Virus - Kein zugriff mehr auf meine Daten
Hallo,
wer kann mir helfen. Ich kann nicht mehr auf meine Fotos zugreifen.
hier meine logs. Code:
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 11-03-2015
Ran by jimbo at 2015-03-20 08:59:23
Running from E:\11111111111111111111
Boot Mode: Normal
==========================================================
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AS: Windows Defender (Enabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
Adobe Flash Player 11 ActiveX (HKLM-x32\...\{41042E28-CCA1-4147-869F-9E928B38F04C}) (Version: 11.9.900.170 - Adobe Systems Incorporated)
Adobe Reader X (10.1.3) MUI (HKLM-x32\...\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}) (Version: 10.1.3 - Adobe Systems Incorporated)
Advanced System Protector (HKLM-x32\...\00212D92-C5D8-4ff4-AE50-B20F0F85C40A_Systweak_Ad~B9F029BF_is1) (Version: 2.1.1000.13491 - Systweak Software) <==== ATTENTION
Apple Application Support (HKLM-x32\...\{A83279FD-CA4B-4206-9535-90974DE76654}) (Version: 2.1.5 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{75104836-CAC7-444E-A39E-3F54151942F5}) (Version: 4.0.0.97 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Backup Manager V3 (x32 Version: 3.0.0.90 - NTI Corporation) Hidden
Beginning Operations Interactive Activities (HKLM-x32\...\Beginning Operations Interactive Activities) (Version: 1.5.0.0 - Lakeshore Learning Materials)
Best Buy pc app (Version: 3.2.2.0 - Best Buy) Hidden
Best Buy pc app (x32 Version: 3.2.2.0 - Best Buy) Hidden
Bing Bar (HKLM-x32\...\{C28D96C0-6A90-459E-A077-A6706F4EC0FC}) (Version: 7.0.765.0 - Microsoft Corporation)
BlockAndSurf (HKLM-x32\...\9CD2DB2C-08CA-CA59-B9D1-742EDBC99710) (Version: - BlockAndSurf-software) <==== ATTENTION
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
Broadcom Card Reader Driver Installer (HKLM\...\{4710662C-8204-4334-A977-B1AC9E547819}) (Version: 14.8.2.2 - Broadcom Corporation)
Broadcom NetLink Controller (HKLM\...\{C91DCB72-F5BB-410D-A91A-314F5D1B4284}) (Version: 14.8.4.1 - Broadcom Corporation)
BrowserSafeguard with RocketTab (HKLM-x32\...\BrowserSafeguard) (Version: - BrowserSafeguard with RocketTab) <==== ATTENTION
Convert Files for Free (HKLM-x32\...\Convert Files for Free) (Version: 7.12 - Convert Files for Free)
CyberLink PowerDVD 10 (HKLM-x32\...\InstallShield_{DEC235ED-58A4-4517-A278-C41E8DAEAB3B}) (Version: 10.0.2912.52 - CyberLink Corp.)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Epson Connect (HKLM-x32\...\{64BA551C-9AF6-495C-93F3-D1270E0045FC}) (Version: - )
Epson Customer Participation (HKLM\...\{814FA673-A085-403C-9545-747FC1495069}) (Version: 1.0.0.0 - SEIKO EPSON CORPORATION)
Epson Download Navigator (HKLM-x32\...\{10F63395-157F-4B93-AB4D-702A2FF11942}) (Version: 1.0.1 - SEIKO EPSON CORPORATION)
Epson Event Manager (HKLM-x32\...\{FA9D303D-0FB2-49C7-9397-8E6B11EA892D}) (Version: 2.50.0001 - SEIKO EPSON CORPORATION)
Epson FAX Utility (HKLM-x32\...\{0CBE6C93-CB2E-4378-91EE-12BE6D4E2E4A}) (Version: 1.20.00 - SEIKO EPSON CORPORATION)
Epson PC-FAX Driver (HKLM-x32\...\EPSON PC-FAX Driver 2) (Version: - )
EPSON Scan (HKLM-x32\...\EPSON Scanner) (Version: - Seiko Epson Corporation)
EPSON WorkForce 545 Series Printer Uninstall (HKLM\...\EPSON WorkForce 545 Series) (Version: - SEIKO EPSON Corporation)
EpsonNet Print (HKLM-x32\...\{3E31400D-274E-4647-916C-2CACC3741799}) (Version: 2.4j - SEIKO EPSON CORPORATION)
ETDWare PS/2-X64 8.0.6.3_WHQL (HKLM\...\Elantech) (Version: 8.0.6.3 - ELAN Microelectronic Corp.)
fst_us_53 (HKLM-x32\...\fst_us_53_is1) (Version: - free_soft_today) <==== ATTENTION
Galerie de photos Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Gateway MyBackup (HKLM-x32\...\InstallShield_{0B61BBD5-DA3C-409A-8730-0C3DC3B0F270}) (Version: 3.0.0.90 - NTI Corporation)
Gateway Power Management (HKLM-x32\...\{3DB0448D-AD82-4923-B305-D001E521A964}) (Version: 6.00.3008 - Gateway Incorporated)
Gateway Recovery Management (HKLM-x32\...\{7F811A54-5A09-4579-90E1-C93498E230D9}) (Version: 5.00.3504 - Gateway Incorporated)
Gateway Registration (HKLM-x32\...\Gateway Registration) (Version: 1.04.3503 - Gateway Incorporated)
Gateway ScreenSaver (HKLM-x32\...\Gateway Screensaver) (Version: 1.1.1022.2010 - Gateway Incorporated)
Gateway Social Networks (HKLM-x32\...\InstallShield_{64EF903E-D00A-414C-94A4-FBA368FFCDC9}) (Version: 3.0.3106 - CyberLink Corp.)
Gateway Social Networks (x32 Version: 3.0.3106 - CyberLink Corp.) Hidden
Gateway Updater (HKLM-x32\...\{EE171732-BEB4-4576-887D-CB62727F01CA}) (Version: 1.02.3500 - Gateway Incorporated)
Identity Card (HKLM-x32\...\Identity Card) (Version: 1.00.3501 - Gateway Incorporated)
Intel(R) Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1007 - Intel Corporation)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 7.0.0.1144 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 8.15.10.2418 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 10.5.0.1026 - Intel Corporation)
iTunes (HKLM\...\{6CFB1B20-ECAE-488F-9FFB-6AD420882E71}) (Version: 10.5.1.42 - Apple Inc.)
Java(TM) 6 Update 7 (HKLM-x32\...\{3248F0A8-6813-11D6-A77B-00B0D0160070}) (Version: 1.6.0.70 - Sun Microsystems, Inc.)
Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Launch Manager (HKLM-x32\...\LManager) (Version: 5.1.7 - Gateway)
Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4 Client Profile (HKLM\...\Microsoft .NET Framework 4 Client Profile) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft Flight Simulator X (HKLM-x32\...\InstallShield_{9527A496-5DF9-412A-ADC7-168BA5379CA6}) (Version: 10.0.60905 - Microsoft Game Studios)
Microsoft Office 2010 (HKLM-x32\...\{95140000-0070-0000-0000-0000000FF1CE}) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Office Click-to-Run 2010 (HKLM-x32\...\Office14.Click2Run) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Office Starter 2010 - English (HKLM-x32\...\{90140011-0066-0409-0000-0000000FF1CE}) (Version: 14.0.5131.5000 - Microsoft Corporation)
Microsoft Silverlight (HKLM-x32\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 4.0.60831.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{A49F249F-0C91-497F-86DF-B2585E8E76B7}) (Version: 8.0.50727.42 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.40820 - Microsoft Corporation)
Mobogenie (HKLM-x32\...\Mobogenie) (Version: - Mobogenie.com) <==== ATTENTION
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
MSXML 4.0 SP2 Parser and SDK (HKLM-x32\...\{716E0306-8318-4364-8B8F-0CC4E9376BAC}) (Version: 4.20.9818.0 - Microsoft Corporation)
Mysearchdial (HKLM-x32\...\mysearchdial) (Version: - Mysearchdial) <==== ATTENTION
Nero DiscSpeed 10 (HKLM-x32\...\{34490F4E-48D0-492E-8249-B48BECF0537C}) (Version: 6.2.10500.2.100 - Nero AG)
Nero Express 10 (HKLM-x32\...\{70550193-1C22-445C-8FA4-564E155DB1A7}) (Version: 10.2.12000.21.100 - Nero AG)
Nero Multimedia Suite 10 Essentials (HKLM-x32\...\{62BF4BD3-B1F6-4FA2-8388-CC0647ACBF86}) (Version: 10.5.10300 - Nero AG)
Nero StartSmart 10 (HKLM-x32\...\{F61D489E-6C44-49AC-AD02-7DA8ACA73A65}) (Version: 10.2.11600.14.100 - Nero AG)
Nero Update (HKLM-x32\...\{65BB0407-4CC8-4DC7-952E-3EEFDF05602A}) (Version: 1.0.0018 - Nero AG)
PC Speed Maximizer v3.2 (HKLM-x32\...\PC Speed Maximizer_is1) (Version: 3.2 - SoftCity)
Perk Prize Panel (HKU\S-1-5-21-3300329991-2820599393-3356462390-1000\...\pp@perk.com) (Version: - )
Plus-HD-9.3 (HKLM-x32\...\Plus-HD-9.3) (Version: 1.34.5.4 - Plus HD) <==== ATTENTION
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6329 - Realtek Semiconductor Corp.)
RegClean-Pro (HKLM-x32\...\RegClean-Pro_is1) (Version: 6.21 - Systweak Inc) <==== ATTENTION
Search Protect (HKLM-x32\...\SearchProtect) (Version: 2.13.0.274 - Client Connect LTD) <==== ATTENTION
Social Privacy DNS (HKLM-x32\...\dnsshield) (Version: - ) <==== ATTENTION
suprasavings (HKLM\...\suprasavings) (Version: 2.0.1 - suprasavings)
SupraSavings (x32 Version: 1.0.0.0 - SupraSavings) Hidden
Video Web Camera (HKLM-x32\...\InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}) (Version: 1.0.1904 - CyberLink Corp.)
