Jump to content

diesel_footwear

Honorary Members
  • Posts

    36
  • Joined

  • Last visited

Reputation

0 Neutral
  1. Im considering reinstalling windows(since I need 64 bit) but im not sure if reinstalling would remove this without reformatting? what do you think?
  2. Greetings, I have re-installed firefox since Im having problems with IE. So far I havent seen the fake popup. Here are the logs for security check Results of screen317's Security Check version 0.99.93 Windows 7 Service Pack 1 x86 (UAC is enabled) Internet Explorer 11 ``````````````Antivirus/Firewall Check:`````````````` Windows Firewall Enabled! Windows Firewall Disabled! avast! Antivirus Antivirus up to date! `````````Anti-malware/Other Utilities Check:````````` TuneUp Utilities 2014 (en-GB) CCleaner Adobe Reader XI Mozilla Firefox (34.0.5) ````````Process Check: objlist.exe by Laurent```````` AVAST Software Avast AvastSvc.exe AVAST Software Avast AvastUI.exe `````````````````System Health check````````````````` Total Fragmentation on Drive C: 0% ````````````````````End of Log``````````````````````
  3. Greetings, Here are the logs from FRST Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 14-12-2014 01 Ran by Ton at 2014-12-16 22:09:46 Run:3 Running from C:\Users\Ton\Desktop Loaded Profile: Ton (Available profiles: Ton) Boot Mode: Normal ============================================== Content of fixlist: ***************** HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION HKU\S-1-5-21-2058238302-804130530-2439220241-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft...=ie&ar=iesearch HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft...d=ie&ar=msnhome HKU\S-1-5-21-2058238302-804130530-2439220241-1000\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft...=ie&ar=iesearch SearchScopes: HKU\S-1-5-21-2058238302-804130530-2439220241-1000 -> {67C334C0-408D-4E6D-B5A7-0ADD6AFFA252} URL = BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation) DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset...lineScanner.cab FF Extension: No Name - faststartff@gmail.com [Not Found] Task: {1009DDF2-0319-4573-87CC-DEA3B1D0B99D} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe Task: {1B0631FE-29F1-4FF9-90F4-D5A6A9C1E3B0} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe EmptyTemp: Reboot: ***************** "HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer" => Key deleted successfully. "HKU\S-1-5-21-2058238302-804130530-2439220241-1000\SOFTWARE\Policies\Microsoft\Internet Explorer" => Key deleted successfully. HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main\\Search Page => value deleted successfully. HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main\\Start Page => value deleted successfully. HKU\S-1-5-21-2058238302-804130530-2439220241-1000\Software\Microsoft\Internet Explorer\Main\\Search Page => Value was restored successfully. "HKU\S-1-5-21-2058238302-804130530-2439220241-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{67C334C0-408D-4E6D-B5A7-0ADD6AFFA252}" => Key deleted successfully. "HKCR\CLSID\{67C334C0-408D-4E6D-B5A7-0ADD6AFFA252}" => Key not found. "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}" => Key deleted successfully. "HKCR\CLSID\{9030D464-4C02-4ABF-8ECC-5164760863C6}" => Key deleted successfully. "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}" => Key deleted successfully. "HKCR\CLSID\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}" => Key deleted successfully. "HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{7530BFB8-7293-4D34-9923-61A11451AFC5}" => Key deleted successfully. "HKCR\CLSID\{7530BFB8-7293-4D34-9923-61A11451AFC5}" => Key deleted successfully. FF Extension: No Name - faststartff@gmail.com [Not Found] => not found. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{1009DDF2-0319-4573-87CC-DEA3B1D0B99D}" => Key deleted successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{1009DDF2-0319-4573-87CC-DEA3B1D0B99D}" => Key deleted successfully. C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore => Moved successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\GoogleUpdateTaskMachineCore" => Key deleted successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{1B0631FE-29F1-4FF9-90F4-D5A6A9C1E3B0}" => Key deleted successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{1B0631FE-29F1-4FF9-90F4-D5A6A9C1E3B0}" => Key deleted successfully. C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA => Moved successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\GoogleUpdateTaskMachineUA" => Key deleted successfully. EmptyTemp: => Removed 83.7 MB temporary data. The system needed a reboot. ==== End of Fixlog ====
  4. I uninstalled chrome and im using IE as I type this. I uninstalled firefox earlier before. here are the logs Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 14-12-2014 01 Ran by Ton (administrator) on TON-PC on 15-12-2014 08:41:39 Running from C:\Users\Ton\Desktop Loaded Profile: Ton (Available profiles: Ton) Platform: Microsoft Windows 7 Professional Service Pack 1 (X86) OS Language: English (United States) Internet Explorer Version 11 Boot Mode: Normal Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (AMD) C:\Windows\System32\atiesrxx.exe (AMD) C:\Windows\System32\atieclxx.exe (AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe (Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe (BlueStack Systems, Inc.) C:\Program Files\BlueStacks\HD-LogRotatorService.exe () D:\garae\Garena Plus\ggdllhost.exe (BlueStack Systems, Inc.) C:\Program Files\BlueStacks\HD-UpdaterService.exe (Microsoft Corporation) C:\Program Files\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe (Microsoft Corporation) C:\Program Files\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe (Intel® Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe (Intel Corporation) C:\Program Files\Intel\Intel® Management Engine Components\DAL\Jhi_service.exe (SEIKO EPSON CORPORATION) C:\Program Files\EPSON\MyEpson Portal\mepService.exe (SEIKO EPSON CORPORATION) C:\Program Files\EPSON\MyEpson Portal\mep.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI.exe (Old McDonald's Farm) C:\Program Files\Autorun Eater\oldmcdonald.exe (MicroStudio) C:\Program Files\Windows Network Accelerater\winvxm.exe (Advanced Micro Devices Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe (Old McDonald's Farm) C:\Program Files\Autorun Eater\billy.exe (AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe (Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe (Microsoft Corporation) C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe (BlueStack Systems, Inc.) C:\Program Files\BlueStacks\HD-Agent.exe (Microsoft Corporation) C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE (MicroTools) C:\Program Files\YouTube Downloader Services\P4\youtubeserv.exe (Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE (ATI Technologies Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe (Microsoft Corporation) C:\Windows\System32\wbem\unsecapp.exe (Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe (Microsoft Corporation) C:\Windows\System32\dllhost.exe (Microsoft Corporation) C:\Windows\System32\dllhost.exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI.exe [6106336 2012-12-28] (Realtek Semiconductor) HKLM\...\Run: [startCCC] => C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [642808 2012-12-19] (Advanced Micro Devices, Inc.) HKLM\...\Run: [Autorun Eater] => C:\Program Files\Autorun Eater\oldmcdonald.exe [522720 2012-02-17] (Old McDonald's Farm) HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1021128 2014-11-21] (Adobe Systems Incorporated) HKLM\...\Run: [APSDaemon] => C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe [43848 2014-04-23] (Apple Inc.) HKLM\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [4085896 2014-08-01] (AVAST Software) HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [152392 2014-05-26] (Apple Inc.) HKLM\...\Run: [GrooveMonitor] => C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation) HKLM\...\Run: [blueStacks Agent] => C:\Program Files\BlueStacks\HD-Agent.exe [843480 2014-10-07] (BlueStack Systems, Inc.) HKU\S-1-5-21-2058238302-804130530-2439220241-1000\...\Run: [DAEMON Tools Lite] => C:\Program Files\DAEMON Tools Lite\DTLite.exe [3674320 2013-01-08] (DT Soft Ltd) HKU\S-1-5-21-2058238302-804130530-2439220241-1000\...\Run: [steam] => C:\Program Files\Steam\steam.exe [1941696 2014-12-13] (Valve Corporation) Startup: C:\Users\Ton\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk ShortcutTarget: OneNote 2007 Screen Clipper and Launcher.lnk -> C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation) ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShell.dll (AVAST Software) ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION HKU\S-1-5-21-2058238302-804130530-2439220241-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome HKU\S-1-5-21-2058238302-804130530-2439220241-1000\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch SearchScopes: HKU\S-1-5-21-2058238302-804130530-2439220241-1000 -> {67C334C0-408D-4E6D-B5A7-0ADD6AFFA252} URL = BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation) BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software) BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation) DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation) Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation) Winsock: Catalog5 07 C:\Program Files\Bonjour\mdnsNSP.dll [121704] (Apple Inc.) Tcpip\..\Interfaces\{43F470EE-9997-4992-BF08-7CCDE476DC40}: [NameServer] 8.8.8.8,8.8.4.4,4.2.2.1,4.2.2.2,208.67.222.222,208.67.220.220,8.26.56.26,8.20.247.20,156.154.70.1,156.154.71.1 FireFox: ======== FF ProfilePath: C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081 FF Plugin: @Apple.com/iTunes,version=1.0 -> C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll () FF Plugin: @ei.VideoDownloadConverter_4z.com/Plugin -> C:\Program Files\VideoDownloadConverter_4zEI\Installr\1.bin\NP4zEISB.dll No File FF Plugin: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 -> C:\Program Files\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation) FF Plugin: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation) FF Plugin: @microsoft.com/GENUINE -> disabled No File FF Plugin: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin: @raidcall.en/RCplugin -> C:\Users\Ton\AppData\Roaming\raidcall\plugins\nprcplugin.dll (Raidcall) FF Plugin: @t.garena.com/garenatalk -> D:\garae\Garena Plus\bbtalk\plugins\npPlugin\npGarenaTalkPlugin.dll No File FF Plugin: @videolan.org/vlc,version=2.0.5 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN) FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF Plugin HKU\S-1-5-21-2058238302-804130530-2439220241-1000: @g2.com/iggweb3dupdater -> C:\Users\Ton\AppData\Roaming\IGG\Web3D\1.0.0.38\NPIGGWeb3DUpdater.dll (IGG) FF Plugin HKU\S-1-5-21-2058238302-804130530-2439220241-1000: @g2.com/joyconnectshell -> C:\Users\Ton\AppData\Roaming\IGG\Web3D\1.0.0.38\NPJoyConnectShell.dll (IGG) FF Plugin HKU\S-1-5-21-2058238302-804130530-2439220241-1000: @gentek.com/thinclient -> C:\IGG\twclient_us\npthinclient.dll No File FF Plugin HKU\S-1-5-21-2058238302-804130530-2439220241-1000: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\Ton\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS) FF user.js: detected! => C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\user.js FF Extension: Skype Click to Call - C:\Program Files\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi [2014-10-02] FF HKLM\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF FF Extension: avast! Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2013-05-05] FF HKLM\...\Firefox\Extensions: [{b9bfaf1c-a63f-47cd-0829-29526ced3667}] - C:\Program Files\Mozilla Firefox\extension\\getvideosoft.xpi FF Extension: YouTube Downloader and Converter - C:\Program Files\Mozilla Firefox\extension\\getvideosoft.xpi [2014-10-02] FF HKLM\...\Firefox\Extensions: [{b9bfaf1c-a63f-47cd-0829-29526ced3775}] - C:\Program Files\Mozilla Firefox\extension\\freeyoubutetomp3.xpi FF Extension: YouTube Downloader and Converter - C:\Program Files\Mozilla Firefox\extension\\freeyoubutetomp3.xpi [2014-10-02] FF HKLM\...\Mozilla Firefox 30.0\Extensions: [{b9bfaf1c-a63f-47cd-0829-29526ced3667}] - C:\Program Files\Mozilla Firefox\extension\\getvideosoft.xpi FF HKLM\...