Zurück   Trojaner-Board > Malware entfernen > Log-Analyse und Auswertung
Windows 7: Webseiten werden auf Werbung umgeleitet (+Werbe-Tabs)

Windows 7: Webseiten werden auf Werbung umgeleitet (+Werbe-Tabs)


Log-Analyse und Auswertung: Windows 7: Webseiten werden auf Werbung umgeleitet (+Werbe-Tabs)

Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML.

Antwort
Alt 22.02.2015, 14:09   #1
jesses
 
Windows 7: Webseiten werden auf Werbung umgeleitet (+Werbe-Tabs) - Standard

Windows 7: Webseiten werden auf Werbung umgeleitet (+Werbe-Tabs)


Hallo, ich suche Hilfe bei meinem Problem mit dem Browser. Ich habe einen Firefox (v35.0.1). Die Startseite lässt sich nicht mehr umstellen, sie springt immer auf
Code:
ATTFilter
hxxp://search.fbdownloader.com/?channel=fpo_nt
. Zudem werden Webseiten öfters auf Werbeseiten umgeleitet wenn ich auf Links klicke, oder sogar Werbung in neuen Tabs geöffnent. Ich weiß nicht, ob diese Information wichtig ist, aber manchmal ist meine Internetverbindung einfach weg (Wlan laut windows nur eingeschränkt verbunden). Nach "Trennen" und wieder "Verbinden" geht es wieder)

Außerdem würde ich gern wissen, ob ich einen Trojaner oÄ. auf diesem Laptop habe und mich so vielleicht jemand ausspionieren kann.

Ich habe die Anleitung für Hilfesuchende nach bestem Wissen befolgt. Ich habe McAfee installiert, wo ich nicht genau weiß ob ich das richtig ausgeschaltet habe (und falls nicht, wie ich das mache).

Hier meine Logs:
(weil zu lang, in neuen posts)

Im Vorraus schon vielen Dank für die Hilfe


FRST Logfile:

FRST Logfile:
Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 21-02-2015
Ran by Jessica (administrator) on JESSICA-PC on 22-02-2015 12:57:18
Running from C:\Users\Jessica\Downloads
Loaded Profiles: Jessica (Available profiles: Jessica)
Platform: Microsoft Windows 7 Home Premium  Service Pack 1 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
() C:\Program Files\ICQ6Toolbar\ICQ Service.exe
(McAfee, Inc.) C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
(McAfee, Inc.) C:\Windows\System32\mfevtps.exe
() C:\Program Files\Samsung Casual Games\GameConsole\OberonGameConsoleService.exe
() C:\Windows\System32\Rezip.exe
() C:\Program Files\CyberLink\Shared files\RichVideo.exe
(Iminent) C:\Program Files\Common Files\Umbrella\umbrella.exe
() C:\Program Files\Web Assistant\ExtensionUpdaterService.exe
(McAfee, Inc.) C:\Program Files\McAfee\MSC\McAPExe.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\AMCore\mcshield.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Samsung Electronics Co., Ltd.) C:\Program Files\Samsung\EasySpeedUpManager\EasySpeedUpManager.exe
(Samsung Electronics Co., Ltd.) C:\Program Files\Samsung\Easy Display Manager\dmhkcore.exe
(SAMSUNG Electronics) C:\Program Files\Samsung\Samsung Support Center\SSCKbdHk.exe
(SEC) C:\Program Files\Samsung\Samsung Recovery Solution 4\WCScheduler.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(CyberLink) C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe
(CyberLink Corp.) C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe
(Iminent) C:\Program Files\Iminent\Iminent.exe
(Iminent) C:\Program Files\Iminent\Iminent.Messengers.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe
(Dropbox, Inc.) C:\Users\Jessica\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\CSP\1.3.336.0\McCSPServiceHost.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\Platform\McUICnt.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(McAfee, Inc.) C:\Program Files\McAfee\SiteAdvisor\saUI.exe
(McAfee, Inc.) C:\Program Files\McAfee\VirusScan\mcods.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
() C:\Users\Jessica\Downloads\Defogger.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [8120864 2009-12-15] (Realtek Semiconductor)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1578280 2009-10-10] (Synaptics Incorporated)
HKLM\...\Run: [UpdateLBPShortCut] => C:\Program Files\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe [222504 2009-05-19] (CyberLink Corp.)
HKLM\...\Run: [CLMLServer] => C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe [103720 2009-06-03] (CyberLink)
HKLM\...\Run: [UpdateP2GoShortCut] => C:\Program Files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe [222504 2009-05-19] (CyberLink Corp.)
HKLM\...\Run: [UpdatePDRShortCut] => C:\Program Files\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exe [222504 2008-01-04] (CyberLink Corp.)
HKLM\...\Run: [RemoteControl8] => C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe [91432 2009-04-15] (CyberLink Corp.)
HKLM\...\Run: [PDVD8LanguageShortcut] => C:\Program Files\CyberLink\PowerDVD8\Language\Language.exe [50472 2009-04-15] (CyberLink Corp.)
HKLM\...\Run: [UpdatePPShortCut] => C:\Program Files\CyberLink\PowerProducer\MUITransfer\MUIStartMenu.exe [218408 2008-12-03] (CyberLink Corp.)
HKLM\...\Run: [UpdatePSTShortCut] => C:\Program Files\CyberLink\DVD Suite\MUITransfer\MUIStartMenu.exe [210216 2009-07-21] (CyberLink Corp.)
HKLM\...\Run: [APLangApp] => C:\Program Files\AnyPC Client\APLangApp.exe [13312 2009-11-20] (DoctorSoft)
HKLM\...\Run: [NvCplDaemon] => RUNDLL32.EXE C:\windows\system32\NvCpl.dll,NvStartup
HKLM\...\Run: [UCam_Menu] => C:\Program Files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe [222504 2009-05-19] (CyberLink Corp.)
HKLM\...\Run: [mcui_exe] => C:\Program Files\McAfee.com\Agent\mcagent.exe [514832 2014-10-06] (McAfee, Inc.)
HKLM\...\Run: [Iminent] => C:\Program Files\Iminent\Iminent.exe [1074736 2013-07-02] (Iminent)
HKLM\...\Run: [IminentMessenger] => C:\Program Files\Iminent\Iminent.Messengers.exe [884784 2013-07-02] (Iminent)
HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM\...\Run: [mcpltui_exe] => C:\Program Files\Common Files\McAfee\Platform\mcuicnt.exe [499352 2014-09-17] (McAfee, Inc.)
HKU\S-1-5-21-2339853823-2107313754-116825072-1001\...\Run: [EA Core] => "C:\Program Files\Electronic Arts\EADM\Core.exe" -silent
HKU\S-1-5-21-2339853823-2107313754-116825072-1001\...\Run: [SSync] => C:\Users\Jessica\AppData\Roaming\SSync\SSync.exe [36864 2013-04-09] ()
HKU\S-1-5-21-2339853823-2107313754-116825072-1001\...\Run: [OMESupervisor] => C:\Users\Jessica\AppData\Local\omesuperv.exe [2239256 2013-12-24] ()
HKU\S-1-5-21-2339853823-2107313754-116825072-1001\...\Run: [swg] => C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2010-03-05] (Google Inc.)
HKU\S-1-5-21-2339853823-2107313754-116825072-1001\...\Run: [SCheck] => C:\Users\Jessica\AppData\Roaming\SCheck\SCheck.exe [37376 2013-12-09] ()
HKU\S-1-5-21-2339853823-2107313754-116825072-1001\...\Run: [Snoozer] => C:\Users\Jessica\AppData\Roaming\Snz\Snz.exe [1641116 2015-02-18] ()
HKU\S-1-5-21-2339853823-2107313754-116825072-1001\...\Run: [DataMgr] => C:\Users\Jessica\AppData\Roaming\DataMgr\DataMgr.exe [168848 2013-06-26] (HTTO Group, Ltd.)
HKU\S-1-5-21-2339853823-2107313754-116825072-1001\...\Run: [Intermediate] => C:\Users\Jessica\AppData\Roaming\Intermediate\Intermediate.exe [37376 2013-12-09] ()
HKU\S-1-5-21-2339853823-2107313754-116825072-1001\...\MountPoints2: F - F:\setup_vmc_lite.exe /checkApplicationPresence
HKU\S-1-5-21-2339853823-2107313754-116825072-1001\...\MountPoints2: {a253fd9b-317b-11df-a1e6-806e6f6e6963} - E:\Autorun.exe
HKU\S-1-5-21-2339853823-2107313754-116825072-1001\...\MountPoints2: {faa0af6a-d47c-11df-8cb9-00245487e561} - F:\setup_vmc_lite.exe /checkApplicationPresence
HKU\S-1-5-18\...\RunOnce: [SPReview] => C:\windows\System32\SPReview\SPReview.exe [280576 2013-03-20] (Microsoft Corporation)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe (McAfee, Inc.)
Startup: C:\Users\Jessica\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\Jessica\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
Startup: C:\Users\Jessica\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk
ShortcutTarget: OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)
ShellIconOverlayIdentifiers: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Jessica\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Jessica\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Jessica\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\S-1-5-21-2339853823-2107313754-116825072-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=smsn&bmod=smsn
HKU\S-1-5-21-2339853823-2107313754-116825072-1001\Software\Microsoft\Internet Explorer\Main,ICQ Search = hxxp://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd
HKU\S-1-5-21-2339853823-2107313754-116825072-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.fbdownloader.com/?channel=fpo
URLSearchHook: HKU\S-1-5-21-2339853823-2107313754-116825072-1001 - Default Value = {855F3B16-6D32-4fe6-8A56-BBB695989046}
URLSearchHook: HKU\S-1-5-21-2339853823-2107313754-116825072-1001 - ICQToolBar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll (ICQ)
URLSearchHook: HKU\S-1-5-21-2339853823-2107313754-116825072-1001 - McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
SearchScopes: HKLM -> DefaultScope {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7SMSN
SearchScopes: HKLM -> {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7SMSN
SearchScopes: HKU\S-1-5-21-2339853823-2107313754-116825072-1001 -> DefaultScope {95B7759C-8C7F-4BF1-B163-73684A933233} URL = hxxp://search.fbdownloader.com/search.php?channel=fpo&q={searchTerms}
SearchScopes: HKU\S-1-5-21-2339853823-2107313754-116825072-1001 -> {6552C7DD-90A4-4387-B795-F8F96747DE19} URL = hxxp://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd
SearchScopes: HKU\S-1-5-21-2339853823-2107313754-116825072-1001 -> {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7SMSN_de___DE401
SearchScopes: HKU\S-1-5-21-2339853823-2107313754-116825072-1001 -> {95B7759C-8C7F-4BF1-B163-73684A933233} URL = hxxp://search.fbdownloader.com/search.php?channel=fpo&q={searchTerms}
SearchScopes: HKU\S-1-5-21-2339853823-2107313754-116825072-1001 -> {BC72CD84-CE4D-47EC-BBFE-F8F58A00E455} URL = https://de.search.yahoo.com/search?fr=mcafee&type=B011DE532D20140115&p={SearchTerms}
SearchScopes: HKU\S-1-5-21-2339853823-2107313754-116825072-1001 -> {CFF4DB9B-135F-47c0-9269-B4C6572FD61A} URL = hxxp://mystart.incredibar.com/mb139/?search={searchTerms}&loc=IB_DS&a=6OyBVFejmS&i=26
BHO: MSS+ Identifier -> {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} -> C:\Program Files\McAfee Security Scan\3.8.150\McAfeeMSS_IE.dll (McAfee, Inc.)
BHO: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO: McAfee Phishing Filter -> {27B4851A-3207-45A2-B947-BE8AFE6163AB} -> c:\progra~1\mcafee\msk\mskapbho.dll No File
BHO: DownloadnSave Class -> {3013CC39-DFA7-4D19-A172-3FE22E46D439} -> C:\ProgramData\DownloadnSave\bhoclass.dll ()
BHO: Web Assistant -> {336D0C35-8A85-403a-B9D2-65C292C39087} -> C:\Program Files\Web Assistant\Extension32.dll ()
BHO: PiccShare BHO -> {553318DA-D010-469E-84B1-496563CAE1C0} -> C:\Users\Jessica\AppData\Local\ext_piccshare\ext_piccshare.dll (HTTO Group, Ltd)
BHO: No Name -> {5C255C8A-E604-49b4-9D64-90988571CECB} ->  No File
BHO: Incredibar.com Helper Object -> {6E13DDE1-2B6E-46CE-8B66-DC8BF36F6B99} -> C:\Program Files\Incredibar.com\incredibar\1.5.11.14\bh\incredibar.dll (Montera Technologeis LTD)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO: IMinent WebBooster (BHO) -> {A09AB6EB-31B5-454C-97EC-9B294D92EE2A} -> C:\Program Files\Iminent\Minibar.InternetExplorer.BHOx86.dll (SIEN)
BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO: Skype Plug-In -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
BHO: McAfee SiteAdvisor BHO -> {B164E929-A1B6-4A06-B104-2CD0E90A88FF} -> c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO: ChromeFrame BHO -> {ECB3C477-1A0A-44BD-BB57-78F9EFE34FA7} -> C:\Program Files\Google\Chrome Frame\Application\32.0.1700.107\npchrome_frame.dll (Google Inc.)
BHO: DVDVideoSoft WebPageAdjuster Class -> {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} -> C:\Program Files\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll (DVDVideoSoft Ltd.)
Toolbar: HKLM - McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
Toolbar: HKLM - Incredibar Toolbar - {F9639E4A-801B-4843-AEE3-03D9DA199E77} - C:\Program Files\Incredibar.com\incredibar\1.5.11.14\incredibarTlbr.dll (Montera Technologeis LTD)
Toolbar: HKLM - ICQToolBar - {855F3B16-6D32-4FE6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll (ICQ)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKU\S-1-5-21-2339853823-2107313754-116825072-1001 -> Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} hxxp://office.microsoft.com/sites/production/ieawsdc32.cab
DPF: {C345E174-3E87-4F41-A01C-B066A90A49B4} hxxp://trial.trymicrosoftoffice.com/trialoaa/buymsoffice_assets/framework/microsoft/wrc32.ocx
Handler: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
Handler: gcf - {9875BFAF-B04D-445E-8A69-BE36838CDE3E} - C:\Program Files\Google\Chrome Frame\Application\32.0.1700.107\npchrome_frame.dll (Google Inc.)
Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)
Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Filter: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - c:\Program Files\McAfee\MSC\McSnIePl.dll (McAfee, Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\Jessica\AppData\Roaming\Mozilla\Firefox\Profiles\xqn19gsg.default
FF DefaultSearchEngine: Search
FF DefaultSearchUrl: hxxp://search.fbdownloader.com/search.php?channel=fpo&q=
FF SearchEngineOrder.1: Sichere Suche
FF SelectedSearchEngine: Search
FF Homepage: https://www.google.de/?gws_rd=ssl
FF Keyword.URL: hxxp://search.fbdownloader.com/search.php?channel=fpo&q=
FF Plugin: @adobe.com/FlashPlayer -> C:\windows\system32\Macromed\Flash\NPSWF32_16_0_0_305.dll ()
FF Plugin: @Google.com/GoogleEarthPlugin -> C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin: @java.com/DTPlugin,version=10.45.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.45.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @mcafee.com/MSC,version=10 -> c:\PROGRA~1\mcafee\msc\NPMCSN~1.DLL ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\3.0.40624.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeLive,version=1.3 -> C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin: @microsoft.com/WLPG,version=14.0.8081.0709 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.26.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.26.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-2339853823-2107313754-116825072-1001: bebomedia.com/OfferMosquitoIEHelper -> C:\Users\Jessica\AppData\Local\ext_offermosquito\npOfferMosquitoIEHelper.dll (Bebo Media Ltd)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\Jessica\AppData\Roaming\Mozilla\Firefox\Profiles\xqn19gsg.default\searchplugins\fbdownloader_search.xml
FF SearchPlugin: C:\Users\Jessica\AppData\Roaming\Mozilla\Firefox\Profiles\xqn19gsg.default\searchplugins\search.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\McSiteAdvisor.xml
FF Extension: Iminent - C:\Users\Jessica\AppData\Roaming\Mozilla\Firefox\Profiles\xqn19gsg.default\Extensions\firefoxmini@go.im.xpi [2014-08-10]
FF Extension: OfferMosquito - C:\Users\Jessica\AppData\Roaming\Mozilla\Firefox\Profiles\xqn19gsg.default\Extensions\om@offermosquito.com.xpi [2013-12-19]
FF Extension: Simple New Tab - C:\Users\Jessica\AppData\Roaming\Mozilla\Firefox\Profiles\xqn19gsg.default\Extensions\snt@simplenewtab.com.xpi [2014-12-24]
FF Extension: Adblock Plus - C:\Users\Jessica\AppData\Roaming\Mozilla\Firefox\Profiles\xqn19gsg.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-03-29]
FF HKLM\...\Firefox\Extensions: [{4ED1F68A-5463-4931-9384-8FFF5ED91D92}] - C:\Program Files\McAfee\SiteAdvisor
FF Extension: McAfee SiteAdvisor - C:\Program Files\McAfee\SiteAdvisor [2010-03-05]
FF HKLM\...\Firefox\Extensions: [{336D0C35-8A85-403a-B9D2-65C292C39087}] - C:\Program Files\Web Assistant\Firefox
FF Extension: Web Assistant - C:\Program Files\Web Assistant\Firefox [2012-05-15]
FF HKLM\...\Firefox\Extensions: [{ACAA314B-EEBA-48e4-AD47-84E31C44796C}] - C:\Program Files\Common Files\DVDVideoSoft\plugins\ff
FF Extension: DVDVideoSoft YouTube MP3 and Video Download - C:\Program Files\Common Files\DVDVideoSoft\plugins\ff [2013-02-14]
FF HKLM\...\Thunderbird\Extensions: [msktbird@mcafee.com] - C:\Program Files\McAfee\MSK
FF Extension: McAfee Anti-Spam Thunderbird Extension - C:\Program Files\McAfee\MSK [2010-03-05]
FF HKU\S-1-5-21-2339853823-2107313754-116825072-1001\...\Firefox\Extensions: [{e4f94d1e-2f53-401e-8885-681602c0ddd8}] - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi
FF Extension: No Name - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi [2014-04-04]

Chrome: 
=======
CHR StartupUrls: Default -> "http:\/\/search.fbdownloader.com\/?channel=fpo"
CHR DefaultSuggestURL: Default -> 
CHR Plugin: (Remoting Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files\Google\Chrome\Application\40.0.2214.111\ppGoogleNaClPluginChrome.dll No File
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files\Google\Chrome\Application\40.0.2214.111\pdf.dll ()
CHR Plugin: (Shockwave Flash) - C:\Program Files\Google\Chrome\Application\40.0.2214.111\gcswf32.dll No File
CHR Plugin: (Shockwave Flash) - C:\windows\system32\Macromed\Flash\NPSWF32_11_2_202_235.dll No File
CHR Plugin: (Injovo Extension Plugin) - C:\Users\Jessica\AppData\Local\Google\Chrome\User Data\Default\Extensions\dlnembnfbcpjnepmfjmngjenhhajpdfd\2.0.0.430_0\npbrowserext.dll No File
CHR Plugin: (McAfee SiteAdvisor) - C:\Users\Jessica\AppData\Local\Google\Chrome\User Data\Default\Extensions\fheoggkfdfchfphceeifdbepaooicaho\3.41.123.2_0\McChPlg.dll No File
CHR Plugin: (McAfee SiteAdvisor) - C:\Program Files\McAfee\SiteAdvisor\npmcffplg32.dll (McAfee, Inc.)
CHR Plugin: (Adobe Acrobat) - C:\Program Files\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll No File
CHR Plugin: (Google Earth Plugin) - C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
CHR Plugin: (Google Update) - C:\Program Files\Google\Update\1.3.21.111\npGoogleUpdate3.dll No File
CHR Plugin: (Silverlight Plug-In) - C:\Program Files\Microsoft Silverlight\3.0.40624.0\npctrl.dll ( Microsoft Corporation)
CHR Plugin: (Microsoft Office Live Plug-in for Firefox) - C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
CHR Plugin: (Windows Live® Photo Gallery) - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (McAfee SecurityCenter) - c:\progra~1\mcafee\msc\npmcsn~1.dll ()
CHR Profile: C:\Users\Jessica\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Love 3) - C:\Users\Jessica\AppData\Local\Google\Chrome\User Data\Default\Extensions\agljhkifkkcfncajnfokkhioadolnkho [2011-10-25]
CHR Extension: (YouTube) - C:\Users\Jessica\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2011-12-16]
CHR Extension: (Google Search) - C:\Users\Jessica\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2011-12-16]
CHR Extension: (SiteAdvisor) - C:\Users\Jessica\AppData\Local\Google\Chrome\User Data\Default\Extensions\fheoggkfdfchfphceeifdbepaooicaho [2011-10-24]
CHR Extension: (OfferMosquito) - C:\Users\Jessica\AppData\Local\Google\Chrome\User Data\Default\Extensions\gbmdkmlcnbapgegninelmjbfibaghdmk [2013-07-20]
CHR Extension: (Iminent) - C:\Users\Jessica\AppData\Local\Google\Chrome\User Data\Default\Extensions\igdhbblpcellaljokkpfhcjlagemhgjl [2013-07-23]
CHR Extension: (Any New Tab) - C:\Users\Jessica\AppData\Local\Google\Chrome\User Data\Default\Extensions\jfenflmklmpohipcckmagnmbmbibnolo [2013-12-07]
CHR Extension: (Gmail) - C:\Users\Jessica\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2011-12-16]
CHR Extension: (Simple New Tab) - C:\Users\Jessica\AppData\Local\Google\Chrome\User Data\Default\Extensions\pmgkeimkiojpjcoiiipekfjaopchhjga [2013-12-25]
CHR HKLM\...\Chrome\Extension: [bopakagnckmlgajfccecajhnimjiiedh] - hxxp://clients2.google.com/service/update2/crx
CHR HKLM\...\Chrome\Extension: [dlnembnfbcpjnepmfjmngjenhhajpdfd] - C:\Program Files\Web Assistant\source.crx [2012-05-15]
CHR HKLM\...\Chrome\Extension: [ebdkldcjjkfbcjdhfkmdlnppdmjdpnoo] - C:\ProgramData\DownloadnSave\ebdkldcjjkfbcjdhfkmdlnppdmjdpnoo.crx [2012-05-15]
CHR HKLM\...\Chrome\Extension: [fheoggkfdfchfphceeifdbepaooicaho] - C:\Program Files\McAfee\SiteAdvisor\McChPlg.crx [2015-02-14]
CHR HKU\S-1-5-21-2339853823-2107313754-116825072-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [docfnddcclkgokdfpnmngpiliiachclb] - C:\Users\Jessica\AppData\Local\Google\Chrome\User Data\Default\ext_piccshare\ext_piccshare.crx [2013-06-26]
CHR HKU\S-1-5-21-2339853823-2107313754-116825072-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [gbmdkmlcnbapgegninelmjbfibaghdmk] - C:\Users\Jessica\AppData\Local\Google\Chrome\User Data\Default\ext_offermosquito\ext_offermosquito.crx [2013-12-19]
CHR HKU\S-1-5-21-2339853823-2107313754-116825072-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [nikpibnbobmbdbheedjfogjlikpgpnhp] - C:\Program Files\Common Files\DVDVideoSoft\plugins\DVDVideoSoftBrowserExtension.crx [2013-02-14]