Video Web Camera (x32 Version: 1.0.1904 - CyberLink Corp.) Hidden
VisualBee for Microsoft PowerPoint (HKU\S-1-5-21-3300329991-2820599393-3356462390-1000\...\VisualBee for Microsoft PowerPoint) (Version: V4.1 - VisualBee.com)
VO Package (HKLM-x32\...\VOPackage) (Version: 1.0.0.0 - ) <==== ATTENTION
WeatherBug (HKLM-x32\...\{297DCADA-86A1-4A42-8A13-66B7D7A09FD2}) (Version: 7.0.0.11 - Earth Networks, Inc.)
webget (HKLM\...\webget) (Version: 2014.05.07.004105 - webget) <==== ATTENTION
Welcome Center (HKLM-x32\...\Gateway Welcome Center) (Version: 1.02.3503 - Gateway Incorporated)
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3538.0513 - Microsoft Corporation)
Yahoo! SiteBuilder (HKLM-x32\...\Yahoo! SiteBuilder) (Version: 2.4.0 - )
==================== Custom CLSID (selected items): ==========================
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
==================== Restore Points =========================
02-03-2014 15:55:38 Scheduled Checkpoint
06-05-2014 19:45:01 Installed WeatherBug
06-05-2014 19:59:06 Removed WeatherBug
18-05-2014 19:14:24 Windows Update
01-07-2014 18:57:13 Scheduled Checkpoint
03-08-2014 17:55:50 Scheduled Checkpoint
01-09-2014 17:59:35 Removed Microsoft Silverlight
04-10-2014 17:49:55 Scheduled Checkpoint
22-01-2015 19:03:32 Windows Modules Installer
22-02-2015 10:22:27 Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005
17-03-2015 18:59:29 Restore Operation
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2009-07-13 19:34 - 2009-06-10 14:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
Task: {11C88312-6794-4A97-8EEF-232D14FCBD0A} - System32\Tasks\BrowserSafeguard Update Task => C:\Program Files (x86)\Browsersafeguard\uninstall.BrowserSafeguard.exe [2014-05-06] () <==== ATTENTION
Task: {189D522F-C971-405F-914C-4B739CEAA785} - System32\Tasks\BlockAndSurf Update => C:\Program Files (x86)\BlockAndSurf-soft\BlockAndSurfp72.exe [2014-05-06] () <==== ATTENTION
Task: {28F9C5C2-23AC-45D8-B52C-CFA2CAC19EDC} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-05-06] (Adobe Systems Incorporated)
Task: {293EECA6-9605-4C6E-8BAF-F86327A116EA} - System32\Tasks\a5484598-527e-4337-aed0-ae0a1d60296a-2 => C:\Program Files (x86)\Plus-HD-9.3\a5484598-527e-4337-aed0-ae0a1d60296a-2.exe [2014-05-06] (Plus HD) <==== ATTENTION
Task: {32B90593-33AA-4D2E-8EFD-1252C107AB37} - System32\Tasks\a5484598-527e-4337-aed0-ae0a1d60296a-1 => C:\Program Files (x86)\Plus-HD-9.3\Plus-HD-9.3-codedownloader.exe [2014-05-06] (Plus HD) <==== ATTENTION
Task: {3708EC8A-8D0B-470E-B591-7A1066EA155D} - System32\Tasks\a5484598-527e-4337-aed0-ae0a1d60296a-5 => C:\Program Files (x86)\Plus-HD-9.3\a5484598-527e-4337-aed0-ae0a1d60296a-5.exe [2014-05-06] (Plus HD) <==== ATTENTION
Task: {4F6CE0C1-96AB-42A7-B815-100E63F6D9E5} - System32\Tasks\BlockAndSurf_wd => C:\Program Files (x86)\BlockAndSurf-soft\BlockAndSurfC.exe [2014-05-06] () <==== ATTENTION
Task: {5EC5EC46-24D9-4F6A-BAAC-E9BD9296FE29} - System32\Tasks\RegClean Pro_DEFAULT => C:\Program Files (x86)\RegClean Pro\RegCleanPro.exe [2014-04-25] (Systweak Inc) <==== ATTENTION
Task: {67914104-9C51-4FD8-9A8F-0D91B0302092} - System32\Tasks\Advanced System Protector_startup => C:\Program Files (x86)\Advanced System Protector\AdvancedSystemProtector.exe [2014-04-08] (Systweak) <==== ATTENTION
Task: {7584F69C-3D5F-4CA7-897B-D3D5031FFFCC} - System32\Tasks\RegClean Pro_UPDATES => C:\Program Files (x86)\RegClean Pro\RegCleanPro.exe [2014-04-25] (Systweak Inc) <==== ATTENTION
Task: {78A7C370-3E23-4B3F-9FEC-A580BF98172C} - System32\Tasks\RegClean Pro => C:\Program Files (x86)\RegClean Pro\RegCleanPro.exe [2014-04-25] (Systweak Inc) <==== ATTENTION
Task: {7965E8F1-288A-45B4-B9C1-9EE8789D6B3B} - System32\Tasks\a5484598-527e-4337-aed0-ae0a1d60296a-3 => C:\Program Files (x86)\Plus-HD-9.3\a5484598-527e-4337-aed0-ae0a1d60296a-3.exe [2014-05-06] (Plus HD) <==== ATTENTION
Task: {8114CC0B-53C5-4EB2-B32E-F782F34D4D10} - System32\Tasks\Adobe Reader Speed Launcher => C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe [2012-04-03] (Adobe Systems Incorporated)
Task: {A232B761-9D2D-4D6A-B753-835CDDDE7D82} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc
Task: {B03751BA-6E7B-48AE-BA19-2503D9F99377} - System32\Tasks\MySearchDial => C:\Users\jimbo\AppData\Roaming\mysearchdial\UpdateProc\UpdateTask.exe [2013-04-12] () <==== ATTENTION
Task: {B15F10B0-9C82-4D18-B788-7B462FD1408D} - System32\Tasks\{70B42AA9-E1C7-452C-A1A5-C7B4BE0B82D2} => Iexplore.exe hxxp://www.skype.com/go/downloading?source=lightinstaller&ver=5.10.0.115.260&LastError=12002
Task: {BCF02AD8-084B-412D-A143-61ED88BD5AFF} - System32\Tasks\PC Speed Maximizer Schedule => C:\Program Files (x86)\PC Speed Maximizer\SPMLauncher.exe [2014-04-28] (Smart PC Solutions)
Task: {D2093508-F738-4875-99F2-C78530A7D74B} - System32\Tasks\a5484598-527e-4337-aed0-ae0a1d60296a-4 => C:\Program Files (x86)\Plus-HD-9.3\a5484598-527e-4337-aed0-ae0a1d60296a-4.exe [2014-05-06] (Plus HD) <==== ATTENTION
Task: {EE2C2FC5-3B1A-4380-965D-E476688FBEFC} - System32\Tasks\Adobe ARM => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2013-11-21] (Adobe Systems Incorporated)
Task: C:\Windows\Tasks\a5484598-527e-4337-aed0-ae0a1d60296a-1.job => C:\Program Files (x86)\Plus-HD-9.3\Plus-HD-9.3-codedownloader.exe/scDuyT /JPMfn=task /aDyzL='Plus-HD-9.3' /XKMBz=53098 /EemsZ='001263' /pnWgC='0' /ncKMMrqN='0' /cEqLz=3C907EC56064401D8FEFD84E7362D4A8IE /jeiLtEMzq=ab6ec8aed2eed3984b1bd0155884e741 /tWJGcc=1_34_05_04 /FIgQJNnGY=1.34.5.4 /gOTqai=1399430210 /tfIBZGczd=http:/stats.clientstaticserv.com /uBJgkTGz=http:/errors.clientstaticserv.com /mdohORTKD=http:/js.clientstaticserv.com /vSumDlQdJ=ie /EbEoIJRSt /cremMoj='http:/update.clientstaticserv.com/ie_code_agent_updates/{CAMP_ID}/update.jso <==== ATTENTION
Task: C:\Windows\Tasks\a5484598-527e-4337-aed0-ae0a1d60296a-2.job => C:\Program Files (x86)\Plus-HD-9.3\a5484598-527e-4337-aed0-ae0a1d60296a-2.exeö/QjPPEqMPP /aDyzL='Plus-HD-9.3' /XKMBz=53098 /EemsZ='001263' /pnWgC='0' /ncKMMrqN='0' /cEqLz=3C907EC56064401D8FEFD84E7362D4A8IE /jeiLtEMzq=ab6ec8aed2eed3984b1bd0155884e741 /tWJGcc=1_34_05_04 /gOTqai=1399430210 /tfIBZGczd=http:/stats.clientstaticserv.com /uBJgkTGz=http:/errors.clientstaticserv.com /xbmUubXP=11111111-1111-1111-1111-110511301198 /vSumDlQdJ=ie /zUshhLsu /EbEoIJRSt /cremMoj='http:/update.clientstaticserv.com/ie_enable_agent_updates/{CAMP_ID}/update.jso <==== ATTENTION
Task: C:\Windows\Tasks\a5484598-527e-4337-aed0-ae0a1d60296a-3.job => C:\Program Files (x86)\Plus-HD-9.3\a5484598-527e-4337-aed0-ae0a1d60296a-3.exe <==== ATTENTION
Task: C:\Windows\Tasks\a5484598-527e-4337-aed0-ae0a1d60296a-4.job => C:\Program Files (x86)\Plus-HD-9.3\a5484598-527e-4337-aed0-ae0a1d60296a-4.exe„/KejrFqk /aDyzL='Plus-HD-9.3' /xgahhVuZ C:\Program Files (x86)\Plus-HD-9.3\53098.xpi' /XKMBz=53098 /EemsZ='001263' /pnWgC='0' /ncKMMrqN='0' /cEqLz=3C907EC56064401D8FEFD84E7362D4A8IE /jeiLtEMzq=ab6ec8aed2eed3984b1bd0155884e741 /tWJGcc=1_34_05_04 /FIgQJNnGY=1.34.5.4 /gOTqai=1399430210 /tfIBZGczd=http:/stats.clientstaticserv.com /uBJgkTGz=http:/errors.clientstaticserv.com /AhDsCpXBw=300 /oOGqSk=120b8567-cef7-4a3f-bc74-951746209d5b@e3f0d12e-110a-4dac-a277-22ad73cee452.com /rOjxnS=0.94 /EidnQWlGX=a120b8567cef74a3fbc74951746209d5be3f0d12e110a4daca27722ad73cee452com53098 /nAraTm=https:/w9u6a2p6.ssl.hwcdn.net/plugin/ff/update/53098.rdf /oxDUqaI='Plus-HD-9.3' /KuXXzULrX='Turn YouTube videos to High Definition by default' /CleTGR='Plus HD' /vSumDlQdJ=ie /EbEoIJRSt /XcXBJjd /udhTCRz /cremMoj='http:/update.clientstaticserv.com/ff_agent_updates/{CAMP_ID}/update.jso <==== ATTENTION
Task: C:\Windows\Tasks\a5484598-527e-4337-aed0-ae0a1d60296a-5.job => C:\Program Files (x86)\Plus-HD-9.3\a5484598-527e-4337-aed0-ae0a1d60296a-5.exe/iIDDKg /aDyzL='Plus-HD-9.3' /XKMBz=53098 /EemsZ='001263' /pnWgC='0' /ncKMMrqN='0' /cEqLz=3C907EC56064401D8FEFD84E7362D4A8IE /jeiLtEMzq=ab6ec8aed2eed3984b1bd0155884e741 /tWJGcc=1_34_05_04 /gOTqai=1399430210 /tfIBZGczd=http:/stats.clientstaticserv.com /uBJgkTGz=http:/errors.clientstaticserv.com /XzMwXdlKp=http:/ipgeoapi.com/ /xtXrsplq=http:/update.clientstaticserv.com /hyACaARKA=2 /TMxlCx=http:/logs.clientstaticserv.com /cremMoj='http:/update.clientstaticserv.com/updater_agent_updates/{CAMP_ID}/update.jso <==== ATTENTION
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\BlockAndSurf Update.job => C:\Program Files (x86)\BlockAndSurf-soft\BlockAndSurfp72.exe <==== ATTENTION
Task: C:\Windows\Tasks\BlockAndSurf_wd.job => C:\Program Files (x86)\BlockAndSurf-soft\BlockAndSurfC.exe <==== ATTENTION
Task: C:\Windows\Tasks\MySearchDial.job => C:\Users\jimbo\AppData\Roaming\MYSEAR~1\UPDATE~1\UPDATE~1.EXE <==== ATTENTION
Task: C:\Windows\Tasks\RegClean Pro_DEFAULT.job => C:\Program Files (x86)\RegClean Pro\RegCleanPro.exe <==== ATTENTION
Task: C:\Windows\Tasks\RegClean Pro_UPDATES.job => C:\Program Files (x86)\RegClean Pro\RegCleanPro.exe <==== ATTENTION
==================== Loaded Modules (whitelisted) ==============
2014-01-28 03:27 - 2014-01-28 03:27 - 00252928 _____ () C:\Program Files (x86)\Convert Files for Free\ConvertFilesforFreeUpdt.exe
2014-05-06 19:56 - 2014-05-06 19:58 - 00070848 _____ () C:\Program Files (x86)\Mobogenie\MgAssist.exe
