4D-4D95-8AC0-7CEF13914131}) (Version: 1.1.1 - ASUSTeK Computer Inc.)
ASUS LifeFrame3 (HKLM-x32\...\{1DBD1F12-ED93-49C0-A7CC-56CBDE488158}) (Version: 3.0.29 - ASUS)
ASUS Live Update (HKLM-x32\...\{FA540E67-095C-4A1B-97BA-4D547DEC9AF4}) (Version: 3.1.7 - ASUS)
ASUS Power4Gear Hybrid (HKLM\...\{9B6239BF-4E85-4590-8D72-51E30DB1A9AA}) (Version: 1.2.1 - ASUS)
ASUS Splendid Video Enhancement Technology (HKLM-x32\...\{0969AF05-4FF6-4C00-9406-43599238DE0D}) (Version: 1.02.0041 - ASUS)
ASUS Virtual Camera (HKLM-x32\...\{EC8BD21F-0CA0-4BBF-97D9-4A52B30041A1}) (Version: 1.0.25 - ASUS)
ASUS WebStorage (HKLM-x32\...\ASUS WebStorage) (Version: 3.0.108.222 - eCareme Technologies, Inc.)
ASUS_Screensaver (HKLM-x32\...\ASUS_Screensaver) (Version: - )
AsusVibe2.0 (HKLM-x32\...\Asus Vibe2.0) (Version: 2.0.9.157 - ASUSTEK)
ATK Package (HKLM-x32\...\{AB5C933E-5C7D-4D30-B314-9C83A49B94BE}) (Version: 1.0.0015 - ASUS)
Buzzdock (HKLM\...\{ac225167-00fc-452d-94c5-bb93600e7d9a}) (Version: - Alactro LLC) <==== ATTENTION
CyberLink LabelPrint (HKLM-x32\...\InstallShield_{C59C179C-668D-49A9-B6EA-0121CCFC1243}) (Version: 2.5.3624 - CyberLink Corp.)
CyberLink LabelPrint (x32 Version: 2.5.3624 - CyberLink Corp.) Hidden
CyberLink Media Suite (HKLM-x32\...\InstallShield_{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}) (Version: 8.0.2926 - CyberLink Corp.)
CyberLink Media Suite (x32 Version: 8.0.2926 - CyberLink Corp.) Hidden
CyberLink Power2Go (HKLM-x32\...\InstallShield_{40BF1E83-20EB-11D8-97C5-0009C5020658}) (Version: 7.0.0.1126 - CyberLink Corp.)
CyberLink Power2Go (x32 Version: 7.0.0.1126 - CyberLink Corp.) Hidden
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Fast Boot (HKLM\...\{13F4A7F3-EABC-4261-AF6B-1317777F0755}) (Version: 1.0.10 - ASUS)
Galeria de Fotografias do Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Galería fotográfica de Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Galerie de photos Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Google Earth (HKLM-x32\...\{3E8A20E1-223F-11E2-9116-B8AC6F98CCE3}) (Version: 7.0.1.8244 - Google)
InstantOn for NB (HKLM-x32\...\{749F674B-2674-47E8-879C-5626A06B2A91}) (Version: 2.2.0 - ASUS)
Intel(R) Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1007 - Intel Corporation)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 7.0.0.1144 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 8.15.10.2559 - Intel Corporation)
Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Malwarebytes Anti-Malware Version 2.0.2.1012 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.2.1012 - Malwarebytes Corporation)
Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden
Microsoft Office 2010 (HKLM-x32\...\{95140000-0070-0000-0000-0000000FF1CE}) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Office Klick-und-Los 2010 (HKLM-x32\...\Office14.Click2Run) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Office Klick-und-Los 2010 (Version: 14.0.4763.1000 - Microsoft Corporation) Hidden
Microsoft Office Starter 2010 - Deutsch (HKLM-x32\...\{90140011-0066-0407-0000-0000000FF1CE}) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
MSVCRT (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSVCRT_amd64 (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
OpenOffice 4.0.1 (HKLM-x32\...\{0AEC308E-7EB3-47F7-BB59-F2C9C6166B27}) (Version: 4.01.9714 - Apache Software Foundation)
Optimizer Pro v3.1 (HKLM-x32\...\Optimizer Pro_is1) (Version: 3.1 - PC Utilities Pro) <==== ATTENTION
Raccolta foto di Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Ralink RT2860 Wireless LAN Card (HKLM-x32\...\{8FC4F1DD-F7FD-4766-804D-3C8FF1D309B0}) (Version: 1.2.0.40 - Ralink)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6454 - Realtek Semiconductor Corp.)
Sonic Focus (HKLM-x32\...\{09BCB9CE-964B-4BDA-AE46-B5A0ABEF1D3F}) (Version: 1.0.0.4 - Synopsys )
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 15.3.6.0 - Synaptics Incorporated)
WebConnect 3.0.0 (HKLM\...\WebConnect) (Version: 3.0.0 - Web Connect) <==== ATTENTION
Windows Live Communications Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3538.0513 - Microsoft Corporation)
Windows Live Essentials (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Family Safety (Version: 15.4.3538.0513 - Microsoft Corporation) Hidden
Windows Live Fotogalerie (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live ID Sign-in Assistant (Version: 7.250.4232.0 - Microsoft Corporation) Hidden
Windows Live Installer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Language Selector (Version: 15.4.3538.0513 - Microsoft Corporation) Hidden
Windows Live Mail (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Mesh - ActiveX-besturingselement voor externe verbindingen (HKLM-x32\...\{C32CE55C-12BA-4951-8797-0967FDEF556F}) (Version: 15.4.5722.2 - Microsoft Corporation)
Windows Live Mesh (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Mesh ActiveX Control for Remote Connections (HKLM-x32\...\{2902F983-B4C1-44BA-B85D-5C6D52E2C441}) (Version: 15.4.5722.2 - Microsoft Corporation)
Windows Live Mesh ActiveX control for remote connections (HKLM-x32\...\{C5398A89-516C-4DAF-BA07-EE7949090E56}) (Version: 15.4.5722.2 - Microsoft Corporation)
Windows Live Mesh ActiveX Control for Remote Connections (HKLM-x32\...\{C63A1E60-B6A4-440B-89A5-1FC6E4AC1C94}) (Version: 15.4.5722.2 - Microsoft Corporation)
Windows Live Messenger (x32 Version: 15.4.3538.0513 - Microsoft Corporation) Hidden
Windows Live Messenger (x32 Version: 15.4.3538.0513 - Корпорация Майкрософт) Hidden
Windows Live MIME IFilter (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Movie Maker (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Common (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Gallery (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live PIMT Platform (x32 Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Remote Client (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Client Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Service (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Service Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live SOXE (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live SOXE Definitions (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform Language Pack (x32 Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Writer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Writer Resources (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live 影像中心 (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live 程式集 (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
WinFlash (HKLM-x32\...\{8F21291E-0444-4B1D-B9F9-4370A73E346D}) (Version: 2.41.0 - ASUS)
Wireless Console 3 (HKLM-x32\...\{19EA33FB-B34E-40EA-8B8A-61743AEB795A}) (Version: 3.0.25 - ASUS)
Συλλογή φωτογραφιών του Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Основные компоненты Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Почта Windows Live (x32 Version: 15.4.3502.0922 - Корпорация Майкрософт) Hidden
Фотоальбом Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
גלריית התמונות של Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
بريد Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
معرض صور Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
==================== Custom CLSID (selected items): ==========================
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
==================== Restore Points =========================
08-06-2014 15:28:50 Windows Update
23-06-2014 14:11:00 Windows Update
23-06-2014 14:59:03 Windows Update
05-07-2014 14:21:46 Windows Update
14-07-2014 13:12:49 Windows Update
14-07-2014 13:40:23 Windows Update
24-07-2014 13:40:18 Windows Update
25-07-2014 15:22:19 Windows Update
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
Task: {38ED05BA-3EC5-4A46-9D24-1136CEF7D1DB} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-07-10] (Adobe Systems Incorporated)
Task: {5F750EB9-6F2A-4A46-8727-0B04B4A5F836} - System32\Tasks\Yahoo! Search => C:\Users\Heinz\AppData\Local\Pay-By-Ads\Yahoo! Search\1.3.8.2\dsrlte.exe
Task: {60120C5B-6A6F-42AF-A5CC-CF3AC0BABDD0} - System32\Tasks\ASUS SmartLogon Console Sensor => C:\Program Files (x86)\ASUS\FaceLogon\sensorsrv.exe [2012-02-17] (ASUSTek Computer Inc.)
Task: {64BCBE8C-7407-4175-8880-F43129DE8B32} - System32\Tasks\0 => Iexplore.exe
Task: {75DF127D-ABB3-4375-9FC2-5B08A3D33AED} - System32\Tasks\{78A5DB1D-D5E8-4F2E-A2BC-620A7A5CABE8} => Iexplore.exe hxxp://www.skype.com/go/downloading?source=lightinstaller&ver=5.10.0.114&LastError=404
Task: {C0B182D8-4607-4594-859C-7DAA3A3BF934} - System32\Tasks\Omiga Plus RunAsStdUser => C:\Program Files (x86)\Omiga Plus\omigaplus.exe
Task: {D0D3DFDD-7DFF-4380-8B34-1A5014B9E3EC} - System32\Tasks\4691 => Wscript.exe C:\Users\Heinz\AppData\Local\Temp\launchie.vbs //B
Task: {DC3D9167-B5B6-4702-8EB8-D7602252EA4D} - System32\Tasks\ASUS P4G => C:\Program Files\ASUS\P4G\BatteryLife.exe [2012-02-16] (ASUS)
Task: {DDA2C99F-454A-4912-B1F9-D8D3798430E7} - System32\Tasks\ATKOSD2 => C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe [2011-12-23] (ASUSTek Computer Inc.)