\Mozilla Firefox 30.0\Extensions: [{b9bfaf1c-a63f-47cd-0829-29526ced3775}] - C:\Program Files\Mozilla Firefox\extension\\freeyoubutetomp3.xpi FF Extension: No Name - C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com [Not Found] FF Extension: No Name - faststartff@gmail.com [Not Found] Chrome: ======= CHR HKLM\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2014-08-01] ========================== Services (Whitelisted) ================= (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-08-01] (AVAST Software) S2 BstHdAndroidSvc; C:\Program Files\BlueStacks\HD-Service.exe [409304 2014-10-07] (BlueStack Systems, Inc.) R2 BstHdLogRotatorSvc; C:\Program Files\BlueStacks\HD-LogRotatorService.exe [388824 2014-10-07] (BlueStack Systems, Inc.) R2 BstHdUpdaterSvc; C:\Program Files\BlueStacks\HD-UpdaterService.exe [782040 2014-10-07] (BlueStack Systems, Inc.) R2 c2cautoupdatesvc; C:\Program Files\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1390176 2014-07-14] (Microsoft Corporation) R2 c2cpnrsvc; C:\Program Files\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1767520 2014-07-14] (Microsoft Corporation) R2 Intel® Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [463896 2012-07-27] (Intel® Corporation) R2 jhi_service; C:\Program Files\Intel\Intel® Management Engine Components\DAL\jhi_service.exe [164736 2013-02-03] (Intel Corporation) R2 MyEpson Portal Service; C:\Program Files\EPSON\MyEpson Portal\mepService.exe [703616 2012-07-26] (SEIKO EPSON CORPORATION) R2 WindowsVNT; C:\Program Files\Windows Network Accelerater\winvxm.exe [2966120 2014-09-09] (MicroStudio) [File not signed] R2 YouTubeDownload_P4; C:\Program Files\YouTube Downloader Services\P4\youtubeserv.exe [2965968 2014-11-22] (MicroTools) ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [24184 2014-08-01] () R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [67824 2014-08-01] (AVAST Software) R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [81768 2014-08-01] (AVAST Software) R0 aswRvrt; C:\Windows\system32\Drivers\aswRvrt.sys [49944 2014-08-01] () R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [779536 2014-11-22] (AVAST Software) R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [414520 2014-08-01] (AVAST Software) S2 aswStm; C:\Windows\system32\drivers\aswStm.sys [71944 2014-08-01] (AVAST Software) R0 aswVmm; C:\Windows\system32\Drivers\aswVmm.sys [192352 2014-08-01] () R2 BstHdDrv; C:\Program Files\BlueStacks\HD-Hypervisor-x86.sys [112344 2014-10-07] (BlueStack Systems) R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [242240 2013-03-12] (DT Soft Ltd) S3 ivusb; C:\Windows\System32\DRIVERS\ivusb.sys [25112 2010-07-29] (Initio Corporation) S3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [114904 2014-12-15] (Malwarebytes Corporation) R3 MEI; C:\Windows\System32\DRIVERS\HECI.sys [55104 2013-02-03] (Intel Corporation) S0 sptd; C:\Windows\System32\Drivers\sptd.sys [717296 2013-03-10] (Duplex Secure Ltd.) S3 catchme; \??\C:\Users\Ton\AppData\Local\Temp\catchme.sys [X] S3 EagleXNt; \??\C:\Windows\system32\drivers\EagleXNt.sys [X] S3 GGSAFERDriver; \??\D:\garae\Garena Plus\Room\safedrv.sys [X] S3 netr28u; system32\DRIVERS\netr28u.sys [X] S3 vtany; \??\C:\Windows\vtany.sys [X] ==================== NetSvcs (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.) ==================== One Month Created Files and Folders ======== (If an entry is included in the fixlist, the file\folder will be moved.) 2014-12-15 08:41 - 2014-12-15 08:42 - 00014611 _____ () C:\Users\Ton\Desktop\FRST.txt 2014-12-15 08:41 - 2014-12-15 08:41 - 00000000 ____D () C:\Users\Ton\Desktop\FRST-OlderVersion 2014-12-14 20:20 - 2014-12-14 20:20 - 00360303 _____ () C:\Users\Ton\Desktop\The Rosie Effect - Graeme Simsion.epub 2014-12-13 17:47 - 2014-12-13 17:47 - 00852505 _____ () C:\Users\Ton\Desktop\SecurityCheck.exe 2014-12-12 08:09 - 2014-12-12 08:09 - 00001804 _____ () C:\Users\Public\Desktop\Apps.lnk 2014-12-12 08:09 - 2014-12-12 08:09 - 00001725 _____ () C:\Users\Public\Desktop\Start BlueStacks.lnk 2014-12-12 08:08 - 2014-12-12 08:08 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\BlueStacks 2014-12-12 08:08 - 2014-12-12 08:08 - 00000000 ____D () C:\ProgramData\BlueStacks 2014-12-12 08:08 - 2014-12-12 08:08 - 00000000 ____D () C:\Program Files\BlueStacks 2014-12-12 08:07 - 2014-12-12 08:07 - 00000000 ____D () C:\Users\Ton\AppData\Local\Bluestacks 2014-12-12 07:59 - 2014-12-12 08:01 - 13444288 _____ (BlueStack Systems Inc.) C:\Users\Ton\Desktop\BlueStacks-SplitInstaller_native.exe 2014-12-10 08:03 - 2014-12-10 08:03 - 00012704 _____ () C:\ComboFix.txt 2014-12-09 17:33 - 2014-12-09 17:33 - 00031232 _____ () C:\Users\Ton\Desktop\3.2.3 Example - Project Schedule, v 1.0.1.xls 2014-12-09 17:11 - 2014-12-09 18:05 - 00013240 _____ () C:\Users\Ton\Desktop\mancon.xlsx 2014-12-09 09:18 - 2014-12-09 09:18 - 00001410 _____ () C:\Users\Ton\Desktop\teqeqweqwe.txt 2014-12-09 09:16 - 2014-12-09 09:16 - 00001410 _____ () C:\tesewqeqwe.txt 2014-12-08 23:23 - 2014-12-08 23:24 - 03166947 _____ () C:\Users\Ton\Desktop\elvui-7.64.zip 2014-12-06 06:34 - 2014-12-06 06:39 - 01404329 _____ () C:\Users\Ton\Documents\image.jpeg 2014-12-06 02:52 - 2014-12-06 02:52 - 00030525 _____ () C:\test.txt 2014-12-06 02:15 - 2014-12-15 08:09 - 00114904 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2014-12-06 02:14 - 2014-12-06 02:14 - 00001020 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk 2014-12-06 02:14 - 2014-12-06 02:14 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware 2014-12-06 02:14 - 2014-12-06 02:14 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-12-06 02:14 - 2014-12-06 02:14 - 00000000 ____D () C:\Program Files\Malwarebytes Anti-Malware 2014-12-06 02:14 - 2014-11-21 06:14 - 00075480 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys 2014-12-06 02:14 - 2014-11-21 06:14 - 00051928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys 2014-12-06 02:14 - 2014-11-21 06:14 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2014-12-06 01:48 - 2014-12-06 01:51 - 20447072 _____ (Malwarebytes Corporation ) C:\Users\Ton\Documents\mbam-setup-2.0.4.1028.exe 2014-12-06 00:57 - 2014-12-06 00:57 - 00321848 _____ (Malwarebytes Corporation) C:\Users\Ton\Documents\mbam-clean-2.1.1.1001.exe 2014-11-29 17:47 - 2014-11-29 17:47 - 00000719 _____ () C:\Users\Public\Desktop\World of Warcraft.lnk 2014-11-29 17:47 - 2014-11-29 17:47 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\World of Warcraft 2014-11-29 16:50 - 2014-12-15 08:41 - 01111040 _____ (Farbar) C:\Users\Ton\Desktop\FRST.exe 2014-11-29 16:32 - 2014-12-15 08:35 - 00000497 _____ () C:\Users\Ton\Desktop\re2c.txt 2014-11-29 16:27 - 2014-11-29 16:27 - 00001077 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk 2014-11-29 16:27 - 2014-11-29 16:27 - 00001065 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk 2014-11-29 16:27 - 2014-11-29 16:27 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service 2014-11-29 16:21 - 2014-11-29 16:21 - 00244120 _____ () C:\Users\Ton\Desktop\Firefox Setup Stub 33.1.1.exe 2014-11-27 16:49 - 2014-11-27 16:49 - 00000000 __SHD () C:\Users\Ton\AppData\Local\EmieBrowserModeList 2014-11-27 15:37 - 2014-11-28 08:07 - 00000000 ____D () C:\Users\Ton\AppData\Local\CatalinaGroup 2014-11-27 15:32 - 2014-11-27 15:32 - 00000000 ____D () C:\Users\Ton\AppData\Local\Maxiget 2014-11-27 15:32 - 2014-11-27 15:32 - 00000000 ____D () C:\Program Files\Maxiget 2014-11-22 10:11 - 2014-11-22 10:30 - 146877652 ____R () C:\Users\Ton\Downloads\The.Big.Bang.Theory.S08E10.HDTV.x264-LOL.mp4 2014-11-21 01:42 - 2014-11-29 13:25 - 00000000 ____D () C:\Program Files\AspInfo 2014-11-21 01:42 - 2014-11-22 23:36 - 00000000 ____D () C:\Program Files\Software Update Services 2014-11-18 10:08 - 2014-11-18 10:09 - 00000000 ____D () C:\Users\Ton\Downloads\Five Finger Death Punch - The Wrong Side of Heaven & The Righteous Side of Hell 2014-11-16 14:00 - 2013-10-02 08:42 - 00049152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\TsUsbFlt.sys 2014-11-16 14:00 - 2013-10-02 08:32 - 00012800 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbRedirectionGroupPolicyControl.exe 2014-11-16 14:00 - 2013-10-02 08:30 - 00014336 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbRedirectionGroupPolicyExtension.dll 2014-11-16 14:00 - 2013-10-02 08:14 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\MsRdpWebAccess.dll 2014-11-16 14:00 - 2013-10-02 08:14 - 00017920 _____ (Microsoft Corporation) C:\Windows\system32\wksprtPS.dll 2014-11-16 14:00 - 2013-10-02 07:58 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\tsgqec.dll 2014-11-16 14:00 - 2013-10-02 07:45 - 00032256 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbGDCoInstaller.dll 2014-11-16 14:00 - 2013-10-02 07:08 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\rdvidcrl.dll 2014-11-16 14:00 - 2013-10-02 07:00 - 00076288 _____ (Microsoft Corporation) C:\Windows\system32\TSWbPrxy.exe 2014-11-16 14:00 - 2013-10-02 06:53 - 00350208 _____ (Microsoft Corporation) C:\Windows\system32\wksprt.exe 2014-11-16 14:00 - 2013-10-02 06:34 - 01068544 _____ (Microsoft Corporation) C:\Windows\system32\mstsc.exe 2014-11-16 13:59 - 2013-10-02 04:55 - 05698048 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll 2014-11-15 03:40 - 2014-12-10 08:03 - 00000000 ____D () C:\Qoobox 2014-11-15 03:40 - 2011-06-26 14:45 - 00256000 _____ () C:\Windows\PEV.exe 2014-11-15 03:40 - 2010-11-08 01:20 - 00208896 _____ () C:\Windows\MBR.exe 2014-11-15 03:40 - 2009-04-20 12:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe 2014-11-15 03:40 - 2000-08-31 08:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe 2014-11-15 03:40 - 2000-08-31 08:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe 2014-11-15 03:40 - 2000-08-31 08:00 - 00098816 _____ () C:\Windows\sed.exe 2014-11-15 03:40 - 2000-08-31 08:00 - 00080412 _____ () C:\Windows\grep.exe 2014-11-15 03:40 - 2000-08-31 08:00 - 00068096 _____ () C:\Windows\zip.exe ==================== One Month Modified Files and Folders ======= (If an entry is included in the fixlist, the file\folder will be moved.) 2014-12-15 08:41 - 2014-10-31 09:36 - 00000000 ____D () C:\FRST 2014-12-15 08:41 - 2013-02-03 19:35 - 00000000 ____D () C:\Program Files\Steam 2014-12-15 08:39 - 2009-07-14 12:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2014-12-15 08:39 - 2009-07-14 12:39 - 00317236 _____ () C:\Windows\setupact.log 2014-12-15 08:38 - 2014-09-20 01:22 - 00000000 ____D () C:\Users\Ton\AppData\Local\Glyph 2014-12-15 08:38 - 2013-02-04 11:10 - 01199354 _____ () C:\Windows\WindowsUpdate.log 2014-12-15 08:37 - 2013-02-09 12:27 - 00000000 ____D () C:\Program Files\Google 2014-12-15 08:36 - 2013-02-09 12:27 - 00000000 ____D () C:\Users\Ton\AppData\Local\Google 2014-12-15 08:15 - 2009-07-14 12:34 - 00031904 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2014-12-15 08:15 - 2009-07-14 12:34 - 00031904 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2014-12-14 22:50 - 2014-01-22 23:38 - 00000000 ____D () C:\Users\Ton\AppData\Local\Battle.net 2014-12-14 20:23 - 2010-11-21 05:01 - 00782470 _____ () C:\Windows\system32\PerfStringBackup.INI 2014-12-14 12:56 - 2014-01-13 10:30 - 00000000 ____D () C:\Users\Ton\AppData\Local\CrashDumps 2014-12-13 17:03 - 2014-01-22 23:38 - 00000000 ____D () C:\Program Files\Battle.net 2014-12-13 17:02 - 2013-02-03 19:35 - 00000000 ____D () C:\Program Files\Common Files\Steam 2014-12-12 20:57 - 2014-11-04 23:29 - 00000948 _____ () C:\Users\Ton\Desktop\Rkill.txt 2014-12-12 09:10 - 2009-07-14 10:37 - 00000000 ____D () C:\Windows\Microsoft.NET 2014-12-12 08:09 - 2009-07-14 10:37 - 00000000 __RHD () C:\Users\Public\Libraries 2014-12-11 23:54 - 2013-03-16 13:57 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk 2014-12-11 03:58 - 2013-02-09 14:56 - 00000000 ____D () C:\Users\Ton\AppData\Roaming\vlc 2014-12-10 16:33 - 2010-11-21 05:48 - 01668076 _____ () C:\Windows\PFRO.log 2014-12-10 08:01 - 2009-07-14 10:04 - 00000215 _____ () C:\Windows\system.ini 2014-12-07 05:56 - 2009-07-14 10:37 - 00000000 ____D () C:\Windows\system 2014-11-30 21:00 - 2013-12-02 21:09 - 00000008 __RSH () C:\Users\Ton\ntuser.pol 2014-11-30 21:00 - 2013-02-09 13:37 - 00000008 __RSH () C:\ProgramData\ntuser.pol 2014-11-30 21:00 - 2013-02-03 19:13 - 00000000 ____D () C:\Users\Ton 2014-11-30 20:57 - 2009-07-14 10:37 - 00000000 ___HD () C:\Windows\system32\GroupPolicy 2014-11-29 17:50 - 2013-03-11 18:52 - 00000000 ____D () C:\Users\Ton\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games 2014-11-29 16:27 - 2014-10-02 00:12 - 00000000 ____D () C:\Program Files\Mozilla Firefox 2014-11-28 08:16 - 2013-03-15 21:35 - 00000000 ____D () C:\Program Files\Microsoft Office 2014-11-28 08:11 - 2013-02-03 19:13 - 00001413 _____ () C:\Users\Ton\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk 2014-11-28 08:11 - 2009-07-14 10:04 - 00000580 _____ () C:\Windows\win.ini 2014-11-24 09:14 - 2013-02-12 18:17 - 00000000 ____D () C:\Users\Ton\AppData\Roaming\uTorrent 2014-11-22 23:36 - 2014-09-29 00:41 - 00000000 ____D () C:\Program Files\YouTube Downloader Services 2014-11-22 02:51 - 2013-05-05 11:48 - 00779536 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsnx.sys 2014-11-18 04:10 - 2009-07-14 10:37 - 00000000 ____D () C:\Windows\rescache 2014-11-18 03:06 - 2013-02-10 15:47 - 00000000 ____D () C:\Users\Ton\Documents\From RB 2014-11-17 14:37 - 2009-07-14 10:37 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories 2014-11-16 02:34 - 2009-07-14 12:53 - 00032646 _____ () C:\Windows\Tasks\SCHEDLGU.TXT 2014-11-15 03:40 - 2014-10-27 08:34 - 00000000 ____D () C:\Windows\erdnt ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\explorer.exe => File is digitally signed C:\Windows\system32\winlogon.exe => File is digitally signed C:\Windows\system32\wininit.exe => File is digitally signed C:\Windows\system32\svchost.exe => File is digitally signed C:\Windows\system32\services.exe => File is digitally signed C:\Windows\system32\User32.dll => File is digitally signed C:\Windows\system32\userinit.exe => File is digitally signed C:\Windows\system32\rpcss.dll => File is digitally signed C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2014-12-06 04:03 ==================== End Of Log ============================ Additional scan result of Farbar Recovery Scan Tool (x86) Version: 14-12-2014 01 Ran by Ton at 2014-12-15 08:42:23 Running from C:\Users\Ton\Desktop Boot Mode: Normal ========================================================== ==================== Security Center ======================== (If an entry is included in the fixlist, it will be removed.) AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B} AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736} ==================== Installed Programs ====================== (Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.) Adobe After Effects CS4 (HKLM\...