2014-05-06 17:41 - 2014-05-06 17:41 - 00316696 _____ () C:\Program Files (x86)\webget\updatewebget.exe
2014-05-06 19:57 - 2014-05-06 19:57 - 00071680 _____ () C:\Program Files (x86)\BlockAndSurf-soft\BlockAndSurfC.exe
2014-05-06 19:57 - 2014-04-29 08:47 - 03265024 _____ () C:\Users\jimbo\AppData\Local\fst_us_53\upfst_us_53.exe
2011-08-18 08:57 - 2011-06-10 10:36 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2014-04-14 21:40 - 2014-04-14 21:40 - 00221184 _____ () C:\Program Files (x86)\Perk Prize Panel\pdr.exe
2014-05-01 14:32 - 2014-05-06 07:16 - 00522752 _____ () C:\Program Files (x86)\Browsersafeguard\BrowserSafeguard.exe
2014-05-06 19:56 - 2014-05-06 19:58 - 00748736 _____ () C:\Program Files (x86)\Mobogenie\DaemonProcess.exe
2014-05-06 00:00 - 2014-05-06 00:00 - 00052736 _____ () C:\Users\jimbo\AppData\Roaming\VOPackage\VOsrv.exe
2014-05-06 19:35 - 2014-05-06 19:35 - 00706560 _____ () C:\Program Files\003\vxlsnyaiet64.exe
2014-05-06 19:57 - 2014-05-06 19:57 - 00144896 _____ () C:\Program Files (x86)\BlockAndSurf-soft\BlockAndSurfKF161.exe
2015-03-20 06:45 - 2015-03-20 06:45 - 00050477 _____ () E:\11111111111111111111\Defogger.exe
2011-09-27 08:23 - 2011-09-27 08:23 - 00087912 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2011-09-27 08:22 - 2011-09-27 08:22 - 01242472 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2011-03-09 10:13 - 2011-03-09 10:13 - 00465640 _____ () C:\Program Files (x86)\NTI\Gateway MyBackup\sqlite3.dll
2011-03-09 10:12 - 2011-03-09 10:12 - 01081664 _____ () C:\Program Files (x86)\NTI\Gateway MyBackup\ACE.dll
2011-03-09 10:12 - 2011-03-09 10:12 - 00125760 _____ () C:\Program Files (x86)\NTI\Gateway MyBackup\MailConverter32.dll
2014-05-06 19:57 - 2012-07-25 12:03 - 00886272 _____ () C:\Program Files (x86)\Advanced System Protector\System.Data.SQLite.dll
2014-05-06 19:57 - 2014-04-08 12:04 - 01730928 _____ () C:\Program Files (x86)\Advanced System Protector\aspsys.dll
2014-05-06 19:56 - 2014-05-06 19:58 - 00065728 _____ () C:\Program Files (x86)\Mobogenie\Device.dll
2014-05-06 19:56 - 2014-05-06 19:58 - 00474816 _____ () C:\Program Files (x86)\Mobogenie\DCR.dll
2014-05-06 19:57 - 2014-05-06 19:57 - 00133120 _____ () C:\Program Files (x86)\BlockAndSurf-soft\BlockAndSurfKF161.dll
2011-10-21 10:53 - 2011-10-21 10:53 - 00172544 _____ () C:\Windows\assembly\NativeImages_v2.0.50727_32\IsdiInterop\39fd377a71bb615895084d5861d5adf6\IsdiInterop.ni.dll
2011-08-18 08:13 - 2011-04-30 00:28 - 00059904 _____ () C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IsdiInterop.dll
==================== Alternate Data Streams (whitelisted) =========
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
==================== Safe Mode (whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== EXE Association (whitelisted) ===============
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
==================== Other Areas ============================
(Currently there is no automatic fix for this section.)
HKU\S-1-5-21-3300329991-2820599393-3356462390-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\jimbo\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: Media is not connected to internet.
==================== MSCONFIG/TASK MANAGER disabled items ==
(Currently there is no automatic fix for this section.)
==================== Accounts: =============================
Administrator (S-1-5-21-3300329991-2820599393-3356462390-500 - Administrator - Disabled)
Guest (S-1-5-21-3300329991-2820599393-3356462390-501 - Limited - Enabled)
jimbo (S-1-5-21-3300329991-2820599393-3356462390-1000 - Administrator - Enabled) => C:\Users\jimbo
scanuser (S-1-5-21-3300329991-2820599393-3356462390-1002 - Limited - Enabled) => C:\Users\scanuser.jimbo-PC
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (03/20/2015 08:54:59 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (03/20/2015 08:54:45 AM) (Source: ConvertFilesforFree) (EventID: 2) (User: )
Description: Can't query a value of the remote_log registry value, code: 2
Error: (03/20/2015 08:54:45 AM) (Source: ConvertFilesforFree) (EventID: 2) (User: )
Description: Can't query a buffer size for the remote_log registry value, code: 2
Error: (03/20/2015 08:54:45 AM) (Source: ConvertFilesforFree) (EventID: 2) (User: )
Description: Can't query a value of the remote_log registry value, code: 2
Error: (03/20/2015 08:54:45 AM) (Source: ConvertFilesforFree) (EventID: 2) (User: )
Description: Can't query a buffer size for the remote_log registry value, code: 2
Error: (03/20/2015 08:33:15 AM) (Source: ConvertFilesforFree) (EventID: 2) (User: )
Description: Can't download info about new versions from: hxxp://www.convertfilesforfree.com/w/updater/u.php?timestamp=1426865595&app_id=B96B8A80B995469784901EB49BB9BB8E&version=7.12&updaterVersion=1.0.4&channel=installmonetize3, to local path: C:\Windows\TEMP\ConvertFilesforFreeUpdt_update.txt
Error: (03/20/2015 08:33:15 AM) (Source: ConvertFilesforFree) (EventID: 2) (User: )
Description: Receive failed, code: 12152
Error: (03/20/2015 08:33:15 AM) (Source: ConvertFilesforFree) (EventID: 2) (User: )
Description: Send failed, code: 12007
Error: (03/20/2015 08:28:24 AM) (Source: CVHSVC) (EventID: 100) (User: )
Description: Information only.
(Patch task for {90140011-0066-0409-0000-0000000FF1CE}): DownloadLatest Failed: There are currently no active network connections. Background Intelligent Transfer Service (BITS) will try again when an adapter is connected.
Error: (03/20/2015 08:18:21 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
System errors:
=============
Error: (03/20/2015 08:17:30 AM) (Source: Ntfs) (EventID: 55) (User: )
Description: The file system structure on the disk is corrupt and unusable.
Please run the chkdsk utility on the volume C:.
Error: (03/20/2015 08:17:30 AM) (Source: Ntfs) (EventID: 55) (User: )
Description: The file system structure on the disk is corrupt and unusable.
Please run the chkdsk utility on the volume C:.
Error: (03/17/2015 08:09:00 PM) (Source: Service Control Manager) (EventID: 7030) (User: )
Description: The MgAssist Service service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.
Error: (03/17/2015 06:55:14 PM) (Source: DCOM) (EventID: 10010) (User: )
Description: {AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
Error: (02/25/2015 07:47:05 PM) (Source: DCOM) (EventID: 10010) (User: )
Description: {AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
Error: (02/25/2015 05:15:24 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: The Computer Browser service depends on the Server service which failed to start because of the following error:
%%1068
Error: (02/25/2015 05:15:24 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: The Computer Browser service depends on the Server service which failed to start because of the following error:
%%1068
Error: (02/25/2015 05:15:24 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: The Computer Browser service depends on the Server service which failed to start because of the following error:
%%1068
Error: (02/25/2015 05:15:20 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: The Computer Browser service depends on the Server service which failed to start because of the following error:
%%1068
Error: (02/25/2015 05:15:20 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: The Computer Browser service depends on the Server service which failed to start because of the following error:
%%1068
Microsoft Office Sessions:
=========================
Error: (03/20/2015 08:54:59 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (03/20/2015 08:54:45 AM) (Source: ConvertFilesforFree) (EventID: 2) (User: )
Description: Can't query a value of the remote_log registry value, code: 2
Error: (03/20/2015 08:54:45 AM) (Source: ConvertFilesforFree) (EventID: 2) (User: )
Description: Can't query a buffer size for the remote_log registry value, code: 2
Error: (03/20/2015 08:54:45 AM) (Source: ConvertFilesforFree) (EventID: 2) (User: )
Description: Can't query a value of the remote_log registry value, code: 2
Error: (03/20/2015 08:54:45 AM) (Source: ConvertFilesforFree) (EventID: 2) (User: )
Description: Can't query a buffer size for the remote_log registry value, code: 2
Error: (03/20/2015 08:33:15 AM) (Source: ConvertFilesforFree) (EventID: 2) (User: )
Description: Can't download info about new versions from: hxxp://www.convertfilesforfree.com/w/updater/u.php?timestamp=1426865595&app_id=B96B8A80B995469784901EB49BB9BB8E&version=7.12&updaterVersion=1.0.4&channel=installmonetize3, to local path: C:\Windows\TEMP\ConvertFilesforFreeUpdt_update.txt
Error: (03/20/2015 08:33:15 AM) (Source: ConvertFilesforFree) (EventID: 2) (User: )
Description: Receive failed, code: 12152
Error: (03/20/2015 08:33:15 AM) (Source: ConvertFilesforFree) (EventID: 2) (User: )
Description: Send failed, code: 12007
Error: (03/20/2015 08:28:24 AM) (Source: CVHSVC) (EventID: 100) (User: )
Description: (Patch task for {90140011-0066-0409-0000-0000000FF1CE}): DownloadLatest Failed: There are currently no active network connections. Background Intelligent Transfer Service (BITS) will try again when an adapter is connected.