Task: {DDF537AA-0A71-4D6C-B9F4-71BA8079A51C} - System32\Tasks\Desk 365 RunAsStdUser => C:\Program Files (x86)\Desk 365\desk365.exe <==== ATTENTION
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
==================== Loaded Modules (whitelisted) =============
2010-07-15 01:11 - 2010-07-15 01:11 - 00031360 _____ () C:\Program Files\ASUS\P4G\DevMng.dll
2012-03-05 03:24 - 2011-05-05 14:30 - 00057640 _____ () C:\Program Files\Synaptics\SynTP\SynTPEnhPS.dll
2012-02-21 23:49 - 2012-02-21 23:49 - 00009216 _____ () C:\Program Files (x86)\ASUS\Splendid\GLCDdll.dll
2010-08-20 18:57 - 2010-08-20 18:57 - 00619816 _____ () C:\Program Files (x86)\CyberLink\Power2Go\CLMediaLibrary.dll
2010-08-20 18:57 - 2010-08-20 18:57 - 00013096 _____ () C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvcPS.dll
2007-07-12 20:11 - 2007-07-12 20:11 - 01163264 _____ () C:\Program Files (x86)\ASUS\Wireless Console 3\acAuth.dll
==================== Alternate Data Streams (whitelisted) =========
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
AlternateDataStreams: C:\ProgramData\Temp:373E1720
==================== Safe Mode (whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfefire => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfefirek => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfefirek.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfehidk => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfehidk.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfevtp => ""="Driver"
==================== EXE Association (whitelisted) =============
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
==================== MSCONFIG/TASK MANAGER disabled items =========
(Currently there is no automatic fix for this section.)
MSCONFIG\startupreg: ACMON => C:\Program Files (x86)\ASUS\Splendid\ACMON.exe
MSCONFIG\startupreg: Adobe Reader Speed Launcher => "C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe"
MSCONFIG\startupreg: ASUS Screen Saver Protector => C:\Windows\AsScrPro.exe
MSCONFIG\startupreg: CLMLServer => "C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe"
MSCONFIG\startupreg: RtHDVCpl => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s
==================== Faulty Device Manager Devices =============
Name: Teredo Tunneling Pseudo-Interface
Description: Microsoft-Teredo-Tunneling-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.
==================== Event log errors: =========================
Application errors:
==================
Error: (07/27/2014 06:43:49 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: dsrlte.exe, Version: 1.1.0.2, Zeitstempel: 0x53996de6
Name des fehlerhaften Moduls: ole32.dll, Version: 6.1.7601.17514, Zeitstempel: 0x4ce7b96f
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0003bc24
ID des fehlerhaften Prozesses: 0x1458
Startzeit der fehlerhaften Anwendung: 0xdsrlte.exe0
Pfad der fehlerhaften Anwendung: dsrlte.exe1
Pfad des fehlerhaften Moduls: dsrlte.exe2
Berichtskennung: dsrlte.exe3
Error: (07/27/2014 06:13:51 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm mbam.exe, Version 1.0.0.532 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: 954
Startzeit: 01cfa9af9911ceda
Endzeit: 15
Anwendungspfad: C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe
Berichts-ID: fc05158e-15a8-11e4-b4ac-10bf4824462e
Error: (07/25/2014 05:23:04 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm IEXPLORE.EXE, Version 11.0.9600.17207 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: 320
Startzeit: 01cfa81bd5569c9d
Endzeit: 0
Anwendungspfad: C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
Berichts-ID:
Error: (07/24/2014 04:17:46 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm mbam.exe, Version 1.0.0.532 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: 1420
Startzeit: 01cfa749d4a1badc
Endzeit: 16
Anwendungspfad: C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe
Berichts-ID: 39c23468-133d-11e4-901a-10bf4824462e
Error: (07/24/2014 04:14:35 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm IEXPLORE.EXE, Version 11.0.9600.17207 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: 2450
Startzeit: 01cfa74977eff3a4
Endzeit: 0
Anwendungspfad: C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
Berichts-ID:
Error: (06/08/2014 05:50:37 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: googleearth.exe, Version: 7.0.1.8244, Zeitstempel: 0x508f4296
Name des fehlerhaften Moduls: googleearth_free.dll, Version: 0.0.0.0, Zeitstempel: 0x508f4277
Ausnahmecode: 0xc0000005
Fehleroffset: 0x001b5833
ID des fehlerhaften Prozesses: 0x20cc
Startzeit der fehlerhaften Anwendung: 0xgoogleearth.exe0
Pfad der fehlerhaften Anwendung: googleearth.exe1
Pfad des fehlerhaften Moduls: googleearth.exe2
Berichtskennung: googleearth.exe3
Error: (06/01/2014 04:21:24 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm googleearth.exe, Version 7.0.1.8244 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: 1158
Startzeit: 01cf7da4a0926fd6
Endzeit: 17
Anwendungspfad: C:\Program Files (x86)\Google\Google Earth\client\googleearth.exe
Berichts-ID: fee475f5-e997-11e3-a4bc-10bf4824462e
System errors:
=============
Error: (07/27/2014 07:07:18 PM) (Source: bowser) (EventID: 8003) (User: )
Description: Der Hauptsuchdienst erhielt eine Serverankündigung vom Computer "EASYBOX",
der der Hauptsuchdienst der Domäne für den NetBT_Tcpip_{DA256DB6-B2D7-4D4C-B550-94AEF01780A0}-Transport zu sein scheint.
Der Hauptsuchdienst wurde beendet oder es wird eine Auswahl erzwungen.
Error: (07/27/2014 06:50:49 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "Software Updater" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
Error: (07/27/2014 06:23:07 PM) (Source: Service Control Manager) (EventID: 7022) (User: )
Description: Der Dienst "Windows Update" wurde nicht richtig gestartet.
Error: (07/27/2014 06:19:14 PM) (Source: bowser) (EventID: 8003) (User: )
Description: Der Hauptsuchdienst erhielt eine Serverankündigung vom Computer "EASYBOX",
der der Hauptsuchdienst der Domäne für den NetBT_Tcpip_{DA256DB6-B2D7-4D4C-B550-94AEF01780A0}-Transport zu sein scheint.
Der Hauptsuchdienst wurde beendet oder es wird eine Auswahl erzwungen.
Error: (07/27/2014 05:28:48 PM) (Source: bowser) (EventID: 8003) (User: )
Description: Der Hauptsuchdienst erhielt eine Serverankündigung vom Computer "EASYBOX",
der der Hauptsuchdienst der Domäne für den NetBT_Tcpip_{DA256DB6-B2D7-4D4C-B550-94AEF01780A0}-Transport zu sein scheint.
Der Hauptsuchdienst wurde beendet oder es wird eine Auswahl erzwungen.
Error: (07/27/2014 05:25:48 PM) (Source: bowser) (EventID: 8003) (User: )
Description: Der Hauptsuchdienst erhielt eine Serverankündigung vom Computer "EASYBOX",
der der Hauptsuchdienst der Domäne für den NetBT_Tcpip_{DA256DB6-B2D7-4D4C-B550-94AEF01780A0}-Transport zu sein scheint.
Der Hauptsuchdienst wurde beendet oder es wird eine Auswahl erzwungen.
Error: (07/27/2014 03:19:35 PM) (Source: bowser) (EventID: 8003) (User: )
Description: Der Hauptsuchdienst erhielt eine Serverankündigung vom Computer "EASYBOX",
der der Hauptsuchdienst der Domäne für den NetBT_Tcpip_{DA256DB6-B2D7-4D4C-B550-94AEF01780A0}-Transport zu sein scheint.
Der Hauptsuchdienst wurde beendet oder es wird eine Auswahl erzwungen.
Error: (07/26/2014 04:53:17 PM) (Source: bowser) (EventID: 8003) (User: )
Description: Der Hauptsuchdienst erhielt eine Serverankündigung vom Computer "EASYBOX",
der der Hauptsuchdienst der Domäne für den NetBT_Tcpip_{DA256DB6-B2D7-4D4C-B550-94AEF01780A0}-Transport zu sein scheint.
Der Hauptsuchdienst wurde beendet oder es wird eine Auswahl erzwungen.
Error: (07/26/2014 04:17:13 PM) (Source: bowser) (EventID: 8003) (User: )
Description: Der Hauptsuchdienst erhielt eine Serverankündigung vom Computer "EASYBOX",
der der Hauptsuchdienst der Domäne für den NetBT_Tcpip_{DA256DB6-B2D7-4D4C-B550-94AEF01780A0}-Transport zu sein scheint.
Der Hauptsuchdienst wurde beendet oder es wird eine Auswahl erzwungen.
Error: (07/26/2014 04:05:12 PM) (Source: bowser) (EventID: 8003) (User: )
Description: Der Hauptsuchdienst erhielt eine Serverankündigung vom Computer "EASYBOX",
der der Hauptsuchdienst der Domäne für den NetBT_Tcpip_{DA256DB6-B2D7-4D4C-B550-94AEF01780A0}-Transport zu sein scheint.
Der Hauptsuchdienst wurde beendet oder es wird eine Auswahl erzwungen.