========================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 HomeNetSvc; C:\Program Files\Common Files\Mcafee\Platform\McSvcHost\McSvHost.exe [286672 2014-10-31] (McAfee, Inc.)
R2 ICQ Service; C:\Program Files\ICQ6Toolbar\ICQ Service.exe [247608 2010-11-21] ()
R2 McAfee SiteAdvisor Service; C:\Program Files\McAfee\SiteAdvisor\McSACore.exe [132160 2015-02-12] (McAfee, Inc.)
R2 McAPExe; C:\Program Files\McAfee\MSC\McAPExe.exe [529216 2014-10-06] (McAfee, Inc.)
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.150\McCHSvc.exe [235696 2014-04-09] (McAfee, Inc.)
R2 mccspsvc; C:\Program Files\Common Files\McAfee\CSP\1.3.336.0\McCSPServiceHost.exe [338160 2014-11-21] (McAfee, Inc.)
R2 McMPFSvc; C:\Program Files\Common Files\Mcafee\Platform\McSvcHost\McSvHost.exe [286672 2014-10-31] (McAfee, Inc.)
R2 McNaiAnn; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [286672 2014-10-31] (McAfee, Inc.)
R3 McODS; C:\Program Files\McAfee\VirusScan\mcods.exe [471560 2014-12-03] (McAfee, Inc.)
R2 mcpltsvc; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [286672 2014-10-31] (McAfee, Inc.)
R2 McProxy; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [286672 2014-10-31] (McAfee, Inc.)
R2 mfecore; C:\Program Files\Common Files\McAfee\AMCore\mcshield.exe [661088 2014-11-06] (McAfee, Inc.)
R2 mfefire; C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe [171368 2014-10-01] (McAfee, Inc.)
R2 mfevtp; C:\windows\system32\mfevtps.exe [179608 2014-10-01] (McAfee, Inc.)
R2 MSK80Service; C:\Program Files\Common Files\Mcafee\Platform\McSvcHost\McSvHost.exe [286672 2014-10-31] (McAfee, Inc.)
R2 OberonGameConsoleService; C:\Program Files\Samsung Casual Games\GameConsole\OberonGameConsoleService.exe [44312 2009-08-13] ()
R2 Rezip; C:\windows\SYSTEM32\Rezip.exe [311296 2009-03-05] () [File not signed]
R2 RichVideo; C:\Program Files\CyberLink\Shared files\RichVideo.exe [247152 2009-07-07] ()
R2 SProtection; C:\Program Files\Common Files\Umbrella\umbrella.exe [3767936 2014-12-18] (Iminent)
R2 Web Assistant Updater; C:\Program Files\Web Assistant\ExtensionUpdaterService.exe [185856 2012-05-01] () [File not signed]
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [680960 2013-05-27] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R3 cfwids; C:\windows\System32\drivers\cfwids.sys [62840 2014-10-01] (McAfee, Inc.)
S3 HipShieldK; C:\windows\System32\drivers\HipShieldK.sys [147912 2013-09-23] (McAfee, Inc.)
R3 mfeapfk; C:\windows\System32\drivers\mfeapfk.sys [135880 2014-10-01] (McAfee, Inc.)
R3 mfeavfk; C:\windows\System32\drivers\mfeavfk.sys [238312 2014-10-01] (McAfee, Inc.)
S3 mfebopk; C:\windows\System32\drivers\mfebopk.sys [67824 2014-10-01] (McAfee, Inc.)
R3 mfefirek; C:\windows\System32\drivers\mfefirek.sys [371712 2014-10-01] (McAfee, Inc.)
R0 mfehidk; C:\windows\System32\drivers\mfehidk.sys [575992 2014-10-01] (McAfee, Inc.)
R3 mfencbdc; C:\windows\System32\DRIVERS\mfencbdc.sys [352360 2014-09-19] (McAfee, Inc.)
S3 mfencrk; C:\windows\System32\DRIVERS\mfencrk.sys [81304 2014-09-19] (McAfee, Inc.)
R0 mfewfpk; C:\windows\System32\drivers\mfewfpk.sys [217232 2014-10-01] (McAfee, Inc.)
R3 yukonw7; C:\windows\System32\DRIVERS\yk62x86.sys [315392 2009-09-28] ()
S3 ZTEusbnet; C:\windows\System32\DRIVERS\ZTEusbnet.sys [110592 2009-04-09] (ZTE Corporation)
S3 ZTEusbvoice; C:\windows\System32\DRIVERS\ZTEusbvoice.sys [105344 2009-04-09] (ZTE Incorporated)

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-02-22 12:57 - 2015-02-22 12:58 - 00029242 _____ () C:\Users\Jessica\Downloads\FRST.txt
2015-02-22 12:56 - 2015-02-22 12:57 - 00000000 ____D () C:\FRST
2015-02-22 12:55 - 2015-02-22 12:56 - 00000476 _____ () C:\Users\Jessica\Downloads\defogger_disable.log
2015-02-22 12:55 - 2015-02-22 12:55 - 00000000 _____ () C:\Users\Jessica\defogger_reenable
2015-02-22 12:49 - 2015-02-22 12:49 - 00380416 _____ () C:\Users\Jessica\Downloads\vnrfyu79.exe
2015-02-22 12:48 - 2015-02-22 12:48 - 01126400 _____ (Farbar) C:\Users\Jessica\Downloads\FRST.exe
2015-02-22 12:48 - 2015-02-22 12:48 - 00050477 _____ () C:\Users\Jessica\Downloads\Defogger.exe
2015-02-21 21:16 - 2015-02-21 21:16 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee
2015-02-18 19:03 - 2015-02-18 19:03 - 00000000 ____D () C:\Users\Jessica\AppData\Roaming\Snz
2015-02-18 12:42 - 2015-01-23 04:43 - 00620032 _____ (Microsoft Corporation) C:\windows\system32\jscript9diag.dll
2015-02-18 12:42 - 2015-01-23 04:17 - 04300800 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll
2015-02-14 12:25 - 2015-01-15 08:46 - 00136640 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ksecpkg.sys
2015-02-14 12:25 - 2015-01-15 08:46 - 00067520 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ksecdd.sys
2015-02-14 12:25 - 2015-01-15 08:43 - 00100352 _____ (Microsoft Corporation) C:\windows\system32\sspicli.dll
2015-02-14 12:25 - 2015-01-15 08:43 - 00015872 _____ (Microsoft Corporation) C:\windows\system32\sspisrv.dll
2015-02-14 12:25 - 2015-01-15 08:42 - 01061376 _____ (Microsoft Corporation) C:\windows\system32\lsasrv.dll
2015-02-14 12:25 - 2015-01-15 08:42 - 00050176 _____ (Microsoft Corporation) C:\windows\system32\auditpol.exe
2015-02-14 12:25 - 2015-01-15 08:42 - 00022528 _____ (Microsoft Corporation) C:\windows\system32\lsass.exe
2015-02-14 12:25 - 2015-01-15 08:42 - 00022016 _____ (Microsoft Corporation) C:\windows\system32\secur32.dll
2015-02-14 12:25 - 2015-01-15 08:39 - 00146432 _____ (Microsoft Corporation) C:\windows\system32\msaudite.dll
2015-02-14 12:25 - 2015-01-15 08:39 - 00060416 _____ (Microsoft Corporation) C:\windows\system32\msobjs.dll
2015-02-14 12:25 - 2015-01-15 08:37 - 00686080 _____ (Microsoft Corporation) C:\windows\system32\adtschema.dll
2015-02-14 12:25 - 2015-01-15 05:21 - 00369968 _____ (Microsoft Corporation) C:\windows\system32\Drivers\cng.sys
2015-02-14 12:25 - 2015-01-09 02:45 - 02380288 _____ (Microsoft Corporation) C:\windows\system32\win32k.sys
2015-02-14 12:24 - 2015-02-04 03:54 - 00482304 _____ (Microsoft Corporation) C:\windows\system32\generaltel.dll
2015-02-14 12:24 - 2015-02-04 03:53 - 00767488 _____ (Microsoft Corporation) C:\windows\system32\appraiser.dll
2015-02-14 12:24 - 2015-02-04 03:53 - 00621056 _____ (Microsoft Corporation) C:\windows\system32\invagent.dll
2015-02-14 12:24 - 2015-02-04 03:53 - 00325632 _____ (Microsoft Corporation) C:\windows\system32\devinv.dll
2015-02-14 12:24 - 2015-02-04 03:53 - 00202752 _____ (Microsoft Corporation) C:\windows\system32\aepdu.dll
2015-02-14 12:24 - 2015-02-04 03:53 - 00159744 _____ (Microsoft Corporation) C:\windows\system32\aepic.dll
2015-02-14 12:24 - 2015-02-04 03:49 - 00886784 _____ (Microsoft Corporation) C:\windows\system32\aeinv.dll
2015-02-14 12:24 - 2015-01-28 00:36 - 01167520 _____ (Microsoft Corporation) C:\windows\system32\aitstatic.exe
2015-02-14 12:24 - 2015-01-14 06:44 - 03972544 _____ (Microsoft Corporation) C:\windows\system32\ntkrnlpa.exe
2015-02-14 12:24 - 2015-01-14 06:44 - 03917760 _____ (Microsoft Corporation) C:\windows\system32\ntoskrnl.exe
2015-02-14 12:24 - 2014-11-26 04:32 - 00571904 _____ (Microsoft Corporation) C:\windows\system32\oleaut32.dll
2015-02-14 12:24 - 2014-10-04 02:42 - 03221504 _____ (Microsoft Corporation) C:\windows\system32\mstscax.dll
2015-02-14 12:24 - 2014-10-04 02:42 - 00131584 _____ (Microsoft Corporation) C:\windows\system32\aaclient.dll
2015-02-14 12:23 - 2015-01-14 06:09 - 00342712 _____ (Microsoft Corporation) C:\windows\system32\iedkcs32.dll
2015-02-14 12:23 - 2015-01-12 03:25 - 19740160 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll
2015-02-14 12:23 - 2015-01-12 03:21 - 02724864 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb
2015-02-14 12:23 - 2015-01-12 03:21 - 00004096 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollectorres.dll
2015-02-14 12:23 - 2015-01-12 03:08 - 00503296 _____ (Microsoft Corporation) C:\windows\system32\vbscript.dll
2015-02-14 12:23 - 2015-01-12 03:07 - 00062464 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll
2015-02-14 12:23 - 2015-01-12 03:07 - 00047616 _____ (Microsoft Corporation) C:\windows\system32\ieetwproxystub.dll
2015-02-14 12:23 - 2015-01-12 03:05 - 00064000 _____ (Microsoft Corporation) C:\windows\system32\MshtmlDac.dll
2015-02-14 12:23 - 2015-01-12 03:02 - 02277888 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll
2015-02-14 12:23 - 2015-01-12 03:00 - 00047104 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll
2015-02-14 12:23 - 2015-01-12 02:59 - 00030720 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll
2015-02-14 12:23 - 2015-01-12 02:57 - 00478208 _____ (Microsoft Corporation) C:\windows\system32\ieui.dll
2015-02-14 12:23 - 2015-01-12 02:55 - 00115712 _____ (Microsoft Corporation) C:\windows\system32\ieUnatt.exe
2015-02-14 12:23 - 2015-01-12 02:55 - 00102912 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollector.exe
2015-02-14 12:23 - 2015-01-12 02:48 - 00667648 _____ (Microsoft Corporation) C:\windows\system32\MsSpellCheckingFacility.exe
2015-02-14 12:23 - 2015-01-12 02:45 - 00418304 _____ (Microsoft Corporation) C:\windows\system32\dxtmsft.dll
2015-02-14 12:23 - 2015-01-12 02:40 - 00060416 _____ (Microsoft Corporation) C:\windows\system32\JavaScriptCollectionAgent.dll
2015-02-14 12:23 - 2015-01-12 02:36 - 00168960 _____ (Microsoft Corporation) C:\windows\system32\msrating.dll
2015-02-14 12:23 - 2015-01-12 02:35 - 00076288 _____ (Microsoft Corporation) C:\windows\system32\mshtmled.dll
2015-02-14 12:23 - 2015-01-12 02:33 - 00285696 _____ (Microsoft Corporation) C:\windows\system32\dxtrans.dll
2015-02-14 12:23 - 2015-01-12 02:23 - 02052608 _____ (Microsoft Corporation) C:\windows\system32\inetcpl.cpl
2015-02-14 12:23 - 2015-01-12 02:23 - 00688640 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll
2015-02-14 12:23 - 2015-01-12 02:23 - 00684544 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe
2015-02-14 12:23 - 2015-01-12 02:22 - 01155072 _____ (Microsoft Corporation) C:\windows\system32\mshtmlmedia.dll
2015-02-14 12:23 - 2015-01-12 02:14 - 12829184 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll
2015-02-14 12:23 - 2015-01-12 02:00 - 01888256 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll
2015-02-14 12:23 - 2015-01-12 01:56 - 01307136 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll
2015-02-14 12:23 - 2015-01-12 01:55 - 00710144 _____ (Microsoft Corporation) C:\windows\system32\ieapfltr.dll
2015-02-14 12:23 - 2015-01-10 07:27 - 00550912 _____ (Microsoft Corporation) C:\windows\system32\kerberos.dll
2015-02-14 12:23 - 2015-01-10 07:27 - 00259584 _____ (Microsoft Corporation) C:\windows\system32\msv1_0.dll
2015-02-14 12:23 - 2015-01-10 07:27 - 00248832 _____ (Microsoft Corporation) C:\windows\system32\schannel.dll
2015-02-14 12:23 - 2015-01-10 07:27 - 00221184 _____ (Microsoft Corporation) C:\windows\system32\ncrypt.dll
2015-02-14 12:23 - 2015-01-10 07:27 - 00172032 _____ (Microsoft Corporation) C:\windows\system32\wdigest.dll
2015-02-14 12:23 - 2015-01-10 07:27 - 00065536 _____ (Microsoft Corporation) C:\windows\system32\TSpkg.dll
2015-02-14 12:23 - 2015-01-10 07:27 - 00017408 _____ (Microsoft Corporation) C:\windows\system32\credssp.dll
2015-02-14 12:22 - 2015-01-13 03:49 - 01230336 _____ (Microsoft Corporation) C:\windows\system32\WindowsCodecs.dll
2015-02-14 12:22 - 2014-12-12 06:07 - 01174528 _____ (Microsoft Corporation) C:\windows\system32\crypt32.dll
2015-02-14 12:22 - 2014-12-08 03:46 - 00308224 _____ (Microsoft Corporation) C:\windows\system32\scesrv.dll
2015-02-14 12:22 - 2014-07-07 02:40 - 00179200 _____ (Microsoft Corporation) C:\windows\system32\wintrust.dll
2015-02-14 12:22 - 2014-07-07 02:40 - 00143872 _____ (Microsoft Corporation) C:\windows\system32\cryptsvc.dll
2015-01-27 18:18 - 2015-01-27 18:18 - 00000000 ____D () C:\Program Files\Mozilla Firefox

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-02-22 12:58 - 2010-03-05 05:29 - 02031858 _____ () C:\windows\WindowsUpdate.log
2015-02-22 12:55 - 2010-09-25 18:25 - 00000000 ____D () C:\Users\Jessica
2015-02-22 12:55 - 2009-07-14 05:34 - 00023328 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-02-22 12:55 - 2009-07-14 05:34 - 00023328 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-02-22 12:38 - 2012-04-15 15:20 - 00000884 _____ () C:\windows\Tasks\Adobe Flash Player Updater.job
2015-02-21 21:09 - 2012-06-15 13:41 - 00000000 ___RD () C:\Users\Jessica\Dropbox
2015-02-21 21:09 - 2012-06-15 13:38 - 00000000 ____D () C:\Users\Jessica\AppData\Roaming\Dropbox
2015-02-21 21:07 - 2010-09-25 18:25 - 00000000 ____D () C:\Users\Jessica\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CyberLink DVD Suite
2015-02-21 21:06 - 2009-07-14 05:53 - 00000006 ____H () C:\windows\Tasks\SA.DAT
2015-02-21 21:06 - 2009-07-14 05:39 - 00194739 _____ () C:\windows\setupact.log
2015-02-20 18:10 - 2010-12-31 17:22 - 00002121 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2015-02-18 19:03 - 2013-07-20 19:27 - 00000000 ____D () C:\Users\Jessica\AppData\Roaming\DataMgr
2015-02-18 19:01 - 2014-12-08 18:36 - 00000000 ____D () C:\Users\Jessica\AppData\Roaming\FBDownloader
2015-02-18 12:37 - 2010-03-05 05:43 - 00000000 ____D () C:\Program Files\Common Files\McAfee
2015-02-15 18:01 - 2009-07-14 05:33 - 00346000 _____ () C:\windows\system32\FNTCACHE.DAT
2015-02-15 17:59 - 2010-03-05 06:55 - 00802060 _____ () C:\windows\PFRO.log
2015-02-15 17:58 - 2014-12-13 11:27 - 00000000 ____D () C:\windows\system32\appraiser
2015-02-15 17:58 - 2014-05-19 18:43 - 00000000 ___SD () C:\windows\system32\CompatTel
2015-02-15 17:58 - 2009-07-14 03:37 - 00000000 ____D () C:\windows\system32\de-DE
2015-02-15 17:31 - 2014-03-04 08:40 - 113756392 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe
2015-02-15 17:31 - 2014-03-04 08:40 - 00000000 ____D () C:\windows\system32\MRT
2015-02-14 12:00 - 2012-06-15 13:41 - 00001025 _____ () C:\Users\Jessica\Desktop\Dropbox.lnk
2015-02-14 12:00 - 2012-06-15 13:39 - 00000000 ____D () C:\Users\Jessica\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2015-02-07 09:33 - 2012-04-15 15:20 - 00701616 _____ (Adobe Systems Incorporated) C:\windows\system32\FlashPlayerApp.exe
2015-02-07 09:33 - 2011-05-21 06:18 - 00071344 _____ (Adobe Systems Incorporated) C:\windows\system32\FlashPlayerCPLApp.cpl
2015-02-07 09:08 - 2014-05-13 16:52 - 00001098 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineUA1cf6ec357c82803.job
2015-02-07 09:08 - 2010-09-25 19:59 - 00001094 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-02-03 21:25 - 2009-07-14 03:37 - 00000000 ____D () C:\windows\Microsoft.NET
2015-02-03 18:43 - 2014-11-08 17:10 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2015-01-25 19:15 - 2009-07-26 21:06 - 01593888 _____ () C:\windows\system32\PerfStringBackup.INI

==================== Files in the root of some directories =======

2013-06-26 07:53 - 2013-06-26 07:53 - 0044216 _____ () C:\Users\Jessica\AppData\Local\ext_piccshare_uninst.exe
2013-12-24 20:45 - 2013-12-24 20:45 - 2239256 _____ () C:\Users\Jessica\AppData\Local\omesuperv.exe
2011-02-22 18:35 - 2011-02-22 18:35 - 0000056 ____H () C:\ProgramData\ezsidmv.dat
2010-09-25 18:26 - 2009-08-17 05:54 - 0131368 _____ () C:\ProgramData\FullRemove.exe
2010-03-05 05:36 - 2010-03-05 05:37 - 0000109 _____ () C:\ProgramData\{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}.log
2010-03-05 05:35 - 2010-03-05 05:35 - 0000106 _____ () C:\ProgramData\{2BF2E31F-B8BB-40A7-B650-98D28E0F7D47}.log
2010-03-05 05:32 - 2010-03-05 05:33 - 0000105 _____ () C:\ProgramData\{40BF1E83-20EB-11D8-97C5-0009C5020658}.log
2010-03-05 05:36 - 2010-03-05 05:36 - 0000110 _____ () C:\ProgramData\{B7A0CE06-068E-11D6-97FD-0050BACBF861}.log
2010-03-05 05:31 - 2010-03-05 05:32 - 0000107 _____ () C:\ProgramData\{C59C179C-668D-49A9-B6EA-0121CCFC1243}.log
2010-03-05 05:33 - 2010-03-05 05:35 - 0000110 _____ () C:\ProgramData\{CB099890-1D5F-11D5-9EA9-0050BAE317E1}.log