Error: (03/20/2015 08:18:21 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
==================== Memory info ===========================
Processor: Intel(R) Celeron(R) CPU B800 @ 1.50GHz
Percentage of memory in use: 65%
Total physical RAM: 1899.86 MB
Available physical RAM: 649.9 MB
Total Pagefile: 3799.72 MB
Available Pagefile: 2330.73 MB
Total Virtual: 8192 MB
Available Virtual: 8191.81 MB
==================== Drives ================================
Drive c: (Gateway) (Fixed) (Total:284.99 GB) (Free:209.15 GB) NTFS
Drive d: (Office Depot) (CDROM) (Total:0.47 GB) (Free:0 GB) CDFS
Drive e: (OS) (Fixed) (Total:99.23 GB) (Free:30.12 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive f: (RECOVERY) (Fixed) (Total:10 GB) (Free:5.72 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 298.1 GB) (Disk ID: A8AEAE60)
Partition 1: (Not Active) - (Size=13 GB) - (Type=27)
Partition 2: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=285 GB) - (Type=07 NTFS)
========================================================
Disk: 1 (MBR Code: Windows 7 or Vista) (Size: 111.8 GB) (Disk ID: 80000000)
Partition 1: (Not Active) - (Size=63 MB) - (Type=DE)
Partition 2: (Not Active) - (Size=10 GB) - (Type=07 NTFS)
Partition 3: (Active) - (Size=99.2 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=2.5 GB) - (Type=OF Extended)
==================== End Of Log ============================
Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 11-03-2015
Ran by jimbo (administrator) on JIMBO-PC on 20-03-2015 08:58:05
Running from E:\11111111111111111111
Loaded Profiles: jimbo (Available profiles: jimbo & scanuser)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: English (United States)
Internet Explorer Version 9 (Default browser: IE)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
() C:\Program Files (x86)\Convert Files for Free\ConvertFilesforFreeUpdt.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\dsiwmis.exe
(Acer Incorporated) C:\Program Files\Gateway\Gateway Power Management\ePowerSvc.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMutilps32.exe
(SEIKO EPSON CORPORATION) C:\Program Files\EPSON\EpsonCustomerParticipation\EPCP.exe
(Acer Incorporated) C:\Program Files (x86)\Gateway\Registration\GREGsvc.exe
(Acer Incorporated) C:\Program Files\Gateway\Gateway Updater\UpdaterService.exe
() C:\Program Files (x86)\Mobogenie\MgAssist.exe
(NTI Corporation) C:\Program Files (x86)\NTI\Gateway MyBackup\IScheduleSvc.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
() C:\Program Files (x86)\webget\updatewebget.exe
(Systweak) C:\Program Files (x86)\Advanced System Protector\AdvancedSystemProtector.exe
() C:\Program Files (x86)\BlockAndSurf-soft\BlockAndSurfC.exe
() C:\Users\jimbo\AppData\Local\fst_us_53\upfst_us_53.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrl.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Acer Incorporated) C:\Program Files\Gateway\Gateway Power Management\ePowerTray.exe
(SEIKO EPSON CORPORATION) C:\Windows\System32\spool\drivers\x64\3\E_YATIHWA.EXE
(SEIKO EPSON CORPORATION) C:\Windows\System32\spool\drivers\x64\3\E_YATIHWA.EXE
() C:\Program Files (x86)\Perk Prize Panel\pdr.exe
(AWS Convergence Technologies, Inc.) C:\Program Files (x86)\AWS\WeatherBug\Weather.exe
(Revizer) C:\Program Files (x86)\BlockAndSurf-soft\BlockNSurf.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
() C:\Program Files (x86)\Browsersafeguard\BrowserSafeguard.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrlHelper.exe
() C:\Program Files (x86)\Mobogenie\DaemonProcess.exe
() C:\Users\jimbo\AppData\Roaming\VOPackage\VOsrv.exe
() C:\Program Files\003\vxlsnyaiet64.exe
(Smart PC Solutions) C:\Program Files (x86)\PC Speed Maximizer\PCSpeedMaximizer.exe
(Systweak Inc) C:\Program Files (x86)\RegClean Pro\RegCleanPro.exe
(Intel Corporation) C:\Windows\System32\igfxext.exe
(Smart PC Solutions) C:\Program Files (x86)\PC Speed Maximizer\SPMSmartScan.exe
(Microsoft Corporation) C:\Program Files (x86)\Windows Live\Photo Gallery\WLXPhotoGallery.exe
(Acer Incorporated) C:\Program Files\Gateway\Gateway Power Management\ePowerEvent.exe
(Client Connect LTD) C:\Program Files (x86)\SearchProtect\Main\bin\CltMngSvc.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE
() C:\Program Files (x86)\BlockAndSurf-soft\BlockAndSurfKF161.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
() E:\11111111111111111111\Defogger.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Nero AG) C:\Program Files (x86)\Nero\Update\NASvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Microsoft Corporation) C:\Windows\System32\wbem\WMIADAP.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [ETDCtrl] => C:\Program Files\Elantech\ETDCtrl.exe [2589992 2011-04-05] (ELAN Microelectronics Corp.)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11785832 2011-03-10] (Realtek Semiconductor)
HKLM\...\Run: [Power Management] => C:\Program Files\Gateway\Gateway Power Management\ePowerTray.exe [1831016 2011-08-02] (Acer Incorporated)
HKLM-x32\...\Run: [BrowserSafeguard] => C:\Program Files (x86)\Browsersafeguard\BrowserSafeguard.exe [522752 2014-05-06] ()
HKLM-x32\...\Run: [mobilegeni daemon] => C:\Program Files (x86)\Mobogenie\DaemonProcess.exe [748736 2014-05-06] ()
HKLM-x32\...\Run: [fst_us_53] => "C:\Program Files (x86)\fst_us_53\fst_us_53.exe"
HKLM-x32\...\RunOnce: [upfst_us_53.exe] => C:\Users\jimbo\AppData\Local\fst_us_53\upfst_us_53.exe [3265024 2014-04-29] ()
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKLM\...\Policies\Explorer: [HideSCAHealth] 1
HKU\S-1-5-21-3300329991-2820599393-3356462390-1000\...\Run: [Best Buy pc app] => C:\Users\jimbo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Best Buy\Best Buy pc app.appref-ms
HKU\S-1-5-21-3300329991-2820599393-3356462390-1000\...\Run: [EPLTarget\P0000000000000000] => C:\Windows\system32\spool\DRIVERS\x64\3\E_YATIHWA.EXE [239488 2011-04-24] (SEIKO EPSON CORPORATION)
HKU\S-1-5-21-3300329991-2820599393-3356462390-1000\...\Run: [EPLTarget\P0000000000000001] => C:\Windows\system32\spool\DRIVERS\x64\3\E_YATIHWA.EXE [239488 2011-04-24] (SEIKO EPSON CORPORATION)
HKU\S-1-5-21-3300329991-2820599393-3356462390-1000\...\Run: [perkda] => C:\Program Files (x86)\Perk Prize Panel\pdr.exe [221184 2014-04-14] ()
HKU\S-1-5-21-3300329991-2820599393-3356462390-1000\...\Run: [Weather] => C:\Program Files (x86)\AWS\WeatherBug\Weather.exe [1653760 2012-11-20] (AWS Convergence Technologies, Inc.)
HKU\S-1-5-21-3300329991-2820599393-3356462390-1000\...\Run: [BlockNSurf] => C:\Program Files (x86)\BlockAndSurf-soft\BlockNSurf.exe [104448 2014-05-06] (Revizer)
HKU\S-1-5-21-3300329991-2820599393-3356462390-1000\...\Policies\Explorer: [HideSCAHealth] 1
HKU\S-1-5-21-3300329991-2820599393-3356462390-1000\...\MountPoints2: {bf8ef63f-3886-11e1-b92a-74de2b181097} - E:\LapNetWizard.exe
AppInit_DLLs: C:\PROGRA~2\SearchProtect\SearchProtect\bin\SPVC64Loader.dll => C:\Program Files (x86)\SearchProtect\SearchProtect\bin\SPVC64Loader.dll [202560 2014-04-10] (Client Connect LTD)
AppInit_DLLs-x32: C:\PROGRA~2\SearchProtect\SearchProtect\bin\SPVC32Loader.dll => C:\Program Files (x86)\SearchProtect\SearchProtect\bin\SPVC32Loader.dll [171840 2014-04-10] (Client Connect LTD)
Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Best Buy pc app.lnk
ShortcutTarget: Best Buy pc app.lnk -> C:\ProgramData\Best Buy pc app\ClickOnceSetup.exe (Microsoft)
Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Best Buy pc app.lnk
ShortcutTarget: Best Buy pc app.lnk -> C:\ProgramData\Best Buy pc app\ClickOnceSetup.exe (Microsoft)
Startup: C:\Users\jimbo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HELP_DECRYPT.HTML ()
Startup: C:\Users\jimbo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HELP_DECRYPT.PNG ()
Startup: C:\Users\jimbo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HELP_DECRYPT.TXT.dotsowa ()
InternetURL: C:\Users\jimbo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.torconnectpaycom/1pNp5c4
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
ProxyEnable: [S-1-5-21-3300329991-2820599393-3356462390-1000] => Internet Explorer proxy is enabled.
ProxyServer: [S-1-5-21-3300329991-2820599393-3356462390-1000] => http=127.0.0.1:14097;https=127.0.0.1:49167
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://start.mysearchdial.com/?f=1&a=cmi_14_19_ie&cd=2XzuyEtN2Y1L1Qzu0BzzyBtD0FyE0FtAyByD0C0A0AzztBtAtN0D0Tzu0SzzyDyBtN1L2XzutBtFtBtDtFyCtFtDtN1L1CzutCyEtDtAtDyD1V1TtN1L1G1B1V1N2Y1L1Qzu2SyC0CtCyE0BtAzz0CtG0AtB0DtDtG0AyD0DyCtG0ByEzzyEtGyBtD0EzytDtD0CtB0FyCtC0A2QtN1M1F1B2Z1V1N2Y1L1Qzu2StByCtDyDyCtCtC0AtG0CtBtDtDtG0AyCyDyCtG0A0D0E0FtGtD0AtCtDyEyCtDtDzyyE0D0A2Q&cr=786219662&ir=
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://start.mysearchdial.com/?f=1&a=cmi_14_19_ie&cd=2XzuyEtN2Y1L1Qzu0BzzyBtD0FyE0FtAyByD0C0A0AzztBtAtN0D0Tzu0SzzyDyBtN1L2XzutBtFtBtDtFyCtFtDtN1L1CzutCyEtDtAtDyD1V1TtN1L1G1B1V1N2Y1L1Qzu2SyC0CtCyE0BtAzz0CtG0AtB0DtDtG0AyD0DyCtG0ByEzzyEtGyBtD0EzytDtD0CtB0FyCtC0A2QtN1M1F1B2Z1V1N2Y1L1Qzu2StByCtDyDyCtCtC0AtG0CtBtDtDtG0AyCyDyCtG0A0D0E0FtGtD0AtCtDyEyCtDtDzyyE0D0A2Q&cr=786219662&ir=
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.bing.com/?pc=MAGW
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.bing.com/?pc=MAGW
HKU\S-1-5-21-3300329991-2820599393-3356462390-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://start.mysearchdial.com/?f=1&a=cmi_14_19_ie&cd=2XzuyEtN2Y1L1Qzu0BzzyBtD0FyE0FtAyByD0C0A0AzztBtAtN0D0Tzu0SzzyDyBtN1L2XzutBtFtBtDtFyCtFtDtN1L1CzutCyEtDtAtDyD1V1TtN1L1G1B1V1N2Y1L1Qzu2SyC0CtCyE0BtAzz0CtG0AtB0DtDtG0AyD0DyCtG0ByEzzyEtGyBtD0EzytDtD0CtB0FyCtC0A2QtN1M1F1B2Z1V1N2Y1L1Qzu2StByCtDyDyCtCtC0AtG0CtBtDtDtG0AyCyDyCtG0A0D0E0FtGtD0AtCtDyEyCtDtDzyyE0D0A2Q&cr=786219662&ir=
HKU\S-1-5-21-3300329991-2820599393-3356462390-1000\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.bing.com/?pc=MAGW
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=AGWTDF&pc=MAGW&src=IE-SearchBox
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=AGWTDF&pc=MAGW&src=IE-SearchBox
SearchScopes: HKLM -> {77AA745B-F4F8-45DA-9B14-61D2D95054C8} URL =
SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=AGWTDF&pc=MAGW&src=IE-SearchBox
SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=AGWTDF&pc=MAGW&src=IE-SearchBox
SearchScopes: HKU\S-1-5-21-3300329991-2820599393-3356462390-1000 -> DefaultScope {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = hxxp://start.mysearchdial.com/results.php?f=4&q={searchTerms}&a=cmi_14_19_ie&cd=2XzuyEtN2Y1L1Qzu0BzzyBtD0FyE0FtAyByD0C0A0AzztBtAtN0D0Tzu0SzzyDyBtN1L2XzutBtFtBtDtFyCtFtDtN1L1CzutCyEtDtAtDyD1V1TtN1L1G1B1V1N2Y1L1Qzu2SyC0CtCyE0BtAzz0CtG0AtB0DtDtG0AyD0DyCtG0ByEzzyEtGyBtD0EzytDtD0CtB0FyCtC0A2QtN1M1F1B2Z1V1N2Y1L1Qzu2StByCtDyDyCtCtC0AtG0CtBtDtDtG0AyCyDyCtG0A0D0E0FtGtD0AtCtDyEyCtDtDzyyE0D0A2Q&cr=786219662&ir=
SearchScopes: HKU\S-1-5-21-3300329991-2820599393-3356462390-1000 -> {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = hxxp://start.mysearchdial.com/results.php?f=4&q={searchTerms}&a=cmi_14_19_ie&cd=2XzuyEtN2Y1L1Qzu0BzzyBtD0FyE0FtAyByD0C0A0AzztBtAtN0D0Tzu0SzzyDyBtN1L2XzutBtFtBtDtFyCtFtDtN1L1CzutCyEtDtAtDyD1V1TtN1L1G1B1V1N2Y1L1Qzu2SyC0CtCyE0BtAzz0CtG0AtB0DtDtG0AyD0DyCtG0ByEzzyEtGyBtD0EzytDtD0CtB0FyCtC0A2QtN1M1F1B2Z1V1N2Y1L1Qzu2StByCtDyDyCtCtC0AtG0CtBtDtDtG0AyCyDyCtG0A0D0E0FtGtD0AtCtDyEyCtDtDzyyE0D0A2Q&cr=786219662&ir=
SearchScopes: HKU\S-1-5-21-3300329991-2820599393-3356462390-1000 -> {77AA745B-F4F8-45DA-9B14-61D2D95054C8} URL = hxxp://search.conduit.com/Results.aspx?gd=&ctid=CT3317458&octid=EB_ORIGINAL_CTID&ISID=M87D4C0DE-93E0-4D2F-9827-4D5525112467&SearchSource=58&CUI=&UM=5&UP=SP37758B00-2A0D-4C1A-96A3-CCF896EF9EF6&q={searchTerms}&SSPV=213DCC_sp_ie
BHO: Plus-HD-9.3 -> {11111111-1111-1111-1111-110511301198} -> C:\Program Files (x86)\Plus-HD-9.3\Plus-HD-9.3-bho64.dll [2014-05-06] (Plus HD)
BHO: ConvertFilesforFree -> {59A062A1-5ECA-4a1a-BC44-B2A9283A8ACB} -> C:\Program Files (x86)\Convert Files for Free\ConvertFilesforFree_x64.dll [2014-01-28] (Convert Files for Free)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2011-03-28] (Microsoft Corp.)