Microsoft Office Sessions:
=========================
Error: (07/27/2014 06:43:49 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: dsrlte.exe1.1.0.253996de6ole32.dll6.1.7601.175144ce7b96fc00000050003bc24145801cfa9b66445ffa4C:\Users\Heinz\AppData\Local\Pay-By-Ads\Yahoo! Search\1.3.8.2\dsrlte.exeC:\Windows\syswow64\ole32.dll2eb6b9c8-15ad-11e4-b1b4-10bf4824462e
Error: (07/27/2014 06:13:51 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: mbam.exe1.0.0.53295401cfa9af9911ceda15C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exefc05158e-15a8-11e4-b4ac-10bf4824462e
Error: (07/25/2014 05:23:04 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: IEXPLORE.EXE11.0.9600.1720732001cfa81bd5569c9d0C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
Error: (07/24/2014 04:17:46 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: mbam.exe1.0.0.532142001cfa749d4a1badc16C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe39c23468-133d-11e4-901a-10bf4824462e
Error: (07/24/2014 04:14:35 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: IEXPLORE.EXE11.0.9600.17207245001cfa74977eff3a40C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
Error: (06/08/2014 05:50:37 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: googleearth.exe7.0.1.8244508f4296googleearth_free.dll0.0.0.0508f4277c0000005001b583320cc01cf83314375ee4bC:\Program Files (x86)\Google\Google Earth\client\googleearth.exeC:\Program Files (x86)\Google\Google Earth\client\googleearth_free.dlla2266745-ef24-11e3-bb13-10bf4824462e
Error: (06/01/2014 04:21:24 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: googleearth.exe7.0.1.8244115801cf7da4a0926fd617C:\Program Files (x86)\Google\Google Earth\client\googleearth.exefee475f5-e997-11e3-a4bc-10bf4824462e
==================== Memory info ===========================
Percentage of memory in use: 29%
Total physical RAM: 6048.13 MB
Available physical RAM: 4293.53 MB
Total Pagefile: 12094.43 MB
Available Pagefile: 10011.46 MB
Total Virtual: 8192 MB
Available Virtual: 8191.84 MB
==================== Drives ================================
Drive c: (PC) (Fixed) (Total:186.3 GB) (Free:134.84 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive d: (Heinz) (Fixed) (Total:254.46 GB) (Free:254.36 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 466 GB) (Disk ID: E3102A4B)
Partition 1: (Not Active) - (Size=25 GB) - (Type=1C)
Partition 2: (Active) - (Size=186 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=254 GB) - (Type=07 NTFS)
==================== End Of Log ============================
Code:
ATTFilter GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-07-28 00:07:30
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 Hitachi_ rev.JE3O 465,76GB
Running: ps8n547p.exe; Driver: C:\Users\Heinz\AppData\Local\Temp\kwloipog.sys
---- User code sections - GMER 2.1 ----
.text C:\Windows\AsScrPro.exe[3664] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076211465 2 bytes [21, 76]
.text C:\Windows\AsScrPro.exe[3664] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000762114bb 2 bytes [21, 76]
.text ... * 2
.text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[3676] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076211465 2 bytes [21, 76]
.text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[3676] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000762114bb 2 bytes [21, 76]
.text ... * 2
---- User IAT/EAT - GMER 2.1 ----
IAT C:\Windows\system32\mfevtps.exe[1632] @ C:\Windows\system32\CRYPT32.dll[KERNEL32.dll!LoadLibraryA] [13ff0c0c0] C:\Windows\system32\mfevtps.exe
---- Threads - GMER 2.1 ----
Thread C:\Windows\System32\svchost.exe [2164:3108] 000007fef1f39688
---- Registry - GMER 2.1 ----
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\0025d3b2962e
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\0025d3b2962e (not active ControlSet)
---- EOF - GMER 2.1 ----
Code:
ATTFilter <?xml version="1.0" encoding="UTF-16" ?>
<mbam-log>
<header>
<date>2014/07/27 18:18:55 +0200</date>
<logfile>mbam-log-2014-07-27 (18-18-53).xml</logfile>
<isadmin>yes</isadmin>
</header>
<engine>
<version>2.00.2.1012</version>
<malware-database>v2014.07.27.05</malware-database>
<rootkit-database>v2014.07.17.01</rootkit-database>
<license>free</license>
<file-protection>disabled</file-protection>
<web-protection>disabled</web-protection>
<self-protection>disabled</self-protection>
</engine>
<system>
<osversion>Windows 7 Service Pack 1</osversion>
<arch>x64</arch>
<username>Heinz</username>
<filesys>NTFS</filesys>
</system>
<summary>
<type>threat</type>
<result>completed</result>
<objects>289489</objects>
<time>1834</time>
<processes>4</processes>
<modules>1</modules>
<keys>52</keys>
<values>6</values>
<datas>0</datas>
<folders>40</folders>
<files>172</files>
<sectors>0</sectors>
</summary>
<options>
<memory>enabled</memory>
<startup>enabled</startup>
<filesystem>enabled</filesystem>
<archives>enabled</archives>
<rootkits>disabled</rootkits>
<deeprootkit>disabled</deeprootkit>
<heuristics>enabled</heuristics>
<pup>enabled</pup>
<pum>enabled</pum>
</options>
<items>
<process><path>C:\Program Files (x86)\SoftwareUpdater\UpdaterService.exe</path><vendor>PUP.Optional.SoftwareUpdater.A</vendor><action>delete-on-reboot</action><pid>2952</pid><hash>f38e594b4a31ca6c4df127f00bf63cc4</hash></process>
<process><path>C:\Program Files (x86)\WebConnect\updateWebConnect.exe</path><vendor>PUP.Optional.WebConnect.A</vendor><action>delete-on-reboot</action><pid>2320</pid><hash>9ce5aff52259fc3a28d51449f30e6898</hash></process>
<process><path>C:\Program Files (x86)\WebConnect\bin\utilWebConnect.exe</path><vendor>PUP.Optional.WebConnect.A</vendor><action>delete-on-reboot</action><pid>3904</pid><hash>2958604496e53105708daab319e8ae52</hash></process>
<process><path>C:\Users\Heinz\AppData\Local\Pay-By-Ads\Yahoo! Search\1.3.8.2\dsrlte.exe</path><vendor>PUP.Optional.PayByAds.A</vendor><action>delete-on-reboot</action><pid>5208</pid><hash>4b365e46e19a26105b46ce1629dbd22e</hash></process>
<module><path>C:\Users\Heinz\AppData\Local\Pay-By-Ads\Yahoo! Search\1.3.8.2\sqlite.dll</path><vendor>PUP.Optional.PayByAds.A</vendor><action>delete-on-reboot</action><hash>f48dcdd766154beb27c2cdf319e9c33d</hash></module>
<key><path>HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\SRVUPDATER</path><vendor>PUP.Optional.SoftwareUpdater.A</vendor><action>success</action><hash>f38e594b4a31ca6c4df127f00bf63cc4</hash></key>
<key><path>HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\Update WebConnect</path><vendor>PUP.Optional.WebConnect.A</vendor><action>success</action><hash>9ce5aff52259fc3a28d51449f30e6898</hash></key>
<key><path>HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\Util WebConnect</path><vendor>PUP.Optional.WebConnect.A</vendor><action>success</action><hash>2958604496e53105708daab319e8ae52</hash></key>
<key><path>HKU\S-1-5-21-3534363647-1427521627-2892733247-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\Yahoo! Search</path><vendor>PUP.Optional.PayByAds.A</vendor><action>success</action><hash>4b365e46e19a26105b46ce1629dbd22e</hash></key>
<key><path>HKLM\SOFTWARE\CLASSES\APPID\{38A066B0-DD5F-4226-AC4F-6A27C1BFB892}</path><vendor>PUP.Optional.PricePeep.A</vendor><action>success</action><hash>b8c9990b0b707db9020e593d32d0f808</hash></key>
<key><path>HKLM\SOFTWARE\WOW6432NODE\CLASSES\APPID\{38A066B0-DD5F-4226-AC4F-6A27C1BFB892}</path><vendor>PUP.Optional.PricePeep.A</vendor><action>success</action><hash>b8c9990b0b707db9020e593d32d0f808</hash></key>
<key><path>HKLM\SOFTWARE\CLASSES\APPID\{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}</path><vendor>PUP.Optional.Delta.A</vendor><action>success</action><hash>e59c3c68c0bbb2846538b9dce61ce61a</hash></key>
<key><path>HKLM\SOFTWARE\WOW6432NODE\CLASSES\APPID\{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}</path><vendor>PUP.Optional.Delta.A</vendor><action>success</action><hash>e59c3c68c0bbb2846538b9dce61ce61a</hash></key>
<key><path>HKLM\SOFTWARE\CLASSES\CLSID\{4AA46D49-459F-4358-B4D1-169048547C23}</path><vendor>PUP.Optional.BrowseFox.A</vendor><action>success</action><hash>d6ab7e2683f8ab8bf4c95a3bc83a43bd</hash></key>
<key><path>HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{4AA46D49-459F-4358-B4D1-169048547C23}</path><vendor>PUP.Optional.BrowseFox.A</vendor><action>success</action><hash>d6ab7e2683f8ab8bf4c95a3bc83a43bd</hash></key>
<key><path>HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{DF84E609-C3A4-49CB-A160-61767DAF8899}</path><vendor>PUP.Optional.WebCake.A</vendor><action>success</action><hash>572aabf94c2f90a64f525f3618ea24dc</hash></key>
<key><path>HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{DF84E609-C3A4-49CB-A160-61767DAF8899}</path><vendor>PUP.Optional.WebCake.A</vendor><action>success</action><hash>572aabf94c2f90a64f525f3618ea24dc</hash></key>
<key><path>HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{FD6D90C0-E6EE-4BC6-B9F7-9ED319698007}</path><vendor>PUP.Optional.PricePeep.A</vendor><action>success</action><hash>3d44ced6f58644f2f9f34f452bd7fa06</hash></key>
<key><path>HKLM\SOFTWARE\CLASSES\TYPELIB\{3BF3DED5-0FC8-4207-AC09-AA7B5AF4E408}</path><vendor>PUP.Optional.PricePeep.A</vendor><action>success</action><hash>3d44ced6f58644f2f9f34f452bd7fa06</hash></key>
<key><path>HKLM\SOFTWARE\CLASSES\INTERFACE\{1B97A696-5576-43AC-A73B-E1D2C78F21E8}</path><vendor>PUP.Optional.PricePeep.A</vendor><action>success</action><hash>3d44ced6f58644f2f9f34f452bd7fa06</hash></key>
