Jump to content

desertdog

Members
  • Posts

    9
  • Joined

  • Last visited

Everything posted by desertdog

  1. I have MEE installed on my server. When I run the scan under client push install, about 75% of my client computers show the message: Access is denied, Failed to create remote service I am able to browse these same computers over the network and my account has unrestricted access to everything on the domain. Why am I getting this message and what do I need to do ? Thanks
  2. I ran JRT and rebooted. Below is the contents of the text file that it created..... Upon reboot, the Conduit error message is finally gone. In addition to that, hard drive activity is now greatly reduced when system is idle. In my case, it seems that the Junkware Removal Tool was what was needed. ------------------------------------------------------------------------------ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Junkware Removal Tool (JRT) by Thisisu Version: 6.1.4 (04.06.2014:1) OS: Windows 7 Home Premium x64 Ran by mike on Sun 04/27/2014 at 22:39:52.83 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~ Services ~~~ Registry Values Successfully repaired: [Registry Value] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\\Start Page Successfully repaired: [Registry Value] HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Main\\Start Page Successfully repaired: [Registry Value] HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\Main\\Start Page Successfully repaired: [Registry Value] HKEY_USERS\S-1-5-19\Software\Microsoft\Internet Explorer\Main\\Start Page Successfully repaired: [Registry Value] HKEY_USERS\S-1-5-20\Software\Microsoft\Internet Explorer\Main\\Start Page Successfully repaired: [Registry Value] HKEY_USERS\S-1-5-21-1229362484-4032704617-3898728357-1001\Software\Microsoft\Internet Explorer\Main\\Start Page ~~~ Registry Keys Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{11111111-1111-1111-1111-110011441193} Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{11111111-1111-1111-1111-110011441193} ~~~ Files ~~~ Folders Successfully deleted: [Folder] "C:\ProgramData\boost_interprocess" Successfully deleted: [Folder] "C:\ProgramData\w3i" ~~~ FireFox Emptied folder: C:\Users\mike\AppData\Roaming\mozilla\firefox\profiles\y428pvf0.default-1396214294990\minidumps [2 files] ~~~ Event Viewer Logs were cleared ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Scan was completed on Sun 04/27/2014 at 22:48:37.32 End of JRT log ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ------------------------------------------------------------------------------
  3. Ran the adwCleaner, scan then clean. Below is the contents of the text file that was created: ----------------------------------------- # AdwCleaner v3.204 - Report created 27/04/2014 at 22:19:25 # Updated 26/04/2014 by Xplode # Operating System : Windows 7 Home Premium Service Pack 1 (64 bits) # Username : mike - ECSC2D # Running from : C:\Users\mike\Downloads\AdwCleaner.exe # Option : Clean ***** [ Services ] ***** ***** [ Files / Folders ] ***** Folder Deleted : C:\Program Files (x86)\w3i Folder Deleted : C:\Windows\SysWOW64\AI_RecycleBin Folder Deleted : C:\Users\mike\AppData\Local\iac Folder Deleted : C:\Users\mike\AppData\Local\NativeMessaging Folder Deleted : C:\Users\mike\AppData\Local\PackageAware Folder Deleted : C:\Users\mike\AppData\LocalLow\Conduit Folder Deleted : C:\Users\mike\AppData\LocalLow\PriceGong Folder Deleted : C:\Users\Mike w\AppData\Local\iac Folder Deleted : C:\Users\Mike w\AppData\LocalLow\mapsgalaxy_39 Folder Deleted : C:\Users\Mike w\AppData\Roaming\Uniblue Folder Deleted : C:\Users\Robert\AppData\LocalLow\AskToolbar Folder Deleted : C:\Users\mike\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkmpcdbgnfjfeelcpebpkflcmbkclfho File Deleted : C:\END File Deleted : C:\Program Files (x86)\Mozilla Firefox\nsprotector.js File Deleted : C:\Users\mike\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_app.mam.conduit.com_0.localstorage File Deleted : C:\Users\mike\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_app.mam.conduit.com_0.localstorage-journal File Deleted : C:\Windows\System32\Tasks\BackgroundContainer Startup Task ***** [ Shortcuts ] ***** ***** [ Registry ] ***** Key Deleted : HKCU\Software\Google\Chrome\Extensions\pkmpcdbgnfjfeelcpebpkflcmbkclfho Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\pkmpcdbgnfjfeelcpebpkflcmbkclfho Key Deleted : HKLM\SOFTWARE\Classes\driverscanner Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASAPI32 Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASMANCS Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\AskInstallChecker-1_RASAPI32 Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\AskInstallChecker-1_RASMANCS Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\askpartnercobrandingtool_rasapi32 Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\askpartnercobrandingtool_rasmancs Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\au__rasapi32 Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\au__rasmancs Key Deleted : HKLM\SOFTWARE\Classes\Toolbar.CT3288691 Key Deleted : HKLM\SOFTWARE\Classes\Toolbar.CT3311834 Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_for_quicktime_RASAPI32 Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_for_quicktime_RASMANCS Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_for_supertux_RASAPI32 Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_for_supertux_RASMANCS Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_for_video-download-capture_RASAPI32 Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_for_video-download-capture_RASMANCS Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1} Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4EFB-9B51-7695ECA05670} Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{02478D38-C3F9-4EFB-9B51-7695ECA05670} Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{EF99BD32-C1FB-11D2-892F-0090271D4F88} Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{FD79F359-E577-46DB-AA74-D6E6B8B45BA8} Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{23119123-0854-469D-807A-171568457991} Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{3B181CF2-878B-4758-8FBD-59D8AC5AB12D} Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{490A5A0F-1471-47FF-8BB5-719F1F5238AD} Key Deleted : HKCU\Software\Cr_Installer Key Deleted : HKCU\Software\ilivid Key Deleted : HKCU\Software\Softonic Key Deleted : HKCU\Software\YahooPartnerToolbar Key Deleted : HKCU\Software\Zugo Key Deleted : HKCU\Software\AppDataLow\Toolbar Key Deleted : HKCU\Software\AppDataLow\Software\BackgroundContainer Key Deleted : HKCU\Software\AppDataLow\Software\SmartBar Key Deleted : HKLM\Software\AVG Secure Search Key Deleted : HKLM\Software\Freeze.com Key Deleted : HKLM\Software\Uniblue Key Deleted : [x64] HKLM\SOFTWARE\Description ***** [ Browsers ] ***** -\\ Internet Explorer v11.0.9600.17041 -\\ Mozilla Firefox v28.0 (en-US) [ File : C:\Users\mike\AppData\Roaming\Mozilla\Firefox\Profiles\y428pvf0.default-1396214294990\prefs.js ] -\\ Google Chrome v34.0.1847.116 [ File : C:\Users\Eve\AppData\Local\Google\Chrome\User Data\Default\preferences ] Deleted [Extension] : kdcnnmifdmlmjffdgeieikcokcogpbej Deleted [Extension] : kincjchfokkeneeofpeefomkikfkiedl [ File : C:\Users\mike\AppData\Local\Google\Chrome\User Data\Default\preferences ] Deleted [Extension] : pkmpcdbgnfjfeelcpebpkflcmbkclfho [ File : C:\Users\Mike w\AppData\Local\Google\Chrome\User Data\Default\preferences ] [ File : C:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default\preferences ] ************************* AdwCleaner[R0].txt - [5827 octets] - [27/04/2014 22:17:56] AdwCleaner[s0].txt - [5569 octets] - [27/04/2014 22:19:25] ########## EOF - C:\AdwCleaner\AdwCleaner[s0].txt - [5629 octets] ########## -----------------------------------------