BHO-x32: 2rs3 -> {10AD2C61-0898-4348-8600-14A342F22AC3} -> C:\Program Files (x86)\SupraSavings\2rs3.dll [2014-03-21] ()
BHO-x32: Plus-HD-9.3 -> {11111111-1111-1111-1111-110511301198} -> C:\Program Files (x86)\Plus-HD-9.3\Plus-HD-9.3-bho.dll [2014-05-06] (Plus HD)
BHO-x32: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2012-04-03] (Adobe Systems Incorporated)
BHO-x32: Perk Prize Panel -> {47F3EB15-C230-4A0B-BE4B-D527FF483B48} -> C:\Program Files (x86)\Perk Prize Panel\pp.dll [2014-04-14] ()
BHO-x32: ConvertFilesforFree -> {59A062A1-5ECA-4a1a-BC44-B2A9283A8ACB} -> C:\Program Files (x86)\Convert Files for Free\ConvertFilesforFree.dll [2014-01-28] (Convert Files for Free)
BHO-x32: SSVHelper Class -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.6.0_07\bin\ssv.dll [2008-06-10] (Sun Microsystems, Inc.)
BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2011-03-28] (Microsoft Corp.)
BHO-x32: Bing Bar Helper -> {d2ce3e00-f94a-4740-988e-03dc2f38c34f} -> C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll [2011-06-07] (Microsoft Corporation.)
BHO-x32: webget -> {dc264a72-fa75-4948-b881-ea8eff8e5dd2} -> C:\Program Files (x86)\webget\webgetbho.dll [2014-05-06] (webget)
Toolbar: HKLM-x32 - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll [2011-06-07] (Microsoft Corporation.)
Tcpip\Parameters: [NameServer] 184.172.114.130,208.43.110.90
Tcpip\..\Interfaces\{25FCCB87-277C-4DA4-8480-07A0F3FD4BE9}: [NameServer] 184.172.114.130,208.43.110.90
Tcpip\..\Interfaces\{2D12189E-15B6-4146-BB1E-ED320E63BED4}: [NameServer] 184.172.114.130,208.43.110.90
Tcpip\..\Interfaces\{846ee342-7039-11de-9d20-806e6f6e6963}: [NameServer] 184.172.114.130,208.43.110.90
Tcpip\..\Interfaces\{D19F69BA-4E4B-4299-90F5-1FCEF457AF50}: [NameServer] 184.172.114.130,208.43.110.90
FireFox:
========
FF Plugin: @bestbuy.com/npBestBuyPcAppDetector,version=1.0 -> C:\ProgramData\Best Buy pc app\npBestBuyPcAppDetector.dll [2011-06-30] (Best Buy)
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2011-10-05] ()
FF Plugin-x32: @bestbuy.com/npBestBuyPcAppDetector,version=1.0 -> C:\ProgramData\Best Buy pc app\npBestBuyPcAppDetector.dll [2011-06-30] (Best Buy)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\4.0.60831.0\npctrl.dll [2011-08-30] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~4\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2011-05-13] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3538.0513 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2011-05-13] (Microsoft Corporation)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll [2012-04-03] (Adobe Systems Inc.)
FF HKU\S-1-5-21-3300329991-2820599393-3356462390-1000\...\Firefox\Extensions: [pp@perk.com] - C:\Program Files (x86)\Perk Prize Panel\FF
FF Extension: No Name - C:\Program Files (x86)\Perk Prize Panel\FF [2014-05-06]
FF HKU\S-1-5-21-3300329991-2820599393-3356462390-1000\...\Firefox\Extensions: [{5083AF0A-1AF1-9CDC-CFAD-830DF3E9D526}] - C:\Program Files (x86)\BlockAndSurf-soft\161.xpi
Chrome:
=======
CHR Profile: C:\Users\jimbo\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Slides) - C:\Users\jimbo\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-02-25]
CHR Extension: (Google Docs) - C:\Users\jimbo\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-02-25]
CHR Extension: (Google Drive) - C:\Users\jimbo\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-02-25]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\jimbo\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2015-02-25]
CHR Extension: (YouTube) - C:\Users\jimbo\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-02-25]
CHR Extension: (Google Search) - C:\Users\jimbo\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-02-25]
CHR Extension: (Google Sheets) - C:\Users\jimbo\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-02-25]
CHR Extension: (No Name) - C:\Users\jimbo\AppData\Local\Google\Chrome\User Data\Default\Extensions\gngfnjclpjflgomhidfecidndbfaniak [2015-03-17]
CHR Extension: (Google Wallet) - C:\Users\jimbo\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-02-25]
CHR Extension: (Gmail) - C:\Users\jimbo\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-02-25]
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 BlockAndSurf; C:\Program Files (x86)\BlockAndSurf-soft\BlockAndSurfKF161.exe [144896 2014-05-06] () [File not signed]
R2 CltMngSvc; C:\Program Files (x86)\SearchProtect\Main\bin\CltMngSvc.exe [2496320 2014-04-10] (Client Connect LTD)
R2 ConvertFilesforFreeUpdt; C:\Program Files (x86)\Convert Files for Free\ConvertFilesforFreeUpdt.exe [252928 2014-01-28] () [File not signed]
S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [69632 2005-04-04] (Macrovision Corporation) [File not signed]
R2 MgAssistService; C:\Program Files (x86)\Mobogenie\MgAssist.exe [70848 2014-05-06] ()
R2 NTI IScheduleSvc; C:\Program Files (x86)\NTI\Gateway MyBackup\IScheduleSvc.exe [257344 2011-03-09] (NTI Corporation)
R2 Update webget; C:\Program Files (x86)\webget\updatewebget.exe [316696 2014-05-06] ()
R2 vosr; C:\Users\jimbo\AppData\Roaming\VOPackage\VOsrv.exe [52736 2014-05-06] () [File not signed] <==== ATTENTION <==== ATTENTION
R2 vxlsnyaiet64; C:\Program Files\003\vxlsnyaiet64.exe [706560 2014-05-06] () [File not signed]
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2009-07-13] (Microsoft Corporation)
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-03-20 08:58 - 2015-03-20 08:58 - 00000000 ____D () C:\FRST
2015-03-20 08:57 - 2015-03-20 08:57 - 00000000 _____ () C:\Users\jimbo\defogger_reenable
2015-03-20 08:18 - 2015-03-20 08:55 - 00001350 _____ () C:\Users\jimbo\Desktop\Clean Registry for Free!.lnk
2015-03-20 08:18 - 2015-03-20 08:18 - 00000000 ____D () C:\Users\jimbo\AppData\Roaming\PC Speed Maximizer
2015-03-17 20:08 - 2015-03-17 20:08 - 00000000 ____D () C:\Users\jimbo\AppData\Roaming\WeatherBug
2015-03-17 20:08 - 2015-03-17 20:08 - 00000000 ____D () C:\Users\jimbo\AppData\Local\WeatherBug
2015-03-17 20:08 - 2015-03-17 20:08 - 00000000 ____D () C:\Users\jimbo\AppData\Local\SearchProtect
2015-03-17 20:08 - 2015-03-17 20:08 - 00000000 ____D () C:\ProgramData\Systweak
2015-02-26 13:39 - 2015-02-26 17:10 - 03148854 _____ () C:\Users\jimbo\Documents\!Decrypt-All-Files-dotsowa.bmp
2015-02-26 13:39 - 2015-02-26 17:10 - 00001266 _____ () C:\Users\jimbo\Documents\!Decrypt-All-Files-dotsowa.txt
2015-02-26 13:15 - 2015-02-26 13:15 - 00008630 _____ () C:\Users\scanuser\HELP_DECRYPT.HTML
2015-02-26 13:15 - 2015-02-26 13:15 - 00008630 _____ () C:\Users\scanuser\AppData\Roaming\HELP_DECRYPT.HTML
2015-02-26 13:15 - 2015-02-26 13:15 - 00008630 _____ () C:\Users\scanuser\AppData\Local\HELP_DECRYPT.HTML
2015-02-26 13:15 - 2015-02-26 13:15 - 00008630 _____ () C:\Users\scanuser\AppData\Local\Apps\HELP_DECRYPT.HTML
2015-02-26 13:15 - 2015-02-26 13:15 - 00008630 _____ () C:\Users\scanuser\AppData\HELP_DECRYPT.HTML
2015-02-26 13:15 - 2015-02-26 13:15 - 00008630 _____ () C:\Users\scanuser.jimbo-PC\HELP_DECRYPT.HTML
2015-02-26 13:15 - 2015-02-26 13:15 - 00008630 _____ () C:\Users\scanuser.jimbo-PC\AppData\Roaming\HELP_DECRYPT.HTML
2015-02-26 13:15 - 2015-02-26 13:15 - 00008630 _____ () C:\Users\scanuser.jimbo-PC\AppData\Local\HELP_DECRYPT.HTML
2015-02-26 13:15 - 2015-02-26 13:15 - 00008630 _____ () C:\Users\scanuser.jimbo-PC\AppData\HELP_DECRYPT.HTML
2015-02-26 13:15 - 2015-02-26 13:15 - 00008630 _____ () C:\Users\jimbo\HELP_DECRYPT.HTML
2015-02-26 13:15 - 2015-02-26 13:15 - 00008630 _____ () C:\Users\jimbo\Desktop\HELP_DECRYPT.HTML
2015-02-26 13:15 - 2015-02-26 13:15 - 00008630 _____ () C:\Users\HELP_DECRYPT.HTML
2015-02-26 13:15 - 2015-02-26 13:15 - 00008630 _____ () C:\HELP_DECRYPT.HTML