<key><path>HKLM\SOFTWARE\CLASSES\INTERFACE\{75BF416E-4326-45B5-8A2D-AE32D05B930B}</path><vendor>PUP.Optional.PricePeep.A</vendor><action>success</action><hash>3d44ced6f58644f2f9f34f452bd7fa06</hash></key>
<key><path>HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{1B97A696-5576-43AC-A73B-E1D2C78F21E8}</path><vendor>PUP.Optional.PricePeep.A</vendor><action>success</action><hash>3d44ced6f58644f2f9f34f452bd7fa06</hash></key>
<key><path>HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{75BF416E-4326-45B5-8A2D-AE32D05B930B}</path><vendor>PUP.Optional.PricePeep.A</vendor><action>success</action><hash>3d44ced6f58644f2f9f34f452bd7fa06</hash></key>
<key><path>HKLM\SOFTWARE\WOW6432NODE\CLASSES\TYPELIB\{3BF3DED5-0FC8-4207-AC09-AA7B5AF4E408}</path><vendor>PUP.Optional.PricePeep.A</vendor><action>success</action><hash>3d44ced6f58644f2f9f34f452bd7fa06</hash></key>
<key><path>HKLM\SOFTWARE\CLASSES\PricePeep.PricePeepBho.1</path><vendor>PUP.Optional.PricePeep.A</vendor><action>success</action><hash>3d44ced6f58644f2f9f34f452bd7fa06</hash></key>
<key><path>HKLM\SOFTWARE\CLASSES\PricePeep.PricePeepBho</path><vendor>PUP.Optional.PricePeep.A</vendor><action>success</action><hash>3d44ced6f58644f2f9f34f452bd7fa06</hash></key>
<key><path>HKLM\SOFTWARE\WOW6432NODE\CLASSES\PricePeep.PricePeepBho</path><vendor>PUP.Optional.PricePeep.A</vendor><action>success</action><hash>3d44ced6f58644f2f9f34f452bd7fa06</hash></key>
<key><path>HKLM\SOFTWARE\WOW6432NODE\CLASSES\PricePeep.PricePeepBho.1</path><vendor>PUP.Optional.PricePeep.A</vendor><action>success</action><hash>3d44ced6f58644f2f9f34f452bd7fa06</hash></key>
<key><path>HKLM\SOFTWARE\CLASSES\TYPELIB\{3BF3DED5-0FC8-4207-AC09-AA7B5AF4E408}</path><vendor>Adware.Agent</vendor><action>success</action><hash>afd203a1f289c175206f54100ef4b54b</hash></key>
<key><path>HKLM\SOFTWARE\CLASSES\INTERFACE\{1B97A696-5576-43AC-A73B-E1D2C78F21E8}</path><vendor>Adware.Agent</vendor><action>success</action><hash>afd203a1f289c175206f54100ef4b54b</hash></key>
<key><path>HKLM\SOFTWARE\CLASSES\INTERFACE\{75BF416E-4326-45B5-8A2D-AE32D05B930B}</path><vendor>Adware.Agent</vendor><action>success</action><hash>afd203a1f289c175206f54100ef4b54b</hash></key>
<key><path>HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{1B97A696-5576-43AC-A73B-E1D2C78F21E8}</path><vendor>Adware.Agent</vendor><action>success</action><hash>afd203a1f289c175206f54100ef4b54b</hash></key>
<key><path>HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{75BF416E-4326-45B5-8A2D-AE32D05B930B}</path><vendor>Adware.Agent</vendor><action>success</action><hash>afd203a1f289c175206f54100ef4b54b</hash></key>
<key><path>HKLM\SOFTWARE\WOW6432NODE\CLASSES\TYPELIB\{3BF3DED5-0FC8-4207-AC09-AA7B5AF4E408}</path><vendor>Adware.Agent</vendor><action>success</action><hash>afd203a1f289c175206f54100ef4b54b</hash></key>
<key><path>HKU\S-1-5-21-3534363647-1427521627-2892733247-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}</path><vendor>PUP.Optional.Babylon.A</vendor><action>success</action><hash>31505d47d5a6c0769e8cf46829d9c33d</hash></key>
<key><path>HKU\S-1-5-21-3534363647-1427521627-2892733247-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{AF6B0594-6008-4327-93E5-608AD710A6FA}</path><vendor>PUP.Optional.WebCake.A</vendor><action>success</action><hash>c2bf3a6ae299aa8c821e375e46bc5da3</hash></key>
<key><path>HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{68B81CCD-A80C-4060-8947-5AE69ED01199}</path><vendor>PUP.Optional.Iminent.A</vendor><action>success</action><hash>a1e0376d8dee94a252917223768cf40c</hash></key>
<key><path>HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{E6B969FB-6D33-48d2-9061-8BBD4899EB08}</path><vendor>PUP.Optional.Iminent.A</vendor><action>success</action><hash>c5bc9d070f6cdf57667ed6bf986a748c</hash></key>
<key><path>HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\SoftwareUpdater</path><vendor>PUP.Optional.SoftwareUpdater.A</vendor><action>success</action><hash>a8d9d0d4611a4ee8eb81848422e203fd</hash></key>
<key><path>HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\{664f7cae-01d9-48b5-bc90-e3c3d6bb0ddb}w64</path><vendor>PUP.Optional.Sanbreel.A</vendor><action>success</action><hash>a7da4c58dd9ee84e0df69893de269d63</hash></key>
<key><path>HKLM\SOFTWARE\DomaIQ</path><vendor>PUP.Optional.DomaIQ.A</vendor><action>success</action><hash>d2afc0e44b3050e6d21b985fba4836ca</hash></key>
<key><path>HKLM\SOFTWARE\CLASSES\APPID\PricePeep.DLL</path><vendor>PUP.Optional.PricePeep.A</vendor><action>success</action><hash>661b6b393c3f76c0267d9379000427d9</hash></key>
<key><path>HKLM\SOFTWARE\WOW6432NODE\DataMngr</path><vendor>PUP.Optional.DataMangr.A</vendor><action>success</action><hash>93ee059f403b7eb83fdd4197b64c13ed</hash></key>
<key><path>HKLM\SOFTWARE\WOW6432NODE\Iminent</path><vendor>PUP.Optional.Iminent.A</vendor><action>success</action><hash>a3de4d57502b013503edb14460a20af6</hash></key>
<key><path>HKLM\SOFTWARE\WOW6432NODE\CLASSES\APPID\PricePeep.DLL</path><vendor>PUP.Optional.PricePeep.A</vendor><action>success</action><hash>d4addfc54c2fdd59b8eb78942ada13ed</hash></key>
<key><path>HKLM\SOFTWARE\WOW6432NODE\SOFTWAREUPDATER</path><vendor>PUP.Optional.SoftwareUpdater.A</vendor><action>success</action><hash>60217d275724ce68a1cd40cc699ba65a</hash></key>
<key><path>HKLM\SOFTWARE\WOW6432NODE\VITTALIA\AxtanInstaller</path><vendor>PUP.Optional.BundleInstaller.A</vendor><action>success</action><hash>f889baead2a9ba7c64255f932fd3bf41</hash></key>
<key><path>HKU\S-1-5-21-3534363647-1427521627-2892733247-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\DataMngr</path><vendor>PUP.Optional.DataMngr.A</vendor><action>success</action><hash>067bb4f0473455e1955daa60a064a15f</hash></key>
<key><path>HKU\S-1-5-21-3534363647-1427521627-2892733247-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\DataMngr_Toolbar</path><vendor>PUP.Optional.DataMngr.A</vendor><action>success</action><hash>2c55a2020a71e650faf752b8996b728e</hash></key>
<key><path>HKU\S-1-5-21-3534363647-1427521627-2892733247-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\Iminent</path><vendor>PUP.Optional.Iminent.A</vendor><action>success</action><hash>abd6772d87f49b9b0ae7dc1917eb926e</hash></key>
<key><path>HKU\S-1-5-21-3534363647-1427521627-2892733247-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\BABSOLUTION\Redir</path><vendor>PUP.Optional.Babylon.A</vendor><action>success</action><hash>671a22820e6da98d8b69f318f1136b95</hash></key>
<key><path>HKU\S-1-5-21-3534363647-1427521627-2892733247-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\BABSOLUTION\Updater</path><vendor>PUP.Optional.Babylon.A</vendor><action>success</action><hash>225fedb73d3e3df90bea12f9689c6c94</hash></key>
<key><path>HKU\S-1-5-21-3534363647-1427521627-2892733247-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\INSTALLCORE\1I1T1Q1S</path><vendor>PUP.Optional.InstallCore.A</vendor><action>success</action><hash>abd6dfc5c2b9f2440bf047ad7989936d</hash></key>
<key><path>HKU\S-1-5-21-3534363647-1427521627-2892733247-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\INSTALLCORE</path><vendor>PUP.Optional.InstallCore.A</vendor><action>success</action><hash>cdb4e8bcb6c578bedf369a71a163bd43</hash></key>
<key><path>HKU\S-1-5-21-3534363647-1427521627-2892733247-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\DOMSTORAGE\superfish.com</path><vendor>PUP.Optional.SuperFish.A</vendor><action>success</action><hash>9fe23b691b607db91719626fe121bb45</hash></key>
<key><path>HKU\S-1-5-21-3534363647-1427521627-2892733247-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\SOFTONIC\Universal Downloader</path><vendor>PUP.Optional.Softonic.A</vendor><action>success</action><hash>b4cd752f80fb2e08050fbd27639fb848</hash></key>
<key><path>HKU\S-1-5-21-3534363647-1427521627-2892733247-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\WEBCONNECT</path><vendor>PUP.Optional.WebConnect.A</vendor><action>success</action><hash>9be6564e1a617fb73231bd4fc143dc24</hash></key>
<value><path>HKU\S-1-5-21-3534363647-1427521627-2892733247-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN</path><valuename>Yahoo! Search</valuename><vendor>PUP.Optional.PayByAds.A</vendor><action>success</action><valuedata>C:\Users\Heinz\AppData\Local\Pay-By-Ads\Yahoo! Search\1.3.8.2\dsrlte.exe</valuedata><hash>4b365e46e19a26105b46ce1629dbd22e</hash></value>
<value><path>HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\SOFTWAREUPDATER</path><valuename>UninstallString</valuename><vendor>PUP.Optional.SoftwareUpdater</vendor><action>success</action><valuedata>C:\Program Files (x86)\SoftwareUpdater\uninstall.exe</valuedata><hash>7d04c2e2e3986dc9e314c963e81c09f7</hash></value>
<value><path>HKLM\SOFTWARE\WOW6432NODE\SOFTWAREUPDATER</path><valuename>partner_keyword</valuename><vendor>PUP.Optional.SoftwareUpdater.A</vendor><action>success</action><valuedata>ALLFILEWINCOM</valuedata><hash>60217d275724ce68a1cd40cc699ba65a</hash></value>
<value><path>HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\SRVUPDATER</path><valuename>ImagePath</valuename><vendor>PUP.Optional.SoftwareUpdater.A</vendor><action>success</action><valuedata>C:\Program Files (x86)\SoftwareUpdater\UpdaterService.exe</valuedata><hash>bcc5fda702791b1bf17a1eeab74d9e62</hash></value>
<value><path>HKU\S-1-5-21-3534363647-1427521627-2892733247-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\INSTALLCORE</path><valuename>tb</valuename><vendor>PUP.Optional.InstallCore.A</vendor><action>success</action><valuedata>0L1N1H2O1S</valuedata><hash>cdb4e8bcb6c578bedf369a71a163bd43</hash></value>