Some content of TEMP:
====================
C:\Users\Jessica\AppData\Local\Temp\0a50e25a83046228c11dcaa7eeed09bb.exe
C:\Users\Jessica\AppData\Local\Temp\abd2bca3e572e998a09f73c81b93454a.exe
C:\Users\Jessica\AppData\Local\Temp\AlawarGameBoxSetup.exe
C:\Users\Jessica\AppData\Local\Temp\AskSLib.dll
C:\Users\Jessica\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpbu8a3e.dll
C:\Users\Jessica\AppData\Local\Temp\EAD1026.exe
C:\Users\Jessica\AppData\Local\Temp\EAD1045.exe
C:\Users\Jessica\AppData\Local\Temp\EAD10F0.exe
C:\Users\Jessica\AppData\Local\Temp\EAD11BB.exe
C:\Users\Jessica\AppData\Local\Temp\EAD1209.exe
C:\Users\Jessica\AppData\Local\Temp\EAD1228.exe
C:\Users\Jessica\AppData\Local\Temp\EAD1248.exe
C:\Users\Jessica\AppData\Local\Temp\EAD1276.exe
C:\Users\Jessica\AppData\Local\Temp\EAD12C4.exe
C:\Users\Jessica\AppData\Local\Temp\EAD1332.exe
C:\Users\Jessica\AppData\Local\Temp\EAD1341.exe
C:\Users\Jessica\AppData\Local\Temp\EAD138.exe
C:\Users\Jessica\AppData\Local\Temp\EAD13FC.exe
C:\Users\Jessica\AppData\Local\Temp\EAD141C.exe
C:\Users\Jessica\AppData\Local\Temp\EAD142B.exe
C:\Users\Jessica\AppData\Local\Temp\EAD145A.exe
C:\Users\Jessica\AppData\Local\Temp\EAD1479.exe
C:\Users\Jessica\AppData\Local\Temp\EAD14C7.exe
C:\Users\Jessica\AppData\Local\Temp\EAD14D7.exe
C:\Users\Jessica\AppData\Local\Temp\EAD1582.exe
C:\Users\Jessica\AppData\Local\Temp\EAD1592.exe
C:\Users\Jessica\AppData\Local\Temp\EAD15B1.exe
C:\Users\Jessica\AppData\Local\Temp\EAD15D0.exe
C:\Users\Jessica\AppData\Local\Temp\EAD15FF.exe
C:\Users\Jessica\AppData\Local\Temp\EAD160F.exe
C:\Users\Jessica\AppData\Local\Temp\EAD162E.exe
C:\Users\Jessica\AppData\Local\Temp\EAD167C.exe
C:\Users\Jessica\AppData\Local\Temp\EAD1776.exe
C:\Users\Jessica\AppData\Local\Temp\EAD1812.exe
C:\Users\Jessica\AppData\Local\Temp\EAD1850.exe
C:\Users\Jessica\AppData\Local\Temp\EAD186F.exe
C:\Users\Jessica\AppData\Local\Temp\EAD1959.exe
C:\Users\Jessica\AppData\Local\Temp\EAD195A.exe
C:\Users\Jessica\AppData\Local\Temp\EAD196.exe
C:\Users\Jessica\AppData\Local\Temp\EAD1978.exe
C:\Users\Jessica\AppData\Local\Temp\EAD1998.exe
C:\Users\Jessica\AppData\Local\Temp\EAD1A53.exe
C:\Users\Jessica\AppData\Local\Temp\EAD1B0E.exe
C:\Users\Jessica\AppData\Local\Temp\EAD1B0F.exe
C:\Users\Jessica\AppData\Local\Temp\EAD1BC9.exe
C:\Users\Jessica\AppData\Local\Temp\EAD1C75.exe
C:\Users\Jessica\AppData\Local\Temp\EAD1C94.exe
C:\Users\Jessica\AppData\Local\Temp\EAD1CB3.exe
C:\Users\Jessica\AppData\Local\Temp\EAD1CD2.exe
C:\Users\Jessica\AppData\Local\Temp\EAD1E2A.exe
C:\Users\Jessica\AppData\Local\Temp\EAD1E2B.exe
C:\Users\Jessica\AppData\Local\Temp\EAD1E4.exe
C:\Users\Jessica\AppData\Local\Temp\EAD1E68.exe
C:\Users\Jessica\AppData\Local\Temp\EAD1F33.exe
C:\Users\Jessica\AppData\Local\Temp\EAD1F71.exe
C:\Users\Jessica\AppData\Local\Temp\EAD1F90.exe
C:\Users\Jessica\AppData\Local\Temp\EAD1FEE.exe
C:\Users\Jessica\AppData\Local\Temp\EAD203C.exe
C:\Users\Jessica\AppData\Local\Temp\EAD207A.exe
C:\Users\Jessica\AppData\Local\Temp\EAD208A.exe
C:\Users\Jessica\AppData\Local\Temp\EAD20B9.exe
C:\Users\Jessica\AppData\Local\Temp\EAD2184.exe
C:\Users\Jessica\AppData\Local\Temp\EAD21B2.exe
C:\Users\Jessica\AppData\Local\Temp\EAD21B3.exe
C:\Users\Jessica\AppData\Local\Temp\EAD222.exe
C:\Users\Jessica\AppData\Local\Temp\EAD22CB.exe
C:\Users\Jessica\AppData\Local\Temp\EAD231.exe
C:\Users\Jessica\AppData\Local\Temp\EAD232.exe
C:\Users\Jessica\AppData\Local\Temp\EAD2348.exe
C:\Users\Jessica\AppData\Local\Temp\EAD23B5.exe
C:\Users\Jessica\AppData\Local\Temp\EAD23B6.exe
C:\Users\Jessica\AppData\Local\Temp\EAD2403.exe
C:\Users\Jessica\AppData\Local\Temp\EAD2413.exe
C:\Users\Jessica\AppData\Local\Temp\EAD2432.exe
C:\Users\Jessica\AppData\Local\Temp\EAD2461.exe
C:\Users\Jessica\AppData\Local\Temp\EAD2470.exe
C:\Users\Jessica\AppData\Local\Temp\EAD2490.exe
C:\Users\Jessica\AppData\Local\Temp\EAD24CE.exe
C:\Users\Jessica\AppData\Local\Temp\EAD256A.exe
C:\Users\Jessica\AppData\Local\Temp\EAD256B.exe
C:\Users\Jessica\AppData\Local\Temp\EAD2589.exe
C:\Users\Jessica\AppData\Local\Temp\EAD258A.exe
C:\Users\Jessica\AppData\Local\Temp\EAD25C8.exe
C:\Users\Jessica\AppData\Local\Temp\EAD260.exe
C:\Users\Jessica\AppData\Local\Temp\EAD2616.exe
C:\Users\Jessica\AppData\Local\Temp\EAD2644.exe
C:\Users\Jessica\AppData\Local\Temp\EAD2654.exe
C:\Users\Jessica\AppData\Local\Temp\EAD2683.exe
C:\Users\Jessica\AppData\Local\Temp\EAD26B2.exe
C:\Users\Jessica\AppData\Local\Temp\EAD26C1.exe
C:\Users\Jessica\AppData\Local\Temp\EAD271F.exe
C:\Users\Jessica\AppData\Local\Temp\EAD2720.exe
C:\Users\Jessica\AppData\Local\Temp\EAD278C.exe
C:\Users\Jessica\AppData\Local\Temp\EAD27F.exe
C:\Users\Jessica\AppData\Local\Temp\EAD2857.exe
C:\Users\Jessica\AppData\Local\Temp\EAD28A5.exe
C:\Users\Jessica\AppData\Local\Temp\EAD28F.exe
C:\Users\Jessica\AppData\Local\Temp\EAD29BE.exe
C:\Users\Jessica\AppData\Local\Temp\EAD2A2B.exe
C:\Users\Jessica\AppData\Local\Temp\EAD2AA9.exe
C:\Users\Jessica\AppData\Local\Temp\EAD2AD6.exe
C:\Users\Jessica\AppData\Local\Temp\EAD2AE7.exe
C:\Users\Jessica\AppData\Local\Temp\EAD2AF6.exe
C:\Users\Jessica\AppData\Local\Temp\EAD2B53.exe
C:\Users\Jessica\AppData\Local\Temp\EAD2BA1.exe
C:\Users\Jessica\AppData\Local\Temp\EAD2BB1.exe
C:\Users\Jessica\AppData\Local\Temp\EAD2BE0.exe
C:\Users\Jessica\AppData\Local\Temp\EAD2BFF.exe
C:\Users\Jessica\AppData\Local\Temp\EAD2C1E.exe
C:\Users\Jessica\AppData\Local\Temp\EAD2C1F.exe
C:\Users\Jessica\AppData\Local\Temp\EAD2C8D.exe
C:\Users\Jessica\AppData\Local\Temp\EAD2D08.exe
C:\Users\Jessica\AppData\Local\Temp\EAD2D37.exe
C:\Users\Jessica\AppData\Local\Temp\EAD2D46.exe
C:\Users\Jessica\AppData\Local\Temp\EAD2D75.exe
C:\Users\Jessica\AppData\Local\Temp\EAD2DD3.exe
C:\Users\Jessica\AppData\Local\Temp\EAD2E.exe
C:\Users\Jessica\AppData\Local\Temp\EAD2E11.exe
C:\Users\Jessica\AppData\Local\Temp\EAD2E21.exe
C:\Users\Jessica\AppData\Local\Temp\EAD2E40.exe
C:\Users\Jessica\AppData\Local\Temp\EAD2E50.exe
C:\Users\Jessica\AppData\Local\Temp\EAD2E6F.exe
C:\Users\Jessica\AppData\Local\Temp\EAD2EAD.exe
C:\Users\Jessica\AppData\Local\Temp\EAD2EC.exe
C:\Users\Jessica\AppData\Local\Temp\EAD2ECC.exe
C:\Users\Jessica\AppData\Local\Temp\EAD2ECD.exe
C:\Users\Jessica\AppData\Local\Temp\EAD2F1B.exe
C:\Users\Jessica\AppData\Local\Temp\EAD2FF5.exe
C:\Users\Jessica\AppData\Local\Temp\EAD3062.exe
C:\Users\Jessica\AppData\Local\Temp\EAD3091.exe
C:\Users\Jessica\AppData\Local\Temp\EAD30A0.exe
C:\Users\Jessica\AppData\Local\Temp\EAD312D.exe
C:\Users\Jessica\AppData\Local\Temp\EAD31C9.exe
C:\Users\Jessica\AppData\Local\Temp\EAD31E8.exe
C:\Users\Jessica\AppData\Local\Temp\EAD3255.exe
C:\Users\Jessica\AppData\Local\Temp\EAD32B.exe
C:\Users\Jessica\AppData\Local\Temp\EAD32C3.exe
C:\Users\Jessica\AppData\Local\Temp\EAD3330.exe
C:\Users\Jessica\AppData\Local\Temp\EAD3542.exe
C:\Users\Jessica\AppData\Local\Temp\EAD366A.exe
C:\Users\Jessica\AppData\Local\Temp\EAD369.exe
C:\Users\Jessica\AppData\Local\Temp\EAD3764.exe
C:\Users\Jessica\AppData\Local\Temp\EAD382F.exe
C:\Users\Jessica\AppData\Local\Temp\EAD386D.exe
C:\Users\Jessica\AppData\Local\Temp\EAD389C.exe
C:\Users\Jessica\AppData\Local\Temp\EAD3967.exe
C:\Users\Jessica\AppData\Local\Temp\EAD39E4.exe
C:\Users\Jessica\AppData\Local\Temp\EAD3A13.exe
C:\Users\Jessica\AppData\Local\Temp\EAD3A41.exe
C:\Users\Jessica\AppData\Local\Temp\EAD3A70.exe
C:\Users\Jessica\AppData\Local\Temp\EAD3AFC.exe
C:\Users\Jessica\AppData\Local\Temp\EAD3B2B.exe
C:\Users\Jessica\AppData\Local\Temp\EAD3B5A.exe
C:\Users\Jessica\AppData\Local\Temp\EAD3BB8.exe
C:\Users\Jessica\AppData\Local\Temp\EAD3C15.exe
C:\Users\Jessica\AppData\Local\Temp\EAD3D1E.exe
C:\Users\Jessica\AppData\Local\Temp\EAD3D6.exe
C:\Users\Jessica\AppData\Local\Temp\EAD3DBA.exe
C:\Users\Jessica\AppData\Local\Temp\EAD3EE3.exe
C:\Users\Jessica\AppData\Local\Temp\EAD3F02.exe
C:\Users\Jessica\AppData\Local\Temp\EAD3F40.exe
C:\Users\Jessica\AppData\Local\Temp\EAD3FDC.exe
C:\Users\Jessica\AppData\Local\Temp\EAD4059.exe
C:\Users\Jessica\AppData\Local\Temp\EAD4088.exe
C:\Users\Jessica\AppData\Local\Temp\EAD40D8.exe
C:\Users\Jessica\AppData\Local\Temp\EAD4153.exe
C:\Users\Jessica\AppData\Local\Temp\EAD41EF.exe
C:\Users\Jessica\AppData\Local\Temp\EAD421E.exe
C:\Users\Jessica\AppData\Local\Temp\EAD421F.exe
C:\Users\Jessica\AppData\Local\Temp\EAD424.exe
C:\Users\Jessica\AppData\Local\Temp\EAD427B.exe
C:\Users\Jessica\AppData\Local\Temp\EAD429A.exe
C:\Users\Jessica\AppData\Local\Temp\EAD42F8.exe
C:\Users\Jessica\AppData\Local\Temp\EAD434.exe
C:\Users\Jessica\AppData\Local\Temp\EAD4385.exe
C:\Users\Jessica\AppData\Local\Temp\EAD43B3.exe
C:\Users\Jessica\AppData\Local\Temp\EAD43E2.exe
C:\Users\Jessica\AppData\Local\Temp\EAD445F.exe
C:\Users\Jessica\AppData\Local\Temp\EAD44B0.exe
C:\Users\Jessica\AppData\Local\Temp\EAD44DC.exe
C:\Users\Jessica\AppData\Local\Temp\EAD453.exe
C:\Users\Jessica\AppData\Local\Temp\EAD45F4.exe
C:\Users\Jessica\AppData\Local\Temp\EAD463.exe
C:\Users\Jessica\AppData\Local\Temp\EAD472.exe
C:\Users\Jessica\AppData\Local\Temp\EAD473.exe
C:\Users\Jessica\AppData\Local\Temp\EAD473C.exe
C:\Users\Jessica\AppData\Local\Temp\EAD4816.exe
C:\Users\Jessica\AppData\Local\Temp\EAD48C3.exe
C:\Users\Jessica\AppData\Local\Temp\EAD4910.exe
C:\Users\Jessica\AppData\Local\Temp\EAD494F.exe
C:\Users\Jessica\AppData\Local\Temp\EAD4B32.exe
C:\Users\Jessica\AppData\Local\Temp\EAD4BED.exe
C:\Users\Jessica\AppData\Local\Temp\EAD4C2C.exe
C:\Users\Jessica\AppData\Local\Temp\EAD4C6B.exe
C:\Users\Jessica\AppData\Local\Temp\EAD4C7A.exe
C:\Users\Jessica\AppData\Local\Temp\EAD4D06.exe
C:\Users\Jessica\AppData\Local\Temp\EAD4D16.exe
C:\Users\Jessica\AppData\Local\Temp\EAD4E0.exe
C:\Users\Jessica\AppData\Local\Temp\EAD4EF.exe
C:\Users\Jessica\AppData\Local\Temp\EAD4F28.exe
C:\Users\Jessica\AppData\Local\Temp\EAD4FF.exe
C:\Users\Jessica\AppData\Local\Temp\EAD5012.exe
C:\Users\Jessica\AppData\Local\Temp\EAD5022.exe
C:\Users\Jessica\AppData\Local\Temp\EAD5023.exe
C:\Users\Jessica\AppData\Local\Temp\EAD507F.exe
C:\Users\Jessica\AppData\Local\Temp\EAD50ED.exe
C:\Users\Jessica\AppData\Local\Temp\EAD512B.exe
C:\Users\Jessica\AppData\Local\Temp\EAD514A.exe
C:\Users\Jessica\AppData\Local\Temp\EAD5179.exe
C:\Users\Jessica\AppData\Local\Temp\EAD5188.exe
C:\Users\Jessica\AppData\Local\Temp\EAD531E.exe
C:\Users\Jessica\AppData\Local\Temp\EAD539B.exe
C:\Users\Jessica\AppData\Local\Temp\EAD53D.exe
C:\Users\Jessica\AppData\Local\Temp\EAD5438.exe
C:\Users\Jessica\AppData\Local\Temp\EAD54D.exe
C:\Users\Jessica\AppData\Local\Temp\EAD55C.exe
C:\Users\Jessica\AppData\Local\Temp\EAD55FB.exe
C:\Users\Jessica\AppData\Local\Temp\EAD56F5.exe
C:\Users\Jessica\AppData\Local\Temp\EAD583D.exe
C:\Users\Jessica\AppData\Local\Temp\EAD58D8.exe
C:\Users\Jessica\AppData\Local\Temp\EAD5917.exe
C:\Users\Jessica\AppData\Local\Temp\EAD5965.exe
C:\Users\Jessica\AppData\Local\Temp\EAD59A3.exe
C:\Users\Jessica\AppData\Local\Temp\EAD5A6E.exe
C:\Users\Jessica\AppData\Local\Temp\EAD5AA.exe
C:\Users\Jessica\AppData\Local\Temp\EAD5AAC.exe
C:\Users\Jessica\AppData\Local\Temp\EAD5B0B.exe
C:\Users\Jessica\AppData\Local\Temp\EAD5C90.exe
C:\Users\Jessica\AppData\Local\Temp\EAD5CA7.exe
C:\Users\Jessica\AppData\Local\Temp\EAD5CAF.exe
C:\Users\Jessica\AppData\Local\Temp\EAD5DB8.exe
C:\Users\Jessica\AppData\Local\Temp\EAD5DB9.exe
C:\Users\Jessica\AppData\Local\Temp\EAD5DC8.exe
C:\Users\Jessica\AppData\Local\Temp\EAD5E36.exe
C:\Users\Jessica\AppData\Local\Temp\EAD5E37.exe
C:\Users\Jessica\AppData\Local\Temp\EAD5ED2.exe
C:\Users\Jessica\AppData\Local\Temp\EAD5F1F.exe
C:\Users\Jessica\AppData\Local\Temp\EAD5F4E.exe
C:\Users\Jessica\AppData\Local\Temp\EAD5FAC.exe
C:\Users\Jessica\AppData\Local\Temp\EAD5FCB.exe
C:\Users\Jessica\AppData\Local\Temp\EAD6028.exe
C:\Users\Jessica\AppData\Local\Temp\EAD6067.exe
C:\Users\Jessica\AppData\Local\Temp\EAD60D5.exe
C:\Users\Jessica\AppData\Local\Temp\EAD6113.exe
C:\Users\Jessica\AppData\Local\Temp\EAD6151.exe
C:\Users\Jessica\AppData\Local\Temp\EAD6180.exe
C:\Users\Jessica\AppData\Local\Temp\EAD619F.exe
C:\Users\Jessica\AppData\Local\Temp\EAD61FC.exe
C:\Users\Jessica\AppData\Local\Temp\EAD625A.exe
C:\Users\Jessica\AppData\Local\Temp\EAD6306.exe
C:\Users\Jessica\AppData\Local\Temp\EAD6392.exe
C:\Users\Jessica\AppData\Local\Temp\EAD6547.exe
C:\Users\Jessica\AppData\Local\Temp\EAD6557.exe
C:\Users\Jessica\AppData\Local\Temp\EAD66CD.exe
C:\Users\Jessica\AppData\Local\Temp\EAD66DD.exe
C:\Users\Jessica\AppData\Local\Temp\EAD6769.exe
C:\Users\Jessica\AppData\Local\Temp\EAD67A7.exe
C:\Users\Jessica\AppData\Local\Temp\EAD685.exe
C:\Users\Jessica\AppData\Local\Temp\EAD6882.exe
C:\Users\Jessica\AppData\Local\Temp\EAD68A1.exe
C:\Users\Jessica\AppData\Local\Temp\EAD68A2.exe
C:\Users\Jessica\AppData\Local\Temp\EAD68C0.exe
C:\Users\Jessica\AppData\Local\Temp\EAD692D.exe
C:\Users\Jessica\AppData\Local\Temp\EAD694.exe
C:\Users\Jessica\AppData\Local\Temp\EAD694D.exe
C:\Users\Jessica\AppData\Local\Temp\EAD6A08.exe
C:\Users\Jessica\AppData\Local\Temp\EAD6A56.exe
C:\Users\Jessica\AppData\Local\Temp\EAD6A75.exe
C:\Users\Jessica\AppData\Local\Temp\EAD6AD3.exe
C:\Users\Jessica\AppData\Local\Temp\EAD6C1B.exe
C:\Users\Jessica\AppData\Local\Temp\EAD6C39.exe
C:\Users\Jessica\AppData\Local\Temp\EAD6C68.exe
C:\Users\Jessica\AppData\Local\Temp\EAD6CB6.exe
C:\Users\Jessica\AppData\Local\Temp\EAD6DBF.exe
C:\Users\Jessica\AppData\Local\Temp\EAD6DDF.exe
C:\Users\Jessica\AppData\Local\Temp\EAD6DEE.exe
C:\Users\Jessica\AppData\Local\Temp\EAD6E1D.exe
C:\Users\Jessica\AppData\Local\Temp\EAD6ED9.exe
C:\Users\Jessica\AppData\Local\Temp\EAD6FA3.exe
C:\Users\Jessica\AppData\Local\Temp\EAD6FC2.exe
C:\Users\Jessica\AppData\Local\Temp\EAD702.exe
C:\Users\Jessica\AppData\Local\Temp\EAD703F.exe
C:\Users\Jessica\AppData\Local\Temp\EAD7196.exe
C:\Users\Jessica\AppData\Local\Temp\EAD730D.exe
C:\Users\Jessica\AppData\Local\Temp\EAD7445.exe
C:\Users\Jessica\AppData\Local\Temp\EAD7500.exe
C:\Users\Jessica\AppData\Local\Temp\EAD75F.exe
C:\Users\Jessica\AppData\Local\Temp\EAD7657.exe
C:\Users\Jessica\AppData\Local\Temp\EAD76E3.exe
C:\Users\Jessica\AppData\Local\Temp\EAD76E4.exe
C:\Users\Jessica\AppData\Local\Temp\EAD7741.exe
C:\Users\Jessica\AppData\Local\Temp\EAD78B7.exe
C:\Users\Jessica\AppData\Local\Temp\EAD78D7.exe
C:\Users\Jessica\AppData\Local\Temp\EAD7A9C.exe
C:\Users\Jessica\AppData\Local\Temp\EAD7ACA.exe
C:\Users\Jessica\AppData\Local\Temp\EAD7AD9.exe
C:\Users\Jessica\AppData\Local\Temp\EAD7B47.exe
C:\Users\Jessica\AppData\Local\Temp\EAD7C5F.exe
C:\Users\Jessica\AppData\Local\Temp\EAD7D2A.exe
C:\Users\Jessica\AppData\Local\Temp\EAD7F8B.exe
C:\Users\Jessica\AppData\Local\Temp\EAD80B.exe
C:\Users\Jessica\AppData\Local\Temp\EAD80F1.exe
C:\Users\Jessica\AppData\Local\Temp\EAD813F.exe
C:\Users\Jessica\AppData\Local\Temp\EAD818D.exe
C:\Users\Jessica\AppData\Local\Temp\EAD81EB.exe