\Adobe_3dcb365ab9e01871fb8c6f27b0ea079) (Version: 9 - Adobe Systems Incorporated) Adobe AIR (HKLM\...\Adobe AIR) (Version: 1.1.0.5790 - Adobe Systems Inc.) Adobe Reader XI (11.0.10) (HKLM\...\{AC76BA86-7AD7-1033-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated) AMD Catalyst Install Manager (HKLM\...\{3825F8BD-F784-6FBB-A5CD-857559148007}) (Version: 8.0.903.0 - Advanced Micro Devices, Inc.) Apple Application Support (HKLM\...\{D9DAD0FF-495A-472B-9F10-BAE430A26682}) (Version: 3.0.3 - Apple Inc.) Apple Mobile Device Support (HKLM\...\{18D47FA1-0440-48D3-A7E0-DA09537FF471}) (Version: 7.1.1.3 - Apple Inc.) Apple Software Update (HKLM\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.) Audacity 2.0.5 (HKLM\...\Audacity_is1) (Version: 2.0.5 - Audacity Team) Autorun Eater v2.6 (HKLM\...\Autorun Eater_is1) (Version: 2.6 - Old McDonald's Farm) avast! Free Antivirus (HKLM\...\avast) (Version: 9.0.2021 - AVAST Software) AVS Screen Capture version 1.1.2 (HKLM\...\AVS Screen Capture_is1) (Version: - Online Media Technologies Ltd.) AVS Update Manager 1.0 (HKLM\...\AVS Update Manager_is1) (Version: - Online Media Technologies Ltd.) AVS Video Editor 5 (HKLM\...\AVS Video Editor_is1) (Version: - Online Media Technologies Ltd.) AVS Video Recorder 2.4 (HKLM\...\AVS Video Recorder_is1) (Version: - Online Media Technologies Ltd.) AVS4YOU Software Navigator 1.4 (HKLM\...\AVS4YOU Software Navigator_is1) (Version: - Online Media Technologies Ltd.) Batman Arkham Origins (HKLM\...\QmF0bWFuQXJraGFtT3JpZ2lucw==_is1) (Version: 1 - ) Battle.net (HKLM\...\Battle.net) (Version: - Blizzard Entertainment) BlueStacks App Player (HKLM\...\BlueStacks App Player) (Version: 0.9.4.4078 - BlueStack Systems, Inc.) BlueStacks Notification Center (HKLM\...\{152E0B21-19D5-4772-9EF8-8E76074B0C0A}) (Version: 0.9.4.4078 - BlueStack Systems, Inc.) Bonjour (HKLM\...\{79155F2B-9895-49D7-8612-D92580E0DE5B}) (Version: 3.0.0.10 - Apple Inc.) CCleaner (HKLM\...\CCleaner) (Version: 4.04 - Piriform) Counter-Strike: Global Offensive (HKLM\...\Steam App 730) (Version: - Valve) D3DX10 (Version: 15.4.2368.0902 - Microsoft) Hidden DAEMON Tools Lite (HKLM\...\DAEMON Tools Lite) (Version: 4.46.1.0328 - DT Soft Ltd) Diablo III (HKLM\...\Diablo III) (Version: - Blizzard Entertainment) Dota 2 (HKLM\...\Steam App 570) (Version: - Valve) Dota 2 Workshop Tools Alpha (HKLM\...\Steam App 316570) (Version: - ) EPSON L200 Series Printer Uninstall (HKLM\...\EPSON L200 Series) (Version: - SEIKO EPSON Corporation) ERUNT 1.1j (HKLM\...\ERUNT_is1) (Version: - Lars Hederer) ESET Online Scanner v3 (HKLM\...\ESET Online Scanner) (Version: - ) GS Auto Clicker (HKLM\...\GS Auto Clicker_is1) (Version: V3.1.3 - goldensoft.org) Hearthstone (HKLM\...\Hearthstone) (Version: - Blizzard Entertainment) Heroes of the Storm (HKLM\...\Heroes of the Storm) (Version: - Blizzard Entertainment) HiJackThis (HKLM\...\{45A66726-69BC-466B-A7A4-12FCBA4883D7}) (Version: 1.0.0 - Trend Micro) Icewind Dale Enhanced Edition (HKLM\...\Icewind Dale Enhanced Edition_is1) (Version: - ) IGG Web3D Player version 1.0.0.38 (HKU\S-1-5-21-2058238302-804130530-2439220241-1000\...\IGG Web3D Player_is1) (Version: 1.0.0.38 - IGG, Inc.) Intel® Management Engine Components (HKLM\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 8.1.20.1337 - Intel Corporation) iPod Reset Utility (HKLM\...\{20ED157B-1A84-4DF7-945E-4951A38A9CBA}) (Version: 1.0.4.71 - Apple Inc.) iTunes (HKLM\...\{0718A90E-93AA-49AF-A4FE-0165ACD91DF0}) (Version: 11.2.2.3 - Apple Inc.) Left 4 Dead 2 (HKLM\...\Steam App 550) (Version: - Valve) Malwarebytes Anti-Malware version 2.0.4.1028 (HKLM\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation) Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation) Microsoft Office 2007 Service Pack 3 (SP3) (HKLM\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version: - Microsoft) Microsoft Office Enterprise 2007 (HKLM\...\ENTERPRISE) (Version: 12.0.6612.1000 - Microsoft Corporation) Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (HKLM\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (HKLM\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation) Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation) Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.51106 (HKLM\...\{615bc16d-60f5-482e-91b3-b51d8130963b}) (Version: 11.0.51106.1 - Корпорация Майкрософт) Movie Maker (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden Mozilla Firefox 33.1.1 (x86 en-US) (HKLM\...\Mozilla Firefox 33.1.1 (x86 en-US)) (Version: 33.1.1 - Mozilla) Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 33.1.1 - Mozilla) MSVCRT (Version: 15.4.2862.0708 - Microsoft) Hidden MSVCRT Redists (Version: 1.0 - Sony Creative Software Inc.) Hidden MSVCRT110 (Version: 16.4.1108.0727 - Microsoft) Hidden MyEpson Portal (HKLM\...\MyEpson Portal) (Version: - SEIKO EPSON Corporation) MyEpson Portal (Version: 1.0.3.0 - SEIKO EPSON CORPORATION) Hidden Notepad++ (HKLM\...\Notepad++) (Version: 6.4.5 - Notepad++ Team) NVIDIA PhysX (HKLM\...\{8B922CF8-8A6C-41CE-A858-F1755D7F5D29}) (Version: 9.12.1031 - NVIDIA Corporation) OpenAL (HKLM\...\OpenAL) (Version: - ) OpenOffice 4.1.0 (HKLM\...\{C87EF11D-36E9-479D-9898-7541EA1E8A6A}) (Version: 4.10.9764 - Apache Software Foundation) Photo Common (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden Photo Gallery (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden Photoshop Camera Raw (Version: 5.0 - Adobe Systems Incorporated) Hidden RaidCall (HKLM\...\RaidCall) (Version: 7.3.0-1.0.10926.49 - raidcall.com) RAR Password Unlocker 4.2.0.0 (HKLM\...\{B789FA51-6A71-408F-92DE-EDE4A517B8F9}_is1) (Version: - Password Unlocker Studio) Realtek Ethernet Controller Driver (HKLM\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.53.216.2012 - Realtek) Realtek High Definition Audio Driver (HKLM\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6813 - Realtek Semiconductor Corp.) Skype Click to Call (HKLM\...\{6D1221A9-17BF-4EC0-81F2-27D30EC30701}) (Version: 7.3.16540.9015 - Microsoft Corporation) Skype™ 6.20 (HKLM\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 6.20.104 - Skype Technologies S.A.) StarCraft II (HKLM\...\StarCraft II) (Version: - Blizzard Entertainment) Steam (HKLM\...\{048298C9-A4D3-490B-9FF9-AB023A9238F3}) (Version: 1.0.0.0 - Valve Corporation) Suite Shared Configuration CS4 (Version: 1.0 - Adobe Systems Incorporated) Hidden Tombraider (HKLM\...\Tombraider_is1) (Version: - ) TuneUp Utilities 2014 (en-GB) (Version: 14.0.1000.275 - TuneUp Software) Hidden Unity Web Player (HKU\S-1-5-21-2058238302-804130530-2439220241-1000\...\UnityWebPlayer) (Version: - Unity Technologies ApS) Update for 2007 Microsoft Office System (KB967642) (HKLM\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version: - Microsoft) Vegas Pro 11.0 (HKLM\...\{6AEFCA01-8DF1-11E1-A17B-F04DA23A5C58}) (Version: 11.0.682 - Sony) Ventrilo Client (HKLM\...\{789289CA-F73A-4A16-A331-54D498CE069F}) (Version: 3.0.8 - Flagship Industries, Inc.) VLC media player 2.0.5 (HKLM\...\VLC media player) (Version: 2.0.5 - VideoLAN) VoiceOver Kit (HKLM\...\{6B4AD1A9-E73A-4184-9D6B-072F8A3C5EBA}) (Version: 1.42.128.0 - Apple Inc.) VST Bridge 1.1 (HKLM\...\VST Bridge_is1) (Version: - ) Warframe (HKLM\...\Steam App 230410) (Version: - Digital Extremes) Warkeys 1.21.0.0b (HKLM\...\Warkeys) (Version: 1.21.0.0b - ) Windows Live Essentials (HKLM\...\WinLiveSuite) (Version: 16.4.3528.0331 - Microsoft Corporation) WinRAR 4.20 (32-bit) (HKLM\...\WinRAR archiver) (Version: 4.20.0 - win.rar GmbH) World of Warcraft (HKLM\...\World of Warcraft) (Version: - Blizzard Entertainment) ==================== Custom CLSID (selected items): ========================== (If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.) CustomCLSID: HKU\S-1-5-21-2058238302-804130530-2439220241-1000_Classes\CLSID\{316AB005-10AA-4B8D-B7C8-60965DF020A4}\InprocServer32 -> C:\Users\Ton\AppData\Roaming\IGG\Web3D\1.0.0.38\NPIGGWeb3DUpdater.dll (IGG) CustomCLSID: HKU\S-1-5-21-2058238302-804130530-2439220241-1000_Classes\CLSID\{444785F1-DE89-4295-863A-D46C3A781394}\InprocServer32 -> C:\Users\Ton\AppData\LocalLow\Unity\WebPlayer\loader\UnityWebPluginAX.ocx (Unity Technologies ApS) CustomCLSID: HKU\S-1-5-21-2058238302-804130530-2439220241-1000_Classes\CLSID\{8BF2F61B-E8C2-4A67-85D0-D6A69F9FD948}\localserver32 -> "C:\Users\Ton\AppData\Local\CatalinaGroup\Citrio\Application\38.0.2125.246\delegate_execute.exe" No (the data entry has 4 more characters). CustomCLSID: HKU\S-1-5-21-2058238302-804130530-2439220241-1000_Classes\CLSID\{EED35E4B-2023-4680-A85C-C654515D97B8}\InprocServer32 -> C:\Users\Ton\AppData\Roaming\IGG\Web3D\1.0.0.38\NPJoyConnectShell.dll (IGG) ==================== Restore Points ========================= 05-12-2014 20:01:53 Windows Update 09-12-2014 23:48:56 ComboFix created restore point 11-12-2014 18:07:49 Windows Update 11-12-2014 23:55:14 Removed BlueStacks Notification Center ==================== Hosts content: ========================== (If needed Hosts: directive could be included in the fixlist to reset Hosts.) 2014-10-27 07:52 - 2014-10-27 07:52 - 00000000 ____A C:\Windows\system32\Drivers\etc\hosts ==================== Scheduled Tasks (whitelisted) ============= (If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.) Task: {0A5F117B-9556-4558-81A3-4DDF73F32AA4} - System32\Tasks\{2161BB1F-D957-43B1-9125-611BD1F35D11} => C:\Program Files\iPod\iPod Reset Utility\iPodResetUtility.exe [2008-04-23] () Task: {1009DDF2-0319-4573-87CC-DEA3B1D0B99D} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe Task: {1B0631FE-29F1-4FF9-90F4-D5A6A9C1E3B0} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe Task: {33FB8668-D0F2-40AF-93D6-CBE971CE23FE} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2014-08-01] (AVAST Software) Task: {3DD532BF-DDEA-4EA3-A935-40CEA3D49D62} - System32\Tasks\{B597E01A-21C6-4C5F-8F2D-9C9BA7111576} => C:\Program Files\iPod\iPod Reset Utility\iPodResetUtility.exe [2008-04-23] () Task: {63EA90ED-BAD0-47D0-9E95-74EEFF3FA6FF} - System32\Tasks\{1CA5AE33-375F-4882-A854-16A864F08607} => C:\Program Files\iPod\iPod Reset Utility\iPodResetUtility.exe [2008-04-23] () Task: {67C0A47A-2B94-4FC7-A5D9-6B6FE7EB536C} - System32\Tasks\{2D13C93D-C8EC-4169-8930-29D3A6E49F4D} => C:\Program Files\iPod\iPod Reset Utility\iPodResetUtility.exe [2008-04-23] () Task: {768AC9BA-D00B-49F3-98B9-8396E4199AA9} - System32\Tasks\{13CA50D8-F769-4425-BF59-5E838CED2CAA} => C:\Program Files\iPod\iPod Reset Utility\iPodResetUtility.exe [2008-04-23] () Task: {8DFA6570-EE00-49F1-B5E9-4A845C651F72} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2013-07-23] (Piriform Ltd) Task: {9275C216-B734-483A-AC64-0098B4C3450E} - System32\Tasks\{37337B43-30FF-42DD-881A-F70EFEB6BD89} => pcalua.exe -a "C:\Program Files\AVAST Software\Avast\aswRunDll.exe" -c "C:\Program Files\AVAST Software\Avast\Setup\setiface.dll" RunSetup Task: {92F50B85-8B6C-40CB-A458-088998385FED} - System32\Tasks\{6AA363C1-BA68-47A6-B91F-CA8A4C648698} => C:\Program Files\Adobe\Adobe After Effects CS4\Support Files\AfterFX.exe [2008-09-03] (Adobe Systems Incorporated) Task: {96F9CEA0-6E93-4678-B1DF-6B74972A92AB} - System32\Tasks\{3D3E26C6-CA54-415A-92C8-C52A79433DB7} => C:\Program Files\iPod\iPod Reset Utility\iPodResetUtility.exe [2008-04-23] () Task: {9DF77BB7-83CB-4B1A-BA95-8A81EB857F29} - System32\Tasks\{9B43CD1A-2E1D-4AB6-81FB-76A3EF45307A} => C:\Program Files\iPod\iPod Reset Utility\iPodResetUtility.exe [2008-04-23] () Task: {AB8B3B93-BDA7-428D-855F-037CEE2D9271} - System32\Tasks\{A087439A-F375-4ACF-837B-E73EE5F7DCAE} => pcalua.exe -a C:\Windows\system32\pcwrun.exe -c "C:\Program Files\iPod\iPod Reset Utility\iPodResetUtility.exe" Task: {BB875151-2256-48A3-A1C0-F82EF25F461E} - System32\Tasks\{145BB0A2-4272-4D91-A8EF-5E2C719664E3} => C:\Program Files\iPod\iPod Reset Utility\iPodResetUtility.exe [2008-04-23] () Task: {C469A803-9509-4989-95BC-14BAE08EB1FD} - System32\Tasks\{F32E7414-44E7-431F-84C4-3699FF5C4B49} => C:\Program Files\iPod\iPod Reset Utility\iPodResetUtility.exe [2008-04-23] () Task: {DE61F50B-A596-4628-8FA7-2EE0346BE5BA} - System32\Tasks\{79B909C8-937B-453B-A17A-5E1B4FE228E1} => D:\New folder (2)\Deadpool\Binaries\DP.exe Task: {E11F640B-E024-42B7-88A1-D2C299A191E6} - System32\Tasks\gg_uac_daemon_Ton => D:\garae\Garena Plus\ggdllhost.exe [2014-09-18] () Task: {E3106650-90F2-4815-8AE6-079B2C25E1BB} - System32\Tasks\{F76113AB-CFA3-421E-8C86-04CB34F6607E} => C:\Program Files\iPod\iPod Reset Utility\iPodResetUtility.exe [2008-04-23] () Task: {E4B0DB4A-5EC4-45B9-AD72-6D1492FDECD5} - System32\Tasks\{7868384C-0C4E-4564-83BD-E903E6EDA776} => C:\Program Files\iPod\iPod Reset Utility\iPodResetUtility.exe [2008-04-23] () Task: {F23D3A5E-6D08-4293-8B5C-54639F2EABB1} - System32\Tasks\{074BF9E1-ECD2-4672-8DCC-F527E11D9997} => pcalua.exe -a C:\Users\Ton\Downloads\iPodResetUtilitySetup.exe -d C:\Users\Ton\Downloads Task: {F911CA0D-B4E2-4D34-A55E-81BA69CF6EA5} - System32\Tasks\{139163B0-6438-4DB5-8E26-E0264B3A02F0} => C:\Program Files\iPod\iPod Reset Utility\iPodResetUtility.exe [2008-04-23] () (If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.) ==================== Loaded Modules (whitelisted) ============= 2014-08-01 17:59 - 2014-08-01 17:59 - 00301152 _____ () C:\Program Files\AVAST Software\Avast\aswProperty.dll 2014-12-15 08:09 - 2014-12-15 08:09 - 02908160 _____ () C:\Program Files\AVAST Software\Avast\defs\14121401\algo.dll 2014-04-23 16:05 - 2014-04-23 16:05 - 00073544 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll 2014-04-23 16:04 - 2014-04-23 16:04 - 01044808 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll 2012-06-18 23:24 - 2012-06-18 23:24 - 00260096 _____ () C:\Program Files\Notepad++\NppShell_05.dll 2014-09-18 15:46 - 2014-09-18 15:46 - 00049456 _____ () D:\garae\Garena Plus\ggdllhost.exe 2014-09-18 15:46 - 2014-09-18 15:46 - 00553776 _____ () D:\garae\Garena Plus\ggspawn.dll 2014-08-01 17:59 - 2014-08-01 17:59 - 19329904 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll ==================== Alternate Data Streams (whitelisted) ========= (If an entry is included in the fixlist, only the Alternate Data Streams will be removed.) ==================== Safe Mode (whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.) ==================== EXE Association (whitelisted) ============= (If an entry is included in the fixlist, the default will be restored. None default entries will be removed.) ==================== MSCONFIG/TASK MANAGER disabled items ========= (Currently there is no automatic fix for this section.) ========================= Accounts: ========================== Administrator (S-1-5-21-2058238302-804130530-2439220241-500 - Administrator - Disabled) Guest (S-1-5-21-2058238302-804130530-2439220241-501 - Limited - Disabled) HomeGroupUser$ (S-1-5-21-2058238302-804130530-2439220241-1002 - Limited - Enabled) Ton (S-1-5-21-2058238302-804130530-2439220241-1000 - Administrator - Enabled) => C:\Users\Ton ==================== Faulty Device Manager Devices ============= Name: Microsoft PS/2 Mouse Description: Microsoft PS/2 Mouse Class Guid: {4d36e96f-e325-11ce-bfc1-08002be10318} Manufacturer: Microsoft Service: i8042prt Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24) Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed. Devices stay in this state if they have been prepared for removal. After you remove the device, this error disappears.Remove the device, and this error should be resolved. Name: Standard PS/2 Keyboard Description: Standard PS/2 Keyboard Class Guid: {4d36e96b-e325-11ce-bfc1-08002be10318} Manufacturer: (Standard keyboards) Service: i8042prt Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24) Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed. Devices stay in this state if they have been prepared for removal. After you remove the device, this error disappears.Remove the device, and this error should be resolved. ==================== Event log errors: ========================= Application errors: ================== Error: (12/15/2014 01:47:33 AM) (Source: BstHdAndroidSvc) (EventID: 0) (User: ) Description: Failed to shut down service. The error that occurred was: System.InvalidOperationException: UpdatePendingStatus can only be called during the handling of Start, Stop, Pause and Continue commands. at System.ServiceProcess.ServiceBase.RequestAdditionalTime(Int32 milliseconds) at BlueStacks.hyperDroid.Service.Service.OnStop() at BlueStacks.hyperDroid.Service.Service.OnShutdown() at System.ServiceProcess.ServiceBase.DeferredShutdown(). Error: (12/14/2014 00:55:45 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: Faulting application name: csgo.exe, version: 0.0.0.0, time stamp: 0x5462bb74 Faulting module name: tier0.dll, version: 0.0.0.0, time stamp: 0x546ef9d7 Exception code: 0x40000015 Fault offset: 0x0002051e Faulting process id: 0x1ee0 Faulting application start time: 0xcsgo.exe0 Faulting application path: csgo.exe1 Faulting module path: csgo.exe2 Report Id: csgo.exe3 Error: (12/14/2014 03:26:33 AM) (Source: BstHdAndroidSvc) (EventID: 0) (User: ) Description: Failed to shut down service. The error that occurred was: System.InvalidOperationException: UpdatePendingStatus can only be called during the handling of Start, Stop, Pause and Continue commands. at System.ServiceProcess.ServiceBase.RequestAdditionalTime(Int32 milliseconds) at BlueStacks.hyperDroid.Service.Service.OnStop() at BlueStacks.hyperDroid.Service.Service.OnShutdown() at System.ServiceProcess.ServiceBase.DeferredShutdown(). Error: (12/13/2014 11:58:42 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: Faulting application name: csgo.exe, version: 0.0.0.0, time stamp: 0x5462bb74 Faulting module name: tier0.dll, version: 0.0.0.0, time stamp: 0x546ef9d7 Exception code: 0x40000015 Fault offset: 0x0002051e Faulting process id: 0x25e0 Faulting application start time: 0xcsgo.exe0 Faulting application path: csgo.exe1 Faulting module path: csgo.exe2 Report Id: csgo.exe3 Error: (12/11/2014 11:53:45 PM) (Source: MsiInstaller) (EventID: 1024) (User: Ton-PC) Description: Product: Adobe Reader XI (11.0.09) - Update '{AC76BA86-7AD7-0000-2550-7A8C40011010}' could not be installed. Error code 1625. Windows Installer can create logs to help troubleshoot issues with installing software packages. Use the following link for instructions on turning on logging support: http://go.microsoft.com/fwlink/?LinkId=23127 Error: (12/06/2014 04:02:00 AM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: ) Description: Cryptographic Services failed while processing the OnIdentity() call in the System Writer Object. Details: AddLegacyDriverFiles: Unable to back up image of binary {cafa2341-3593-4cb1-a3e9-745f5dc21ff1}Gw. System Error: The system cannot find the file specified. . Error: (12/05/2014 00:03:31 AM) (Source: BstHdAndroidSvc) (EventID: 0) (User: ) Description: Service cannot be started. System.ApplicationException: Cannot start service. Service did not stop gracefully the last time it was run. at BlueStacks.hyperDroid.Service.Service.OnStart(String[] args) at System.ServiceProcess.ServiceBase.ServiceQueuedMainCallback(Object state) Error: (11/30/2014 09:12:12 PM) (Source: VSS) (EventID: 8194) (User: ) Description: Volume Shadow Copy Service error: Unexpected error querying for the IVssWriterCallback interface. hr = 0x80070005, Access is denied. . This is often caused by incorrect security settings in either the writer or requestor process. Operation: Gathering Writer Data Context: Writer Class Id: {e8132975-6f93-4464-a53e-1050253ae220} Writer Name: System Writer Writer Instance ID: {811f92a4-56b0-452b-85ad-d15cdc3b0076} Error: (11/29/2014 08:30:44 PM) (Source: Application Hang) (EventID: 1002) (User: ) Description: The program iexplore.exe version 11.0.9600.17420 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel. Process ID: f6c Start Time: 01d00bd027b6d97f Termination Time: 0 Application Path: C:\Program Files\Internet Explorer\iexplore.exe Report Id: Error: (11/27/2014 03:32:33 PM) (Source: MsiInstaller) (EventID: 11316) (User: Ton-PC) Description: Product: Google Update Helper -- Error 1316. The specified account already exists. System errors: ============= Error: (12/15/2014 08:40:31 AM) (Source: Service Control Manager) (EventID: 7026) (User: ) Description: The following boot-start or system-start driver(s) failed to load: sptd Error: (12/15/2014 08:38:59 AM) (Source: sptd) (EventID: 4) (User: ) Description: Driver detected an internal error in its data structures for . Error: (12/15/2014 08:08:22 AM) (Source: Service Control Manager) (EventID: 7026) (User: ) Description: The following boot-start or system-start driver(s) failed to load: sptd Error: (12/15/2014 08:06:48 AM) (Source: sptd) (EventID: 4) (User: ) Description: Driver detected an internal error in its data structures for . Error: (12/14/2014 11:45:15 AM) (Source: bowser) (EventID: 8003) (User: ) Description: The master browser has received a server announcement from the computer BALENG-PC that believes that it is the master browser for the domain on transport NetBT_Tcpip_{43F470EE-9997-4992-BF08-7CCDE476. The master browser is stopping or an election is being forced. Error: (12/14/2014 10:56:57 AM) (Source: Service Control Manager) (EventID: 7026) (User: ) Description: The following boot-start or system-start driver(s) failed to load: sptd Error: (12/14/2014 10:56:57 AM) (Source: Service Control Manager) (EventID: 7022) (User: ) Description: The BlueStacks Android Service service hung on starting. Error: (12/14/2014 10:54:10 AM) (Source: sptd) (EventID: 4) (User: ) Description: Driver detected an internal error in its data structures for . Error: (12/13/2014 05:06:58 PM) (Source: Service Control Manager) (EventID: 7022) (User: ) Description: The Windows Update service hung on starting. Error: (12/13/2014 05:02:12 PM) (Source: Service Control Manager) (EventID: 7026) (User: ) Description: The following boot-start or system-start driver(s) failed to load: sptd Microsoft Office Sessions: ========================= Error: (10/12/2013 00:22:14 AM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: ) Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 2314 seconds with 0 seconds of active time. This session ended with a crash. ==================== Memory info =========================== Processor: Intel® Core i3-2120 CPU @ 3.30GHz Percentage of memory in use: 31% Total physical RAM: 3563.71 MB Available physical RAM: 2446.57 MB Total Pagefile: 7125.7 MB Available Pagefile: 5926.64 MB Total Virtual: 2047.88 MB Available Virtual: 1906.79 MB ==================== Drives ================================ Drive c: () (Fixed) (Total:886.36 GB) (Free:213.47 GB) NTFS Drive d: () (Fixed) (Total:976.56 GB) (Free:248.02 GB) NTFS Drive e: () (Fixed) (Total:149.05 GB) (Free:81.62 GB) NTFS Drive f: (Icewind Dale EE) (CDROM) (Total:2.65 GB) (Free:0 GB) CDFS ==================== MBR & Partition Table ================== ======================================================== Disk: 0 (MBR Code: Windows 7 or 8) (Size: 1863 GB) (Disk ID: BB02619D) Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS) Partition 2: (Not Active) - (Size=886.4 GB) - (Type=07 NTFS) Partition 3: (Not Active) - (Size=976.6 GB) - (Type=07 NTFS) ======================================================== Disk: 1 (MBR Code: Windows 7 or 8) (Size: 149.1 GB) (Disk ID: D4EED4EE) Partition 1: (Not Active) - (Size=149 GB) - (Type=07 NTFS) ==================== End Of Log ============================
  5. successfully downloaded it. here are the logs Results of screen317's Security Check version 0.99.93 Windows 7 Service Pack 1 x86 (UAC is enabled) Internet Explorer 11 ``````````````Antivirus/Firewall Check:`````````````` Windows Firewall Enabled! Windows Firewall Disabled! avast! Antivirus Antivirus up to date! `````````Anti-malware/Other Utilities Check:````````` TuneUp Utilities 2014 (en-GB) CCleaner Adobe Reader XI Mozilla Firefox 33.1.1 Firefox out of Date! Google Chrome (39.0.2171.71) Google Chrome (39.0.2171.95) ````````Process Check: objlist.exe by Laurent```````` Malwarebytes Anti-Malware mbamservice.exe Malwarebytes Anti-Malware mbam.exe Malwarebytes Anti-Malware mbamscheduler.exe AVAST Software Avast AvastSvc.exe AVAST Software Avast AvastUI.exe `````````````````System Health check````````````````` Total Fragmentation on Drive C: 0% ````````````````````End of Log``````````````````````
  6. Here are the logs. No items were needed to be fixed Malwarebytes Anti-Malwarewww.malwarebytes.org Scan Date: 12/11/2014Scan Time: 8:54:05 AMLogfile: Administrator: Yes Version: 2.00.4.1028Malware Database: v2014.12.10.10Rootkit Database: v2014.12.08.03License: TrialMalware Protection: EnabledMalicious Website Protection: EnabledSelf-protection: Disabled OS: Windows 7 Service Pack 1CPU: x86File System: NTFSUser: Ton Scan Type: Threat ScanResult: CompletedObjects Scanned: 320988Time Elapsed: 21 min, 40 sec Memory: EnabledStartup: EnabledFilesystem: EnabledArchives: EnabledRootkits: DisabledHeuristics: EnabledPUP: EnabledPUM: Enabled Processes: 0(No malicious items detected) Modules: 0(No malicious items detected) Registry Keys: 0(No malicious items detected) Registry Values: 0(No malicious items detected) Registry Data: 0(No malicious items detected) Folders: 0(No malicious items detected) Files: 0(No malicious items detected) Physical Sectors: 0(No malicious items detected) (end)