<value><path>HKU\S-1-5-21-3534363647-1427521627-2892733247-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\WEBCONNECT</path><valuename>iid</valuename><vendor>PUP.Optional.WebConnect.A</vendor><action>success</action><valuedata>def_WebConnect</valuedata><hash>9be6564e1a617fb73231bd4fc143dc24</hash></value>
<folder><path>C:\ProgramData\eSafe\log</path><vendor>PUP.Optional.eSafe.A</vendor><action>success</action><hash>f48d495b95e61026e760d819cc3658a8</hash></folder>
<folder><path>C:\Program Files (x86)\SoftwareUpdater</path><vendor>PUP.Optional.SoftwareUpdater.A</vendor><action>delete-on-reboot</action><hash>a8d9d0d4611a4ee8eb81848422e203fd</hash></folder>
<folder><path>C:\Users\Heinz\AppData\Roaming\Desk 365</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></folder>
<folder><path>C:\Users\Heinz\AppData\Roaming\Desk 365\app</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></folder>
<folder><path>C:\Users\Heinz\AppData\Roaming\Desk 365\app\config</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></folder>
<folder><path>C:\Users\Heinz\AppData\Roaming\Desk 365\app\config\1</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></folder>
<folder><path>C:\Users\Heinz\AppData\Roaming\Desk 365\app\config\3</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></folder>
<folder><path>C:\Users\Heinz\AppData\Roaming\Desk 365\app\config\35</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></folder>
<folder><path>C:\Users\Heinz\AppData\Roaming\Desk 365\app\config\36</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></folder>
<folder><path>C:\Users\Heinz\AppData\Roaming\Desk 365\app\config\39</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></folder>
<folder><path>C:\Users\Heinz\AppData\Roaming\Desk 365\app\config\4</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></folder>
<folder><path>C:\Users\Heinz\AppData\Roaming\Desk 365\app\config\41</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></folder>
<folder><path>C:\Users\Heinz\AppData\Roaming\Desk 365\app\config\42</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></folder>
<folder><path>C:\Users\Heinz\AppData\Roaming\Desk 365\components</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></folder>
<folder><path>C:\Users\Heinz\AppData\Roaming\Desk 365\desk_bkg</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></folder>
<folder><path>C:\Users\Heinz\AppData\Roaming\Desk 365\icons</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></folder>
<folder><path>C:\Users\Heinz\AppData\Roaming\Desk 365\promote</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></folder>
<folder><path>C:\Users\Heinz\AppData\Roaming\Desk 365\sysicons</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></folder>
<folder><path>C:\Users\Heinz\AppData\Roaming\Desk 365\wp</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></folder>
<folder><path>C:\Program Files (x86)\Desk 365</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>6c1572321269be7829bf3bcd857f25db</hash></folder>
<folder><path>C:\Users\Heinz\AppData\Local\Temp\Desk365\eInstall</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>2160cdd793e876c0c34ff4b5cf338977</hash></folder>
<folder><path>C:\Users\Heinz\AppData\Local\Temp\Desk365\eInstall\image</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>2160cdd793e876c0c34ff4b5cf338977</hash></folder>
<folder><path>C:\Users\Heinz\AppData\Local\Temp\Desk365\eInstall\image\default</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>2160cdd793e876c0c34ff4b5cf338977</hash></folder>
<folder><path>C:\Users\Heinz\AppData\Local\Temp\Desk365\eInstall\Install</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>2160cdd793e876c0c34ff4b5cf338977</hash></folder>
<folder><path>C:\Users\Heinz\AppData\Local\Temp\Desk365\eInstall\language</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>2160cdd793e876c0c34ff4b5cf338977</hash></folder>
<folder><path>C:\Users\Heinz\AppData\Local\Temp\Desk365\eInstall\language\en_us</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>2160cdd793e876c0c34ff4b5cf338977</hash></folder>
<folder><path>C:\Users\Heinz\AppData\Local\Temp\Desk365\eInstall\language\es_es</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>2160cdd793e876c0c34ff4b5cf338977</hash></folder>
<folder><path>C:\Users\Heinz\AppData\Local\Temp\Desk365\eInstall\language\pt_br</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>2160cdd793e876c0c34ff4b5cf338977</hash></folder>
<folder><path>C:\Users\Heinz\AppData\Local\Temp\Desk365\eInstall\language\tr_tr</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>2160cdd793e876c0c34ff4b5cf338977</hash></folder>
<folder><path>C:\Users\Heinz\AppData\Local\Temp\Desk365\eInstall\language\zh_cn</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>2160cdd793e876c0c34ff4b5cf338977</hash></folder>
<folder><path>C:\Users\Heinz\AppData\Local\Temp\Desk365\eInstall\language\zh_tw</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>2160cdd793e876c0c34ff4b5cf338977</hash></folder>
<folder><path>C:\Users\Heinz\AppData\Local\Temp\Desk365\eInstall\layout</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>2160cdd793e876c0c34ff4b5cf338977</hash></folder>
<folder><path>C:\Users\Heinz\AppData\Local\Temp\Desk365\eInstall\layout\default</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>2160cdd793e876c0c34ff4b5cf338977</hash></folder>
<folder><path>C:\Users\Heinz\AppData\Local\Temp\Desk365\eInstall\style</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>2160cdd793e876c0c34ff4b5cf338977</hash></folder>
<folder><path>C:\Program Files (x86)\Common Files\337\libcef</path><vendor>PUP.Optional.337Technologies.A</vendor><action>success</action><hash>b3ce3a6a403bf4423adb86230ff312ee</hash></folder>
<folder><path>C:\Program Files (x86)\Common Files\337\libcef\1.1364.1123</path><vendor>PUP.Optional.337Technologies.A</vendor><action>success</action><hash>b3ce3a6a403bf4423adb86230ff312ee</hash></folder>
<folder><path>C:\Program Files (x86)\Common Files\337\libcef\1.1364.1123\locales</path><vendor>PUP.Optional.337Technologies.A</vendor><action>success</action><hash>b3ce3a6a403bf4423adb86230ff312ee</hash></folder>
<folder><path>C:\Users\Heinz\AppData\Local\Pay-By-Ads</path><vendor>PUP.Optional.PayByAds.A</vendor><action>delete-on-reboot</action><hash>f48dcdd766154beb27c2cdf319e9c33d</hash></folder>
<folder><path>C:\Users\Heinz\AppData\Local\Pay-By-Ads\Yahoo! Search</path><vendor>PUP.Optional.PayByAds.A</vendor><action>delete-on-reboot</action><hash>f48dcdd766154beb27c2cdf319e9c33d</hash></folder>
<folder><path>C:\Users\Heinz\AppData\Local\Pay-By-Ads\Yahoo! Search\1.3.8.2</path><vendor>PUP.Optional.PayByAds.A</vendor><action>delete-on-reboot</action><hash>f48dcdd766154beb27c2cdf319e9c33d</hash></folder>
<file><path>C:\Program Files (x86)\SoftwareUpdater\UpdaterService.exe</path><vendor>PUP.Optional.SoftwareUpdater.A</vendor><action>delete-on-reboot</action><hash>f38e594b4a31ca6c4df127f00bf63cc4</hash></file>
<file><path>C:\Program Files (x86)\WebConnect\updateWebConnect.exe</path><vendor>PUP.Optional.WebConnect.A</vendor><action>delete-on-reboot</action><hash>9ce5aff52259fc3a28d51449f30e6898</hash></file>
<file><path>C:\Program Files (x86)\WebConnect\bin\utilWebConnect.exe</path><vendor>PUP.Optional.WebConnect.A</vendor><action>delete-on-reboot</action><hash>2958604496e53105708daab319e8ae52</hash></file>
<file><path>C:\Users\Heinz\AppData\Local\Pay-By-Ads\Yahoo! Search\1.3.8.2\dsrlte.exe</path><vendor>PUP.Optional.PayByAds.A</vendor><action>delete-on-reboot</action><hash>4b365e46e19a26105b46ce1629dbd22e</hash></file>
<file><path>C:\Users\Heinz\AppData\Roaming\Desk 365\components\component_libcef_1.1364.1123.exe</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>39485c48cbb01f17f632db012bd9cf31</hash></file>
<file><path>C:\$Recycle.Bin\S-1-5-21-3534363647-1427521627-2892733247-1000\$R5ZU2N6.exe</path><vendor>PUP.Optional.OptimizerPro</vendor><action>success</action><hash>1e63762ed3a804326473b17f639e52ae</hash></file>
<file><path>C:\Users\Heinz\AppData\Local\Temp\instloffer.exe</path><vendor>PUP.Optional.Vittalia</vendor><action>success</action><hash>8af7fda7215a66d0fbf208a822dfa55b</hash></file>
<file><path>C:\Users\Heinz\AppData\Local\Temp\Setup.exe\efcbea222c7a44a0adc609f06e3defab\eSetup.exe</path><vendor>PUP.Optional.MSILLauncher.A</vendor><action>success</action><hash>235ef4b096e586b0a53cd73f946d16ea</hash></file>
<file><path>C:\Users\Heinz\AppData\Local\Temp\Setup.exe\efcbea222c7a44a0adc609f06e3defab\installer.exe</path><vendor>PUP.Optional.MSILLauncher.A</vendor><action>success</action><hash>770af8ac8af1280ead343bdbc33ead53</hash></file>
<file><path>C:\Users\Heinz\AppData\Local\Temp\Setup.exe\efcbea222c7a44a0adc609f06e3defab\software\Delta Babylon.exe</path><vendor>PUP.Optional.DeltaTB</vendor><action>success</action><hash>a7dad0d4fb80f343d0bf60c08779c43c</hash></file>
<file><path>C:\Users\Heinz\AppData\Local\Temp\Setup.exe\efcbea222c7a44a0adc609f06e3defab\software\Desk365.exe</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>94ed2a7a2e4df34364c4716b18ec8e72</hash></file>
<file><path>C:\Users\Heinz\AppData\Local\Temp\Setup.exe\efcbea222c7a44a0adc609f06e3defab\software\OptimizerPro.exe</path><vendor>PUP.Optional.OptimizePro.A</vendor><action>success</action><hash>41400d975c1f0e284e0127f71be5b64a</hash></file>