C:\Users\Jessica\AppData\Local\Temp\EAD821A.exe
C:\Users\Jessica\AppData\Local\Temp\EAD8258.exe
C:\Users\Jessica\AppData\Local\Temp\EAD82A.exe
C:\Users\Jessica\AppData\Local\Temp\EAD82B6.exe
C:\Users\Jessica\AppData\Local\Temp\EAD82C5.exe
C:\Users\Jessica\AppData\Local\Temp\EAD8352.exe
C:\Users\Jessica\AppData\Local\Temp\EAD8353.exe
C:\Users\Jessica\AppData\Local\Temp\EAD83A.exe
C:\Users\Jessica\AppData\Local\Temp\EAD83B.exe
C:\Users\Jessica\AppData\Local\Temp\EAD83BF.exe
C:\Users\Jessica\AppData\Local\Temp\EAD842C.exe
C:\Users\Jessica\AppData\Local\Temp\EAD847A.exe
C:\Users\Jessica\AppData\Local\Temp\EAD849.exe
C:\Users\Jessica\AppData\Local\Temp\EAD85A3.exe
C:\Users\Jessica\AppData\Local\Temp\EAD8600.exe
C:\Users\Jessica\AppData\Local\Temp\EAD868D.exe
C:\Users\Jessica\AppData\Local\Temp\EAD87C5.exe
C:\Users\Jessica\AppData\Local\Temp\EAD87E4.exe
C:\Users\Jessica\AppData\Local\Temp\EAD8880.exe
C:\Users\Jessica\AppData\Local\Temp\EAD88AF.exe
C:\Users\Jessica\AppData\Local\Temp\EAD896A.exe
C:\Users\Jessica\AppData\Local\Temp\EAD89D7.exe
C:\Users\Jessica\AppData\Local\Temp\EAD89F6.exe
C:\Users\Jessica\AppData\Local\Temp\EAD8A35.exe
C:\Users\Jessica\AppData\Local\Temp\EAD8AC1.exe
C:\Users\Jessica\AppData\Local\Temp\EAD8B3E.exe
C:\Users\Jessica\AppData\Local\Temp\EAD8B5D.exe
C:\Users\Jessica\AppData\Local\Temp\EAD8BCE.exe
C:\Users\Jessica\AppData\Local\Temp\EAD8CF3.exe
C:\Users\Jessica\AppData\Local\Temp\EAD8D21.exe
C:\Users\Jessica\AppData\Local\Temp\EAD8D6.exe
C:\Users\Jessica\AppData\Local\Temp\EAD8DFC.exe
C:\Users\Jessica\AppData\Local\Temp\EAD8E0B.exe
C:\Users\Jessica\AppData\Local\Temp\EAD8E79.exe
C:\Users\Jessica\AppData\Local\Temp\EAD8F15.exe
C:\Users\Jessica\AppData\Local\Temp\EAD8F34.exe
C:\Users\Jessica\AppData\Local\Temp\EAD8F63.exe
C:\Users\Jessica\AppData\Local\Temp\EAD906C.exe
C:\Users\Jessica\AppData\Local\Temp\EAD90E9.exe
C:\Users\Jessica\AppData\Local\Temp\EAD91A4.exe
C:\Users\Jessica\AppData\Local\Temp\EAD91A5.exe
C:\Users\Jessica\AppData\Local\Temp\EAD9201.exe
C:\Users\Jessica\AppData\Local\Temp\EAD9211.exe
C:\Users\Jessica\AppData\Local\Temp\EAD9212.exe
C:\Users\Jessica\AppData\Local\Temp\EAD9230.exe
C:\Users\Jessica\AppData\Local\Temp\EAD928E.exe
C:\Users\Jessica\AppData\Local\Temp\EAD933.exe
C:\Users\Jessica\AppData\Local\Temp\EAD93B6.exe
C:\Users\Jessica\AppData\Local\Temp\EAD93F5.exe
C:\Users\Jessica\AppData\Local\Temp\EAD9404.exe
C:\Users\Jessica\AppData\Local\Temp\EAD94A0.exe
C:\Users\Jessica\AppData\Local\Temp\EAD94B0.exe
C:\Users\Jessica\AppData\Local\Temp\EAD94CF.exe
C:\Users\Jessica\AppData\Local\Temp\EAD94FE.exe
C:\Users\Jessica\AppData\Local\Temp\EAD955B.exe
C:\Users\Jessica\AppData\Local\Temp\EAD959A.exe
C:\Users\Jessica\AppData\Local\Temp\EAD95F7.exe
C:\Users\Jessica\AppData\Local\Temp\EAD9617.exe
C:\Users\Jessica\AppData\Local\Temp\EAD9674.exe
C:\Users\Jessica\AppData\Local\Temp\EAD9675.exe
C:\Users\Jessica\AppData\Local\Temp\EAD9693.exe
C:\Users\Jessica\AppData\Local\Temp\EAD9694.exe
C:\Users\Jessica\AppData\Local\Temp\EAD96D2.exe
C:\Users\Jessica\AppData\Local\Temp\EAD96E1.exe
C:\Users\Jessica\AppData\Local\Temp\EAD9701.exe
C:\Users\Jessica\AppData\Local\Temp\EAD9702.exe
C:\Users\Jessica\AppData\Local\Temp\EAD9710.exe
C:\Users\Jessica\AppData\Local\Temp\EAD972F.exe
C:\Users\Jessica\AppData\Local\Temp\EAD977D.exe
C:\Users\Jessica\AppData\Local\Temp\EAD97BC.exe
C:\Users\Jessica\AppData\Local\Temp\EAD97CB.exe
C:\Users\Jessica\AppData\Local\Temp\EAD97EB.exe
C:\Users\Jessica\AppData\Local\Temp\EAD980A.exe
C:\Users\Jessica\AppData\Local\Temp\EAD9887.exe
C:\Users\Jessica\AppData\Local\Temp\EAD9888.exe
C:\Users\Jessica\AppData\Local\Temp\EAD9896.exe
C:\Users\Jessica\AppData\Local\Temp\EAD991.exe
C:\Users\Jessica\AppData\Local\Temp\EAD9951.exe
C:\Users\Jessica\AppData\Local\Temp\EAD99CE.exe
C:\Users\Jessica\AppData\Local\Temp\EAD99ED.exe
C:\Users\Jessica\AppData\Local\Temp\EAD9A0.exe
C:\Users\Jessica\AppData\Local\Temp\EAD9A2D.exe
C:\Users\Jessica\AppData\Local\Temp\EAD9A5B.exe
C:\Users\Jessica\AppData\Local\Temp\EAD9A5C.exe
C:\Users\Jessica\AppData\Local\Temp\EAD9A89.exe
C:\Users\Jessica\AppData\Local\Temp\EAD9AC8.exe
C:\Users\Jessica\AppData\Local\Temp\EAD9AF7.exe
C:\Users\Jessica\AppData\Local\Temp\EAD9B45.exe
C:\Users\Jessica\AppData\Local\Temp\EAD9B64.exe
C:\Users\Jessica\AppData\Local\Temp\EAD9B65.exe
C:\Users\Jessica\AppData\Local\Temp\EAD9B93.exe
C:\Users\Jessica\AppData\Local\Temp\EAD9BD1.exe
C:\Users\Jessica\AppData\Local\Temp\EAD9BF0.exe
C:\Users\Jessica\AppData\Local\Temp\EAD9C.exe
C:\Users\Jessica\AppData\Local\Temp\EAD9C00.exe
C:\Users\Jessica\AppData\Local\Temp\EAD9C01.exe
C:\Users\Jessica\AppData\Local\Temp\EAD9C2F.exe
C:\Users\Jessica\AppData\Local\Temp\EAD9C4E.exe
C:\Users\Jessica\AppData\Local\Temp\EAD9C6D.exe
C:\Users\Jessica\AppData\Local\Temp\EAD9CDB.exe
C:\Users\Jessica\AppData\Local\Temp\EAD9D.exe
C:\Users\Jessica\AppData\Local\Temp\EAD9D47.exe
C:\Users\Jessica\AppData\Local\Temp\EAD9DB5.exe
C:\Users\Jessica\AppData\Local\Temp\EAD9DC7.exe
C:\Users\Jessica\AppData\Local\Temp\EAD9DE3.exe
C:\Users\Jessica\AppData\Local\Temp\EAD9DE4.exe
C:\Users\Jessica\AppData\Local\Temp\EAD9E13.exe
C:\Users\Jessica\AppData\Local\Temp\EAD9E22.exe
C:\Users\Jessica\AppData\Local\Temp\EAD9E23.exe
C:\Users\Jessica\AppData\Local\Temp\EAD9E51.exe
C:\Users\Jessica\AppData\Local\Temp\EAD9E7F.exe
C:\Users\Jessica\AppData\Local\Temp\EAD9E9F.exe
C:\Users\Jessica\AppData\Local\Temp\EAD9EAE.exe
C:\Users\Jessica\AppData\Local\Temp\EAD9F2B.exe
C:\Users\Jessica\AppData\Local\Temp\EAD9F69.exe
C:\Users\Jessica\AppData\Local\Temp\EAD9F79.exe
C:\Users\Jessica\AppData\Local\Temp\EAD9F89.exe
C:\Users\Jessica\AppData\Local\Temp\EAD9F8A.exe
C:\Users\Jessica\AppData\Local\Temp\EAD9FA8.exe
C:\Users\Jessica\AppData\Local\Temp\EAD9FD7.exe
C:\Users\Jessica\AppData\Local\Temp\EAD9FE6.exe
C:\Users\Jessica\AppData\Local\Temp\EAD9FF6.exe
C:\Users\Jessica\AppData\Local\Temp\EADA005.exe
C:\Users\Jessica\AppData\Local\Temp\EADA006.exe
C:\Users\Jessica\AppData\Local\Temp\EADA015.exe
C:\Users\Jessica\AppData\Local\Temp\EADA0E.exe
C:\Users\Jessica\AppData\Local\Temp\EADA0E0.exe
C:\Users\Jessica\AppData\Local\Temp\EADA0EF.exe
C:\Users\Jessica\AppData\Local\Temp\EADA11E.exe
C:\Users\Jessica\AppData\Local\Temp\EADA14D.exe
C:\Users\Jessica\AppData\Local\Temp\EADA18B.exe
C:\Users\Jessica\AppData\Local\Temp\EADA1D.exe
C:\Users\Jessica\AppData\Local\Temp\EADA1D9.exe
C:\Users\Jessica\AppData\Local\Temp\EADA1E9.exe
C:\Users\Jessica\AppData\Local\Temp\EADA1F9.exe
C:\Users\Jessica\AppData\Local\Temp\EADA227.exe
C:\Users\Jessica\AppData\Local\Temp\EADA275.exe
C:\Users\Jessica\AppData\Local\Temp\EADA285.exe
C:\Users\Jessica\AppData\Local\Temp\EADA2C3.exe
C:\Users\Jessica\AppData\Local\Temp\EADA2E3.exe
C:\Users\Jessica\AppData\Local\Temp\EADA2E4.exe
C:\Users\Jessica\AppData\Local\Temp\EADA2F2.exe
C:\Users\Jessica\AppData\Local\Temp\EADA321.exe
C:\Users\Jessica\AppData\Local\Temp\EADA331.exe
C:\Users\Jessica\AppData\Local\Temp\EADA340.exe
C:\Users\Jessica\AppData\Local\Temp\EADA36F.exe
C:\Users\Jessica\AppData\Local\Temp\EADA3AD.exe
C:\Users\Jessica\AppData\Local\Temp\EADA3CD.exe
C:\Users\Jessica\AppData\Local\Temp\EADA3DC.exe
C:\Users\Jessica\AppData\Local\Temp\EADA3EC.exe
C:\Users\Jessica\AppData\Local\Temp\EADA40B.exe
C:\Users\Jessica\AppData\Local\Temp\EADA449.exe
C:\Users\Jessica\AppData\Local\Temp\EADA478.exe
C:\Users\Jessica\AppData\Local\Temp\EADA497.exe
C:\Users\Jessica\AppData\Local\Temp\EADA4A7.exe
C:\Users\Jessica\AppData\Local\Temp\EADA4B7.exe
C:\Users\Jessica\AppData\Local\Temp\EADA4F5.exe
C:\Users\Jessica\AppData\Local\Temp\EADA514.exe
C:\Users\Jessica\AppData\Local\Temp\EADA524.exe
C:\Users\Jessica\AppData\Local\Temp\EADA543.exe
C:\Users\Jessica\AppData\Local\Temp\EADA544.exe
C:\Users\Jessica\AppData\Local\Temp\EADA553.exe
C:\Users\Jessica\AppData\Local\Temp\EADA562.exe
C:\Users\Jessica\AppData\Local\Temp\EADA563.exe
C:\Users\Jessica\AppData\Local\Temp\EADA5B0.exe
C:\Users\Jessica\AppData\Local\Temp\EADA5C.exe
C:\Users\Jessica\AppData\Local\Temp\EADA5C0.exe
C:\Users\Jessica\AppData\Local\Temp\EADA5FE.exe
C:\Users\Jessica\AppData\Local\Temp\EADA61D.exe
C:\Users\Jessica\AppData\Local\Temp\EADA64C.exe
C:\Users\Jessica\AppData\Local\Temp\EADA64D.exe
C:\Users\Jessica\AppData\Local\Temp\EADA67B.exe
C:\Users\Jessica\AppData\Local\Temp\EADA67C.exe
C:\Users\Jessica\AppData\Local\Temp\EADA68B.exe
C:\Users\Jessica\AppData\Local\Temp\EADA69A.exe
C:\Users\Jessica\AppData\Local\Temp\EADA6D9.exe
C:\Users\Jessica\AppData\Local\Temp\EADA6DA.exe
C:\Users\Jessica\AppData\Local\Temp\EADA6DB.exe
C:\Users\Jessica\AppData\Local\Temp\EADA717.exe
C:\Users\Jessica\AppData\Local\Temp\EADA746.exe
C:\Users\Jessica\AppData\Local\Temp\EADA765.exe
C:\Users\Jessica\AppData\Local\Temp\EADA784.exe
C:\Users\Jessica\AppData\Local\Temp\EADA785.exe
C:\Users\Jessica\AppData\Local\Temp\EADA7B.exe
C:\Users\Jessica\AppData\Local\Temp\EADA7B3.exe
C:\Users\Jessica\AppData\Local\Temp\EADA7C3.exe
C:\Users\Jessica\AppData\Local\Temp\EADA87E.exe
C:\Users\Jessica\AppData\Local\Temp\EADA87F.exe
C:\Users\Jessica\AppData\Local\Temp\EADA88D.exe
C:\Users\Jessica\AppData\Local\Temp\EADA8FB.exe
C:\Users\Jessica\AppData\Local\Temp\EADA8FC.exe
C:\Users\Jessica\AppData\Local\Temp\EADA939.exe
C:\Users\Jessica\AppData\Local\Temp\EADA93A.exe
C:\Users\Jessica\AppData\Local\Temp\EADA958.exe
C:\Users\Jessica\AppData\Local\Temp\EADA997.exe
C:\Users\Jessica\AppData\Local\Temp\EADA998.exe
C:\Users\Jessica\AppData\Local\Temp\EADA9B6.exe
C:\Users\Jessica\AppData\Local\Temp\EADA9C5.exe
C:\Users\Jessica\AppData\Local\Temp\EADA9E5.exe
C:\Users\Jessica\AppData\Local\Temp\EADA9F4.exe
C:\Users\Jessica\AppData\Local\Temp\EADA9F5.exe
C:\Users\Jessica\AppData\Local\Temp\EADAA13.exe
C:\Users\Jessica\AppData\Local\Temp\EADAA14.exe
C:\Users\Jessica\AppData\Local\Temp\EADAA15.exe
C:\Users\Jessica\AppData\Local\Temp\EADAA42.exe
C:\Users\Jessica\AppData\Local\Temp\EADAA71.exe
C:\Users\Jessica\AppData\Local\Temp\EADAAA0.exe
C:\Users\Jessica\AppData\Local\Temp\EADAABF.exe
C:\Users\Jessica\AppData\Local\Temp\EADAACF.exe
C:\Users\Jessica\AppData\Local\Temp\EADAADE.exe
C:\Users\Jessica\AppData\Local\Temp\EADAB0D.exe
C:\Users\Jessica\AppData\Local\Temp\EADAB4B.exe
C:\Users\Jessica\AppData\Local\Temp\EADAB7A.exe
C:\Users\Jessica\AppData\Local\Temp\EADABC8.exe
C:\Users\Jessica\AppData\Local\Temp\EADABC9.exe
C:\Users\Jessica\AppData\Local\Temp\EADABCA.exe
C:\Users\Jessica\AppData\Local\Temp\EADABCB.exe
C:\Users\Jessica\AppData\Local\Temp\EADABD8.exe
C:\Users\Jessica\AppData\Local\Temp\EADABF7.exe
C:\Users\Jessica\AppData\Local\Temp\EADABF8.exe
C:\Users\Jessica\AppData\Local\Temp\EADABF9.exe
C:\Users\Jessica\AppData\Local\Temp\EADAC07.exe
C:\Users\Jessica\AppData\Local\Temp\EADAC1A.exe
C:\Users\Jessica\AppData\Local\Temp\EADAC26.exe
C:\Users\Jessica\AppData\Local\Temp\EADAC45.exe
C:\Users\Jessica\AppData\Local\Temp\EADAC64.exe
C:\Users\Jessica\AppData\Local\Temp\EADAC83.exe
C:\Users\Jessica\AppData\Local\Temp\EADAC84.exe
C:\Users\Jessica\AppData\Local\Temp\EADACB2.exe
C:\Users\Jessica\AppData\Local\Temp\EADACC2.exe
C:\Users\Jessica\AppData\Local\Temp\EADACD1.exe
C:\Users\Jessica\AppData\Local\Temp\EADACD2.exe
C:\Users\Jessica\AppData\Local\Temp\EADAD00.exe
C:\Users\Jessica\AppData\Local\Temp\EADAD01.exe
C:\Users\Jessica\AppData\Local\Temp\EADAD02.exe
C:\Users\Jessica\AppData\Local\Temp\EADAD1F.exe
C:\Users\Jessica\AppData\Local\Temp\EADAD20.exe
C:\Users\Jessica\AppData\Local\Temp\EADAD2F.exe
C:\Users\Jessica\AppData\Local\Temp\EADAD30.exe
C:\Users\Jessica\AppData\Local\Temp\EADAD5E.exe
C:\Users\Jessica\AppData\Local\Temp\EADAD5F.exe
C:\Users\Jessica\AppData\Local\Temp\EADAD7D.exe
C:\Users\Jessica\AppData\Local\Temp\EADAD7E.exe
C:\Users\Jessica\AppData\Local\Temp\EADAD8D.exe
C:\Users\Jessica\AppData\Local\Temp\EADAD9C.exe
C:\Users\Jessica\AppData\Local\Temp\EADADAC.exe
C:\Users\Jessica\AppData\Local\Temp\EADADCB.exe
C:\Users\Jessica\AppData\Local\Temp\EADADEA.exe
C:\Users\Jessica\AppData\Local\Temp\EADAE09.exe
C:\Users\Jessica\AppData\Local\Temp\EADAE19.exe
C:\Users\Jessica\AppData\Local\Temp\EADAE1A.exe
C:\Users\Jessica\AppData\Local\Temp\EADAE29.exe
C:\Users\Jessica\AppData\Local\Temp\EADAE48.exe
C:\Users\Jessica\AppData\Local\Temp\EADAE49.exe
C:\Users\Jessica\AppData\Local\Temp\EADAE77.exe
C:\Users\Jessica\AppData\Local\Temp\EADAE86.exe
C:\Users\Jessica\AppData\Local\Temp\EADAEC5.exe
C:\Users\Jessica\AppData\Local\Temp\EADAED4.exe
C:\Users\Jessica\AppData\Local\Temp\EADAEE4.exe
C:\Users\Jessica\AppData\Local\Temp\EADAF03.exe
C:\Users\Jessica\AppData\Local\Temp\EADAF13.exe
C:\Users\Jessica\AppData\Local\Temp\EADAF41.exe
C:\Users\Jessica\AppData\Local\Temp\EADAF51.exe
C:\Users\Jessica\AppData\Local\Temp\EADAF52.exe
C:\Users\Jessica\AppData\Local\Temp\EADAF70.exe
C:\Users\Jessica\AppData\Local\Temp\EADAF80.exe
C:\Users\Jessica\AppData\Local\Temp\EADAF81.exe
C:\Users\Jessica\AppData\Local\Temp\EADAF8F.exe
C:\Users\Jessica\AppData\Local\Temp\EADAF9F.exe
C:\Users\Jessica\AppData\Local\Temp\EADAFAF.exe
C:\Users\Jessica\AppData\Local\Temp\EADAFDD.exe
C:\Users\Jessica\AppData\Local\Temp\EADAFDE.exe
C:\Users\Jessica\AppData\Local\Temp\EADAFED.exe
C:\Users\Jessica\AppData\Local\Temp\EADAFFD.exe
C:\Users\Jessica\AppData\Local\Temp\EADAFFE.exe
C:\Users\Jessica\AppData\Local\Temp\EADAFFF.exe
C:\Users\Jessica\AppData\Local\Temp\EADB01C.exe
C:\Users\Jessica\AppData\Local\Temp\EADB03B.exe
C:\Users\Jessica\AppData\Local\Temp\EADB04B.exe
C:\Users\Jessica\AppData\Local\Temp\EADB05A.exe
C:\Users\Jessica\AppData\Local\Temp\EADB05B.exe
C:\Users\Jessica\AppData\Local\Temp\EADB06A.exe
C:\Users\Jessica\AppData\Local\Temp\EADB07B.exe
C:\Users\Jessica\AppData\Local\Temp\EADB0B8.exe
C:\Users\Jessica\AppData\Local\Temp\EADB0B9.exe
C:\Users\Jessica\AppData\Local\Temp\EADB0BA.exe
C:\Users\Jessica\AppData\Local\Temp\EADB0C7.exe
C:\Users\Jessica\AppData\Local\Temp\EADB0C8.exe
C:\Users\Jessica\AppData\Local\Temp\EADB154.exe
C:\Users\Jessica\AppData\Local\Temp\EADB163.exe
C:\Users\Jessica\AppData\Local\Temp\EADB192.exe
C:\Users\Jessica\AppData\Local\Temp\EADB193.exe
C:\Users\Jessica\AppData\Local\Temp\EADB1D1.exe
C:\Users\Jessica\AppData\Local\Temp\EADB1D2.exe
C:\Users\Jessica\AppData\Local\Temp\EADB1F0.exe
C:\Users\Jessica\AppData\Local\Temp\EADB1F1.exe
C:\Users\Jessica\AppData\Local\Temp\EADB1F2.exe
C:\Users\Jessica\AppData\Local\Temp\EADB1FF.exe
C:\Users\Jessica\AppData\Local\Temp\EADB20F.exe
C:\Users\Jessica\AppData\Local\Temp\EADB21F.exe
C:\Users\Jessica\AppData\Local\Temp\EADB220.exe
C:\Users\Jessica\AppData\Local\Temp\EADB23E.exe
C:\Users\Jessica\AppData\Local\Temp\EADB23F.exe
C:\Users\Jessica\AppData\Local\Temp\EADB24D.exe
C:\Users\Jessica\AppData\Local\Temp\EADB26.exe
C:\Users\Jessica\AppData\Local\Temp\EADB2BB.exe
C:\Users\Jessica\AppData\Local\Temp\EADB2BC.exe
C:\Users\Jessica\AppData\Local\Temp\EADB2CA.exe