  7. Good Day! Here are the combofix logs: ComboFix 14-12-08.01 - Ton 12/10/2014 7:51.7.4 - x86Microsoft Windows 7 Professional 6.1.7601.1.1252.1.1033.18.3564.1970 [GMT 8:00]Running from: c:\users\Ton\Desktop\ComboFix.exeAV: avast! Antivirus *Enabled/Updated* {17AD7D40-BA12-9C46-7131-94903A54AD8B}SP: avast! Antivirus *Enabled/Updated* {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}..((((((((((((((((((((((((( Files Created from 2014-11-10 to 2014-12-10 )))))))))))))))))))))))))))))))..2014-12-10 00:01 . 2014-12-10 00:01 -------- d-----w- c:\users\Public\AppData\Local\temp2014-12-10 00:01 . 2014-12-10 00:01 -------- d-----w- c:\users\Default\AppData\Local\temp2014-12-05 20:02 . 2014-11-02 04:17 8941456 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{ACC3E2E0-3F18-43BF-AEA6-3E58239D05DD}\mpengine.dll2014-12-05 18:15 . 2014-12-09 23:43 114904 ----a-w- c:\windows\system32\drivers\MBAMSwissArmy.sys2014-12-05 18:14 . 2014-12-05 18:14 -------- d-----w- c:\program files\Malwarebytes Anti-Malware2014-12-05 18:14 . 2014-12-05 18:14 -------- d-----w- c:\programdata\Malwarebytes2014-12-05 18:14 . 2014-11-20 22:14 51928 ----a-w- c:\windows\system32\drivers\mwac.sys2014-12-05 18:14 . 2014-11-20 22:14 75480 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys2014-12-05 18:14 . 2014-11-20 22:14 23256 ----a-w- c:\windows\system32\drivers\mbam.sys2014-11-27 08:49 . 2014-11-27 08:49 -------- d-sh--w- c:\users\Ton\AppData\Local\EmieBrowserModeList2014-11-27 07:37 . 2014-11-28 00:07 -------- d-----w- c:\users\Ton\AppData\Local\CatalinaGroup2014-11-27 07:32 . 2014-11-27 07:32 -------- d-----w- c:\program files\Maxiget2014-11-27 07:32 . 2014-11-27 07:32 -------- d-----w- c:\users\Ton\AppData\Local\Maxiget2014-11-20 17:42 . 2014-11-29 05:25 -------- d-----w- c:\program files\AspInfo2014-11-20 17:42 . 2014-11-22 15:36 -------- d-----w- c:\program files\Software Update Services2014-11-16 06:00 . 2013-10-01 23:45 32256 ----a-w- c:\windows\system32\TsUsbGDCoInstaller.dll2014-11-16 06:00 . 2013-10-02 00:32 12800 ----a-w- c:\windows\system32\TsUsbRedirectionGroupPolicyControl.exe2014-11-16 06:00 . 2013-10-02 00:42 49152 ----a-w- c:\windows\system32\drivers\TsUsbFlt.sys2014-11-16 06:00 . 2013-10-02 00:30 14336 ----a-w- c:\windows\system32\TsUsbRedirectionGroupPolicyExtension.dll2014-11-16 06:00 . 2013-10-02 00:14 17920 ----a-w- c:\windows\system32\wksprtPS.dll2014-11-16 06:00 . 2013-10-02 00:14 50176 ----a-w- c:\windows\system32\MsRdpWebAccess.dll2014-11-16 06:00 . 2013-10-01 23:58 53248 ----a-w- c:\windows\system32\tsgqec.dll2014-11-16 06:00 . 2013-10-01 23:08 855552 ----a-w- c:\windows\system32\rdvidcrl.dll2014-11-16 06:00 . 2013-10-01 23:00 76288 ----a-w- c:\windows\system32\TSWbPrxy.exe2014-11-16 06:00 . 2013-10-01 22:53 350208 ----a-w- c:\windows\system32\wksprt.exe2014-11-16 06:00 . 2013-10-01 22:34 1068544 ----a-w- c:\windows\system32\mstsc.exe2014-11-16 05:59 . 2013-10-01 20:55 5698048 ----a-w- c:\windows\system32\mstscax.dll2014-11-12 16:59 . 2014-10-14 01:50 523776 ----a-w- c:\windows\system32\termsrv.dll2014-11-12 16:59 . 2014-10-14 01:46 681984 ----a-w- c:\windows\system32\adtschema.dll2014-11-12 16:59 . 2014-10-14 01:56 136632 ----a-w- c:\windows\system32\drivers\ksecpkg.sys2014-11-12 16:59 . 2014-10-14 01:50 1059840 ----a-w- c:\windows\system32\lsasrv.dll2014-11-12 16:59 . 2014-10-14 01:47 146432 ----a-w- c:\windows\system32\msaudite.dll2014-11-12 16:58 . 2014-10-25 01:32 67584 ----a-w- c:\windows\system32\packager.dll2014-11-12 16:58 . 2014-10-18 01:33 571904 ----a-w- c:\windows\system32\oleaut32.dll2014-11-12 16:58 . 2014-08-12 01:36 701440 ----a-w- c:\windows\system32\IMJP10K.DLL2014-11-12 16:58 . 2014-10-14 01:50 2363904 ----a-w- c:\windows\system32\msi.dll2014-11-12 16:58 . 2014-08-21 06:26 1237504 ----a-w- c:\windows\system32\msxml3.dll2014-11-12 16:58 . 2014-08-21 06:23 2048 ----a-w- c:\windows\system32\msxml3r.dll2014-11-12 16:56 . 2014-11-05 17:50 254464 ----a-w- c:\windows\system32\generaltel.dll2014-11-12 16:56 . 2014-11-05 17:50 203776 ----a-w- c:\windows\system32\aepdu.dll2014-11-12 16:56 . 2014-11-05 17:47 302592 ----a-w- c:\windows\system32\aeinv.dll2014-11-12 13:46 . 2014-12-09 10:06 163504 ----a-w- c:\programdata\Microsoft\Windows\Sqm\Manifest\Sqm10145.bin...(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))).2014-11-21 18:51 . 2013-05-05 03:48 779536 ----a-w- c:\windows\system32\drivers\aswsnx.sys2014-11-04 16:20 . 2014-11-04 15:59 34808 ----a-w- c:\windows\system32\drivers\TrueSight.sys2014-11-04 06:30 . 2013-02-03 11:37 229000 ------w- c:\windows\system32\MpSigStub.exe2014-11-01 03:12 . 2014-11-01 03:12 444952 ----a-w- c:\windows\system32\wrap_oal.dll2014-11-01 03:12 . 2014-11-01 03:12 109080 ----a-w- c:\windows\system32\OpenAL32.dll2014-09-30 13:25 . 2014-09-30 13:25 0 ---ha-w- c:\users\Ton\AppData\Local\BITCE66.tmp2014-09-25 01:40 . 2014-10-01 19:47 519680 ----a-w- c:\windows\system32\qdvd.dll..((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))..*Note* empty entries & legit default entries are not shown REGEDIT4.[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]@="{472083B0-C522-11CF-8763-00608CC02F24}"[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]2014-08-01 09:59 578240 ----a-w- c:\program files\AVAST Software\Avast\ashShell.dll.[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\DTLite.exe" [2013-01-08 3674320]"Steam"="c:\program files\Steam\steam.exe" [2014-12-06 1941696].[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]"RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RtkNGUI.exe" [2012-12-28 6106336]"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2012-12-19 642808]"Autorun Eater"="c:\program files\Autorun Eater\oldmcdonald.exe" [2012-02-17 522720]"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2014-08-21 959176]"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2014-04-23 43848]"AvastUI.exe"="c:\program files\AVAST Software\Avast\AvastUI.exe" [2014-08-01 4085896]"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2014-05-26 152392]"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2009-02-26 30040]"BlueStacks Agent"="c:\program files\BlueStacks\HD-Agent.exe" [2014-06-23 832272].c:\users\Ton\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE /tsr [2009-2-26 97680].[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]"ConsentPromptBehaviorAdmin"= 5 (0x5)"ConsentPromptBehaviorUser"= 3 (0x3)"EnableUIADesktopToggle"= 0 (0x0).R0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2013-03-10 717296]R2 aswStm;aswStm;c:\windows\system32\drivers\aswStm.sys [2014-08-01 71944]R2 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [2014-04-03 315008]R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys [2010-11-20 62464]R3 EagleXNt;EagleXNt;c:\windows\system32\drivers\EagleXNt.sys [x]R3 GGSAFERDriver;GGSAFER Driver;d:\garae\Garena Plus\Room\safedrv.sys [x]R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe [2014-11-06 102912]R3 ivusb;Initio Driver for USB Default Controller;c:\windows\system32\DRIVERS\ivusb.sys [2010-07-28 25112]R3 MBAMWebAccessControl;MBAMWebAccessControl;c:\windows\system32\drivers\mwac.sys [2014-11-20 51928]R3 netr28u;RT2870 USB Extensible Wireless LAN Card Driver;c:\windows\system32\DRIVERS\netr28u.sys [x]R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2012-08-23 14848]R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2013-10-02 49152]R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2012-08-23 27136]R3 vtany;vtany;c:\windows\vtany.sys [x]R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2013-02-09 1343400]S0 aswRvrt;avast! Revert; [x]S0 aswVmm;avast! VM Monitor; [x]S1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [2014-11-21 779536]S1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [2014-08-01 414520]S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [2013-03-12 242240]S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2012-12-19 219136]S2 aswHwid;avast! HardwareID;c:\windows\system32\drivers\aswHwid.sys [2014-08-01 24184]S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2014-08-01 67824]S2 BstHdAndroidSvc;BlueStacks Android Service;c:\program files\BlueStacks\HD-Service.exe BstHdAndroidSvc Android [x]S2 BstHdDrv;BlueStacks Hypervisor;c:\program files\BlueStacks\HD-Hypervisor-x86.sys [2014-06-23 113424]S2 BstHdLogRotatorSvc;BlueStacks Log Rotator Service;c:\program files\BlueStacks\HD-LogRotatorService.exe [2014-06-23 385808]S2 BstHdUpdaterSvc;BlueStacks Updater Service;c:\program files\BlueStacks\HD-UpdaterService.exe [2014-06-23 774928]S2 c2cautoupdatesvc;Skype Click to Call Updater;c:\program files\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [2014-07-14 1390176]S2 c2cpnrsvc;Skype Click to Call PNR Service;c:\program files\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [2014-07-14 1767520]S2 Intel® Capability Licensing Service Interface;Intel® Capability Licensing Service Interface;c:\program files\Intel\iCLS Client\HeciServer.exe [2012-07-27 463896]S2 jhi_service;Intel® Dynamic Application Loader Host Interface Service;c:\program files\Intel\Intel® Management Engine Components\DAL\jhi_service.exe [2013-02-03 164736]S2 MBAMService;MBAMService;c:\program files\Malwarebytes Anti-Malware\mbamservice.exe [2014-11-20 969016]S2 MyEpson Portal Service;MyEpson Portal Service;c:\program files\EPSON\MyEpson Portal\mepService.exe [2012-07-26 703616]S2 UNS;Intel® Management and Security Application User Notification Service;c:\program files\Intel\Intel® Management Engine Components\UNS\UNS.exe [2013-02-03 363904]S2 WindowsVNT;Windows Virtual Network;c:\program files\Windows Network Accelerater\winvxm.exe [2014-09-09 2966120]S2 YouTubeDownload_P4;YouTube Downloader Services (P4);c:\program files\YouTube Downloader Services\P4\youtubeserv.exe [2014-11-22 2965968]S3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW73.sys [2012-11-06 84992]S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2014-11-20 23256]S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\MBAMSwissArmy.sys [2014-12-09 114904]S3 MEI;Intel® Management Engine Interface ;c:\windows\system32\DRIVERS\HECI.sys [2013-02-03 55104]S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt86win7.sys [2012-02-16 514152]S4 MBAMScheduler;MBAMScheduler;c:\program files\Malwarebytes Anti-Malware\mbamscheduler.exe [2014-11-20 1871160]..--- Other Services/Drivers In Memory ---.*NewlyCreated* - MBAMSWISSARMY.[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]2014-11-27 08:03 1087304 ----a-w- c:\program files\Google\Chrome\Application\39.0.2171.71\Installer\chrmstp.exe..------- Supplementary Scan -------.mSearch Bar = hxxp://www.google.comTCP: Interfaces\{43F470EE-9997-4992-BF08-7CCDE476DC40}: NameServer = 8.8.8.8,8.8.4.4,4.2.2.1,4.2.2.2,208.67.222.222,208.67.220.220,8.26.56.26,8.20.247.20,156.154.70.1,156.154.71.1FF - ProfilePath - c:\users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\..--------------------- LOCKED REGISTRY KEYS ---------------------.[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]@Denied: (Full) (Everyone).Completion time: 2014-12-10 08:03:05ComboFix-quarantined-files.txt 2014-12-10 00:03ComboFix2.txt 2014-11-28 00:57ComboFix3.txt 2014-11-14 19:56ComboFix4.txt 2014-10-27 03:11.Pre-Run: 223,119,343,616 bytes freePost-Run: 223,056,121,856 bytes free.- - End Of File - - 32C579812ED52CDDCD0516B0242D1F04A36C5E4F47E84449FF07ED3517B43A31
  8. I;ve been out for a few days so i scanned another, here are the logs Malwarebytes Anti-Malware www.malwarebytes.org Scan Date: 12/9/2014 Scan Time: 8:44:37 AM Logfile: teqeqweqwe.txt Administrator: Yes Version: 2.00.4.1028 Malware Database: v2014.12.08.10 Rootkit Database: v2014.12.08.01 License: Trial Malware Protection: Enabled Malicious Website Protection: Enabled Self-protection: Disabled OS: Windows 7 Service Pack 1 CPU: x86 File System: NTFS User: Ton Scan Type: Threat Scan Result: Completed Objects Scanned: 321525 Time Elapsed: 24 min, 24 sec Memory: Enabled Startup: Enabled Filesystem: Enabled Archives: Enabled Rootkits: Enabled Heuristics: Enabled PUP: Enabled PUM: Enabled Processes: 0 (No malicious items detected) Modules: 0 (No malicious items detected) Registry Keys: 0 (No malicious items detected) Registry Values: 0 (No malicious items detected) Registry Data: 0 (No malicious items detected) Folders: 0 (No malicious items detected) Files: 2 PUP.Optional.AZLyrics.A, C:\Users\Ton\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_www.azlyrics.com_0.localstorage, Quarantined, [b6af48183745a195ca0c2a1f7e859967], PUP.Optional.AZLyrics.A, C:\Users\Ton\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_www.azlyrics.com_0.localstorage-journal, Quarantined, [1550a6bad3a9aa8c7462d9703cc707f9], Physical Sectors: 0 (No malicious items detected) (end)