<file><path>C:\Users\Heinz\AppData\Local\Temp\Setup.exe\efcbea222c7a44a0adc609f06e3defab\software\Setup.exe</path><vendor>PUP.Optional.Tugluu.A</vendor><action>success</action><hash>a7dab4f0d9a28ea85cef58d89b6745bb</hash></file>
<file><path>C:\Users\Heinz\AppData\Local\Temp\Desk365\eInstall\eInstall.exe</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>98e95f450b7045f1f19c28f503fe16ea</hash></file>
<file><path>C:\Users\Heinz\AppData\Local\Temp\nseDBAF.tmp\tkDecript.dll</path><vendor>PUP.Optional.Vittalia</vendor><action>success</action><hash>b4cd4b596b1088aecb22ecc4bd4425db</hash></file>
<file><path>C:\Users\Heinz\AppData\Local\Temp\BFFD9C9F-BAB0-7891-B2A7-8E09C2F4DB12\ccp.exe</path><vendor>Trojan.RotBrowse</vendor><action>success</action><hash>631ec5df86f5a294904d4955c044837d</hash></file>
<file><path>C:\Users\Heinz\AppData\Local\Temp\BFFD9C9F-BAB0-7891-B2A7-8E09C2F4DB12\CrxInstaller.dll</path><vendor>PUP.Optional.Babylon.A</vendor><action>success</action><hash>641de3c16a11e15540b6b26f8f72bf41</hash></file>
<file><path>C:\Users\Heinz\AppData\Local\Temp\BFFD9C9F-BAB0-7891-B2A7-8E09C2F4DB12\MyBabylonTB.exe</path><vendor>PUP.Optional.Delta.A</vendor><action>success</action><hash>5031d8cc72098aac5aa2cdabe0210ef2</hash></file>
<file><path>C:\Users\Heinz\AppData\Local\Temp\BFFD9C9F-BAB0-7891-B2A7-8E09C2F4DB12\Setup.exe</path><vendor>PUP.Optional.Babylon.A</vendor><action>success</action><hash>324f287cfa8155e14fffa77918e845bb</hash></file>
<file><path>C:\Users\Heinz\AppData\Local\Temp\60DC5A58-BAB0-7891-B94F-3CFD5F3E4F38\BUSolution.dll</path><vendor>PUP.Optional.BabSolution.A</vendor><action>success</action><hash>3c45bee64a314de9073a809544bd639d</hash></file>
<file><path>C:\Users\Heinz\AppData\Local\Temp\60DC5A58-BAB0-7891-B94F-3CFD5F3E4F38\ccp.exe</path><vendor>Trojan.RotBrowse</vendor><action>success</action><hash>bcc5fda7accf2e083da0f5a9dd272bd5</hash></file>
<file><path>C:\Users\Heinz\AppData\Local\Temp\60DC5A58-BAB0-7891-B94F-3CFD5F3E4F38\CrxInstaller.dll</path><vendor>PUP.Optional.Babylon.A</vendor><action>success</action><hash>e1a04163adce68ce8e68928fbe43e41c</hash></file>
<file><path>C:\Users\Heinz\AppData\Local\Temp\60DC5A58-BAB0-7891-B94F-3CFD5F3E4F38\MntrDLLInstall.dll</path><vendor>PUP.Optional.Babylon.A</vendor><action>success</action><hash>542ddacad6a5989e8671a27fd22fd52b</hash></file>
<file><path>C:\Users\Heinz\AppData\Local\Temp\60DC5A58-BAB0-7891-B94F-3CFD5F3E4F38\MyDeltaTB.exe</path><vendor>PUP.Optional.Delta.A</vendor><action>success</action><hash>433e1c883e3d60d646b64a2ed62b7b85</hash></file>
<file><path>C:\Users\Heinz\AppData\Local\Temp\is1135169017\387750_stp\DeltaTB.exe</path><vendor>PUP.Optional.Babylon.A</vendor><action>success</action><hash>6c151193de9da393bc11af5f60a1768a</hash></file>
<file><path>C:\Users\Heinz\AppData\Local\Temp\is1135169017\387765_stp\WebConnect.exe</path><vendor>PUP.Optional.WebConnect.A</vendor><action>success</action><hash>e1a0455fa8d3c96d15273b37ec1805fb</hash></file>
<file><path>C:\Users\Heinz\AppData\Local\Temp\is1135169017\387968_stp\OptimizerPro.exe</path><vendor>PUP.Optional.OptimizePro.A</vendor><action>success</action><hash>68192d771b60d462024dbd615ba5619f</hash></file>
<file><path>C:\Windows\Temp\updater\KeyGen.dll</path><vendor>Trojan.SProtector</vendor><action>success</action><hash>0e7381234b302e08fa7e5b2ce41d0ef2</hash></file>
<file><path>C:\ProgramData\eSafe\log\eGdpSvc.LOG</path><vendor>PUP.Optional.eSafe.A</vendor><action>success</action><hash>f48d495b95e61026e760d819cc3658a8</hash></file>
<file><path>C:\Program Files (x86)\SoftwareUpdater\KeyGen.dll</path><vendor>PUP.Optional.SoftwareUpdater.A</vendor><action>delete-on-reboot</action><hash>a8d9d0d4611a4ee8eb81848422e203fd</hash></file>
<file><path>C:\Program Files (x86)\SoftwareUpdater\AppsUpdater.exe</path><vendor>PUP.Optional.SoftwareUpdater.A</vendor><action>delete-on-reboot</action><hash>a8d9d0d4611a4ee8eb81848422e203fd</hash></file>
<file><path>C:\Program Files (x86)\SoftwareUpdater\AppsUpdater.exe.config</path><vendor>PUP.Optional.SoftwareUpdater.A</vendor><action>success</action><hash>a8d9d0d4611a4ee8eb81848422e203fd</hash></file>
<file><path>C:\Program Files (x86)\SoftwareUpdater\config.xml</path><vendor>PUP.Optional.SoftwareUpdater.A</vendor><action>success</action><hash>a8d9d0d4611a4ee8eb81848422e203fd</hash></file>
<file><path>C:\Program Files (x86)\SoftwareUpdater\Interop.Shell32.dll</path><vendor>PUP.Optional.SoftwareUpdater.A</vendor><action>delete-on-reboot</action><hash>a8d9d0d4611a4ee8eb81848422e203fd</hash></file>
<file><path>C:\Program Files (x86)\SoftwareUpdater\translations.xml</path><vendor>PUP.Optional.SoftwareUpdater.A</vendor><action>success</action><hash>a8d9d0d4611a4ee8eb81848422e203fd</hash></file>
<file><path>C:\Program Files (x86)\SoftwareUpdater\uninstall.exe</path><vendor>PUP.Optional.SoftwareUpdater.A</vendor><action>success</action><hash>a8d9d0d4611a4ee8eb81848422e203fd</hash></file>
<file><path>C:\Users\Heinz\AppData\Roaming\Desk 365\promote.xml</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></file>
<file><path>C:\Users\Heinz\AppData\Roaming\Desk 365\desk_bkg_list.xml</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></file>
<file><path>C:\Users\Heinz\AppData\Roaming\Desk 365\desk_list.xml</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></file>
<file><path>C:\Users\Heinz\AppData\Roaming\Desk 365\desk_settings.ini</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></file>
<file><path>C:\Users\Heinz\AppData\Roaming\Desk 365\process_mgr.xml</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></file>
<file><path>C:\Users\Heinz\AppData\Roaming\Desk 365\app\config\1\angrybirds.db</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></file>
<file><path>C:\Users\Heinz\AppData\Roaming\Desk 365\app\config\1\angrybirds.ico</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></file>
<file><path>C:\Users\Heinz\AppData\Roaming\Desk 365\app\config\3\BigFarm.db</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></file>
<file><path>C:\Users\Heinz\AppData\Roaming\Desk 365\app\config\3\BigFarm.ico</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></file>
<file><path>C:\Users\Heinz\AppData\Roaming\Desk 365\app\config\35\Gmail.db</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></file>
<file><path>C:\Users\Heinz\AppData\Roaming\Desk 365\app\config\35\Gmail.ico</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></file>
<file><path>C:\Users\Heinz\AppData\Roaming\Desk 365\app\config\36\Outlook.db</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></file>
<file><path>C:\Users\Heinz\AppData\Roaming\Desk 365\app\config\36\Outlook.ico</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></file>
<file><path>C:\Users\Heinz\AppData\Roaming\Desk 365\app\config\39\ESPN.db</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></file>
<file><path>C:\Users\Heinz\AppData\Roaming\Desk 365\app\config\39\ESPN.ico</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></file>
<file><path>C:\Users\Heinz\AppData\Roaming\Desk 365\app\config\4\Empire.db</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></file>
<file><path>C:\Users\Heinz\AppData\Roaming\Desk 365\app\config\4\Empire.ico</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></file>
<file><path>C:\Users\Heinz\AppData\Roaming\Desk 365\app\config\41\gcalendar.db</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></file>
<file><path>C:\Users\Heinz\AppData\Roaming\Desk 365\app\config\41\gcalendar.ico</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></file>
<file><path>C:\Users\Heinz\AppData\Roaming\Desk 365\app\config\42\pulse.db</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></file>
<file><path>C:\Users\Heinz\AppData\Roaming\Desk 365\app\config\42\pulse.ico</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></file>
<file><path>C:\Users\Heinz\AppData\Roaming\Desk 365\desk_bkg\desk_bkg_1.png</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></file>
<file><path>C:\Users\Heinz\AppData\Roaming\Desk 365\desk_bkg\desk_bkg_2.png</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></file>
<file><path>C:\Users\Heinz\AppData\Roaming\Desk 365\desk_bkg\desk_bkg_3.png</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></file>
<file><path>C:\Users\Heinz\AppData\Roaming\Desk 365\desk_bkg\desk_bkg_4.png</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></file>
<file><path>C:\Users\Heinz\AppData\Roaming\Desk 365\desk_bkg\desk_bkg_5.png</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></file>
<file><path>C:\Users\Heinz\AppData\Roaming\Desk 365\desk_bkg\desk_bkg_default.png</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></file>
<file><path>C:\Users\Heinz\AppData\Roaming\Desk 365\icons\iexplore_ee43df38ca14bfac5699021d2ffa2cb2_48_48.png</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></file>
<file><path>C:\Users\Heinz\AppData\Roaming\Desk 365\icons\337_7c9140b13c049fd26989f7fa25b77cb1_48_48.png</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></file>
<file><path>C:\Users\Heinz\AppData\Roaming\Desk 365\icons\angrybirds_00ff92c12703baaf0130d6aec427d047_48_48.png</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></file>
<file><path>C:\Users\Heinz\AppData\Roaming\Desk 365\icons\Barbie_00a67ff4ef657679a6c88553135d62ad_48_48.png</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></file>