C:\Users\Jessica\AppData\Local\Temp\EADB2F9.exe
C:\Users\Jessica\AppData\Local\Temp\EADB309.exe
C:\Users\Jessica\AppData\Local\Temp\EADB318.exe
C:\Users\Jessica\AppData\Local\Temp\EADB328.exe
C:\Users\Jessica\AppData\Local\Temp\EADB329.exe
C:\Users\Jessica\AppData\Local\Temp\EADB347.exe
C:\Users\Jessica\AppData\Local\Temp\EADB357.exe
C:\Users\Jessica\AppData\Local\Temp\EADB366.exe
C:\Users\Jessica\AppData\Local\Temp\EADB376.exe
C:\Users\Jessica\AppData\Local\Temp\EADB385.exe
C:\Users\Jessica\AppData\Local\Temp\EADB3A5.exe
C:\Users\Jessica\AppData\Local\Temp\EADB3A6.exe
C:\Users\Jessica\AppData\Local\Temp\EADB3D3.exe
C:\Users\Jessica\AppData\Local\Temp\EADB3E3.exe
C:\Users\Jessica\AppData\Local\Temp\EADB3F3.exe
C:\Users\Jessica\AppData\Local\Temp\EADB402.exe
C:\Users\Jessica\AppData\Local\Temp\EADB403.exe
C:\Users\Jessica\AppData\Local\Temp\EADB412.exe
C:\Users\Jessica\AppData\Local\Temp\EADB441.exe
C:\Users\Jessica\AppData\Local\Temp\EADB450.exe
C:\Users\Jessica\AppData\Local\Temp\EADB46F.exe
C:\Users\Jessica\AppData\Local\Temp\EADB47F.exe
C:\Users\Jessica\AppData\Local\Temp\EADB48F.exe
C:\Users\Jessica\AppData\Local\Temp\EADB49E.exe
C:\Users\Jessica\AppData\Local\Temp\EADB49F.exe
C:\Users\Jessica\AppData\Local\Temp\EADB4AE.exe
C:\Users\Jessica\AppData\Local\Temp\EADB50B.exe
C:\Users\Jessica\AppData\Local\Temp\EADB53A.exe
C:\Users\Jessica\AppData\Local\Temp\EADB53B.exe
C:\Users\Jessica\AppData\Local\Temp\EADB53C.exe
C:\Users\Jessica\AppData\Local\Temp\EADB54A.exe
C:\Users\Jessica\AppData\Local\Temp\EADB55.exe
C:\Users\Jessica\AppData\Local\Temp\EADB579.exe
C:\Users\Jessica\AppData\Local\Temp\EADB598.exe
C:\Users\Jessica\AppData\Local\Temp\EADB5A7.exe
C:\Users\Jessica\AppData\Local\Temp\EADB5B7.exe
C:\Users\Jessica\AppData\Local\Temp\EADB5D6.exe
C:\Users\Jessica\AppData\Local\Temp\EADB5D7.exe
C:\Users\Jessica\AppData\Local\Temp\EADB5D8.exe
C:\Users\Jessica\AppData\Local\Temp\EADB5E6.exe
C:\Users\Jessica\AppData\Local\Temp\EADB634.exe
C:\Users\Jessica\AppData\Local\Temp\EADB635.exe
C:\Users\Jessica\AppData\Local\Temp\EADB653.exe
C:\Users\Jessica\AppData\Local\Temp\EADB672.exe
C:\Users\Jessica\AppData\Local\Temp\EADB691.exe
C:\Users\Jessica\AppData\Local\Temp\EADB6A1.exe
C:\Users\Jessica\AppData\Local\Temp\EADB6A2.exe
C:\Users\Jessica\AppData\Local\Temp\EADB6C0.exe
C:\Users\Jessica\AppData\Local\Temp\EADB6C1.exe
C:\Users\Jessica\AppData\Local\Temp\EADB6EF.exe
C:\Users\Jessica\AppData\Local\Temp\EADB6FF.exe
C:\Users\Jessica\AppData\Local\Temp\EADB700.exe
C:\Users\Jessica\AppData\Local\Temp\EADB71E.exe
C:\Users\Jessica\AppData\Local\Temp\EADB72D.exe
C:\Users\Jessica\AppData\Local\Temp\EADB73D.exe
C:\Users\Jessica\AppData\Local\Temp\EADB74D.exe
C:\Users\Jessica\AppData\Local\Temp\EADB75C.exe
C:\Users\Jessica\AppData\Local\Temp\EADB75D.exe
C:\Users\Jessica\AppData\Local\Temp\EADB75E.exe
C:\Users\Jessica\AppData\Local\Temp\EADB78B.exe
C:\Users\Jessica\AppData\Local\Temp\EADB78C.exe
C:\Users\Jessica\AppData\Local\Temp\EADB78D.exe
C:\Users\Jessica\AppData\Local\Temp\EADB79B.exe
C:\Users\Jessica\AppData\Local\Temp\EADB7AA.exe
C:\Users\Jessica\AppData\Local\Temp\EADB7C9.exe
C:\Users\Jessica\AppData\Local\Temp\EADB7E9.exe
C:\Users\Jessica\AppData\Local\Temp\EADB7F8.exe
C:\Users\Jessica\AppData\Local\Temp\EADB7F9.exe
C:\Users\Jessica\AppData\Local\Temp\EADB817.exe
C:\Users\Jessica\AppData\Local\Temp\EADB827.exe
C:\Users\Jessica\AppData\Local\Temp\EADB828.exe
C:\Users\Jessica\AppData\Local\Temp\EADB837.exe
C:\Users\Jessica\AppData\Local\Temp\EADB846.exe
C:\Users\Jessica\AppData\Local\Temp\EADB856.exe
C:\Users\Jessica\AppData\Local\Temp\EADB8A4.exe
C:\Users\Jessica\AppData\Local\Temp\EADB8C3.exe
C:\Users\Jessica\AppData\Local\Temp\EADB8E2.exe
C:\Users\Jessica\AppData\Local\Temp\EADB8E3.exe
C:\Users\Jessica\AppData\Local\Temp\EADB902.exe
C:\Users\Jessica\AppData\Local\Temp\EADB911.exe
C:\Users\Jessica\AppData\Local\Temp\EADB912.exe
C:\Users\Jessica\AppData\Local\Temp\EADB96F.exe
C:\Users\Jessica\AppData\Local\Temp\EADB970.exe
C:\Users\Jessica\AppData\Local\Temp\EADB97E.exe
C:\Users\Jessica\AppData\Local\Temp\EADB99D.exe
C:\Users\Jessica\AppData\Local\Temp\EADB9BD.exe
C:\Users\Jessica\AppData\Local\Temp\EADB9FB.exe
C:\Users\Jessica\AppData\Local\Temp\EADBA1A.exe
C:\Users\Jessica\AppData\Local\Temp\EADBA3.exe
C:\Users\Jessica\AppData\Local\Temp\EADBA68.exe
C:\Users\Jessica\AppData\Local\Temp\EADBA97.exe
C:\Users\Jessica\AppData\Local\Temp\EADBAA7.exe
C:\Users\Jessica\AppData\Local\Temp\EADBAA8.exe
C:\Users\Jessica\AppData\Local\Temp\EADBAB6.exe
C:\Users\Jessica\AppData\Local\Temp\EADBAB7.exe
C:\Users\Jessica\AppData\Local\Temp\EADBAB8.exe
C:\Users\Jessica\AppData\Local\Temp\EADBAC6.exe
C:\Users\Jessica\AppData\Local\Temp\EADBB04.exe
C:\Users\Jessica\AppData\Local\Temp\EADBB33.exe
C:\Users\Jessica\AppData\Local\Temp\EADBB34.exe
C:\Users\Jessica\AppData\Local\Temp\EADBB43.exe
C:\Users\Jessica\AppData\Local\Temp\EADBB62.exe
C:\Users\Jessica\AppData\Local\Temp\EADBB81.exe
C:\Users\Jessica\AppData\Local\Temp\EADBB91.exe
C:\Users\Jessica\AppData\Local\Temp\EADBB92.exe
C:\Users\Jessica\AppData\Local\Temp\EADBBB0.exe
C:\Users\Jessica\AppData\Local\Temp\EADBBBF.exe
C:\Users\Jessica\AppData\Local\Temp\EADBBCF.exe
C:\Users\Jessica\AppData\Local\Temp\EADBBD0.exe
C:\Users\Jessica\AppData\Local\Temp\EADBBDF.exe
C:\Users\Jessica\AppData\Local\Temp\EADBBEE.exe
C:\Users\Jessica\AppData\Local\Temp\EADBC1D.exe
C:\Users\Jessica\AppData\Local\Temp\EADBC1E.exe
C:\Users\Jessica\AppData\Local\Temp\EADBC3C.exe
C:\Users\Jessica\AppData\Local\Temp\EADBC6B.exe
C:\Users\Jessica\AppData\Local\Temp\EADBC7B.exe
C:\Users\Jessica\AppData\Local\Temp\EADBC8A.exe
C:\Users\Jessica\AppData\Local\Temp\EADBC9A.exe
C:\Users\Jessica\AppData\Local\Temp\EADBC9B.exe
C:\Users\Jessica\AppData\Local\Temp\EADBC9C.exe
C:\Users\Jessica\AppData\Local\Temp\EADBC9D.exe
C:\Users\Jessica\AppData\Local\Temp\EADBCB9.exe
C:\Users\Jessica\AppData\Local\Temp\EADBCD8.exe
C:\Users\Jessica\AppData\Local\Temp\EADBCD9.exe
C:\Users\Jessica\AppData\Local\Temp\EADBCDA.exe
C:\Users\Jessica\AppData\Local\Temp\EADBCF7.exe
C:\Users\Jessica\AppData\Local\Temp\EADBD26.exe
C:\Users\Jessica\AppData\Local\Temp\EADBD36.exe
C:\Users\Jessica\AppData\Local\Temp\EADBD37.exe
C:\Users\Jessica\AppData\Local\Temp\EADBD45.exe
C:\Users\Jessica\AppData\Local\Temp\EADBD74.exe
C:\Users\Jessica\AppData\Local\Temp\EADBD93.exe
C:\Users\Jessica\AppData\Local\Temp\EADBDA3.exe
C:\Users\Jessica\AppData\Local\Temp\EADBDA4.exe
C:\Users\Jessica\AppData\Local\Temp\EADBDB3.exe
C:\Users\Jessica\AppData\Local\Temp\EADBDB4.exe
C:\Users\Jessica\AppData\Local\Temp\EADBDF1.exe
C:\Users\Jessica\AppData\Local\Temp\EADBE01.exe
C:\Users\Jessica\AppData\Local\Temp\EADBE4F.exe
C:\Users\Jessica\AppData\Local\Temp\EADBE50.exe
C:\Users\Jessica\AppData\Local\Temp\EADBE6E.exe
C:\Users\Jessica\AppData\Local\Temp\EADBE7D.exe
C:\Users\Jessica\AppData\Local\Temp\EADBECB.exe
C:\Users\Jessica\AppData\Local\Temp\EADBF0A.exe
C:\Users\Jessica\AppData\Local\Temp\EADBF29.exe
C:\Users\Jessica\AppData\Local\Temp\EADBF58.exe
C:\Users\Jessica\AppData\Local\Temp\EADBFB5.exe
C:\Users\Jessica\AppData\Local\Temp\EADBFD5.exe
C:\Users\Jessica\AppData\Local\Temp\EADBFE4.exe
C:\Users\Jessica\AppData\Local\Temp\EADC01.exe
C:\Users\Jessica\AppData\Local\Temp\EADC042.exe
C:\Users\Jessica\AppData\Local\Temp\EADC051.exe
C:\Users\Jessica\AppData\Local\Temp\EADC0FD.exe
C:\Users\Jessica\AppData\Local\Temp\EADC0FE.exe
C:\Users\Jessica\AppData\Local\Temp\EADC10.exe
C:\Users\Jessica\AppData\Local\Temp\EADC11C.exe
C:\Users\Jessica\AppData\Local\Temp\EADC11D.exe
C:\Users\Jessica\AppData\Local\Temp\EADC14B.exe
C:\Users\Jessica\AppData\Local\Temp\EADC15B.exe
C:\Users\Jessica\AppData\Local\Temp\EADC1A9.exe
C:\Users\Jessica\AppData\Local\Temp\EADC1D7.exe
C:\Users\Jessica\AppData\Local\Temp\EADC1D8.exe
C:\Users\Jessica\AppData\Local\Temp\EADC216.exe
C:\Users\Jessica\AppData\Local\Temp\EADC235.exe
C:\Users\Jessica\AppData\Local\Temp\EADC245.exe
C:\Users\Jessica\AppData\Local\Temp\EADC246.exe
C:\Users\Jessica\AppData\Local\Temp\EADC283.exe
C:\Users\Jessica\AppData\Local\Temp\EADC2A2.exe
C:\Users\Jessica\AppData\Local\Temp\EADC2A3.exe
C:\Users\Jessica\AppData\Local\Temp\EADC2B2.exe
C:\Users\Jessica\AppData\Local\Temp\EADC2E1.exe
C:\Users\Jessica\AppData\Local\Temp\EADC2E2.exe
C:\Users\Jessica\AppData\Local\Temp\EADC30.exe
C:\Users\Jessica\AppData\Local\Temp\EADC31.exe
C:\Users\Jessica\AppData\Local\Temp\EADC31F.exe
C:\Users\Jessica\AppData\Local\Temp\EADC32.exe
C:\Users\Jessica\AppData\Local\Temp\EADC33E.exe
C:\Users\Jessica\AppData\Local\Temp\EADC33F.exe
C:\Users\Jessica\AppData\Local\Temp\EADC37D.exe
C:\Users\Jessica\AppData\Local\Temp\EADC3CB.exe
C:\Users\Jessica\AppData\Local\Temp\EADC3CC.exe
C:\Users\Jessica\AppData\Local\Temp\EADC3DA.exe
C:\Users\Jessica\AppData\Local\Temp\EADC3EA.exe
C:\Users\Jessica\AppData\Local\Temp\EADC3EB.exe
C:\Users\Jessica\AppData\Local\Temp\EADC3EC.exe
C:\Users\Jessica\AppData\Local\Temp\EADC457.exe
C:\Users\Jessica\AppData\Local\Temp\EADC4B5.exe
C:\Users\Jessica\AppData\Local\Temp\EADC4C4.exe
C:\Users\Jessica\AppData\Local\Temp\EADC4D4.exe
C:\Users\Jessica\AppData\Local\Temp\EADC551.exe
C:\Users\Jessica\AppData\Local\Temp\EADC560.exe
C:\Users\Jessica\AppData\Local\Temp\EADC57F.exe
C:\Users\Jessica\AppData\Local\Temp\EADC5AE.exe
C:\Users\Jessica\AppData\Local\Temp\EADC5CD.exe
C:\Users\Jessica\AppData\Local\Temp\EADC5E.exe
C:\Users\Jessica\AppData\Local\Temp\EADC5ED.exe
C:\Users\Jessica\AppData\Local\Temp\EADC5FC.exe
C:\Users\Jessica\AppData\Local\Temp\EADC60C.exe
C:\Users\Jessica\AppData\Local\Temp\EADC61B.exe
C:\Users\Jessica\AppData\Local\Temp\EADC62B.exe
C:\Users\Jessica\AppData\Local\Temp\EADC62C.exe
C:\Users\Jessica\AppData\Local\Temp\EADC62D.exe
C:\Users\Jessica\AppData\Local\Temp\EADC65A.exe
C:\Users\Jessica\AppData\Local\Temp\EADC65B.exe
C:\Users\Jessica\AppData\Local\Temp\EADC669.exe
C:\Users\Jessica\AppData\Local\Temp\EADC66A.exe
C:\Users\Jessica\AppData\Local\Temp\EADC6A8.exe
C:\Users\Jessica\AppData\Local\Temp\EADC6C7.exe
C:\Users\Jessica\AppData\Local\Temp\EADC6C8.exe
C:\Users\Jessica\AppData\Local\Temp\EADC6D7.exe
C:\Users\Jessica\AppData\Local\Temp\EADC734.exe
C:\Users\Jessica\AppData\Local\Temp\EADC744.exe
C:\Users\Jessica\AppData\Local\Temp\EADC763.exe
C:\Users\Jessica\AppData\Local\Temp\EADC773.exe
C:\Users\Jessica\AppData\Local\Temp\EADC774.exe
C:\Users\Jessica\AppData\Local\Temp\EADC775.exe
C:\Users\Jessica\AppData\Local\Temp\EADC782.exe
C:\Users\Jessica\AppData\Local\Temp\EADC792.exe
C:\Users\Jessica\AppData\Local\Temp\EADC7B1.exe
C:\Users\Jessica\AppData\Local\Temp\EADC7B2.exe
C:\Users\Jessica\AppData\Local\Temp\EADC7B3.exe
C:\Users\Jessica\AppData\Local\Temp\EADC7E0.exe
C:\Users\Jessica\AppData\Local\Temp\EADC7FF.exe
C:\Users\Jessica\AppData\Local\Temp\EADC800.exe
C:\Users\Jessica\AppData\Local\Temp\EADC802.exe
C:\Users\Jessica\AppData\Local\Temp\EADC81E.exe
C:\Users\Jessica\AppData\Local\Temp\EADC84D.exe
C:\Users\Jessica\AppData\Local\Temp\EADC85D.exe
C:\Users\Jessica\AppData\Local\Temp\EADC86C.exe
C:\Users\Jessica\AppData\Local\Temp\EADC88B.exe
C:\Users\Jessica\AppData\Local\Temp\EADC89B.exe
C:\Users\Jessica\AppData\Local\Temp\EADC8D9.exe
C:\Users\Jessica\AppData\Local\Temp\EADC927.exe
C:\Users\Jessica\AppData\Local\Temp\EADC928.exe
C:\Users\Jessica\AppData\Local\Temp\EADC966.exe
C:\Users\Jessica\AppData\Local\Temp\EADC975.exe
C:\Users\Jessica\AppData\Local\Temp\EADC9B4.exe
C:\Users\Jessica\AppData\Local\Temp\EADC9D3.exe
C:\Users\Jessica\AppData\Local\Temp\EADC9F2.exe
C:\Users\Jessica\AppData\Local\Temp\EADCA31.exe
C:\Users\Jessica\AppData\Local\Temp\EADCA50.exe
C:\Users\Jessica\AppData\Local\Temp\EADCA51.exe
C:\Users\Jessica\AppData\Local\Temp\EADCA8E.exe
C:\Users\Jessica\AppData\Local\Temp\EADCAAD.exe
C:\Users\Jessica\AppData\Local\Temp\EADCAAE.exe
C:\Users\Jessica\AppData\Local\Temp\EADCAFB.exe
C:\Users\Jessica\AppData\Local\Temp\EADCB0B.exe
C:\Users\Jessica\AppData\Local\Temp\EADCB1B.exe
C:\Users\Jessica\AppData\Local\Temp\EADCB2A.exe
C:\Users\Jessica\AppData\Local\Temp\EADCB2B.exe
C:\Users\Jessica\AppData\Local\Temp\EADCB3A.exe
C:\Users\Jessica\AppData\Local\Temp\EADCB59.exe
C:\Users\Jessica\AppData\Local\Temp\EADCB5A.exe
C:\Users\Jessica\AppData\Local\Temp\EADCB69.exe
C:\Users\Jessica\AppData\Local\Temp\EADCB88.exe
C:\Users\Jessica\AppData\Local\Temp\EADCBC6.exe
C:\Users\Jessica\AppData\Local\Temp\EADCBC7.exe
C:\Users\Jessica\AppData\Local\Temp\EADCC05.exe
C:\Users\Jessica\AppData\Local\Temp\EADCC24.exe
C:\Users\Jessica\AppData\Local\Temp\EADCC91.exe
C:\Users\Jessica\AppData\Local\Temp\EADCCCF.exe
C:\Users\Jessica\AppData\Local\Temp\EADCCFE.exe
C:\Users\Jessica\AppData\Local\Temp\EADCD0E.exe
C:\Users\Jessica\AppData\Local\Temp\EADCD4C.exe
C:\Users\Jessica\AppData\Local\Temp\EADCD5C.exe
C:\Users\Jessica\AppData\Local\Temp\EADCD7B.exe
C:\Users\Jessica\AppData\Local\Temp\EADCD8B.exe
C:\Users\Jessica\AppData\Local\Temp\EADCD9A.exe
C:\Users\Jessica\AppData\Local\Temp\EADCDAA.exe
C:\Users\Jessica\AppData\Local\Temp\EADCDAB.exe
C:\Users\Jessica\AppData\Local\Temp\EADCDC9.exe
C:\Users\Jessica\AppData\Local\Temp\EADCDE8.exe
C:\Users\Jessica\AppData\Local\Temp\EADCE07.exe
C:\Users\Jessica\AppData\Local\Temp\EADCE08.exe
C:\Users\Jessica\AppData\Local\Temp\EADCE17.exe
C:\Users\Jessica\AppData\Local\Temp\EADCE18.exe
C:\Users\Jessica\AppData\Local\Temp\EADCE46.exe
C:\Users\Jessica\AppData\Local\Temp\EADCE47.exe
C:\Users\Jessica\AppData\Local\Temp\EADCE65.exe
C:\Users\Jessica\AppData\Local\Temp\EADCE66.exe
C:\Users\Jessica\AppData\Local\Temp\EADCEC3.exe
C:\Users\Jessica\AppData\Local\Temp\EADCEC4.exe
C:\Users\Jessica\AppData\Local\Temp\EADCEF1.exe
C:\Users\Jessica\AppData\Local\Temp\EADCF11.exe
C:\Users\Jessica\AppData\Local\Temp\EADCF30.exe
C:\Users\Jessica\AppData\Local\Temp\EADCF9D.exe
C:\Users\Jessica\AppData\Local\Temp\EADCFAD.exe
C:\Users\Jessica\AppData\Local\Temp\EADCFCC.exe
C:\Users\Jessica\AppData\Local\Temp\EADCFDB.exe
C:\Users\Jessica\AppData\Local\Temp\EADCFEC.exe
C:\Users\Jessica\AppData\Local\Temp\EADCFFB.exe
C:\Users\Jessica\AppData\Local\Temp\EADD02A.exe
C:\Users\Jessica\AppData\Local\Temp\EADD077.exe
C:\Users\Jessica\AppData\Local\Temp\EADD0C5.exe
C:\Users\Jessica\AppData\Local\Temp\EADD0C6.exe
C:\Users\Jessica\AppData\Local\Temp\EADD0D5.exe
C:\Users\Jessica\AppData\Local\Temp\EADD123.exe
C:\Users\Jessica\AppData\Local\Temp\EADD133.exe
C:\Users\Jessica\AppData\Local\Temp\EADD152.exe
C:\Users\Jessica\AppData\Local\Temp\EADD1A0.exe
C:\Users\Jessica\AppData\Local\Temp\EADD1CF.exe
C:\Users\Jessica\AppData\Local\Temp\EADD1D0.exe
C:\Users\Jessica\AppData\Local\Temp\EADD20D.exe
C:\Users\Jessica\AppData\Local\Temp\EADD20E.exe
C:\Users\Jessica\AppData\Local\Temp\EADD23C.exe
C:\Users\Jessica\AppData\Local\Temp\EADD25B.exe
C:\Users\Jessica\AppData\Local\Temp\EADD2A9.exe
C:\Users\Jessica\AppData\Local\Temp\EADD307.exe