  9. I copied those logs before scanning then clicked Fix after. Here are the logs Malwarebytes Anti-Malware www.malwarebytes.org Scan Date: 12/6/2014 Scan Time: 2:20:39 AM Logfile: Administrator: Yes Version: 2.00.4.1028 Malware Database: v2014.12.05.09 Rootkit Database: v2014.12.03.01 License: Trial Malware Protection: Enabled Malicious Website Protection: Enabled Self-protection: Disabled OS: Windows 7 Service Pack 1 CPU: x86 File System: NTFS User: Ton Scan Type: Threat Scan Result: Completed Objects Scanned: 321533 Time Elapsed: 15 min, 53 sec Memory: Enabled Startup: Enabled Filesystem: Enabled Archives: Enabled Rootkits: Enabled Heuristics: Enabled PUP: Enabled PUM: Enabled Processes: 0 (No malicious items detected) Modules: 0 (No malicious items detected) Registry Keys: 6 PUP.Optional.Sanbreel.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\{cafa2341-3593-4cb1-a3e9-745f5dc21ff1}Gw, Quarantined, [db9c6bf3205c4aecbbfbd8857f847e82], PUP.Optional.MyStartSearch.A, HKLM\SOFTWARE\mystartsearchSoftware, Quarantined, [5f1879e5b2ca46f0386d9cad6a99936d], PUP.Optional.WPM.A, HKLM\SOFTWARE\supWindowsMangerProtect, Quarantined, [f7809dc11b61b77f928117a62bd97b85], PUP.Optional.SupTab.A, HKLM\SOFTWARE\SUPDP, Quarantined, [b1c60856285490a6b7d2b99eea1924dc], PUP.Optional.WindowsMangerProtect.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\EVENTLOG\APPLICATION\WindowsMangerProtect, Quarantined, [4b2c401e93e9bf77448991bb9c6760a0], PUP.Optional.FastStart.A, HKU\S-1-5-21-2058238302-804130530-2439220241-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MOZILLA\EXTENDS, Quarantined, [f681d985a8d44de9f6d361f3e221b050], Registry Values: 3 PUP.Optional.FastStart.A, HKLM\SOFTWARE\MOZILLA\FIREFOX\EXTENSIONS|faststartff@gmail.com, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com, Quarantined, [e79064fa83f9f83e2ffe615be81c768a] PUP.Optional.SupTab.A, HKLM\SOFTWARE\SUPDP|dir, C:\Program Files\SupTab, Quarantined, [b1c60856285490a6b7d2b99eea1924dc] PUP.Optional.FastStart.A, HKU\S-1-5-21-2058238302-804130530-2439220241-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MOZILLA\EXTENDS|appid, faststartff@gmail.com, Quarantined, [f681d985a8d44de9f6d361f3e221b050] Registry Data: 0 (No malicious items detected) Folders: 60 PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com, Quarantined, [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\chrome, Quarantined, [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\chrome\content, Quarantined, [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\chrome\content\include, Quarantined, [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\chrome\content\include\tools, Quarantined, [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\chrome\content\js, Quarantined, [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\chrome\content\js\lib, Quarantined, [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\chrome\content\js\module, Quarantined, [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\chrome\content\js\pack, Quarantined, [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\chrome\locale, Quarantined, [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\chrome\locale\en, Quarantined, [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\chrome\locale\en-US, Quarantined, [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\chrome\locale\es, Quarantined, [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\chrome\locale\es-419, Quarantined, [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\chrome\locale\fr, Quarantined, [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\chrome\locale\fr-BE, Quarantined, [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\chrome\locale\fr-CA, Quarantined, [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\chrome\locale\fr-CH, Quarantined, [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\chrome\locale\fr-LU, Quarantined, [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\chrome\locale\it, Quarantined, [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\chrome\locale\it-CH, Quarantined, [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\chrome\locale\pl, Quarantined, [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\chrome\locale\pt-BR, Quarantined, [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\chrome\locale\ru, Quarantined, [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\chrome\locale\ru-MO, Quarantined, [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\chrome\locale\tr, Quarantined, [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\chrome\locale\vi, Quarantined, [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\chrome\locale\zh-CN, Quarantined, [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\chrome\locale\zh-TW, Quarantined, [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\chrome\skin, Quarantined, [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\defaults, Quarantined, [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\defaults\preferences, Quarantined, [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\modules, Quarantined, [3740de80601c3006bf0d51da719235cb], PUP.Optional.WPM.A, C:\ProgramData\WindowsMangerProtect, Quarantined, [da9d91cd6e0eb3835caa022b05feb749], PUP.Optional.WPM.A, C:\ProgramData\WindowsMangerProtect\update, Quarantined, [da9d91cd6e0eb3835caa022b05feb749], PUP.Optional.SupTab.A, C:\Program Files\SupTab, Quarantined, [87f0ea74bdbfb581cb4aa68d58abc739], PUP.Optional.SupTab.A, C:\Program Files\SupTab\skin, Quarantined, [87f0ea74bdbfb581cb4aa68d58abc739], PUP.Optional.SupTab.A, C:\Program Files\SupTab\web, Quarantined, [87f0ea74bdbfb581cb4aa68d58abc739], PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\img, Quarantined, [87f0ea74bdbfb581cb4aa68d58abc739], PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\js, Quarantined, [87f0ea74bdbfb581cb4aa68d58abc739], PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\_locales, Quarantined, [87f0ea74bdbfb581cb4aa68d58abc739], PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\_locales\en-US, Quarantined, [87f0ea74bdbfb581cb4aa68d58abc739], PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\_locales\es-419, Quarantined, [87f0ea74bdbfb581cb4aa68d58abc739], PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\_locales\es-ES, Quarantined, [87f0ea74bdbfb581cb4aa68d58abc739], PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\_locales\fr-BE, Quarantined, [87f0ea74bdbfb581cb4aa68d58abc739], PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\_locales\fr-CA, Quarantined, [87f0ea74bdbfb581cb4aa68d58abc739], PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\_locales\fr-CH, Quarantined, [87f0ea74bdbfb581cb4aa68d58abc739], PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\_locales\fr-FR, Quarantined, [87f0ea74bdbfb581cb4aa68d58abc739], PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\_locales\fr-LU, Quarantined, [87f0ea74bdbfb581cb4aa68d58abc739], PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\_locales\it-CH, Quarantined, [87f0ea74bdbfb581cb4aa68d58abc739], PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\_locales\it-IT, Quarantined, [87f0ea74bdbfb581cb4aa68d58abc739], PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\_locales\pl, Quarantined, [87f0ea74bdbfb581cb4aa68d58abc739], PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\_locales\pt, Quarantined, [87f0ea74bdbfb581cb4aa68d58abc739], PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\_locales\pt-BR, Quarantined, [87f0ea74bdbfb581cb4aa68d58abc739], PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\_locales\ru, Quarantined, [87f0ea74bdbfb581cb4aa68d58abc739], PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\_locales\ru-MO, Quarantined, [87f0ea74bdbfb581cb4aa68d58abc739], PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\_locales\tr-TR, Quarantined, [87f0ea74bdbfb581cb4aa68d58abc739], PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\_locales\vi-VI, Quarantined, [87f0ea74bdbfb581cb4aa68d58abc739], PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\_locales\zh-CN, Quarantined, [87f0ea74bdbfb581cb4aa68d58abc739], PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\_locales\zh-TW, Quarantined, [87f0ea74bdbfb581cb4aa68d58abc739], Files: 109 PUP.Optional.Sanbreel.A, C:\Windows\System32\drivers\{cafa2341-3593-4cb1-a3e9-745f5dc21ff1}Gw.sys, Delete-on-Reboot, [7cd1f9d19a27b7b1ed5f3585a77dec0b], PUP.Optional.MyStartSearch.A, C:\Program Files\Mozilla Firefox\browser\searchplugins\mystartsearch.xml, Quarantined, [12655a043f3d91a5485ba4a50102bc44], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\chrome.manifest, Quarantined, [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\install.rdf, Quarantined, [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\chrome\content\index.html, Quarantined, [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\chrome\content\quick_start.js, Quarantined, [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\chrome\content\quick_start.xul, Quarantined, [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\chrome\content\include\speed_dial.js, Quarantined, [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\chrome\content\include\tools\about_blank_hook.js, Quarantined, [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\chrome\content\include\tools\misc.js, Quarantined, [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\chrome\content\include\tools\popup_image_helper.js, Quarantined, [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\chrome\content\include\tools\urlrequestor.js, Quarantined, [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\chrome\content\js\js.js, Quarantined, [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\chrome\content\js\lib\doT.min.js, Quarantined, [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\chrome\content\js\lib\jquery-2.1.0.min.js, Quarantined, [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\chrome\content\js\lib\jquery.autocomplete.js, Quarantined, [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\chrome\content\js\module\hotSearch.js, Quarantined, [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\chrome\content\js\module\mostgrid.js, Quarantined, [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\chrome\content\js\module\search.js, Quarantined, [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\chrome\content\js\module\stat.js, Quarantined, [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\chrome\content\js\pack\common.js, Quarantined, [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\chrome\content\js\pack\ga.js, Quarantined, [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\chrome\content\js\pack\xagainit.js, Quarantined, [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\chrome\locale\en\locale.properties, Quarantined, [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\chrome\locale\en-US\locale.properties, Quarantined, [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\chrome\locale\es\locale.properties, Quarantined, [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\chrome\locale\es-419\locale.properties, Quarantined, [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\chrome\locale\fr\locale.properties, Quarantined, [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\chrome\locale\fr-BE\locale.properties, Quarantined, [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\chrome\locale\fr-CA\locale.properties, Quarantined, [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\chrome\locale\fr-CH\locale.properties, Quarantined, [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\chrome\locale\fr-LU\locale.properties, Quarantined, [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\chrome\locale\it\locale.properties, Quarantined, [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\chrome\locale\it-CH\locale.properties, Quarantined, [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\chrome\locale\pl\locale.properties, Quarantined, [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\chrome\locale\pt-BR\locale.properties, Quarantined, [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\chrome\locale\ru\locale.properties, Quarantined, [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\chrome\locale\ru-MO\locale.properties, Quarantined, [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\chrome\locale\tr\locale.properties, Quarantined, [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\chrome\locale\vi\locale.properties, Quarantined, [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\chrome\locale\zh-CN\locale.properties, Quarantined, [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\chrome\locale\zh-TW\locale.properties, Quarantined, [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\chrome\skin\default_logo.png, Quarantined, [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\chrome\skin\googlelogo.png, Quarantined, [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\chrome\skin\google_trends.png, Quarantined, [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\chrome\skin\icon.png, Quarantined, [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\chrome\skin\loading.gif, Quarantined, [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\chrome\skin\logo.png, Quarantined, [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\chrome\skin\newtab.ico, Quarantined, [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\chrome\skin\simple.css, Quarantined, [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\chrome\skin\style.css, Quarantined, [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\defaults\preferences\fvd.js, Quarantined, [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\defaults\preferences\preferences.js, Quarantined, [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\modules\addonmanager.js, Quarantined, [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\modules\aes.js, Quarantined, [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\modules\config.js, Quarantined, [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\modules\dialogs.js, Quarantined, [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\modules\last_tab.js, Quarantined, [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\modules\misc.js, Quarantined, [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\modules\properties.js, Quarantined, [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\modules\remoterequest.js, Quarantined, [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\modules\restoreprefs.js, Quarantined, [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\modules\settings.js, Quarantined, [3740de80601c3006bf0d51da719235cb], PUP.Optional.WPM.A, C:\ProgramData\WindowsMangerProtect\update\conf, Quarantined, [da9d91cd6e0eb3835caa022b05feb749], PUP.Optional.SupTab.A, C:\Program