<file><path>C:\Users\Heinz\AppData\Roaming\Desk 365\icons\BigFarm_de933b0e5218a4db24bebe3d55ed3558_48_48.png</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></file>
<file><path>C:\Users\Heinz\AppData\Roaming\Desk 365\icons\chrome_a6a6966da5bc1fec7f04e834c3946096.ico</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></file>
<file><path>C:\Users\Heinz\AppData\Roaming\Desk 365\icons\chrome_a6a6966da5bc1fec7f04e834c3946096_48_48.png</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></file>
<file><path>C:\Users\Heinz\AppData\Roaming\Desk 365\icons\Empire_22b42f57d1c467841280810e218d5510_48_48.png</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></file>
<file><path>C:\Users\Heinz\AppData\Roaming\Desk 365\icons\ESPN_a7b078f5f5f5b87efcef66ab5783cf9d_48_48.png</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></file>
<file><path>C:\Users\Heinz\AppData\Roaming\Desk 365\icons\Facebook_aab07bc79cf599b25c0110f32d46a3ef_48_48.png</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></file>
<file><path>C:\Users\Heinz\AppData\Roaming\Desk 365\icons\gcalendar_50b3e3c5fc202f0cfcae8032b2465c1b_48_48.png</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></file>
<file><path>C:\Users\Heinz\AppData\Roaming\Desk 365\icons\Gmail_731b6d011bd9f67463a916a496775935_48_48.png</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></file>
<file><path>C:\Users\Heinz\AppData\Roaming\Desk 365\icons\Google_60d75cb277f0c452fa60dba8350caf65_48_48.png</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></file>
<file><path>C:\Users\Heinz\AppData\Roaming\Desk 365\icons\iexplore_ee43df38ca14bfac5699021d2ffa2cb2.ico</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></file>
<file><path>C:\Users\Heinz\AppData\Roaming\Desk 365\icons\Mario_52934d81761dc31187a93a3a0be7fecc_48_48.png</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></file>
<file><path>C:\Users\Heinz\AppData\Roaming\Desk 365\icons\Outlook_6f817b67fa6af1a9c8abfa3813a8595c_48_48.png</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></file>
<file><path>C:\Users\Heinz\AppData\Roaming\Desk 365\icons\pulse_b5a242da04cc06eacd02b1ca41e3583c_48_48.png</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></file>
<file><path>C:\Users\Heinz\AppData\Roaming\Desk 365\icons\sys_computer_48_48.png</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></file>
<file><path>C:\Users\Heinz\AppData\Roaming\Desk 365\icons\sys_control_panel_48_48.png</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></file>
<file><path>C:\Users\Heinz\AppData\Roaming\Desk 365\icons\sys_my_documents_48_48.png</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></file>
<file><path>C:\Users\Heinz\AppData\Roaming\Desk 365\icons\Twitter_ebddd85ec04b7b94a2b2e97b73a90a4a_48_48.png</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></file>
<file><path>C:\Users\Heinz\AppData\Roaming\Desk 365\icons\Youtube_bf18fdfc4aefd6417a8bacae4be5b415_48_48.png</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></file>
<file><path>C:\Users\Heinz\AppData\Roaming\Desk 365\promote\337.ico</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></file>
<file><path>C:\Users\Heinz\AppData\Roaming\Desk 365\promote\337_7c9140b13c049fd26989f7fa25b77cb1.ico</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></file>
<file><path>C:\Users\Heinz\AppData\Roaming\Desk 365\promote\barbie.ico</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></file>
<file><path>C:\Users\Heinz\AppData\Roaming\Desk 365\promote\Barbie_00a67ff4ef657679a6c88553135d62ad.ico</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></file>
<file><path>C:\Users\Heinz\AppData\Roaming\Desk 365\promote\facebook.ico</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></file>
<file><path>C:\Users\Heinz\AppData\Roaming\Desk 365\promote\Facebook_aab07bc79cf599b25c0110f32d46a3ef.ico</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></file>
<file><path>C:\Users\Heinz\AppData\Roaming\Desk 365\promote\GameCenter.ico</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></file>
<file><path>C:\Users\Heinz\AppData\Roaming\Desk 365\promote\google.ico</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></file>
<file><path>C:\Users\Heinz\AppData\Roaming\Desk 365\promote\Google_60d75cb277f0c452fa60dba8350caf65.ico</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></file>
<file><path>C:\Users\Heinz\AppData\Roaming\Desk 365\promote\mario.ico</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></file>
<file><path>C:\Users\Heinz\AppData\Roaming\Desk 365\promote\Mario_52934d81761dc31187a93a3a0be7fecc.ico</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></file>
<file><path>C:\Users\Heinz\AppData\Roaming\Desk 365\promote\twitter.ico</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></file>
<file><path>C:\Users\Heinz\AppData\Roaming\Desk 365\promote\Twitter_ebddd85ec04b7b94a2b2e97b73a90a4a.ico</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></file>
<file><path>C:\Users\Heinz\AppData\Roaming\Desk 365\promote\v9.ico</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></file>
<file><path>C:\Users\Heinz\AppData\Roaming\Desk 365\promote\youtube.ico</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></file>
<file><path>C:\Users\Heinz\AppData\Roaming\Desk 365\promote\Youtube_bf18fdfc4aefd6417a8bacae4be5b415.ico</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></file>
<file><path>C:\Users\Heinz\AppData\Roaming\Desk 365\sysicons\0737cc0646562366bf607aa1fa2a03bd_21.ico</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></file>
<file><path>C:\Users\Heinz\AppData\Roaming\Desk 365\sysicons\07584c03a5dd11a6104e45e8ad03b3fe_104.ico</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></file>
<file><path>C:\Users\Heinz\AppData\Roaming\Desk 365\sysicons\07584c03a5dd11a6104e45e8ad03b3fe_107.ico</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></file>
<file><path>C:\Users\Heinz\AppData\Roaming\Desk 365\wp\r0.jpg</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></file>
<file><path>C:\Users\Heinz\AppData\Roaming\Desk 365\wp\r1.jpg</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></file>
<file><path>C:\Users\Heinz\AppData\Roaming\Desk 365\wp\r2.jpg</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></file>
<file><path>C:\Users\Heinz\AppData\Roaming\Desk 365\wp\r3.jpg</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></file>
<file><path>C:\Users\Heinz\AppData\Roaming\Desk 365\wp\r4.jpg</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></file>
<file><path>C:\Users\Heinz\AppData\Roaming\Desk 365\wp\r5.jpg</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></file>
<file><path>C:\Users\Heinz\AppData\Roaming\Desk 365\wp\r6.jpg</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></file>
<file><path>C:\Users\Heinz\AppData\Roaming\Desk 365\wp\r7.jpg</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></file>
<file><path>C:\Users\Heinz\AppData\Roaming\Desk 365\wp\r8.jpg</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></file>
<file><path>C:\Users\Heinz\AppData\Roaming\Desk 365\wp\r9.jpg</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></file>
<file><path>C:\Program Files (x86)\Desk 365\promote.xml</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>6c1572321269be7829bf3bcd857f25db</hash></file>
<file><path>C:\Program Files (x86)\Desk 365\desk_bkg_list.xml</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>6c1572321269be7829bf3bcd857f25db</hash></file>
<file><path>C:\Program Files (x86)\Desk 365\desk_list.xml</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>6c1572321269be7829bf3bcd857f25db</hash></file>
<file><path>C:\Program Files (x86)\Desk 365\desk_settings.ini</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>6c1572321269be7829bf3bcd857f25db</hash></file>
<file><path>C:\Program Files (x86)\Desk 365\process_mgr.xml</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>6c1572321269be7829bf3bcd857f25db</hash></file>
<file><path>C:\Program Files (x86)\Desk 365\recent.xml</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>6c1572321269be7829bf3bcd857f25db</hash></file>
<file><path>C:\Windows\System32\drivers\{664f7cae-01d9-48b5-bc90-e3c3d6bb0ddb}w64.sys</path><vendor>PUP.Optional.Sanbreel.A</vendor><action>success</action><hash>a7da4c58dd9ee84e0df69893de269d63</hash></file>
<file><path>C:\Users\Heinz\AppData\Local\Temp\Desk365\eInstall\main</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>2160cdd793e876c0c34ff4b5cf338977</hash></file>
<file><path>C:\Users\Heinz\AppData\Local\Temp\Desk365\eInstall\msvcp100.dll</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>2160cdd793e876c0c34ff4b5cf338977</hash></file>
<file><path>C:\Users\Heinz\AppData\Local\Temp\Desk365\eInstall\msvcr100.dll</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>2160cdd793e876c0c34ff4b5cf338977</hash></file>
<file><path>C:\Users\Heinz\AppData\Local\Temp\Desk365\eInstall\segoeui.ttf</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>2160cdd793e876c0c34ff4b5cf338977</hash></file>
<file><path>C:\Users\Heinz\AppData\Local\Temp\Desk365\eInstall\segoeuib.ttf</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>2160cdd793e876c0c34ff4b5cf338977</hash></file>
<file><path>C:\Users\Heinz\AppData\Local\Temp\Desk365\eInstall\image\default\app_icon.png</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>2160cdd793e876c0c34ff4b5cf338977</hash></file>
<file><path>C:\Users\Heinz\AppData\Local\Temp\Desk365\eInstall\image\default\change_skin.png</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>2160cdd793e876c0c34ff4b5cf338977</hash></file>