C:\Users\Jessica\AppData\Local\Temp\EADD326.exe
C:\Users\Jessica\AppData\Local\Temp\EADD335.exe
C:\Users\Jessica\AppData\Local\Temp\EADD39.exe
C:\Users\Jessica\AppData\Local\Temp\EADD3C2.exe
C:\Users\Jessica\AppData\Local\Temp\EADD3C3.exe
C:\Users\Jessica\AppData\Local\Temp\EADD401.exe
C:\Users\Jessica\AppData\Local\Temp\EADD41F.exe
C:\Users\Jessica\AppData\Local\Temp\EADD420.exe
C:\Users\Jessica\AppData\Local\Temp\EADD48D.exe
C:\Users\Jessica\AppData\Local\Temp\EADD49C.exe
C:\Users\Jessica\AppData\Local\Temp\EADD4AC.exe
C:\Users\Jessica\AppData\Local\Temp\EADD4CB.exe
C:\Users\Jessica\AppData\Local\Temp\EADD538.exe
C:\Users\Jessica\AppData\Local\Temp\EADD598.exe
C:\Users\Jessica\AppData\Local\Temp\EADD5B5.exe
C:\Users\Jessica\AppData\Local\Temp\EADD613.exe
C:\Users\Jessica\AppData\Local\Temp\EADD614.exe
C:\Users\Jessica\AppData\Local\Temp\EADD632.exe
C:\Users\Jessica\AppData\Local\Temp\EADD651.exe
C:\Users\Jessica\AppData\Local\Temp\EADD670.exe
C:\Users\Jessica\AppData\Local\Temp\EADD671.exe
C:\Users\Jessica\AppData\Local\Temp\EADD6AF.exe
C:\Users\Jessica\AppData\Local\Temp\EADD6BE.exe
C:\Users\Jessica\AppData\Local\Temp\EADD6CE.exe
C:\Users\Jessica\AppData\Local\Temp\EADD6ED.exe
C:\Users\Jessica\AppData\Local\Temp\EADD6FD.exe
C:\Users\Jessica\AppData\Local\Temp\EADD74B.exe
C:\Users\Jessica\AppData\Local\Temp\EADD76A.exe
C:\Users\Jessica\AppData\Local\Temp\EADD77.exe
C:\Users\Jessica\AppData\Local\Temp\EADD78.exe
C:\Users\Jessica\AppData\Local\Temp\EADD7A8.exe
C:\Users\Jessica\AppData\Local\Temp\EADD7B8.exe
C:\Users\Jessica\AppData\Local\Temp\EADD7C7.exe
C:\Users\Jessica\AppData\Local\Temp\EADD7C8.exe
C:\Users\Jessica\AppData\Local\Temp\EADD7D7.exe
C:\Users\Jessica\AppData\Local\Temp\EADD7F6.exe
C:\Users\Jessica\AppData\Local\Temp\EADD825.exe
C:\Users\Jessica\AppData\Local\Temp\EADD826.exe
C:\Users\Jessica\AppData\Local\Temp\EADD883.exe
C:\Users\Jessica\AppData\Local\Temp\EADD8F0.exe
C:\Users\Jessica\AppData\Local\Temp\EADD90F.exe
C:\Users\Jessica\AppData\Local\Temp\EADD910.exe
C:\Users\Jessica\AppData\Local\Temp\EADD93E.exe
C:\Users\Jessica\AppData\Local\Temp\EADD94D.exe
C:\Users\Jessica\AppData\Local\Temp\EADD99C.exe
C:\Users\Jessica\AppData\Local\Temp\EADD9CB.exe
C:\Users\Jessica\AppData\Local\Temp\EADDA09.exe
C:\Users\Jessica\AppData\Local\Temp\EADDA0A.exe
C:\Users\Jessica\AppData\Local\Temp\EADDA28.exe
C:\Users\Jessica\AppData\Local\Temp\EADDA29.exe
C:\Users\Jessica\AppData\Local\Temp\EADDA2A.exe
C:\Users\Jessica\AppData\Local\Temp\EADDA6.exe
C:\Users\Jessica\AppData\Local\Temp\EADDA77.exe
C:\Users\Jessica\AppData\Local\Temp\EADDA85.exe
C:\Users\Jessica\AppData\Local\Temp\EADDAD3.exe
C:\Users\Jessica\AppData\Local\Temp\EADDB12.exe
C:\Users\Jessica\AppData\Local\Temp\EADDB22.exe
C:\Users\Jessica\AppData\Local\Temp\EADDB31.exe
C:\Users\Jessica\AppData\Local\Temp\EADDB41.exe
C:\Users\Jessica\AppData\Local\Temp\EADDB6F.exe
C:\Users\Jessica\AppData\Local\Temp\EADDB8F.exe
C:\Users\Jessica\AppData\Local\Temp\EADDB90.exe
C:\Users\Jessica\AppData\Local\Temp\EADDBFC.exe
C:\Users\Jessica\AppData\Local\Temp\EADDC1B.exe
C:\Users\Jessica\AppData\Local\Temp\EADDC1C.exe
C:\Users\Jessica\AppData\Local\Temp\EADDC3A.exe
C:\Users\Jessica\AppData\Local\Temp\EADDC59.exe
C:\Users\Jessica\AppData\Local\Temp\EADDCA7.exe
C:\Users\Jessica\AppData\Local\Temp\EADDCC7.exe
C:\Users\Jessica\AppData\Local\Temp\EADDCE6.exe
C:\Users\Jessica\AppData\Local\Temp\EADDCF5.exe
C:\Users\Jessica\AppData\Local\Temp\EADDD63.exe
C:\Users\Jessica\AppData\Local\Temp\EADDD72.exe
C:\Users\Jessica\AppData\Local\Temp\EADDD82.exe
C:\Users\Jessica\AppData\Local\Temp\EADDDE0.exe
C:\Users\Jessica\AppData\Local\Temp\EADDE0E.exe
C:\Users\Jessica\AppData\Local\Temp\EADDE3D.exe
C:\Users\Jessica\AppData\Local\Temp\EADDE7B.exe
C:\Users\Jessica\AppData\Local\Temp\EADDE9B.exe
C:\Users\Jessica\AppData\Local\Temp\EADDED9.exe
C:\Users\Jessica\AppData\Local\Temp\EADDEE9.exe
C:\Users\Jessica\AppData\Local\Temp\EADDF17.exe
C:\Users\Jessica\AppData\Local\Temp\EADDF56.exe
C:\Users\Jessica\AppData\Local\Temp\EADDF57.exe
C:\Users\Jessica\AppData\Local\Temp\EADDF58.exe
C:\Users\Jessica\AppData\Local\Temp\EADDF75.exe
C:\Users\Jessica\AppData\Local\Temp\EADDF85.exe
C:\Users\Jessica\AppData\Local\Temp\EADDFB4.exe
C:\Users\Jessica\AppData\Local\Temp\EADDFC3.exe
C:\Users\Jessica\AppData\Local\Temp\EADDFF2.exe
C:\Users\Jessica\AppData\Local\Temp\EADE001.exe
C:\Users\Jessica\AppData\Local\Temp\EADE011.exe
C:\Users\Jessica\AppData\Local\Temp\EADE021.exe
C:\Users\Jessica\AppData\Local\Temp\EADE04.exe
C:\Users\Jessica\AppData\Local\Temp\EADE05.exe
C:\Users\Jessica\AppData\Local\Temp\EADE07E.exe
C:\Users\Jessica\AppData\Local\Temp\EADE0FB.exe
C:\Users\Jessica\AppData\Local\Temp\EADE10B.exe
C:\Users\Jessica\AppData\Local\Temp\EADE168.exe
C:\Users\Jessica\AppData\Local\Temp\EADE188.exe
C:\Users\Jessica\AppData\Local\Temp\EADE1C6.exe
C:\Users\Jessica\AppData\Local\Temp\EADE1C7.exe
C:\Users\Jessica\AppData\Local\Temp\EADE1C8.exe
C:\Users\Jessica\AppData\Local\Temp\EADE204.exe
C:\Users\Jessica\AppData\Local\Temp\EADE281.exe
C:\Users\Jessica\AppData\Local\Temp\EADE2BF.exe
C:\Users\Jessica\AppData\Local\Temp\EADE2EE.exe
C:\Users\Jessica\AppData\Local\Temp\EADE31D.exe
C:\Users\Jessica\AppData\Local\Temp\EADE35B.exe
C:\Users\Jessica\AppData\Local\Temp\EADE3A9.exe
C:\Users\Jessica\AppData\Local\Temp\EADE3AA.exe
C:\Users\Jessica\AppData\Local\Temp\EADE42.exe
C:\Users\Jessica\AppData\Local\Temp\EADE493.exe
C:\Users\Jessica\AppData\Local\Temp\EADE4E2.exe
C:\Users\Jessica\AppData\Local\Temp\EADE52.exe
C:\Users\Jessica\AppData\Local\Temp\EADE520.exe
C:\Users\Jessica\AppData\Local\Temp\EADE55E.exe
C:\Users\Jessica\AppData\Local\Temp\EADE59D.exe
C:\Users\Jessica\AppData\Local\Temp\EADE5AC.exe
C:\Users\Jessica\AppData\Local\Temp\EADE5BC.exe
C:\Users\Jessica\AppData\Local\Temp\EADE60A.exe
C:\Users\Jessica\AppData\Local\Temp\EADE619.exe
C:\Users\Jessica\AppData\Local\Temp\EADE629.exe
C:\Users\Jessica\AppData\Local\Temp\EADE658.exe
C:\Users\Jessica\AppData\Local\Temp\EADE6B5.exe
C:\Users\Jessica\AppData\Local\Temp\EADE6D5.exe
C:\Users\Jessica\AppData\Local\Temp\EADE703.exe
C:\Users\Jessica\AppData\Local\Temp\EADE732.exe
C:\Users\Jessica\AppData\Local\Temp\EADE780.exe
C:\Users\Jessica\AppData\Local\Temp\EADE79F.exe
C:\Users\Jessica\AppData\Local\Temp\EADE7AF.exe
C:\Users\Jessica\AppData\Local\Temp\EADE7B0.exe
C:\Users\Jessica\AppData\Local\Temp\EADE7FD.exe
C:\Users\Jessica\AppData\Local\Temp\EADE81D.exe
C:\Users\Jessica\AppData\Local\Temp\EADE84B.exe
C:\Users\Jessica\AppData\Local\Temp\EADE84C.exe
C:\Users\Jessica\AppData\Local\Temp\EADE899.exe
C:\Users\Jessica\AppData\Local\Temp\EADE89A.exe
C:\Users\Jessica\AppData\Local\Temp\EADE8C8.exe
C:\Users\Jessica\AppData\Local\Temp\EADE8D7.exe
C:\Users\Jessica\AppData\Local\Temp\EADE916.exe
C:\Users\Jessica\AppData\Local\Temp\EADE925.exe
C:\Users\Jessica\AppData\Local\Temp\EADE926.exe
C:\Users\Jessica\AppData\Local\Temp\EADE927.exe
C:\Users\Jessica\AppData\Local\Temp\EADE993.exe
C:\Users\Jessica\AppData\Local\Temp\EADE9B2.exe
C:\Users\Jessica\AppData\Local\Temp\EADE9D1.exe
C:\Users\Jessica\AppData\Local\Temp\EADEA1F.exe
C:\Users\Jessica\AppData\Local\Temp\EADEA3E.exe
C:\Users\Jessica\AppData\Local\Temp\EADEA6D.exe
C:\Users\Jessica\AppData\Local\Temp\EADEA7D.exe
C:\Users\Jessica\AppData\Local\Temp\EADEACB.exe
C:\Users\Jessica\AppData\Local\Temp\EADEADA.exe
C:\Users\Jessica\AppData\Local\Temp\EADEAF.exe
C:\Users\Jessica\AppData\Local\Temp\EADEB76.exe
C:\Users\Jessica\AppData\Local\Temp\EADEBC4.exe
C:\Users\Jessica\AppData\Local\Temp\EADEC12.exe
C:\Users\Jessica\AppData\Local\Temp\EADEC22.exe
C:\Users\Jessica\AppData\Local\Temp\EADEC31.exe
C:\Users\Jessica\AppData\Local\Temp\EADEC8F.exe
C:\Users\Jessica\AppData\Local\Temp\EADECAE.exe
C:\Users\Jessica\AppData\Local\Temp\EADECAF.exe
C:\Users\Jessica\AppData\Local\Temp\EADECCE.exe
C:\Users\Jessica\AppData\Local\Temp\EADECE.exe
C:\Users\Jessica\AppData\Local\Temp\EADECED.exe
C:\Users\Jessica\AppData\Local\Temp\EADED1C.exe
C:\Users\Jessica\AppData\Local\Temp\EADED69.exe
C:\Users\Jessica\AppData\Local\Temp\EADED98.exe
C:\Users\Jessica\AppData\Local\Temp\EADEDD7.exe
C:\Users\Jessica\AppData\Local\Temp\EADEDF6.exe
C:\Users\Jessica\AppData\Local\Temp\EADEE25.exe
C:\Users\Jessica\AppData\Local\Temp\EADEE34.exe
C:\Users\Jessica\AppData\Local\Temp\EADEE44.exe
C:\Users\Jessica\AppData\Local\Temp\EADEEA1.exe
C:\Users\Jessica\AppData\Local\Temp\EADEEE.exe
C:\Users\Jessica\AppData\Local\Temp\EADEEEF.exe
C:\Users\Jessica\AppData\Local\Temp\EADEEFF.exe
C:\Users\Jessica\AppData\Local\Temp\EADEF3E.exe
C:\Users\Jessica\AppData\Local\Temp\EADF066.exe
C:\Users\Jessica\AppData\Local\Temp\EADF0A4.exe
C:\Users\Jessica\AppData\Local\Temp\EADF0A5.exe
C:\Users\Jessica\AppData\Local\Temp\EADF0D.exe
C:\Users\Jessica\AppData\Local\Temp\EADF111.exe
C:\Users\Jessica\AppData\Local\Temp\EADF112.exe
C:\Users\Jessica\AppData\Local\Temp\EADF17F.exe
C:\Users\Jessica\AppData\Local\Temp\EADF180.exe
C:\Users\Jessica\AppData\Local\Temp\EADF20B.exe
C:\Users\Jessica\AppData\Local\Temp\EADF269.exe
C:\Users\Jessica\AppData\Local\Temp\EADF2A7.exe
C:\Users\Jessica\AppData\Local\Temp\EADF314.exe
C:\Users\Jessica\AppData\Local\Temp\EADF362.exe
C:\Users\Jessica\AppData\Local\Temp\EADF366.exe
C:\Users\Jessica\AppData\Local\Temp\EADF3FF.exe
C:\Users\Jessica\AppData\Local\Temp\EADF42D.exe
C:\Users\Jessica\AppData\Local\Temp\EADF44C.exe
C:\Users\Jessica\AppData\Local\Temp\EADF4B.exe
C:\Users\Jessica\AppData\Local\Temp\EADF4BA.exe
C:\Users\Jessica\AppData\Local\Temp\EADF4E8.exe
C:\Users\Jessica\AppData\Local\Temp\EADF517.exe
C:\Users\Jessica\AppData\Local\Temp\EADF556.exe
C:\Users\Jessica\AppData\Local\Temp\EADF5C3.exe
C:\Users\Jessica\AppData\Local\Temp\EADF64F.exe
C:\Users\Jessica\AppData\Local\Temp\EADF739.exe
C:\Users\Jessica\AppData\Local\Temp\EADF758.exe
C:\Users\Jessica\AppData\Local\Temp\EADF778.exe
C:\Users\Jessica\AppData\Local\Temp\EADF7D5.exe
C:\Users\Jessica\AppData\Local\Temp\EADF7E5.exe
C:\Users\Jessica\AppData\Local\Temp\EADF804.exe
C:\Users\Jessica\AppData\Local\Temp\EADF805.exe
C:\Users\Jessica\AppData\Local\Temp\EADF814.exe
C:\Users\Jessica\AppData\Local\Temp\EADF833.exe
C:\Users\Jessica\AppData\Local\Temp\EADF862.exe
C:\Users\Jessica\AppData\Local\Temp\EADF871.exe
C:\Users\Jessica\AppData\Local\Temp\EADF881.exe
C:\Users\Jessica\AppData\Local\Temp\EADF8A0.exe
C:\Users\Jessica\AppData\Local\Temp\EADF8BF.exe
C:\Users\Jessica\AppData\Local\Temp\EADF8D.exe
C:\Users\Jessica\AppData\Local\Temp\EADFA26.exe
C:\Users\Jessica\AppData\Local\Temp\EADFA36.exe
C:\Users\Jessica\AppData\Local\Temp\EADFA9.exe
C:\Users\Jessica\AppData\Local\Temp\EADFAA4.exe
C:\Users\Jessica\AppData\Local\Temp\EADFAC2.exe
C:\Users\Jessica\AppData\Local\Temp\EADFAD2.exe
C:\Users\Jessica\AppData\Local\Temp\EADFAE1.exe
C:\Users\Jessica\AppData\Local\Temp\EADFB4E.exe
C:\Users\Jessica\AppData\Local\Temp\EADFB5E.exe
C:\Users\Jessica\AppData\Local\Temp\EADFB8.exe
C:\Users\Jessica\AppData\Local\Temp\EADFB8D.exe
C:\Users\Jessica\AppData\Local\Temp\EADFB9C.exe
C:\Users\Jessica\AppData\Local\Temp\EADFBBC.exe
C:\Users\Jessica\AppData\Local\Temp\EADFCA6.exe
C:\Users\Jessica\AppData\Local\Temp\EADFD03.exe
C:\Users\Jessica\AppData\Local\Temp\EADFD22.exe
C:\Users\Jessica\AppData\Local\Temp\EADFD32.exe
C:\Users\Jessica\AppData\Local\Temp\EADFD51.exe
C:\Users\Jessica\AppData\Local\Temp\EADFD70.exe
C:\Users\Jessica\AppData\Local\Temp\EADFD71.exe
C:\Users\Jessica\AppData\Local\Temp\EADFE7A.exe
C:\Users\Jessica\AppData\Local\Temp\EADFE7B.exe
C:\Users\Jessica\AppData\Local\Temp\EADFE89.exe
C:\Users\Jessica\AppData\Local\Temp\EADFE99.exe
C:\Users\Jessica\AppData\Local\Temp\EADFEC8.exe
C:\Users\Jessica\AppData\Local\Temp\EADFED9.exe
C:\Users\Jessica\AppData\Local\Temp\EADFF16.exe
C:\Users\Jessica\AppData\Local\Temp\EADFF35.exe
C:\Users\Jessica\AppData\Local\Temp\EADFF93.exe
C:\Users\Jessica\AppData\Local\Temp\EADFFA2.exe
C:\Users\Jessica\AppData\Local\Temp\EADFFC1.exe
C:\Users\Jessica\AppData\Local\Temp\EADFFE0.exe
C:\Users\Jessica\AppData\Local\Temp\EADFFF0.exe
C:\Users\Jessica\AppData\Local\Temp\IcqUpdater.exe
C:\Users\Jessica\AppData\Local\Temp\IminentSetup.exe
C:\Users\Jessica\AppData\Local\Temp\installerdll109403.dll
C:\Users\Jessica\AppData\Local\Temp\installerdll109965.dll
C:\Users\Jessica\AppData\Local\Temp\installerdll111213.dll
C:\Users\Jessica\AppData\Local\Temp\installerdll120073.dll
C:\Users\Jessica\AppData\Local\Temp\installerdll1229818.dll
C:\Users\Jessica\AppData\Local\Temp\installerdll125144.dll
C:\Users\Jessica\AppData\Local\Temp\installerdll125487.dll
C:\Users\Jessica\AppData\Local\Temp\installerdll126126.dll
C:\Users\Jessica\AppData\Local\Temp\installerdll126142.dll
C:\Users\Jessica\AppData\Local\Temp\installerdll126672.dll
C:\Users\Jessica\AppData\Local\Temp\installerdll127203.dll
C:\Users\Jessica\AppData\Local\Temp\installerdll127593.dll
C:\Users\Jessica\AppData\Local\Temp\installerdll128919.dll
C:\Users\Jessica\AppData\Local\Temp\installerdll131555.dll
C:\Users\Jessica\AppData\Local\Temp\installerdll132632.dll
C:\Users\Jessica\AppData\Local\Temp\installerdll133302.dll
C:\Users\Jessica\AppData\Local\Temp\installerdll138794.dll
C:\Users\Jessica\AppData\Local\Temp\installerdll138918.dll
C:\Users\Jessica\AppData\Local\Temp\installerdll143115.dll
C:\Users\Jessica\AppData\Local\Temp\installerdll144737.dll
C:\Users\Jessica\AppData\Local\Temp\installerdll146001.dll
C:\Users\Jessica\AppData\Local\Temp\installerdll155938.dll
C:\Users\Jessica\AppData\Local\Temp\installerdll161975.dll
C:\Users\Jessica\AppData\Local\Temp\installerdll163707.dll
C:\Users\Jessica\AppData\Local\Temp\installerdll167342.dll
C:\Users\Jessica\AppData\Local\Temp\installerdll176671.dll
C:\Users\Jessica\AppData\Local\Temp\installerdll176749.dll
C:\Users\Jessica\AppData\Local\Temp\installerdll200102.dll
C:\Users\Jessica\AppData\Local\Temp\installerdll200227.dll
C:\Users\Jessica\AppData\Local\Temp\installerdll254422.dll
C:\Users\Jessica\AppData\Local\Temp\installerdll275965.dll
C:\Users\Jessica\AppData\Local\Temp\installerdll292720.dll
C:\Users\Jessica\AppData\Local\Temp\installerdll306791.dll
C:\Users\Jessica\AppData\Local\Temp\installerdll343841.dll
C:\Users\Jessica\AppData\Local\Temp\installerdll345713.dll
C:\Users\Jessica\AppData\Local\Temp\installerdll369410.dll
C:\Users\Jessica\AppData\Local\Temp\installerdll491137.dll
C:\Users\Jessica\AppData\Local\Temp\installerdll5760274.dll
C:\Users\Jessica\AppData\Local\Temp\jre-7u45-windows-i586-iftw.exe
C:\Users\Jessica\AppData\Local\Temp\jre-8u31-windows-au.exe
C:\Users\Jessica\AppData\Local\Temp\SearchWithGoogleUpdate.exe
C:\Users\Jessica\AppData\Local\Temp\Setup.exe
C:\Users\Jessica\AppData\Local\Temp\SkypeSetup.exe
C:\Users\Jessica\AppData\Local\Temp\UninstallEADM.dll
C:\Users\Jessica\AppData\Local\Temp\ZDATAI50.DLL
C:\Users\Jessica\AppData\Local\Temp\_WUTL95.DLL