Files\SupTab\msvcp110.dll, Quarantined, [87f0ea74bdbfb581cb4aa68d58abc739], PUP.Optional.SupTab.A, C:\Program Files\SupTab\msvcr110.dll, Quarantined, [87f0ea74bdbfb581cb4aa68d58abc739], PUP.Optional.SupTab.A, C:\Program Files\SupTab\uninstall.exe, Quarantined, [87f0ea74bdbfb581cb4aa68d58abc739], PUP.Optional.SupTab.A, C:\Program Files\SupTab\skin\btn.png, Quarantined, [87f0ea74bdbfb581cb4aa68d58abc739], PUP.Optional.SupTab.A, C:\Program Files\SupTab\skin\close.png, Quarantined, [87f0ea74bdbfb581cb4aa68d58abc739], PUP.Optional.SupTab.A, C:\Program Files\SupTab\skin\main.xml, Quarantined, [87f0ea74bdbfb581cb4aa68d58abc739], PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\data.html, Quarantined, [87f0ea74bdbfb581cb4aa68d58abc739], PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\indexIE.html, Quarantined, [87f0ea74bdbfb581cb4aa68d58abc739], PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\indexIE8.html, Quarantined, [87f0ea74bdbfb581cb4aa68d58abc739], PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\main.css, Quarantined, [87f0ea74bdbfb581cb4aa68d58abc739], PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\ver.txt, Quarantined, [87f0ea74bdbfb581cb4aa68d58abc739], PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\img\google_trends.png, Quarantined, [87f0ea74bdbfb581cb4aa68d58abc739], PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\img\icon128.png, Quarantined, [87f0ea74bdbfb581cb4aa68d58abc739], PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\img\icon16.png, Quarantined, [87f0ea74bdbfb581cb4aa68d58abc739], PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\img\icon48.png, Quarantined, [87f0ea74bdbfb581cb4aa68d58abc739], PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\img\loading.gif, Quarantined, [87f0ea74bdbfb581cb4aa68d58abc739], PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\img\logo32.ico, Quarantined, [87f0ea74bdbfb581cb4aa68d58abc739], PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\js\common.js, Quarantined, [87f0ea74bdbfb581cb4aa68d58abc739], PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\js\ga.js, Quarantined, [87f0ea74bdbfb581cb4aa68d58abc739], PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\js\jquery-1.11.0.min.js, Quarantined, [87f0ea74bdbfb581cb4aa68d58abc739], PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\js\jquery.autocomplete.js, Quarantined, [87f0ea74bdbfb581cb4aa68d58abc739], PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\js\js.js, Quarantined, [87f0ea74bdbfb581cb4aa68d58abc739], PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\js\library.js, Quarantined, [87f0ea74bdbfb581cb4aa68d58abc739], PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\js\xagainit-ie8.js, Quarantined, [87f0ea74bdbfb581cb4aa68d58abc739], PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\js\xagainit2.0.js, Quarantined, [87f0ea74bdbfb581cb4aa68d58abc739], PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\_locales\en-US\messages.json, Quarantined, [87f0ea74bdbfb581cb4aa68d58abc739], PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\_locales\es-419\messages.json, Quarantined, [87f0ea74bdbfb581cb4aa68d58abc739], PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\_locales\es-ES\messages.json, Quarantined, [87f0ea74bdbfb581cb4aa68d58abc739], PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\_locales\fr-BE\messages.json, Quarantined, [87f0ea74bdbfb581cb4aa68d58abc739], PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\_locales\fr-CA\messages.json, Quarantined, [87f0ea74bdbfb581cb4aa68d58abc739], PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\_locales\fr-CH\messages.json, Quarantined, [87f0ea74bdbfb581cb4aa68d58abc739], PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\_locales\fr-FR\messages.json, Quarantined, [87f0ea74bdbfb581cb4aa68d58abc739], PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\_locales\fr-LU\messages.json, Quarantined, [87f0ea74bdbfb581cb4aa68d58abc739], PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\_locales\it-CH\messages.json, Quarantined, [87f0ea74bdbfb581cb4aa68d58abc739], PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\_locales\it-IT\messages.json, Quarantined, [87f0ea74bdbfb581cb4aa68d58abc739], PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\_locales\pl\messages.json, Quarantined, [87f0ea74bdbfb581cb4aa68d58abc739], PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\_locales\pt\messages.json, Quarantined, [87f0ea74bdbfb581cb4aa68d58abc739], PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\_locales\pt-BR\messages.json, Quarantined, [87f0ea74bdbfb581cb4aa68d58abc739], PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\_locales\ru\messages.json, Quarantined, [87f0ea74bdbfb581cb4aa68d58abc739], PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\_locales\ru-MO\messages.json, Quarantined, [87f0ea74bdbfb581cb4aa68d58abc739], PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\_locales\tr-TR\messages.json, Quarantined, [87f0ea74bdbfb581cb4aa68d58abc739], PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\_locales\vi-VI\messages.json, Quarantined, [87f0ea74bdbfb581cb4aa68d58abc739], PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\_locales\zh-CN\messages.json, Quarantined, [87f0ea74bdbfb581cb4aa68d58abc739], PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\_locales\zh-TW\messages.json, Quarantined, [87f0ea74bdbfb581cb4aa68d58abc739], PUP.Optional.QuickStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\prefs.js, Good: (), Bad: (user_pref("browser.newtab.url", "chrome://quick_start/content/index.html"), Replaced,[9cdb3925e399a690ba8af9a0b550f30d] Physical Sectors: 0 (No malicious items detected) (end)
  10. Here are the logs: Malwarebytes Anti-Malware www.malwarebytes.org Scan Date: 12/6/2014 Scan Time: 2:20:39 AM Logfile: Administrator: Yes Version: 2.00.4.1028 Malware Database: v2014.12.05.09 Rootkit Database: v2014.12.03.01 License: Trial Malware Protection: Enabled Malicious Website Protection: Enabled Self-protection: Disabled OS: Windows 7 Service Pack 1 CPU: x86 File System: NTFS User: Ton Scan Type: Threat Scan Result: Completed Objects Scanned: 321533 Time Elapsed: 15 min, 53 sec Memory: Enabled Startup: Enabled Filesystem: Enabled Archives: Enabled Rootkits: Enabled Heuristics: Enabled PUP: Enabled PUM: Enabled Processes: 0 (No malicious items detected) Modules: 0 (No malicious items detected) Registry Keys: 6 PUP.Optional.Sanbreel.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\{cafa2341-3593-4cb1-a3e9-745f5dc21ff1}Gw, , [db9c6bf3205c4aecbbfbd8857f847e82], PUP.Optional.MyStartSearch.A, HKLM\SOFTWARE\mystartsearchSoftware, , [5f1879e5b2ca46f0386d9cad6a99936d], PUP.Optional.WPM.A, HKLM\SOFTWARE\supWindowsMangerProtect, , [f7809dc11b61b77f928117a62bd97b85], PUP.Optional.SupTab.A, HKLM\SOFTWARE\SUPDP, , [b1c60856285490a6b7d2b99eea1924dc], PUP.Optional.WindowsMangerProtect.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\EVENTLOG\APPLICATION\WindowsMangerProtect, , [4b2c401e93e9bf77448991bb9c6760a0], PUP.Optional.FastStart.A, HKU\S-1-5-21-2058238302-804130530-2439220241-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MOZILLA\EXTENDS, , [f681d985a8d44de9f6d361f3e221b050], Registry Values: 3 PUP.Optional.FastStart.A, HKLM\SOFTWARE\MOZILLA\FIREFOX\EXTENSIONS|faststartff@gmail.com, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com, , [e79064fa83f9f83e2ffe615be81c768a] PUP.Optional.SupTab.A, HKLM\SOFTWARE\SUPDP|dir, C:\Program Files\SupTab, , [b1c60856285490a6b7d2b99eea1924dc] PUP.Optional.FastStart.A, HKU\S-1-5-21-2058238302-804130530-2439220241-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MOZILLA\EXTENDS|appid, faststartff@gmail.com, , [f681d985a8d44de9f6d361f3e221b050] Registry Data: 0 (No malicious items detected) Folders: 60 PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com, , [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\chrome, , [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\chrome\content, , [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\chrome\content\include, , [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\chrome\content\include\tools, , [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\chrome\content\js, , [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\chrome\content\js\lib, , [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\chrome\content\js\module, , [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\chrome\content\js\pack, , [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\chrome\locale, , [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\chrome\locale\en, , [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\chrome\locale\en-US, , [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\chrome\locale\es, , [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\chrome\locale\es-419, , [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\chrome\locale\fr, , [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\chrome\locale\fr-BE, , [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\chrome\locale\fr-CA, , [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\chrome\locale\fr-CH, , [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\chrome\locale\fr-LU, , [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\chrome\locale\it, , [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\chrome\locale\it-CH, , [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\chrome\locale\pl, , [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\chrome\locale\pt-BR, , [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\chrome\locale\ru, , [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\chrome\locale\ru-MO, , [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\chrome\locale\tr, , [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\chrome\locale\vi, , [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\chrome\locale\zh-CN, , [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\chrome\locale\zh-TW, , [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\chrome\skin, , [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\defaults, , [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\defaults\preferences, , [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\modules, , [3740de80601c3006bf0d51da719235cb], PUP.Optional.WPM.A, C:\ProgramData\WindowsMangerProtect, , [da9d91cd6e0eb3835caa022b05feb749], PUP.Optional.WPM.A, C:\ProgramData\WindowsMangerProtect\update, , [da9d91cd6e0eb3835caa022b05feb749], PUP.Optional.SupTab.A, C:\Program Files\SupTab, , [87f0ea74bdbfb581cb4aa68d58abc739], PUP.Optional.SupTab.A, C:\Program Files\SupTab\skin, , [87f0ea74bdbfb581cb4aa68d58abc739], PUP.Optional.SupTab.A, C:\Program