2015-02-26 13:15 - 2015-02-26 13:15 - 00004258 _____ () C:\Users\HELP_DECRYPT.TXT
2015-02-26 13:15 - 2015-02-26 13:15 - 00004258 _____ () C:\HELP_DECRYPT.TXT
2015-02-26 13:15 - 2015-02-26 13:15 - 00000292 _____ () C:\Users\scanuser\HELP_DECRYPT.URL
2015-02-26 13:15 - 2015-02-26 13:15 - 00000292 _____ () C:\Users\scanuser\AppData\Roaming\HELP_DECRYPT.URL
2015-02-26 13:15 - 2015-02-26 13:15 - 00000292 _____ () C:\Users\scanuser\AppData\Local\HELP_DECRYPT.URL
2015-02-26 13:15 - 2015-02-26 13:15 - 00000292 _____ () C:\Users\scanuser\AppData\Local\Apps\HELP_DECRYPT.URL
2015-02-26 13:15 - 2015-02-26 13:15 - 00000292 _____ () C:\Users\scanuser\AppData\HELP_DECRYPT.URL
2015-02-26 13:15 - 2015-02-26 13:15 - 00000292 _____ () C:\Users\scanuser.jimbo-PC\HELP_DECRYPT.URL
2015-02-26 13:15 - 2015-02-26 13:15 - 00000292 _____ () C:\Users\scanuser.jimbo-PC\AppData\Roaming\HELP_DECRYPT.URL
2015-02-26 13:15 - 2015-02-26 13:15 - 00000292 _____ () C:\Users\scanuser.jimbo-PC\AppData\Local\HELP_DECRYPT.URL
2015-02-26 13:15 - 2015-02-26 13:15 - 00000292 _____ () C:\Users\scanuser.jimbo-PC\AppData\HELP_DECRYPT.URL
2015-02-26 13:15 - 2015-02-26 13:15 - 00000292 _____ () C:\Users\jimbo\HELP_DECRYPT.URL
2015-02-26 13:15 - 2015-02-26 13:15 - 00000292 _____ () C:\Users\jimbo\Desktop\HELP_DECRYPT.URL
2015-02-26 13:15 - 2015-02-26 13:15 - 00000292 _____ () C:\Users\HELP_DECRYPT.URL
2015-02-26 13:15 - 2015-02-26 13:15 - 00000292 _____ () C:\HELP_DECRYPT.URL
2015-02-26 12:55 - 2015-02-26 13:40 - 02530805 _____ () C:\ProgramData\vjpaaaa.html
2015-02-25 19:46 - 2015-02-25 19:46 - 00023483 _____ () C:\Users\jimbo\Desktop\Office Depot Work Order 0062011602443 Ticket 28866516 Receipt.mht
2015-02-25 15:36 - 2015-03-17 20:07 - 00000000 ____D () C:\Program Files (x86)\Google
2015-02-25 15:36 - 2015-02-25 15:38 - 00000000 ____D () C:\Users\jimbo\AppData\Local\Google
2015-02-25 13:32 - 2015-02-25 13:32 - 00000000 ____D () C:\Users\jimbo\AppData\Roaming\Malwarebytes
2015-02-25 13:32 - 2015-02-25 13:32 - 00000000 ____D () C:\ProgramData\Malwarebytes
2015-02-25 13:26 - 2015-02-25 13:26 - 00000000 ____D () C:\TDSSKiller_Quarantine
2015-02-25 08:08 - 2015-03-17 19:57 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\smartmontools
2015-02-25 08:08 - 2015-03-17 19:57 - 00000000 ____D () C:\Program Files (x86)\smartmontools
2015-02-24 07:26 - 2015-03-17 19:57 - 00000000 ____D () C:\Program Files (x86)\officedepot_stk_sop
2015-02-24 07:26 - 2015-02-24 07:26 - 00000000 ____D () C:\ProgramData\support.com
2015-02-23 12:03 - 2015-02-26 13:31 - 00000000 ____D () C:\Users\jimbo\AppData\Roaming\UpdSysDrv32Xz32
2015-02-22 10:25 - 2015-02-23 13:16 - 00000199 _____ () C:\ProgramData\5DR4A7.dat
2015-02-22 10:23 - 2015-02-22 10:23 - 00000000 ____D () C:\Users\Default\AppData\Roaming\Macromedia
2015-02-22 10:23 - 2015-02-22 10:23 - 00000000 ____D () C:\Users\Default\AppData\Roaming\Adobe
2015-02-22 10:23 - 2015-02-22 10:23 - 00000000 ____D () C:\Users\Default User\AppData\Roaming\Macromedia
2015-02-22 10:23 - 2015-02-22 10:23 - 00000000 ____D () C:\Users\Default User\AppData\Roaming\Adobe
2015-02-22 10:23 - 2015-02-22 10:23 - 00000000 ____D () C:\ProgramData\Package Cache
2015-02-22 10:22 - 2015-02-24 08:13 - 00000000 ____D () C:\Users\Default\AppData\Roaming\Compatibility Verifier
2015-02-22 10:22 - 2015-02-24 08:13 - 00000000 ____D () C:\Users\Default User\AppData\Roaming\Compatibility Verifier
2015-02-21 13:18 - 2015-03-17 19:14 - 00000000 ____D () C:\Users\jimbo\AppData\Roaming\supportdotcom
2015-02-20 17:47 - 2015-02-24 08:13 - 00000000 ____D () C:\ProgramData\{CA2FACF7-9029-4A21-892B-E7F60B39FF1A}
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-03-20 08:58 - 2011-09-14 20:16 - 01376724 _____ () C:\Windows\WindowsUpdate.log
2015-03-20 08:57 - 2014-05-06 19:57 - 00000424 _____ () C:\Windows\Tasks\BlockAndSurf Update.job
2015-03-20 08:57 - 2014-05-06 19:57 - 00000000 ____D () C:\Users\jimbo\AppData\Local\fst_us_53
2015-03-20 08:57 - 2014-05-06 19:56 - 00003108 _____ () C:\Windows\System32\Tasks\RegClean Pro
2015-03-20 08:57 - 2011-10-17 16:39 - 00000000 ____D () C:\Users\jimbo
2015-03-20 08:56 - 2014-05-06 19:55 - 00000292 _____ () C:\Windows\Tasks\MySearchDial.job
2015-03-20 08:55 - 2014-05-06 19:57 - 00003120 _____ () C:\Windows\System32\Tasks\Advanced System Protector_startup
2015-03-20 08:55 - 2014-05-06 19:38 - 00003248 _____ () C:\Windows\System32\Tasks\PC Speed Maximizer Schedule
2015-03-20 08:55 - 2014-05-06 19:37 - 00001450 _____ () C:\Windows\Tasks\a5484598-527e-4337-aed0-ae0a1d60296a-5.job
2015-03-20 08:54 - 2014-05-06 19:57 - 00000404 _____ () C:\Windows\Tasks\BlockAndSurf_wd.job
2015-03-20 08:54 - 2014-05-06 19:37 - 00003112 _____ () C:\Windows\Tasks\a5484598-527e-4337-aed0-ae0a1d60296a-3.job
2015-03-20 08:54 - 2014-05-06 19:37 - 00002158 _____ () C:\Windows\Tasks\a5484598-527e-4337-aed0-ae0a1d60296a-4.job
2015-03-20 08:54 - 2014-05-06 19:37 - 00001362 _____ () C:\Windows\Tasks\a5484598-527e-4337-aed0-ae0a1d60296a-2.job
2015-03-20 08:54 - 2014-05-06 19:37 - 00001362 _____ () C:\Windows\Tasks\a5484598-527e-4337-aed0-ae0a1d60296a-1.job
2015-03-20 08:54 - 2009-07-13 22:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-03-20 08:54 - 2009-07-13 21:51 - 00110600 _____ () C:\Windows\setupact.log
2015-03-20 08:29 - 2009-07-13 22:13 - 00727182 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-03-20 08:27 - 2014-05-06 19:48 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-03-20 08:25 - 2009-07-13 21:45 - 00016976 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-03-20 08:25 - 2009-07-13 21:45 - 00016976 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-03-19 16:49 - 2014-05-06 19:57 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\free_soft_today
2015-03-19 16:49 - 2014-05-06 19:57 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Advanced System Protector
2015-03-19 16:49 - 2014-05-06 19:57 - 00000000 ____D () C:\Program Files (x86)\fst_us_53
2015-03-19 16:49 - 2014-05-06 19:57 - 00000000 ____D () C:\Program Files (x86)\BlockAndSurf-soft
2015-03-19 16:49 - 2014-05-06 19:57 - 00000000 ____D () C:\Program Files (x86)\Advanced System Protector
2015-03-19 16:49 - 2014-05-06 19:56 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RegClean Pro
2015-03-19 16:49 - 2014-05-06 19:56 - 00000000 ____D () C:\Program Files (x86)\RegClean Pro
2015-03-19 16:49 - 2014-05-06 19:56 - 00000000 ____D () C:\Program Files (x86)\Mobogenie
2015-03-19 16:49 - 2014-05-06 19:56 - 00000000 ____D () C:\Program Files (x86)\File Type Helper
2015-03-19 16:49 - 2014-05-06 19:56 - 00000000 ____D () C:\Program Files (x86)\Convert Files for Free
2015-03-19 16:49 - 2014-05-06 19:55 - 00000000 ____D () C:\Program Files (x86)\webget
2015-03-19 16:49 - 2014-05-06 19:55 - 00000000 ____D () C:\Program Files (x86)\Mysearchdial
2015-03-19 16:49 - 2014-05-06 19:36 - 00000000 ____D () C:\Program Files (x86)\Plus-HD-9.3
2015-03-19 16:49 - 2014-05-06 19:35 - 00000000 ____D () C:\Program Files (x86)\SupraSavings
2015-03-19 16:49 - 2014-05-06 19:33 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PC Speed Maximizer
2015-03-19 16:49 - 2014-05-06 19:33 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\BrowserSafeguard
2015-03-19 16:49 - 2014-05-06 19:33 - 00000000 ____D () C:\Program Files (x86)\PC Speed Maximizer
2015-03-19 16:49 - 2014-05-06 19:33 - 00000000 ____D () C:\Program Files (x86)\Browsersafeguard
2015-03-19 16:49 - 2014-05-06 19:32 - 00000000 ____D () C:\Program Files (x86)\SearchProtect
2015-03-19 16:49 - 2014-05-06 19:31 - 00000000 ____D () C:\Program Files (x86)\Social Privacy DNS