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\windows\explorer.exe => File is digitally signed
C:\windows\system32\winlogon.exe => File is digitally signed
C:\windows\system32\wininit.exe => File is digitally signed
C:\windows\system32\svchost.exe => File is digitally signed
C:\windows\system32\services.exe => File is digitally signed
C:\windows\system32\User32.dll => File is digitally signed
C:\windows\system32\userinit.exe => File is digitally signed
C:\windows\system32\rpcss.dll => File is digitally signed
C:\windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-10-23 17:07

==================== End Of Log ============================
--- --- ---

--- --- ---

Alt 22.02.2015, 14:11   #2
jesses
 
Windows 7: Webseiten werden auf Werbung umgeleitet (+Werbe-Tabs) - Standard

Windows 7: Webseiten werden auf Werbung umgeleitet (+Werbe-Tabs)


Code:
ATTFilter
Additional scan result of Farbar Recovery Scan Tool (x86) Version: 21-02-2015
Ran by Jessica at 2015-02-22 12:59:48
Running from C:\Users\Jessica\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: McAfee Anti-Virus und Anti-Spyware (Enabled - Up to date) {DA9F8ED0-D0DE-39CC-F55A-51AB4CC1B556}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: McAfee Anti-Virus und Anti-Spyware (Enabled - Up to date) {61FE6F34-F6E4-3642-CFEA-6AD93746FFEB}
FW: McAfee Firewall (Enabled) {E2A40FF5-9AB1-3894-DE05-F89EB212F22D}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Adobe AIR (HKLM\...\Adobe AIR) (Version: 2.7.0.19480 - Adobe Systems Incorporated)
Adobe Download Assistant (HKLM\...\com.adobe.downloadassistant.AdobeDownloadAssistant) (Version: 1.0.2 - Adobe Systems Incorporated)
Adobe Flash Player 16 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 16.0.0.305 - Adobe Systems Incorporated)
Adobe Flash Player 16 NPAPI (HKLM\...\Adobe Flash Player NPAPI) (Version: 16.0.0.305 - Adobe Systems Incorporated)
Adobe Reader XI - Deutsch (HKLM\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.00 - Adobe Systems Incorporated)
AnyPC Client (HKLM\...\{1AFA1FEF-8CF9-4A51-AC46-64FAA7F3D9E2}) (Version: 1.0.0.25 - Doctorsoft)
Atheros Client Installation Program (HKLM\...\{D1434266-0486-4469-B338-A60082CC04E1}) (Version: 1.0.2.1119 - Atheros)
BatteryLifeExtender (HKLM\...\{853F8A41-A3C9-43FA-87FA-1AE74FC6F3F7}) (Version: 1.0.1 - Samsung)
Canon MP Navigator EX 2.0 (HKLM\...\MP Navigator EX 2.0) (Version:  - )
Compatibility Pack für 2007 Office System (HKLM\...\{90120000-0020-0407-0000-0000000FF1CE}) (Version: 12.0.4518.1014 - Microsoft Corporation)
CyberLink DVD Suite (HKLM\...\InstallShield_{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}) (Version: 6.0.2806 - CyberLink Corp.)
CyberLink LabelPrint (HKLM\...\InstallShield_{C59C179C-668D-49A9-B6EA-0121CCFC1243}) (Version: 2.5.1916 - CyberLink Corp.)
CyberLink Power2Go (HKLM\...\InstallShield_{40BF1E83-20EB-11D8-97C5-0009C5020658}) (Version: 6.0.3108a - CyberLink Corp.)
CyberLink PowerDirector (HKLM\...\InstallShield_{CB099890-1D5F-11D5-9EA9-0050BAE317E1}) (Version: 7.0.3213 - CyberLink Corp.)
CyberLink PowerDVD 8 (HKLM\...\InstallShield_{2BF2E31F-B8BB-40A7-B650-98D28E0F7D47}) (Version: 8.0.2815b - CyberLink Corp.)
CyberLink PowerProducer (HKLM\...\InstallShield_{B7A0CE06-068E-11D6-97FD-0050BACBF861}) (Version: 5.0.1.1812 - CyberLink Corp.)
CyberLink YouCam (HKLM\...\InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}) (Version: 2.0.3625 - CyberLink Corp.)
Dairy Dash (HKLM\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-115053100}) (Version:  - Oberon Media)
Die Sims™ 3 (HKLM\...\{C05D8CDB-417D-4335-A38C-A0659EDFD6B8}) (Version: 1.50.56 - Electronic Arts)
DownloadnSave (HKLM\...\{A8B0DBDE-8119-48B0-8088-D12DA01C36BA}) (Version:  - DownloadnSave)
Dropbox (HKU\S-1-5-21-2339853823-2107313754-116825072-1001\...\Dropbox) (Version: 3.2.6 - Dropbox, Inc.)
Easy Display Manager (HKLM\...\{17283B95-21A8-4996-97DA-547A48DB266F}) (Version: 3.0 - Samsung Electronics Co., Ltd.)
Easy Network Manager (HKLM\...\{34B76DCB-BF7C-440F-B058-C84172C1E338}) (Version: 4.2.8 - Samsung)
Easy SpeedUp Manager (HKLM\...\{EF367AA4-070B-493C-9575-85BE59D789C9}) (Version: 3.0.0.5 - Samsung Electronics Co.,Ltd.)
EasyBatteryManager (HKLM\...\{178EE5F4-0F86-4BF0-A0D1-9790AFF409D1}) (Version: 4.0.0.3 - Samsung)
Farm Frenzy 2 (HKLM\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-11531173}) (Version:  - Oberon Media)
Farm Frenzy 2 (HKLM\...\Farm Frenzy 2) (Version:  - Alawar Entertainment Inc.)
Free YouTube to MP3 Converter version 3.12.0.128 (HKLM\...\Free YouTube to MP3 Converter_is1) (Version: 3.12.0.128 - DVDVideoSoft Ltd.)
Game Pack (HKLM\...\{63eafc52-b963-4297-a7eb-d412944e7065}_is1) (Version: 5.3.0.10 - Oberon Media, Inc.)
Go-Go Gourmet (HKLM\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-114072167}) (Version:  - Oberon Media)
Google Chrome (HKLM\...\Google Chrome) (Version: 40.0.2214.115 - Google Inc.)
Google Chrome Frame (HKLM\...\{CD4ABC29-0547-388C-B8BC-EF88333E5C2E}) (Version: 65.119.72 - Google, Inc.)
Google Earth (HKLM\...\{4D2A6330-2F8B-11E3-9C40-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)
Google Toolbar for Internet Explorer (HKLM\...\{2318C2B1-4965-11d4-9B18-009027A5CD4F}) (Version: 7.5.5111.1712 - Google Inc.)
Google Toolbar for Internet Explorer (Version: 1.0.0 - Google Inc.) Hidden
Google Update Helper (Version: 1.3.25.11 - Google Inc.) Hidden
Google Update Helper (Version: 1.3.26.9 - Google Inc.) Hidden
ICQ Toolbar (HKLM\...\ICQToolbar) (Version: 3.0.0 - ICQ)
ICQ7.5 (HKLM\...\{7578ADEA-D65F-4C89-A249-B1C88B6FFC20}) (Version: 7.5 - ICQ)
Iminent (HKLM\...\IMBoosterARP) (Version: 6.27.21.0 - Iminent) <==== ATTENTION
Iminent (Version: 6.27.21.0 - Iminent) Hidden <==== ATTENTION
Incredibar Toolbar  on IE (HKLM\...\incredibar) (Version:  - ) <==== ATTENTION
Intel(R) Rapid Storage Technology (HKLM\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 9.5.4.1001 - Intel Corporation)
Intel(R) Turbo Boost Technology Driver (HKLM\...\{D6C630BF-8DBB-4042-8562-DC9A52CB6E7E}) (Version: 01.00.01.1003 - Intel Corporation)
Java 7 Update 45 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83217025FF}) (Version: 7.0.450 - Oracle)
Junk Mail filter update (Version: 14.0.8089.726 - Microsoft Corporation) Hidden
Marvell Miniport Driver (HKLM\...\Marvell Miniport Driver) (Version: 11.22.3.3 - Marvell)
McAfee Internet Security (HKLM\...\MSC) (Version: 13.6.1492 - McAfee, Inc.)
McAfee Security Scan Plus (HKLM\...\McAfee Security Scan) (Version: 3.8.150.1 - McAfee, Inc.)
McAfee SiteAdvisor (HKLM\...\{35ED3F83-4BDC-4c44-8EC6-6A8301C7413A}) (Version: 3.7.191 - McAfee, Inc.)
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft Office 2007 Service Pack 2 (SP2) (HKLM\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}) (Version:  - Microsoft)
Microsoft Office Home and Student 2007 (HKLM\...\HOMESTUDENTR) (Version: 12.0.6425.1000 - Microsoft Corporation)
Microsoft Office Live Add-in 1.3 (HKLM\...\{57F0ED40-8F11-41AA-B926-4A66D0D1A9CC}) (Version: 2.0.2313.0 - Microsoft Corporation)
Microsoft Office PowerPoint Viewer 2007 (German) (HKLM\...\{95120000-00AF-0407-0000-0000000FF1CE}) (Version: 12.0.4518.1014 - Microsoft Corporation)
Microsoft Office Suite Activation Assistant (HKLM\...\{E50AE784-FABE-46DA-A1F8-7B6B56DCB22E}) (Version: 2.9 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 3.0.40624.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Works (HKLM\...\{39D0E034-1042-4905-BECB-5502909FCB7C}) (Version: 9.7.0621 - Microsoft Corporation)
Microsoft WSE 3.0 Runtime (HKLM\...\{E3E71D07-CD27-46CB-8448-16D4FB29AA13}) (Version: 3.0.5305.0 - Microsoft Corp.)
Mozilla Firefox 35.0.1 (x86 de) (HKLM\...\Mozilla Firefox 35.0.1 (x86 de)) (Version: 35.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 33.0.3 - Mozilla)
NVIDIA Drivers (HKLM\...\NVIDIA Drivers) (Version: 1.4 - NVIDIA Corporation)
Origin (HKLM\...\Origin) (Version: 8.4.1.210 - Electronic Arts, Inc.)
PhotoFiltre (HKU\S-1-5-21-2339853823-2107313754-116825072-1001\...\PhotoFiltre) (Version:  - )
PiccShare (HKU\S-1-5-21-2339853823-2107313754-116825072-1001\...\PiccShare) (Version: 2.0 - HTTO Group Ltd)
Realtek High Definition Audio Driver (HKLM\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6003 - Realtek Semiconductor Corp.)
REALTEK Wireless LAN Software (HKLM\...\{F2BC3383-F000-410C-A038-3846ADBE8D90}) (Version: 1.01.0088 - REALTEK Semiconductor Corp.)
Roll (HKLM\...\RollerCoaster Tycoon Setup) (Version:  - )
Samsung Recovery Solution 4 (HKLM\...\{145DE957-0679-4A2A-BB5C-1D3E9808FAB2}) (Version: 4.0.0.6 - Samsung)
Samsung R-Series (HKLM\...\{3EED7541-55F8-4DC6-B9CD-28762D71310E}) (Version: 1.0 - Samsung)
Samsung Support Center (HKLM\...\{0A353130-D22C-41DD-8C67-1B02A05F2CE0}) (Version: 1.1.0 - Samsung)
Samsung Update Plus (HKLM\...\{D3F2FAA5-FEC4-42AA-9ABA-1F763919A2B5}) (Version: 2.0 - Samsung Electronics Co., Ltd.)
Shared C Run-time for x86 (Version: 10.0.0 - McAfee) Hidden
Skype Toolbars (HKLM\...\{A29549FD-65F3-440C-A552-6B8114CF319D}) (Version: 5.2.4170 - Skype Technologies S.A.)
Skype™ 5.1 (HKLM\...\{E633D396-5188-4E9D-8F6B-BFB8BF3467E8}) (Version: 5.1.112 - Skype Technologies S.A.)
Spelling Dictionaries Support For Adobe Reader 9 (HKLM\...\{AC76BA86-7AD7-5464-3428-900000000004}) (Version: 9.0.0 - Adobe Systems Incorporated)
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 14.0.10.0 - Synaptics Incorporated)
Uninstall 1.0.0.1 (HKLM\...\Uninstall_is1) (Version:  - )
USA Raser (HKLM\...\{F92C4EE6-BEA9-11D7-9E00-0004769EEFEB}) (Version: 1.00.0000 - ComputerBild Spiele)
User Guide (HKLM\...\{BAE68339-B0F6-4D33-9554-5A3DB2DFF5DA}) (Version: 1.0 - )
Web Assistant 2.0.0.430 (HKLM\...\{336D0C35-8A85-403a-B9D2-65C292C39087}_is1) (Version:  - IB) <==== ATTENTION
Windows Live Anmelde-Assistent (HKLM\...\{52B97218-98CB-4B8B-9283-D213C85E1AA4}) (Version: 5.000.818.5 - Microsoft Corporation)
Windows Live Essentials (HKLM\...\WinLiveSuite_Wave3) (Version: 14.0.8089.0726 - Microsoft Corporation)
Windows Live Sync (HKLM\...\{76618402-179D-4699-A66B-D351C59436BC}) (Version: 14.0.8089.726 - Microsoft Corporation)
Windows Live-Uploadtool (HKLM\...\{205C6BDD-7B73-42DE-8505-9A093F35A238}) (Version: 14.0.8014.1029 - Microsoft Corporation)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-2339853823-2107313754-116825072-1001_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\Jessica\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2339853823-2107313754-116825072-1001_Classes\CLSID\{039B2CA5-3B41-4D93-AD77-47D3293FC5CB}\InprocServer32 -> C:\Program Files\Skype\Plugin Manager\ezPMUtils.dll (EasyBits Media AS)
CustomCLSID: HKU\S-1-5-21-2339853823-2107313754-116825072-1001_Classes\CLSID\{3bc93e76-92f8-5fda-b676-5afee3735bf1}\InprocServer32 -> C:\Users\Jessica\AppData\Local\ext_offermosquito\npOfferMosquitoIEHelper.dll (Bebo Media Ltd)
CustomCLSID: HKU\S-1-5-21-2339853823-2107313754-116825072-1001_Classes\CLSID\{42481700-CF3C-4D05-8EC6-F9A1C57E8DC0}\InprocServer32 -> C:\Program Files\Skype\Plugin Manager\ezPMUtils.dll (EasyBits Media AS)
CustomCLSID: HKU\S-1-5-21-2339853823-2107313754-116825072-1001_Classes\CLSID\{9000834c-c6c7-43ac-b8ee-dc9668f39a81}\localserver32 -> C:\Users\Jessica\AppData\Local\Temp\{91814ec0-b5f0-11d2-80b9-00104b1f6cea}\IDriver.NonElevated.exe (InstallShield Software Corporation)
CustomCLSID: HKU\S-1-5-21-2339853823-2107313754-116825072-1001_Classes\CLSID\{BB6410D8-F879-4184-9C5C-6A02D16AE0B3}\InprocServer32 -> C:\Program Files\Skype\Plugin Manager\ezPMUtils.dll (EasyBits Media AS)
CustomCLSID: HKU\S-1-5-21-2339853823-2107313754-116825072-1001_Classes\CLSID\{CA1073A2-5F3F-4445-8E5E-7109BDCEDDBE}\InprocServer32 -> C:\Program Files\Skype\Plugin Manager\ezPMUtils.dll (EasyBits Media AS)
CustomCLSID: HKU\S-1-5-21-2339853823-2107313754-116825072-1001_Classes\CLSID\{D0D38C6E-BF64-4C42-840D-3E0019D9F7A6}\InprocServer32 -> C:\Program Files\Skype\Plugin Manager\ezPMUtils.dll (EasyBits Media AS)
CustomCLSID: HKU\S-1-5-21-2339853823-2107313754-116825072-1001_Classes\CLSID\{D5A55D2D-C59D-42C3-A5BF-4C08EEE74339}\InprocServer32 -> C:\Program Files\Skype\Plugin Manager\ezPMUtils.dll (EasyBits Media AS)
CustomCLSID: HKU\S-1-5-21-2339853823-2107313754-116825072-1001_Classes\CLSID\{ECD97DE5-3C8F-4ACB-AEEE-CCAB78F7711C}\InprocServer32 -> C:\Users\Jessica\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2339853823-2107313754-116825072-1001_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Jessica\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2339853823-2107313754-116825072-1001_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Jessica\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2339853823-2107313754-116825072-1001_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Jessica\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2339853823-2107313754-116825072-1001_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Jessica\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2339853823-2107313754-116825072-1001_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Jessica\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2339853823-2107313754-116825072-1001_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Jessica\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2339853823-2107313754-116825072-1001_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Jessica\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2339853823-2107313754-116825072-1001_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Jessica\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)

==================== Restore Points  =========================

13-11-2014 18:15:54 Windows Update
14-11-2014 17:26:30 Windows Update
14-11-2014 18:14:37 Windows Update
19-11-2014 14:43:35 Windows Update
11-12-2014 19:13:47 Windows Update
20-12-2014 13:43:10 Windows Update
14-01-2015 16:38:30 Windows Update
25-01-2015 19:09:44 Windows Update
15-02-2015 17:25:03 Windows Update
18-02-2015 13:02:30 Windows Update

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 03:04 - 2009-06-10 22:39 - 00000824 ____A C:\windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {1B86C506-262B-429B-8D50-80E18E2532FA} - System32\Tasks\APSchedulerC => C:\Program Files\AnyPC Client\APLanMgrC.exe [2009-11-20] (DoctorSoft)
Task: {25B852AF-0F08-417D-A112-DD474B4238F8} - System32\Tasks\EasyBatteryManager => C:\Program Files\Samsung\EasyBatteryManager\EasyBatteryMgr4.exe [2009-10-16] (SAMSUNG Electronics co., LTD.)
Task: {4E14B5BF-F42C-4018-96CF-AA157825AB21} - System32\Tasks\Adobe Flash Player Updater => C:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2015-02-07] (Adobe Systems Incorporated)
Task: {54F6AC96-D31C-4C31-B246-7154DCE95320} - System32\Tasks\GoogleUpdateTaskMachineUA1cf6ec357c82803 => C:\Program Files\Google\Update\GoogleUpdate.exe [2014-10-23] (Google Inc.)
Task: {5E0C9381-BE2E-4129-A068-3FAA4BA194BA} - System32\Tasks\{A18BF3C6-420B-4554-B06C-5A644B21F51D} => pcalua.exe -a E:\SETUP.EXE -d E:\
Task: {6378EDF5-B3D1-4A49-A0C8-B161AED57A67} - System32\Tasks\SUPBackground => C:\Program Files\Samsung\Samsung Update Plus\SUPBackground.exe [2010-04-20] ()
Task: {7D7A6B61-5176-4311-A896-70F9A63A916A} - System32\Tasks\{CF6B4929-8E58-4AB7-9B72-DC44FD1BC523} => pcalua.exe -a "C:\Users\Jessica\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WEOL8OP7\Chicken_Invaders3_regular-setup[1].exe" -d C:\Users\Jessica\Desktop
Task: {85432527-CE8D-4EEF-A10F-D3CFF47DF566} - System32\Tasks\EasySpeedUpManager => C:\Program Files\SAMSUNG\EasySpeedUpManager\EasySpeedUpManager.exe [2009-10-13] (Samsung Electronics Co., Ltd.)
Task: {A1A0D5E6-3009-4926-B46E-75870411DCA1} - System32\Tasks\{2F0F3373-B524-487F-94BA-07960FD35FB6} => pcalua.exe -a "C:\Program Files\Fox\Croc\Crocrun.exe" -d "C:\Program Files\Fox\Croc"
Task: {A262B463-C260-4781-909F-C756859A9E66} - System32\Tasks\BatteryLifeExtender => C:\Program Files\Samsung\BatteryLifeExtender\BatteryLifeExtender.exe [2009-11-19] (Samsung Electronics. Co. Ltd.)
Task: {ABEB90BB-C5E2-43F6-AF6D-E0A25D7840D7} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2014-10-23] (Google Inc.)
Task: {C653CBBB-78D5-46AA-B7BA-99E64B7FF124} - System32\Tasks\EasyDisplayMgr => C:\Program Files\Samsung\Easy Display Manager\dmhkcore.exe [2009-11-04] (Samsung Electronics Co., Ltd.)
Task: {CC9DF44D-CBB5-4AE5-8A89-DEDA5CF44EF5} - System32\Tasks\SamsungSupportCenter => C:\Program Files\Samsung\Samsung Support Center\SSCKbdHk.exe [2009-12-14] (SAMSUNG Electronics)
Task: {CEEA1937-5644-4F73-ACCF-F96476C92D0D} - System32\Tasks\{3CECFE6E-F5D3-4756-BB85-59ABE1046913} => pcalua.exe -a E:\Patch_Game\Install2.exe -d E:\Patch_Game
Task: {D907D439-A03E-4D08-B861-C10484AFFAE1} - System32\Tasks\advSRS4 => C:\Program Files\Samsung\Samsung Recovery Solution 4\WCScheduler.exe [2010-01-19] (SEC)
Task: {F521FC92-68D8-41D9-B014-B28EDA259DBB} - System32\Tasks\{81DEA884-3630-4003-B2DB-DCFD4358B7B9} => C:\Program Files\Skype\\Phone\Skype.exe [2011-01-26] (Skype Technologies S.A.)