Files\SupTab\web, , [87f0ea74bdbfb581cb4aa68d58abc739], PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\img, , [87f0ea74bdbfb581cb4aa68d58abc739], PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\js, , [87f0ea74bdbfb581cb4aa68d58abc739], PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\_locales, , [87f0ea74bdbfb581cb4aa68d58abc739], PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\_locales\en-US, , [87f0ea74bdbfb581cb4aa68d58abc739], PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\_locales\es-419, , [87f0ea74bdbfb581cb4aa68d58abc739], PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\_locales\es-ES, , [87f0ea74bdbfb581cb4aa68d58abc739], PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\_locales\fr-BE, , [87f0ea74bdbfb581cb4aa68d58abc739], PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\_locales\fr-CA, , [87f0ea74bdbfb581cb4aa68d58abc739], PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\_locales\fr-CH, , [87f0ea74bdbfb581cb4aa68d58abc739], PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\_locales\fr-FR, , [87f0ea74bdbfb581cb4aa68d58abc739], PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\_locales\fr-LU, , [87f0ea74bdbfb581cb4aa68d58abc739], PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\_locales\it-CH, , [87f0ea74bdbfb581cb4aa68d58abc739], PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\_locales\it-IT, , [87f0ea74bdbfb581cb4aa68d58abc739], PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\_locales\pl, , [87f0ea74bdbfb581cb4aa68d58abc739], PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\_locales\pt, , [87f0ea74bdbfb581cb4aa68d58abc739], PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\_locales\pt-BR, , [87f0ea74bdbfb581cb4aa68d58abc739], PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\_locales\ru, , [87f0ea74bdbfb581cb4aa68d58abc739], PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\_locales\ru-MO, , [87f0ea74bdbfb581cb4aa68d58abc739], PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\_locales\tr-TR, , [87f0ea74bdbfb581cb4aa68d58abc739], PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\_locales\vi-VI, , [87f0ea74bdbfb581cb4aa68d58abc739], PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\_locales\zh-CN, , [87f0ea74bdbfb581cb4aa68d58abc739], PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\_locales\zh-TW, , [87f0ea74bdbfb581cb4aa68d58abc739], Files: 109 PUP.Optional.MyStartSearch.A, C:\Program Files\Mozilla Firefox\browser\searchplugins\mystartsearch.xml, , [12655a043f3d91a5485ba4a50102bc44], PUP.Optional.Sanbreel.A, C:\Windows\System32\drivers\{cafa2341-3593-4cb1-a3e9-745f5dc21ff1}Gw.sys, , [7cd1f9d19a27b7b1ed5f3585a77dec0b], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\chrome.manifest, , [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\install.rdf, , [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\chrome\content\index.html, , [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\chrome\content\quick_start.js, , [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\chrome\content\quick_start.xul, , [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\chrome\content\include\speed_dial.js, , [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\chrome\content\include\tools\about_blank_hook.js, , [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\chrome\content\include\tools\misc.js, , [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\chrome\content\include\tools\popup_image_helper.js, , [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\chrome\content\include\tools\urlrequestor.js, , [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\chrome\content\js\js.js, , [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\chrome\content\js\lib\doT.min.js, , [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\chrome\content\js\lib\jquery-2.1.0.min.js, , [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\chrome\content\js\lib\jquery.autocomplete.js, , [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\chrome\content\js\module\hotSearch.js, , [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\chrome\content\js\module\mostgrid.js, , [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\chrome\content\js\module\search.js, , [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\chrome\content\js\module\stat.js, , [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\chrome\content\js\pack\common.js, , [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\chrome\content\js\pack\ga.js, , [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\chrome\content\js\pack\xagainit.js, , [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\chrome\locale\en\locale.properties, , [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\chrome\locale\en-US\locale.properties, , [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\chrome\locale\es\locale.properties, , [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\chrome\locale\es-419\locale.properties, , [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\chrome\locale\fr\locale.properties, , [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\chrome\locale\fr-BE\locale.properties, , [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\chrome\locale\fr-CA\locale.properties, , [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\chrome\locale\fr-CH\locale.properties, , [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\chrome\locale\fr-LU\locale.properties, , [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\chrome\locale\it\locale.properties, , [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\chrome\locale\it-CH\locale.properties, , [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\chrome\locale\pl\locale.properties, , [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\chrome\locale\pt-BR\locale.properties, , [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\chrome\locale\ru\locale.properties, , [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\chrome\locale\ru-MO\locale.properties, , [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\chrome\locale\tr\locale.properties, , [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\chrome\locale\vi\locale.properties, , [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\chrome\locale\zh-CN\locale.properties, , [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\chrome\locale\zh-TW\locale.properties, , [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\chrome\skin\default_logo.png, , [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\chrome\skin\googlelogo.png, , [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\chrome\skin\google_trends.png, , [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\chrome\skin\icon.png, , [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\chrome\skin\loading.gif, , [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\chrome\skin\logo.png, , [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\chrome\skin\newtab.ico, , [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\chrome\skin\simple.css, , [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\chrome\skin\style.css, , [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\defaults\preferences\fvd.js, , [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\defaults\preferences\preferences.js, , [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\modules\addonmanager.js, , [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\modules\aes.js, , [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\modules\config.js, , [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\modules\dialogs.js, , [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\modules\last_tab.js, , [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\modules\misc.js, , [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\modules\properties.js, , [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\modules\remoterequest.js, , [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\modules\restoreprefs.js, , [3740de80601c3006bf0d51da719235cb], PUP.Optional.FastStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\extensions\faststartff@gmail.com\modules\settings.js, , [3740de80601c3006bf0d51da719235cb], PUP.Optional.WPM.A, C:\ProgramData\WindowsMangerProtect\update\conf, , [da9d91cd6e0eb3835caa022b05feb749], PUP.Optional.SupTab.A, C:\Program Files\SupTab\msvcp110.dll, , [87f0ea74bdbfb581cb4aa68d58abc739], PUP.Optional.SupTab.A, C:\Program Files\SupTab\msvcr110.dll, , [87f0ea74bdbfb581cb4aa68d58abc739], PUP.Optional.SupTab.A, C:\Program Files\SupTab\uninstall.exe, , [87f0ea74bdbfb581cb4aa68d58abc739], PUP.Optional.SupTab.A, C:\Program Files\SupTab\skin\btn.png, , [87f0ea74bdbfb581cb4aa68d58abc739], PUP.Optional.SupTab.A, C:\Program Files\SupTab\skin\close.png, , [87f0ea74bdbfb581cb4aa68d58abc739], PUP.Optional.SupTab.A, C:\Program Files\SupTab\skin\main.xml, , [87f0ea74bdbfb581cb4aa68d58abc739], PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\data.html, , [87f0ea74bdbfb581cb4aa68d58abc739], PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\indexIE.html, , [87f0ea74bdbfb581cb4aa68d58abc739], PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\indexIE8.html, , [87f0ea74bdbfb581cb4aa68d58abc739], PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\main.css, , [87f0ea74bdbfb581cb4aa68d58abc739], PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\ver.txt, , [87f0ea74bdbfb581cb4aa68d58abc739], PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\img\google_trends.png, , [87f0ea74bdbfb581cb4aa68d58abc739], PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\img\icon128.png, , [87f0ea74bdbfb581cb4aa68d58abc739], PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\img\icon16.png, , [87f0ea74bdbfb581cb4aa68d58abc739], PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\img\icon48.png, , [87f0ea74bdbfb581cb4aa68d58abc739], PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\img\loading.gif, , [87f0ea74bdbfb581cb4aa68d58abc739], PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\img\logo32.ico, , [87f0ea74bdbfb581cb4aa68d58abc739], PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\js\common.js, , [87f0ea74bdbfb581cb4aa68d58abc739], PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\js\ga.js, , [87f0ea74bdbfb581cb4aa68d58abc739], PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\js\jquery-1.11.0.min.js, , [87f0ea74bdbfb581cb4aa68d58abc739], PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\js\jquery.autocomplete.js, , [87f0ea74bdbfb581cb4aa68d58abc739], PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\js\js.js, , [87f0ea74bdbfb581cb4aa68d58abc739], PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\js\library.js, , [87f0ea74bdbfb581cb4aa68d58abc739], PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\js\xagainit-ie8.js, , [87f0ea74bdbfb581cb4aa68d58abc739], PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\js\xagainit2.0.js, , [87f0ea74bdbfb581cb4aa68d58abc739], PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\_locales\en-US\messages.json, , [87f0ea74bdbfb581cb4aa68d58abc739], PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\_locales\es-419\messages.json, , [87f0ea74bdbfb581cb4aa68d58abc739], PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\_locales\es-ES\messages.json, , [87f0ea74bdbfb581cb4aa68d58abc739], PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\_locales\fr-BE\messages.json, , [87f0ea74bdbfb581cb4aa68d58abc739], PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\_locales\fr-CA\messages.json, , [87f0ea74bdbfb581cb4aa68d58abc739], PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\_locales\fr-CH\messages.json, , [87f0ea74bdbfb581cb4aa68d58abc739], PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\_locales\fr-FR\messages.json, , [87f0ea74bdbfb581cb4aa68d58abc739], PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\_locales\fr-LU\messages.json, , [87f0ea74bdbfb581cb4aa68d58abc739], PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\_locales\it-CH\messages.json, , [87f0ea74bdbfb581cb4aa68d58abc739], PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\_locales\it-IT\messages.json, , [87f0ea74bdbfb581cb4aa68d58abc739], PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\_locales\pl\messages.json, , [87f0ea74bdbfb581cb4aa68d58abc739], PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\_locales\pt\messages.json, , [87f0ea74bdbfb581cb4aa68d58abc739], PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\_locales\pt-BR\messages.json, , [87f0ea74bdbfb581cb4aa68d58abc739], PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\_locales\ru\messages.json, , [87f0ea74bdbfb581cb4aa68d58abc739], PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\_locales\ru-MO\messages.json, , [87f0ea74bdbfb581cb4aa68d58abc739], PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\_locales\tr-TR\messages.json, , [87f0ea74bdbfb581cb4aa68d58abc739], PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\_locales\vi-VI\messages.json, , [87f0ea74bdbfb581cb4aa68d58abc739], PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\_locales\zh-CN\messages.json, , [87f0ea74bdbfb581cb4aa68d58abc739], PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\_locales\zh-TW\messages.json, , [87f0ea74bdbfb581cb4aa68d58abc739], PUP.Optional.QuickStart.A, C:\Users\Ton\AppData\Roaming\Mozilla\Firefox\Profiles\9ianp5ln.default-1415799794081\prefs.js, Good: (), Bad: (user_pref("browser.newtab.url", "chrome://quick_start/content/index.html"), ,[9cdb3925e399a690ba8af9a0b550f30d] Physical Sectors: 0 (No malicious items detected) (end)
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.