<file><path>C:\Users\Heinz\AppData\Local\Temp\Desk365\eInstall\image\default\combo_skin.png</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>2160cdd793e876c0c34ff4b5cf338977</hash></file>
<file><path>C:\Users\Heinz\AppData\Local\Temp\Desk365\eInstall\image\default\edit_skin.png</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>2160cdd793e876c0c34ff4b5cf338977</hash></file>
<file><path>C:\Users\Heinz\AppData\Local\Temp\Desk365\eInstall\image\default\install_back.png</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>2160cdd793e876c0c34ff4b5cf338977</hash></file>
<file><path>C:\Users\Heinz\AppData\Local\Temp\Desk365\eInstall\image\default\install_button_skin.png</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>2160cdd793e876c0c34ff4b5cf338977</hash></file>
<file><path>C:\Users\Heinz\AppData\Local\Temp\Desk365\eInstall\image\default\install_check_checked.png</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>2160cdd793e876c0c34ff4b5cf338977</hash></file>
<file><path>C:\Users\Heinz\AppData\Local\Temp\Desk365\eInstall\image\default\install_check_intermediate.png</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>2160cdd793e876c0c34ff4b5cf338977</hash></file>
<file><path>C:\Users\Heinz\AppData\Local\Temp\Desk365\eInstall\image\default\install_check_uncheck.png</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>2160cdd793e876c0c34ff4b5cf338977</hash></file>
<file><path>C:\Users\Heinz\AppData\Local\Temp\Desk365\eInstall\image\default\install_logo.png</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>2160cdd793e876c0c34ff4b5cf338977</hash></file>
<file><path>C:\Users\Heinz\AppData\Local\Temp\Desk365\eInstall\image\default\install_resource.xml</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>2160cdd793e876c0c34ff4b5cf338977</hash></file>
<file><path>C:\Users\Heinz\AppData\Local\Temp\Desk365\eInstall\image\default\patch_file_icon.png</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>2160cdd793e876c0c34ff4b5cf338977</hash></file>
<file><path>C:\Users\Heinz\AppData\Local\Temp\Desk365\eInstall\image\default\pic-error.png</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>2160cdd793e876c0c34ff4b5cf338977</hash></file>
<file><path>C:\Users\Heinz\AppData\Local\Temp\Desk365\eInstall\image\default\pic-info.png</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>2160cdd793e876c0c34ff4b5cf338977</hash></file>
<file><path>C:\Users\Heinz\AppData\Local\Temp\Desk365\eInstall\image\default\pic-question.png</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>2160cdd793e876c0c34ff4b5cf338977</hash></file>
<file><path>C:\Users\Heinz\AppData\Local\Temp\Desk365\eInstall\image\default\pic-warning.png</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>2160cdd793e876c0c34ff4b5cf338977</hash></file>
<file><path>C:\Users\Heinz\AppData\Local\Temp\Desk365\eInstall\image\default\popup_dialog_bk.png</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>2160cdd793e876c0c34ff4b5cf338977</hash></file>
<file><path>C:\Users\Heinz\AppData\Local\Temp\Desk365\eInstall\image\default\progressbar_bk.png</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>2160cdd793e876c0c34ff4b5cf338977</hash></file>
<file><path>C:\Users\Heinz\AppData\Local\Temp\Desk365\eInstall\image\default\progressbar_image.png</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>2160cdd793e876c0c34ff4b5cf338977</hash></file>
<file><path>C:\Users\Heinz\AppData\Local\Temp\Desk365\eInstall\image\default\radio_normal.png</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>2160cdd793e876c0c34ff4b5cf338977</hash></file>
<file><path>C:\Users\Heinz\AppData\Local\Temp\Desk365\eInstall\image\default\radio_selected.png</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>2160cdd793e876c0c34ff4b5cf338977</hash></file>
<file><path>C:\Users\Heinz\AppData\Local\Temp\Desk365\eInstall\image\default\sys_close.png</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>2160cdd793e876c0c34ff4b5cf338977</hash></file>
<file><path>C:\Users\Heinz\AppData\Local\Temp\Desk365\eInstall\Install\AirZip.inst</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>2160cdd793e876c0c34ff4b5cf338977</hash></file>
<file><path>C:\Users\Heinz\AppData\Local\Temp\Desk365\eInstall\Install\edesk.inst</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>2160cdd793e876c0c34ff4b5cf338977</hash></file>
<file><path>C:\Users\Heinz\AppData\Local\Temp\Desk365\eInstall\Install\gamelogin.inst</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>2160cdd793e876c0c34ff4b5cf338977</hash></file>
<file><path>C:\Users\Heinz\AppData\Local\Temp\Desk365\eInstall\language\protocol.txt</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>2160cdd793e876c0c34ff4b5cf338977</hash></file>
<file><path>C:\Users\Heinz\AppData\Local\Temp\Desk365\eInstall\language\en_us\install_lang.ini</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>2160cdd793e876c0c34ff4b5cf338977</hash></file>
<file><path>C:\Users\Heinz\AppData\Local\Temp\Desk365\eInstall\language\es_es\install_lang.ini</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>2160cdd793e876c0c34ff4b5cf338977</hash></file>
<file><path>C:\Users\Heinz\AppData\Local\Temp\Desk365\eInstall\language\pt_br\install_lang.ini</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>2160cdd793e876c0c34ff4b5cf338977</hash></file>
<file><path>C:\Users\Heinz\AppData\Local\Temp\Desk365\eInstall\language\tr_tr\install_lang.ini</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>2160cdd793e876c0c34ff4b5cf338977</hash></file>
<file><path>C:\Users\Heinz\AppData\Local\Temp\Desk365\eInstall\layout\default\eDeskInstall.xml</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>2160cdd793e876c0c34ff4b5cf338977</hash></file>
<file><path>C:\Users\Heinz\AppData\Local\Temp\Desk365\eInstall\layout\default\gamelogin.xml</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>2160cdd793e876c0c34ff4b5cf338977</hash></file>
<file><path>C:\Users\Heinz\AppData\Local\Temp\Desk365\eInstall\layout\default\install_msgbox.xml</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>2160cdd793e876c0c34ff4b5cf338977</hash></file>
<file><path>C:\Users\Heinz\AppData\Local\Temp\Desk365\eInstall\layout\default\languageSelect.xml</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>2160cdd793e876c0c34ff4b5cf338977</hash></file>
<file><path>C:\Users\Heinz\AppData\Local\Temp\Desk365\eInstall\layout\default\uninstgl.xml</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>2160cdd793e876c0c34ff4b5cf338977</hash></file>
<file><path>C:\Users\Heinz\AppData\Local\Temp\Desk365\eInstall\style\install_style.xml</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>2160cdd793e876c0c34ff4b5cf338977</hash></file>
<file><path>C:\Program Files (x86)\Common Files\337\libcef\1.1364.1123\icudt.dll</path><vendor>PUP.Optional.337Technologies.A</vendor><action>success</action><hash>b3ce3a6a403bf4423adb86230ff312ee</hash></file>
<file><path>C:\Program Files (x86)\Common Files\337\libcef\1.1364.1123\libcef.dll</path><vendor>PUP.Optional.337Technologies.A</vendor><action>success</action><hash>b3ce3a6a403bf4423adb86230ff312ee</hash></file>
<file><path>C:\Program Files (x86)\Common Files\337\libcef\1.1364.1123\locales\en-US.pak</path><vendor>PUP.Optional.337Technologies.A</vendor><action>success</action><hash>b3ce3a6a403bf4423adb86230ff312ee</hash></file>
<file><path>C:\Users\Heinz\AppData\Local\Pay-By-Ads\Yahoo! Search\1.3.8.2\app.ini</path><vendor>PUP.Optional.PayByAds.A</vendor><action>success</action><hash>f48dcdd766154beb27c2cdf319e9c33d</hash></file>
<file><path>C:\Users\Heinz\AppData\Local\Pay-By-Ads\Yahoo! Search\1.3.8.2\chrmXtn.dll</path><vendor>PUP.Optional.PayByAds.A</vendor><action>success</action><hash>f48dcdd766154beb27c2cdf319e9c33d</hash></file>
<file><path>C:\Users\Heinz\AppData\Local\Pay-By-Ads\Yahoo! Search\1.3.8.2\ffxtn.dll</path><vendor>PUP.Optional.PayByAds.A</vendor><action>success</action><hash>f48dcdd766154beb27c2cdf319e9c33d</hash></file>
<file><path>C:\Users\Heinz\AppData\Local\Pay-By-Ads\Yahoo! Search\1.3.8.2\ieds.xml</path><vendor>PUP.Optional.PayByAds.A</vendor><action>success</action><hash>f48dcdd766154beb27c2cdf319e9c33d</hash></file>
<file><path>C:\Users\Heinz\AppData\Local\Pay-By-Ads\Yahoo! Search\1.3.8.2\rvt.js</path><vendor>PUP.Optional.PayByAds.A</vendor><action>success</action><hash>f48dcdd766154beb27c2cdf319e9c33d</hash></file>
<file><path>C:\Users\Heinz\AppData\Local\Pay-By-Ads\Yahoo! Search\1.3.8.2\serp.js</path><vendor>PUP.Optional.PayByAds.A</vendor><action>success</action><hash>f48dcdd766154beb27c2cdf319e9c33d</hash></file>
<file><path>C:\Users\Heinz\AppData\Local\Pay-By-Ads\Yahoo! Search\1.3.8.2\sqlite.dll</path><vendor>PUP.Optional.PayByAds.A</vendor><action>delete-on-reboot</action><hash>f48dcdd766154beb27c2cdf319e9c33d</hash></file>
</items>
</mbam-log>
Ich hätte jetzt gerne noch einen Antivirus Pro Log gepostet, dann wäre der Beitrag aber zu lang. Wenn gewollt, kann ich ihn zu einem späteren Zeitpunkt posten. Ich bedanke mich im Voraus und entschuldige mich schon mal für die Form dieses Beitrages. LG |
| Themen zu Malwarebytes mehrere Funde, auch Trojaner? |
| 4d36e972-e325-11ce-bfc1-08002be10318, device driver, focus, install.exe, msil/browsefox.a, msil/browsefox.e, msil/browsefox.g, teredo, win32/browsefox.c, win32/browsefox.g, win32/browsefox.i, win32/browsefox.k, win64/browsefox.a, wscript.exe |
Baum-Darstellung