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\windows\Tasks\Adobe Flash Player Updater.job => C:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\windows\Tasks\GoogleUpdateTaskMachineUA1cf6ec357c82803.job => C:\Program Files\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) ==============

2011-04-24 23:03 - 2010-11-21 11:49 - 00247608 _____ () C:\Program Files\ICQ6Toolbar\ICQ Service.exe
2010-03-05 05:51 - 2009-01-29 04:26 - 00117264 _____ () c:\Program Files\McAfee\SiteAdvisor\apengine.dll
2010-03-05 05:51 - 2009-01-29 04:27 - 00071696 _____ () c:\Program Files\McAfee\SiteAdvisor\mcfrmwk.dll
2010-03-05 05:51 - 2009-01-29 04:27 - 00207376 _____ () c:\Program Files\McAfee\SiteAdvisor\cntscan.dll
2010-09-25 18:27 - 2009-08-13 20:58 - 00044312 _____ () C:\Program Files\Samsung Casual Games\GameConsole\OberonGameConsoleService.exe
2010-03-05 05:29 - 2009-03-05 10:54 - 00311296 _____ () C:\windows\SYSTEM32\Rezip.exe
2010-03-05 05:34 - 2009-07-07 19:23 - 00247152 ____N () C:\Program Files\CyberLink\Shared files\RichVideo.exe
2012-05-15 12:38 - 2012-05-01 13:31 - 00185856 _____ () C:\Program Files\Web Assistant\ExtensionUpdaterService.exe
2010-03-05 05:38 - 2006-08-12 04:48 - 00049152 _____ () C:\Program Files\Samsung\Easy Display Manager\HookDllPS2.dll
2009-06-03 12:59 - 2009-06-03 12:59 - 00619816 ____N () C:\Program Files\CyberLink\Power2Go\CLMediaLibrary.dll
2009-06-03 12:59 - 2009-06-03 12:59 - 00013096 ____N () C:\Program Files\CyberLink\Power2Go\CLMLSvcPS.dll
2015-02-10 22:00 - 2015-02-10 22:00 - 00750080 _____ () C:\Users\Jessica\AppData\Roaming\Dropbox\bin\libGLESv2.dll
2015-02-21 21:08 - 2015-02-21 21:08 - 00043008 _____ () c:\users\jessica\appdata\local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpbu8a3e.dll
2015-02-10 22:00 - 2015-02-10 22:00 - 00047616 _____ () C:\Users\Jessica\AppData\Roaming\Dropbox\bin\libEGL.dll
2015-02-10 22:00 - 2015-02-10 22:00 - 00865280 _____ () C:\Users\Jessica\AppData\Roaming\Dropbox\bin\plugins\platforms\qwindows.dll
2015-02-10 22:00 - 2015-02-10 22:00 - 00200704 _____ () C:\Users\Jessica\AppData\Roaming\Dropbox\bin\plugins\imageformats\qjpeg.dll
2015-01-27 18:18 - 2015-01-27 18:18 - 03925104 _____ () C:\Program Files\Mozilla Firefox\mozjs.dll
2015-02-22 12:48 - 2015-02-22 12:48 - 00050477 _____ () C:\Users\Jessica\Downloads\Defogger.exe

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

AlternateDataStreams: C:\ProgramData\Temp:4CF61E54
AlternateDataStreams: C:\ProgramData\Temp:8173A019
AlternateDataStreams: C:\ProgramData\Temp:A42A9F39
AlternateDataStreams: C:\ProgramData\Temp:ABE89FFE
AlternateDataStreams: C:\ProgramData\Temp:E1F04E8D

==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcpltsvc => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\McMPFSvc => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MCODS => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcpltsvc => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfefire => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfefirek => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfefirek.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfehidk => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfehidk.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfevtp => ""="Driver"

==================== EXE Association (whitelisted) ===============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-2339853823-2107313754-116825072-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\Jessica\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 192.168.178.1

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)


==================== Accounts: =============================

Administrator (S-1-5-21-2339853823-2107313754-116825072-500 - Administrator - Disabled)
Gast (S-1-5-21-2339853823-2107313754-116825072-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-2339853823-2107313754-116825072-1002 - Limited - Enabled)
Jessica (S-1-5-21-2339853823-2107313754-116825072-1001 - Administrator - Enabled) => C:\Users\Jessica

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (02/22/2015 01:01:40 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.Windows.Common-Controls,language="&#x2a;",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"1".
Die abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="&#x2a;",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".

Error: (02/22/2015 01:00:51 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.Windows.Common-Controls,language="&#x2a;",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"1".
Die abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="&#x2a;",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".

Error: (02/22/2015 00:49:50 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: rundll32.exe_aepdu.dll, Version: 6.1.7600.16385, Zeitstempel: 0x4a5bc637
Name des fehlerhaften Moduls: ole32.dll, Version: 6.1.7601.17514, Zeitstempel: 0x4ce7b96f
Ausnahmecode: 0xc0000095
Fehleroffset: 0x000485aa
ID des fehlerhaften Prozesses: 0x1568
Startzeit der fehlerhaften Anwendung: 0xrundll32.exe_aepdu.dll0
Pfad der fehlerhaften Anwendung: rundll32.exe_aepdu.dll1
Pfad des fehlerhaften Moduls: rundll32.exe_aepdu.dll2
Berichtskennung: rundll32.exe_aepdu.dll3

Error: (02/18/2015 07:03:19 PM) (Source: MsiInstaller) (EventID: 11925) (User: Jessica-PC)
Description: Produkt: Microsoft Visual C++ 2005 Redistributable -- Error 1925.Sie besitzen keine ausreichenden Berechtigungen, um diese Installation für alle Benutzer dieses Computers auszuführen. Melden Sie sich als Administrator an, und wiederholen Sie diese Installation.

Error: (02/18/2015 07:01:57 PM) (Source: MsiInstaller) (EventID: 11925) (User: Jessica-PC)
Description: Produkt: Microsoft Visual C++ 2005 Redistributable -- Error 1925.Sie besitzen keine ausreichenden Berechtigungen, um diese Installation für alle Benutzer dieses Computers auszuführen. Melden Sie sich als Administrator an, und wiederholen Sie diese Installation.

Error: (01/23/2015 02:47:38 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm EXCEL.EXE, Version 12.0.6425.1000 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 14d0

Startzeit: 01d03712b93e649d

Endzeit: 0

Anwendungspfad: C:\Program Files\Microsoft Office\Office12\EXCEL.EXE

Berichts-ID: 47aef398-a306-11e4-95a6-00245487e561

Error: (01/14/2015 03:55:33 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: iexplore.exe, Version: 11.0.9600.17496, Zeitstempel: 0x546fddcc
Name des fehlerhaften Moduls: bhoclass.dll, Version: 1.0.0.1, Zeitstempel: 0x4f79fd40
Ausnahmecode: 0xc0000005
Fehleroffset: 0x000055e6
ID des fehlerhaften Prozesses: 0x10b0
Startzeit der fehlerhaften Anwendung: 0xiexplore.exe0
Pfad der fehlerhaften Anwendung: iexplore.exe1
Pfad des fehlerhaften Moduls: iexplore.exe2
Berichtskennung: iexplore.exe3

Error: (01/14/2015 03:55:24 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: iexplore.exe, Version: 11.0.9600.17496, Zeitstempel: 0x546fddcc
Name des fehlerhaften Moduls: bhoclass.dll, Version: 1.0.0.1, Zeitstempel: 0x4f79fd40
Ausnahmecode: 0xc0000005
Fehleroffset: 0x000055e6
ID des fehlerhaften Prozesses: 0x14fc
Startzeit der fehlerhaften Anwendung: 0xiexplore.exe0
Pfad der fehlerhaften Anwendung: iexplore.exe1
Pfad des fehlerhaften Moduls: iexplore.exe2
Berichtskennung: iexplore.exe3

Error: (01/14/2015 03:33:12 PM) (Source: AVLogEvent) (EventID: 5004) (User: NT-AUTORITÄT)
Description: McShield crashed.
Error Code:c0000005

Error: (01/14/2015 03:33:11 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: mcshield.exe, Version: 1.1.3.178, Zeitstempel: 0x53d17f0e
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.18247, Zeitstempel: 0x521ea91c
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0003224d
ID des fehlerhaften Prozesses: 0x8c8
Startzeit der fehlerhaften Anwendung: 0xmcshield.exe0
Pfad der fehlerhaften Anwendung: mcshield.exe1
Pfad des fehlerhaften Moduls: mcshield.exe2
Berichtskennung: mcshield.exe3


System errors:
=============
Error: (02/18/2015 01:35:52 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "Server" wurde mit folgendem Fehler beendet: 
%%1062

Error: (02/18/2015 01:02:37 PM) (Source: DCOM) (EventID: 10010) (User: )
Description: {ADA518B9-B7A3-4C36-B4ED-49EB3FA189FC}

Error: (02/18/2015 00:39:02 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "McAfee Platform Services" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1053

Error: (02/18/2015 00:39:02 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst McAfee Platform Services erreicht.

Error: (02/18/2015 00:39:01 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "McAfee Platform Services" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1053

Error: (02/18/2015 00:39:01 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst McAfee Platform Services erreicht.

Error: (02/18/2015 00:37:32 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "McAfee Proxy Service" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1053

Error: (02/18/2015 00:37:32 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst McAfee Proxy Service erreicht.

Error: (02/18/2015 00:37:32 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "McAfee Personal Firewall Service" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1053

Error: (02/18/2015 00:37:32 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst McAfee Personal Firewall Service erreicht.


Microsoft Office Sessions:
=========================

==================== Memory info =========================== 

Processor: Intel(R) Core(TM) i3 CPU M 330 @ 2.13GHz
Percentage of memory in use: 54%
Total physical RAM: 3060.55 MB
Available physical RAM: 1388.52 MB
Total Pagefile: 6119.39 MB
Available Pagefile: 4243.91 MB
Total Virtual: 2047.88 MB
Available Virtual: 1880.79 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:141.49 GB) (Free:67.43 GB) NTFS
Drive d: () (Fixed) (Total:141.5 GB) (Free:122.67 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 298.1 GB) (Disk ID: B0FD1CB0)
Partition 1: (Not Active) - (Size=15 GB) - (Type=27)
Partition 2: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=141.5 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=141.5 GB) - (Type=07 NTFS)

==================== End Of Log ============================
Code:
ATTFilter
GMER Logfile:


	
Code: 

 
ATTFilter


  

	
GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2015-02-22 13:44:50
Windows 6.1.7601 Service Pack 1 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 WDC_WD32 rev.11.0 298,09GB
Running: vnrfyu79.exe; Driver: C:\Users\Jessica\AppData\Local\Temp\pwlirfoc.sys


---- Kernel code sections - GMER 2.1 ----

.text           ntkrnlpa.exe!ZwRequestWaitReplyPort + 1495                                                            83E4E9E5 1 Byte  [06]
.text           ntkrnlpa.exe!KiDispatchInterrupt + 5A2                                                                83E88312 19 Bytes  [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3}

---- User code sections - GMER 2.1 ----

.text           C:\Program Files\Common Files\Mcafee\Platform\McSvcHost\McSvHost.exe[2056] kernel32.dll!LoadLibraryA  760EDD15 5 Bytes  JMP 6DBEAF70 C:\Program Files\Common Files\McAfee\McProxy\mcproxy.dll
.text           C:\Program Files\Common Files\Mcafee\Platform\McSvcHost\McSvHost.exe[2056] kernel32.dll!LoadLibraryW  760EEFF2 5 Bytes  JMP 6DBEB070 C:\Program Files\Common Files\McAfee\McProxy\mcproxy.dll

---- Devices - GMER 2.1 ----

AttachedDevice  \Driver\kbdclass \Device\KeyboardClass0                                                               Wdf01000.sys
AttachedDevice  \Driver\kbdclass \Device\KeyboardClass1                                                               Wdf01000.sys

---- Registry - GMER 2.1 ----

Reg             HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\0026b654edff                           
Reg             HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\0026b654f652                           
Reg             HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\0026b66b6864                           
Reg             HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\0026b654edff (not active ControlSet)       
Reg             HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\0026b654f652 (not active ControlSet)       
Reg             HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\0026b66b6864 (not active ControlSet)       
Reg             HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\CIT\System\Active                    
Reg             HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\CIT\System\Active@8F16C038           2415

---- Disk sectors - GMER 2.1 ----

Disk            \Device\Harddisk0\DR0                                                                                 unknown MBR code

---- EOF - GMER 2.1 ----
         
 
--- --- ---
__________________
Alt 22.02.2015, 16:32   #3
deeprybka
/// TB-Ausbilder
/// Anleitungs-Guru
 
Windows 7: Webseiten werden auf Werbung umgeleitet (+Werbe-Tabs) - Standard

Windows 7: Webseiten werden auf Werbung umgeleitet (+Werbe-Tabs)




Mein Name ist Jürgen und ich werde Dir bei Deinem Problem behilflich sein. Zusammen schaffen wir das...
  • Bitte arbeite alle Schritte der Reihe nach ab.
  • Lese die Anleitungen sorgfältig durch bevor Du beginnst. Wenn es Probleme gibt oder Du etwas nicht verstehst, dann stoppe mit Deiner Ausführung und beschreibe mir das Problem.
  • Führe bitte nur Scans durch, zu denen Du von mir aufgefordert wurdest.
  • Bitte kein Crossposting (posten in mehreren Foren).
  • Installiere oder deinstalliere während der Bereinigung keine Software, außer Du wurdest dazu aufgefordert.
  • Speichere alle unsere Tools auf dem Desktop ab. Link: So ladet Ihr unsere Tools richtig
  • Poste die Logfiles direkt in Deinen Thread in Code-Tags.
  • Bedenke, dass wir hier alle während unserer Freizeit tätig sind, wenn du innerhalb von 24 Stunden nichts von mir liest, dann schreibe mir bitte eine PM.

Hinweis:
Ich kann Dir niemals eine Garantie geben, dass wir alle schädlichen Dateien finden werden.
Eine Formatierung ist meist der schnellere und immer der sicherste Weg, aber auch nur bei wirklicher Malware empfehlenswert.
Adware & Co. können wir sehr gut entfernen.
Solltest Du Dich für eine Bereinigung entscheiden, arbeite solange mit, bis Du mein clean bekommst.



Los geht's:

Schritt 1



Drücke bitte die + R Taste und schreibe notepad in das Ausführen Fenster.
Klicke auf OK und kopiere nun den Text aus der Codebox in das leere Textdokument:
Code:
ATTFilter
Iminent (Version: 6.27.21.0 - Iminent) Hidden
Speichere dieses bitte als Fixlist.txt in das Verzeichnis ab, in dem sich auch die FRST-Anwendung befindet.
  • Starte FRST und drücke auf den Fix-Button.
  • Navigiere anschließend über
    zu und drücke den "Aktualisieren" Button.


Schritt 2

Bitte deinstalliere folgende Programme:

Iminent
Iminent
Incredibar Toolbar on IE
Web Assistant 2.0.0.430


Versuche es bei Windows 7 zunächst über Systemsteuerung/Programme deinstallieren.

Sollte das nicht gehen, lade Dir bitte Revo Uninstallerhier herunter. Entpacke die zip-Datei auf den Desktop. Anleitung
  • Starte die Revouninstaller.exe
  • Klicke auf Optionen und wähle als Sprache Deutsch.
  • Suche im Uninstallerfeld nach den oben angegebenen Programmen und wähle sie einzeln aus.
    Klicke jedes Mal auf Uninstall.
  • Wähle anschließend den Modus "Moderat" aus.
  • Reste löschen:
    Klicke auf dann auf und dann auf .

Wenn Du ein Programm nicht deinstallieren kannst, mach mit dem nächsten weiter.
Auch wenn am Ende noch Programme übrig geblieben sind, führe den nächsten Schritt aus:

Schritt 3

Downloade Dir bitte AdwCleaner Logo Icon AdwCleaner auf deinen Desktop.
  • Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
  • Starte die AdwCleaner.exe mit einem Doppelklick.
  • Stimme den Nutzungsbedingungen zu.
  • Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
    • "Tracing" Schlüssel löschen
    • Winsock Einstellungen zurücksetzen
    • Proxy Einstellungen zurücksetzen
    • Internet Explorer Richtlinien zurücksetzen
    • Chrome Richtlinien zurücksetzen
    • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
  • Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
  • Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
  • Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).


Schritt 4

  • Download
  • Installiere das Programm in den vorgegebenen Pfad.
  • Starte Malwarebytes' Anti-Malware (MBAM).
  • Sollte die Benutzeroberfläche noch in Englisch sein, klicke auf Settings und wähle bei Language Deutsch aus.
  • Unter Erkennung und Schutz setze bitte einen Haken bei "Suche nach Rootkits".
  • Klicke im Anschluss auf "Suchlauf", wähle den Bedrohungssuchlauf aus, aktualisiere die Datenbanken und klicke auf "Suchlauf jetzt starten".
  • Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. (geht so...)
  • Poste mir den Inhalt der Logdatei (geht so...). Klicke dazu auf Verlauf und dann auf Anwendungsprotokolle.
  • Wähle das neueste Suchlauf-Protokoll aus und klicke auf Ansicht. Klicke auf "In Zwischenablage kopieren" poste mir den Inhalt in Code-Tags als Antwort in den Thread.

Schritt 5



Bitte starte FRST erneut, markiere auch die checkbox und drücke auf Scan.
Bitte poste mir den Inhalt der beiden Logs die erstellt werden.
__________________
__________________
Antwort

Themen zu Windows 7: Webseiten werden auf Werbung umgeleitet (+Werbe-Tabs)
anleitung, code, dvdvideosoft ltd., eingeschränkt, firefox, internetverbindung, klicke, laptop, links, mcafee, neue, neuen, nicht mehr, problem, seite, startseite, suche, trojaner, umgeleitet, verbindung, webseiten, werbung, wichtig, windows, windows 7, wlan


« Windows 8: Ad- und Malwarebefall nach Neuistallation | Werbefenster öffnen sich alle 5 Min in Explorer und in Chrome - Kaspersky findet keine Malware »


Ähnliche Themen: Windows 7: Webseiten werden auf Werbung umgeleitet (+Werbe-Tabs)


  1. Windows 7 Webseiten werden auf Werbung umgeleitet
    Log-Analyse und Auswertung - 07.09.2015 (10)
  2. Windows 7: Webseiten werden auf Werbung umgeleitet
    Log-Analyse und Auswertung - 19.08.2015 (11)
  3. Windows 7: Webseiten werden auf Werbung umgeleitet
    Log-Analyse und Auswertung - 15.07.2015 (19)
  4. Windows 7: Webseiten werden auf Werbung umgeleitet
    Log-Analyse und Auswertung - 24.04.2015 (31)
  5. Windows 7 : Webseiten sind von werbe adds besetzt und werden ständig zu pop ups umgeleitet
    Log-Analyse und Auswertung - 31.03.2015 (17)
  6. Windows 8.1: Webseiten werden auf Werbung umgeleitet
    Log-Analyse und Auswertung - 13.01.2015 (8)
  7. Windows 7: Webseiten werden auf Werbung umgeleitet.
    Plagegeister aller Art und deren Bekämpfung - 25.11.2014 (9)
  8. Windows 7: Webseiten werden auf Werbung umgeleitet.
    Log-Analyse und Auswertung - 12.11.2014 (8)
  9. Windows 7: Webseiten werden auf Werbung umgeleitet
    Log-Analyse und Auswertung - 11.09.2014 (13)
  10. Windows 7: Internet Explorer startet automatisch Werbung/ Webseiten werden auf Werbung umgeleitet
    Log-Analyse und Auswertung - 27.07.2014 (7)
  11. Windows 7: Webseiten werden auf Werbung umgeleitet; ständig erscheinende Werbe-Pop-Ups und blau markierte Wörter
    Log-Analyse und Auswertung - 03.07.2014 (18)
  12. Windows 7: Webseiten werden auf Werbung umgeleitet, dauernd neue Tabs und Seiten ohne das ich was mache
    Log-Analyse und Auswertung - 24.06.2014 (35)
  13. Windows 7: Webseiten werden auf Werbung umgeleitet
    Log-Analyse und Auswertung - 19.05.2014 (15)
  14. Windows 7: Webseiten werden auf Werbung umgeleitet
    Log-Analyse und Auswertung - 17.05.2014 (7)
  15. Windows 7: Webseiten werden auf werbung umgeleitet
    Log-Analyse und Auswertung - 27.10.2013 (9)
  16. Windows 7: Webseiten werden auf Werbung umgeleitet.
    Plagegeister aller Art und deren Bekämpfung - 12.09.2013 (3)
  17. Windows 8: Webseiten werden auf Werbung umgeleitet
    Log-Analyse und Auswertung - 24.08.2013 (5)
Anleitungen und Tipps

- Für alle Hilfesuchenden! Was beachten?

- Anleitung: MyStartSearch.com entfernen

- Anleitung: WebSearches löschen

- Hilfe: iStartSurf entfernen – so gehts!

- Anleitung: Omiga Plus richtig entfernen

- Browser Viren entfernen


Zum Thema Windows 7: Webseiten werden auf Werbung umgeleitet (+Werbe-Tabs) - Hallo, ich suche Hilfe bei meinem Problem mit dem Browser. Ich habe einen Firefox (v35.0.1). Die Startseite lässt sich nicht mehr umstellen, sie springt immer auf Code: Alles auswählen Aufklappen - Windows 7: Webseiten werden auf Werbung umgeleitet (+Werbe-Tabs)...
Archiv
Du betrachtest: Windows 7: Webseiten werden auf Werbung umgeleitet (+Werbe-Tabs) auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19