2015-03-19 16:49 - 2014-05-06 19:31 - 00000000 ____D () C:\Program Files (x86)\Perk Prize Panel
2015-03-19 16:49 - 2011-08-18 08:25 - 00000000 ____D () C:\ProgramData\BackupManager
2015-03-19 16:49 - 2011-08-18 08:24 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2015-03-19 16:49 - 2011-08-18 08:24 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight
2015-03-19 16:48 - 2014-05-06 19:57 - 00000000 ____D () C:\Users\jimbo\AppData\Local\Mobogenie
2015-03-19 16:48 - 2014-05-06 19:56 - 00000000 ____D () C:\Users\jimbo\AppData\Roaming\Systweak
2015-03-19 16:48 - 2014-05-06 19:56 - 00000000 ____D () C:\Users\jimbo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Mobogenie
2015-03-19 16:48 - 2014-05-06 19:55 - 00000000 ____D () C:\Users\jimbo\AppData\Roaming\mysearchdial
2015-03-19 16:48 - 2014-05-06 19:45 - 00000000 ____D () C:\Users\jimbo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WeatherBug
2015-03-19 16:48 - 2014-05-06 19:44 - 00000000 ____D () C:\Users\jimbo\AppData\Roaming\VOPackage
2015-03-19 16:48 - 2014-05-06 19:44 - 00000000 ____D () C:\Users\jimbo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VOPackage
2015-03-19 16:48 - 2014-05-06 19:39 - 00000000 ____D () C:\Users\jimbo\AppData\Local\VisualBeeClient
2015-03-19 16:48 - 2014-05-06 19:38 - 00000000 ____D () C:\Users\jimbo\AppData\Local\VisualBeeExe
2015-03-19 16:48 - 2009-07-13 20:20 - 00000000 ___HD () C:\Windows\system32\GroupPolicy
2015-03-19 16:48 - 2009-07-13 20:20 - 00000000 ____D () C:\Windows\SysWOW64\GroupPolicy
2015-03-19 16:48 - 2009-07-13 20:20 - 00000000 ____D () C:\Windows\system32\NDF
2015-03-19 16:48 - 2009-07-13 20:20 - 00000000 ____D () C:\Windows\AppCompat
2015-03-17 20:07 - 2014-05-06 19:56 - 00000284 _____ () C:\Windows\Tasks\RegClean Pro_UPDATES.job
2015-03-17 20:07 - 2014-05-06 19:56 - 00000276 _____ () C:\Windows\Tasks\RegClean Pro_DEFAULT.job
2015-03-17 20:00 - 2012-07-26 08:59 - 00000000 ____D () C:\Users\scanuser.jimbo-PC
2015-03-17 20:00 - 2012-07-25 16:24 - 00000000 ____D () C:\Users\scanuser\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Best Buy
2015-03-17 19:59 - 2014-05-06 19:35 - 00000000 ____D () C:\Program Files\SupraSavings
2015-03-17 19:57 - 2014-05-18 18:05 - 00000000 ____D () C:\Program Files (x86)\Skype
2015-03-17 19:57 - 2014-05-06 19:55 - 00000000 ____D () C:\Program Files (x86)\AnyProtectEx
2015-03-17 19:57 - 2014-05-06 19:45 - 00000000 ____D () C:\Program Files (x86)\AWS
2015-03-17 19:14 - 2009-07-13 20:20 - 00000000 ____D () C:\Windows\registration
2015-03-17 19:13 - 2012-07-25 16:23 - 00000000 ____D () C:\Users\scanuser\AppData\Local\Apps\2.0
2015-03-17 19:13 - 2012-07-12 19:46 - 00000000 ____D () C:\Users\jimbo\AppData\Roaming\Skype
2015-03-17 19:13 - 2011-10-27 20:03 - 00000000 ____D () C:\Users\jimbo\AppData\Roaming\SoftGrid Client
2015-03-17 19:13 - 2011-10-17 16:48 - 00000000 ____D () C:\Users\jimbo\AppData\Roaming\Adobe
2015-03-17 19:06 - 2012-11-15 17:42 - 00000000 ____D () C:\Users\jimbo\AppData\Local\Microsoft Games
2015-03-17 19:06 - 2011-11-17 16:35 - 00000000 ____D () C:\ProgramData\{93E26451-CD9A-43A5-A2FA-C42392EA4001}
2015-03-17 19:06 - 2011-08-18 08:29 - 00000000 ____D () C:\ProgramData\Gateway
2015-03-17 19:05 - 2011-08-18 08:23 - 00000000 ____D () C:\Program Files (x86)\Social Networks
2015-03-17 19:04 - 2011-11-17 16:35 - 00000000 ____D () C:\Program Files (x86)\iTunes
2015-03-17 19:03 - 2011-08-18 08:55 - 00000000 ___HD () C:\OEM
2015-02-26 13:15 - 2013-06-09 09:02 - 00001392 _____ () C:\Users\scanuser\HELP_DECRYPT.TXT.dotsowa
2015-02-26 13:15 - 2013-06-09 09:02 - 00001392 _____ () C:\Users\scanuser\AppData\Roaming\HELP_DECRYPT.TXT.dotsowa
2015-02-26 13:15 - 2013-06-09 09:02 - 00001392 _____ () C:\Users\scanuser\AppData\Local\HELP_DECRYPT.TXT.dotsowa
2015-02-26 13:15 - 2013-06-09 09:02 - 00001392 _____ () C:\Users\scanuser\AppData\Local\Apps\HELP_DECRYPT.TXT.dotsowa
2015-02-26 13:15 - 2013-06-09 09:02 - 00001392 _____ () C:\Users\scanuser\AppData\HELP_DECRYPT.TXT.dotsowa
2015-02-26 13:15 - 2013-06-09 09:02 - 00001392 _____ () C:\Users\scanuser.jimbo-PC\HELP_DECRYPT.TXT.dotsowa
2015-02-26 13:15 - 2013-06-09 09:02 - 00001392 _____ () C:\Users\scanuser.jimbo-PC\AppData\Roaming\HELP_DECRYPT.TXT.dotsowa
2015-02-26 13:15 - 2013-06-09 09:02 - 00001392 _____ () C:\Users\scanuser.jimbo-PC\AppData\Local\HELP_DECRYPT.TXT.dotsowa
2015-02-26 13:15 - 2013-06-09 09:02 - 00001392 _____ () C:\Users\scanuser.jimbo-PC\AppData\HELP_DECRYPT.TXT.dotsowa
2015-02-26 13:15 - 2013-06-09 09:02 - 00001392 _____ () C:\Users\jimbo\HELP_DECRYPT.TXT.dotsowa
2015-02-26 13:15 - 2013-06-09 09:02 - 00001392 _____ () C:\Users\jimbo\Desktop\HELP_DECRYPT.TXT.dotsowa
2015-02-26 13:08 - 2014-05-18 18:05 - 00000000 ____D () C:\Users\jimbo\AppData\Local\Skype
2015-02-26 13:07 - 2011-11-17 16:36 - 00000000 ____D () C:\Users\jimbo\AppData\Local\Apple Computer
2015-02-26 13:07 - 2011-10-19 16:54 - 00000000 ____D () C:\Users\jimbo\AppData\Roaming\CyberLink
2015-02-26 13:07 - 2011-10-19 16:01 - 00000000 ____D () C:\Users\jimbo\sitebuilder
2015-02-26 13:06 - 2013-12-23 22:15 - 00000000 ____D () C:\Users\jimbo\Documents\CyberLink
2015-02-26 13:05 - 2011-11-17 16:36 - 00000000 ____D () C:\Users\jimbo\AppData\Roaming\Apple Computer
2015-02-26 12:59 - 2014-12-31 14:47 - 00000000 ____D () C:\ProgramData\Leapfrog
2015-02-26 12:49 - 2015-02-01 19:12 - 00001392 _____ () C:\Users\jimbo\Downloads\HELP_DECRYPT.TXT.dotsowa
2015-02-26 12:49 - 2015-02-01 19:00 - 00008630 _____ () C:\Users\jimbo\Downloads\HELP_DECRYPT.HTML
2015-02-26 12:49 - 2015-02-01 19:00 - 00000292 _____ () C:\Users\jimbo\Downloads\HELP_DECRYPT.URL
2015-02-26 12:49 - 2011-09-14 20:15 - 00000000 ____D () C:\book
2015-02-26 12:48 - 2015-02-01 19:12 - 00001392 _____ () C:\Users\jimbo\Documents\HELP_DECRYPT.TXT.dotsowa
2015-02-26 12:48 - 2015-02-01 18:59 - 00008630 _____ () C:\Users\jimbo\Documents\HELP_DECRYPT.HTML
2015-02-26 12:48 - 2015-02-01 18:59 - 00000292 _____ () C:\Users\jimbo\Documents\HELP_DECRYPT.URL
2015-02-25 15:36 - 2011-10-17 16:41 - 00000000 ____D () C:\Users\jimbo\AppData\Local\Deployment
2015-02-25 13:31 - 2015-02-01 19:12 - 00204336 _____ () C:\TDSSKiller.3.0.0.44_25.02.2015_12.29.30_log.TXT.dotsowa
2015-02-25 13:26 - 2015-02-01 19:12 - 00209520 _____ () C:\TDSSKiller.3.0.0.44_25.02.2015_12.09.16_log.TXT.dotsowa
2015-02-24 09:51 - 2011-10-19 17:00 - 00000000 ____D () C:\Users\jimbo\AppData\Local\CrashDumps
2015-02-24 07:43 - 2015-02-01 19:04 - 00000000 ____D () C:\Users\jimbo\AppData\Roaming\Local Store
2015-02-24 07:43 - 2010-11-21 00:16 - 00000000 ___RD () C:\Users\Public\Recorded TV
2015-02-23 17:30 - 2011-10-17 16:41 - 00000000 ____D () C:\Users\jimbo\AppData\Local\Apps\2.0
2015-02-23 17:30 - 2011-10-17 16:39 - 00062408 _____ () C:\Users\jimbo\AppData\Local\GDIPFONTCACHEV1.DAT
2015-02-23 13:18 - 2012-07-26 08:59 - 00062408 _____ () C:\Users\scanuser.jimbo-PC\AppData\Local\GDIPFONTCACHEV1.DAT
2015-02-23 13:18 - 2012-07-25 16:23 - 00062408 _____ () C:\Users\scanuser\AppData\Local\GDIPFONTCACHEV1.DAT
2015-02-23 13:16 - 2015-02-01 19:12 - 00692896 _____ () C:\Users\jimbo\Downloads\april sound lot.JPEG.dotsowa
2015-02-23 13:16 - 2015-02-01 19:12 - 00067984 _____ () C:\Users\jimbo\Downloads\image.JPEG.dotsowa
2015-02-23 13:16 - 2015-02-01 19:12 - 00067424 _____ () C:\Users\jimbo\Downloads\image (1).JPEG.dotsowa
2015-02-23 13:09 - 2013-09-26 22:33 - 01512054 _____ () C:\Users\jimbo\Downloads\jiimmie.bmp
2015-02-23 12:29 - 2015-02-01 19:12 - 01637968 _____ () C:\Users\jimbo\Downloads\2013-06-15 23.00.14.JPG.dotsowa
2015-02-23 12:29 - 2015-02-01 19:12 - 01633472 _____ () C:\Users\jimbo\Downloads\2013-06-13 14.30.04.JPG.dotsowa
2015-02-23 12:29 - 2015-02-01 19:12 - 01570208 _____ () C:\Users\jimbo\Documents\ju043.JPG.dotsowa
2015-02-23 12:29 - 2015-02-01 19:12 - 01563168 _____ () C:\Users\jimbo\Downloads\2012-12-04 13.19.03.JPG.dotsowa
2015-02-23 12:29 - 2015-02-01 19:12 - 01563168 _____ () C:\Users\jimbo\Downloads\2012-12-04 13.19.03 (1).JPG.dotsowa
2015-02-23 12:29 - 2015-02-01 19:12 - 01543088 _____ () C:\Users\jimbo\Downloads\benz 2.JPG.dotsowa
2015-02-23 12:29 - 2015-02-01 19:12 - 01529072 _____ () C:\Users\jimbo\Downloads\2012-12-04 13.09.53.JPG.dotsowa
2015-02-23 12:29 - 2015-02-01 19:12 - 01486832 _____ () C:\Users\jimbo\Downloads\2012-12-04 13.09.50.JPG.dotsowa
2015-02-23 12:29 - 2015-02-01 19:12 - 01474176 _____ () C:\Users\jimbo\Downloads\2013-06-15 22.58.55.JPG.dotsowa
2015-02-23 12:29 - 2015-02-01 19:12 - 01458400 _____ () C:\Users\jimbo\Downloads\2012-12-06 14.08.47.JPG.dotsowa
2015-02-23 12:29 - 2015-02-01 19:12 - 01448848 _____ () C:\Users\jimbo\Downloads\2012-12-02 13.31.16 (1).JPG.dotsowa
2015-02-23 12:29 - 2015-02-01 19:12 - 01415264 _____ () C:\Users\jimbo\Downloads\2012-12-02 13.42.23.JPG.dotsowa
2015-02-23 12:29 - 2015-02-01 19:12 - 01409168 _____ () C:\Users\jimbo\Downloads\benz 1.JPG.dotsowa
2015-02-23 12:29 - 2015-02-01 19:12 - 00927088 _____ () C:\Users\jimbo\Downloads\P1010335.JPG.dotsowa
2015-02-23 12:29 - 2015-02-01 19:12 - 00216144 _____ () C:\Users\jimbo\Downloads\IMG_6096.JPG.dotsowa
2015-02-23 12:29 - 2015-02-01 19:12 - 00113040 _____ () C:\Users\jimbo\Downloads\2012-11-16 09.09.21.JPG.dotsowa
2015-02-23 12:29 - 2015-02-01 19:12 - 00105008 _____ () C:\Users\jimbo\Downloads\2012-09-22 10.33.59.JPG.dotsowa
2015-02-23 12:29 - 2015-02-01 19:12 - 00103312 _____ () C:\Users\jimbo\Downloads\2012-11-16 09.26.47.JPG.dotsowa
2015-02-23 12:29 - 2015-02-01 19:12 - 00102608 _____ () C:\Users\jimbo\Downloads\2012-11-28 10.29.35.JPG.dotsowa
2015-02-23 12:29 - 2015-02-01 19:12 - 00102608 _____ () C:\Users\jimbo\Downloads\2012-11-28 10.29.35 (1).JPG.dotsowa
2015-02-23 12:29 - 2015-02-01 19:12 - 00102256 _____ () C:\Users\jimbo\Downloads\2012-09-22 16.18.16.JPG.dotsowa
2015-02-23 12:29 - 2015-02-01 19:12 - 00102016 _____ () C:\Users\jimbo\Downloads\2012-09-22 16.18.20.JPG.dotsowa
2015-02-23 12:29 - 2015-02-01 19:12 - 00099360 _____ () C:\Users\jimbo\Downloads\2012-11-21 10.12.34 (1).JPG.dotsowa
2015-02-23 12:29 - 2015-02-01 19:12 - 00098512 _____ () C:\Users\jimbo\Downloads\2012-11-25 14.30.45.JPG.dotsowa
2015-02-23 12:29 - 2015-02-01 19:12 - 00098480 _____ () C:\Users\jimbo\Downloads\2012-11-21 10.10.37.JPG.dotsowa
2015-02-23 12:29 - 2015-02-01 19:12 - 00098400 _____ () C:\Users\jimbo\Downloads\2012-09-25 09.52.50.JPG.dotsowa
2015-02-23 12:29 - 2015-02-01 19:12 - 00098352 _____ () C:\Users\jimbo\Downloads\2012-11-25 11.24.26.JPG.dotsowa
2015-02-23 12:29 - 2015-02-01 19:12 - 00098096 _____ () C:\Users\jimbo\Downloads\2012-10-26 17.50.44.JPG.dotsowa
2015-02-23 12:29 - 2015-02-01 19:12 - 00097168 _____ () C:\Users\jimbo\Downloads\2012-11-22 12.33.27 (1).JPG.dotsowa
2015-02-23 12:29 - 2015-02-01 19:12 - 00087296 _____ () C:\Users\jimbo\Downloads\2012-11-22 12.33.33.JPG.dotsowa
2015-02-23 12:29 - 2015-02-01 19:12 - 00072416 _____ () C:\Users\jimbo\Downloads\2011-07-27 20.33.36.JPG.dotsowa
2015-02-23 12:29 - 2015-02-01 19:12 - 00068896 _____ () C:\Users\jimbo\Downloads\2011-07-27 19.43.14.JPG.dotsowa
2015-02-23 12:29 - 2015-02-01 19:12 - 00050160 _____ () C:\Users\jimbo\Downloads\125.JPG.dotsowa
2015-02-23 12:29 - 2015-02-01 19:12 - 00049168 _____ () C:\Users\jimbo\Downloads\photo (6).JPG.dotsowa
2015-02-23 12:29 - 2015-02-01 19:12 - 00047280 _____ () C:\Users\jimbo\Downloads\photo (4).JPG.dotsowa
2015-02-23 12:29 - 2015-02-01 19:12 - 00046576 _____ () C:\Users\jimbo\Downloads\mosh nikolie.JPG.dotsowa
2015-02-23 12:29 - 2015-02-01 19:12 - 00043536 _____ () C:\Users\jimbo\Downloads\photo (1).JPG.dotsowa
2015-02-23 12:29 - 2015-02-01 19:12 - 00042240 _____ () C:\Users\jimbo\Downloads\photo (3).JPG.dotsowa
2015-02-23 12:29 - 2015-02-01 19:12 - 00042032 _____ () C:\Users\jimbo\Downloads\photo (7).JPG.dotsowa
2015-02-23 12:29 - 2015-02-01 19:12 - 00037136 _____ () C:\Users\jimbo\Downloads\5889_1205979585252_1101520136_30650803_2303811_n.JPG.dotsowa
2015-02-23 12:29 - 2015-02-01 19:12 - 00033808 _____ () C:\Users\jimbo\Downloads\photo (2).JPG.dotsowa
2015-02-23 12:29 - 2015-02-01 19:12 - 00033024 _____ () C:\Users\jimbo\Downloads\photo (5).JPG.dotsowa
2015-02-23 12:29 - 2015-02-01 19:12 - 00028256 _____ () C:\Users\jimbo\Downloads\photo.JPG.dotsowa
2015-02-23 12:29 - 2015-02-01 19:12 - 00019728 _____ () C:\Users\jimbo\Downloads\imagejpeg_2.JPG.dotsowa
2015-02-23 12:29 - 2015-02-01 19:12 - 00018944 ___SH () C:\Users\jimbo\Downloads\Folder.JPG.dotsowa
2015-02-23 12:29 - 2015-02-01 19:12 - 00017584 _____ () C:\Users\jimbo\Downloads\01102011108.JPG.dotsowa
2015-02-23 12:29 - 2015-02-01 19:12 - 00004832 ___SH () C:\Users\jimbo\Downloads\AlbumArtSmall.JPG.dotsowa
2015-02-21 16:20 - 2009-07-13 22:32 - 00000000 ____D () C:\Windows\system32\FxsTmp
==================== Files in the root of some directories =======
2014-05-06 19:49 - 2014-05-06 20:03 - 0000318 _____ () C:\Users\jimbo\AppData\Roaming\aps.uninstall.scan.results
2015-02-01 18:57 - 2015-02-01 18:57 - 0008658 _____ () C:\Users\jimbo\AppData\Roaming\HELP_DECRYPT.HTML
2015-02-01 18:57 - 2015-02-23 12:59 - 0045821 _____ () C:\Users\jimbo\AppData\Roaming\HELP_DECRYPT.PNG
2015-02-01 19:12 - 2015-02-01 18:57 - 0001392 _____ () C:\Users\jimbo\AppData\Roaming\HELP_DECRYPT.TXT.dotsowa
2015-02-01 18:57 - 2015-02-01 18:57 - 0000304 _____ () C:\Users\jimbo\AppData\Roaming\HELP_DECRYPT.URL
2014-05-06 19:55 - 2014-05-06 15:02 - 1727775 _____ (AnyProtect.com) C:\Users\jimbo\AppData\Local\AnyProtectScannerSetup.exe
2015-02-01 18:57 - 2015-02-01 18:57 - 0008658 _____ () C:\Users\jimbo\AppData\Local\HELP_DECRYPT.HTML
2015-02-01 18:57 - 2015-02-23 12:57 - 0045821 _____ () C:\Users\jimbo\AppData\Local\HELP_DECRYPT.PNG
2015-02-01 19:12 - 2015-02-01 18:57 - 0001392 _____ () C:\Users\jimbo\AppData\Local\HELP_DECRYPT.TXT.dotsowa
2015-02-01 18:57 - 2015-02-01 18:57 - 0000304 _____ () C:\Users\jimbo\AppData\Local\HELP_DECRYPT.URL
2014-05-06 19:44 - 2014-05-06 19:44 - 1745440 _____ (AnyProtect.com) C:\Users\jimbo\AppData\Local\nsz12E2.tmp
2012-07-25 15:53 - 2012-07-25 15:53 - 0000017 _____ () C:\Users\jimbo\AppData\Local\resmon.resmoncfg
2015-02-22 10:25 - 2015-02-23 13:16 - 0000199 _____ () C:\ProgramData\5DR4A7.dat
2015-02-01 18:55 - 2015-02-01 18:55 - 0008658 _____ () C:\ProgramData\HELP_DECRYPT.HTML
2015-02-01 18:55 - 2015-02-23 12:57 - 0045821 _____ () C:\ProgramData\HELP_DECRYPT.PNG
2015-02-01 19:12 - 2015-02-01 18:55 - 0001392 _____ () C:\ProgramData\HELP_DECRYPT.TXT.dotsowa
2015-02-01 18:55 - 2015-02-01 18:55 - 0000304 _____ () C:\ProgramData\HELP_DECRYPT.URL
2015-02-26 12:55 - 2015-02-26 13:40 - 2530805 _____ () C:\ProgramData\vjpaaaa.html
Files to move or delete:
====================
C:\ProgramData\5DR4A7.dat
Some content of TEMP:
====================
C:\Users\jimbo\AppData\Local\Temp\COMAP.EXE
C:\Users\jimbo\AppData\Local\Temp\file_157154.exe
C:\Users\jimbo\AppData\Local\Temp\file_3764020663.exe
C:\Users\jimbo\AppData\Local\Temp\helper.exe
C:\Users\jimbo\AppData\Local\Temp\nsp8DE3.exe
C:\Users\jimbo\AppData\Local\Temp\nspC0C7.exe
C:\Users\jimbo\AppData\Local\Temp\SendMsg.dll
C:\Users\jimbo\AppData\Local\Temp\setup.exe
C:\Users\jimbo\AppData\Local\Temp\System.Data.SQLite.dll
C:\Users\jimbo\AppData\Local\Temp\System.Data.SQLite35100.dll
C:\Users\jimbo\AppData\Local\Temp\vbmz10.exe
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2015-02-24 08:50
==================== End Of Log ============================
|