  4. Below are the results of Fixlog.txt first, and the log from the malwarebytes quickscan Conduit error message still occuring, Ill try the last two suggestions in a minute... Fixlog.txt: ---------------------------------------------------------------- Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 27-04-2014 Ran by mike at 2014-04-27 20:55:54 Run:1 Running from C:\Users\mike\Downloads\frst64 Boot Mode: Normal ============================================== Content of fixlist: ***************** Start HKU\S-1-5-21-1229362484-4032704617-3898728357-1001\...\MountPoints2: H - H:\setup.exe -a HKU\S-1-5-21-1229362484-4032704617-3898728357-1001\...\MountPoints2: {2163a700-14aa-11e1-83b7-002197d95ef5} - I:\setup.exe -a HKU\S-1-5-21-1229362484-4032704617-3898728357-1001\...\MountPoints2: {39b0c568-7625-11e3-9f58-002197d95ef5} - H:\VZW_Software_upgrade_assistant.exe HKU\S-1-5-21-1229362484-4032704617-3898728357-1001\...\MountPoints2: {9c96663d-7609-11e0-af53-002197d95ef5} - F:\TLBootstrap_WPP.exe SearchScopes: HKLM-x32 - {b0441a0e-a49a-4e16-afc1-74ecced1921f} URL = http://search.mywebs...t=sb&searchfor={searchTerms} Toolbar: HKLM-x32 - No Name - {f84db37a-ae6f-423b-9f51-14b5ec10c879} - No File Toolbar: HKCU - No Name - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - No File Toolbar: HKCU - No Name - {D4027C7F-154A-4066-A1AD-4243D8127440} - No File Toolbar: HKCU - No Name - {F84DB37A-AE6F-423B-9F51-14B5EC10C879} - No File Handler: a5res\CLSID - No CLSID Value - Handler: XBasic\CLSID - No CLSID Value - Handler: XBasic\OLEScript - No CLSID Value - Handler: XBasicV10\CLSID - No CLSID Value - Handler: XBasicV10\OLEScript - No CLSID Value - Handler-x32: a5res\CLSID - No CLSID Value - Handler-x32: XBasic\CLSID - No CLSID Value - Handler-x32: XBasic\OLEScript - No CLSID Value - Handler-x32: XBasicV10\CLSID - No CLSID Value - Handler-x32: XBasicV10\OLEScript - No CLSID Value - S4 LMIRfsClientNP; No ImagePath U3 av9k0pbr; C:\Windows\System32\Drivers\av9k0pbr.sys [0 ] (Advanced Micro Devices) C:\Windows\System32\Drivers\av9k0pbr.sys C:\Users\Eve\AppData\Local\Temp\handbrake-setup.exe C:\Users\jim\AppData\Local\Temp\jre-6u29-windows-i586-iftw-rv.exe C:\Users\mike\AppData\Local\Temp\7-Zip.exe C:\Users\mike\AppData\Local\Temp\BearShare_setup.exe C:\Users\mike\AppData\Local\Temp\bitool.dll C:\Users\mike\AppData\Local\Temp\cbSetupE.exe C:\Users\mike\AppData\Local\Temp\Del9479.exe C:\Users\mike\AppData\Local\Temp\DivXSetup.exe C:\Users\mike\AppData\Local\Temp\dlLogic.exe C:\Users\mike\AppData\Local\Temp\DTLite4413-0173.exe C:\Users\mike\AppData\Local\Temp\DTLite4453-0297.exe C:\Users\mike\AppData\Local\Temp\DTLite4454-0315.exe C:\Users\mike\AppData\Local\Temp\DTLite4471-0333.exe C:\Users\mike\AppData\Local\Temp\GUR2673.exe C:\Users\mike\AppData\Local\Temp\GUR2971.exe C:\Users\mike\AppData\Local\Temp\iqu_installer.exe C:\Users\mike\AppData\Local\Temp\jre-6u24-windows-i586-iftw-rv.exe C:\Users\mike\AppData\Local\Temp\jre-6u26-windows-i586-iftw-rv.exe C:\Users\mike\AppData\Local\Temp\jre-6u29-windows-i586-iftw-rv.exe C:\Users\mike\AppData\Local\Temp\jre-6u35-windows-i586-iftw.exe C:\Users\mike\AppData\Local\Temp\jre-6u37-windows-i586-iftw.exe C:\Users\mike\AppData\Local\Temp\jre-7u15-windows-i586-iftw.exe C:\Users\mike\AppData\Local\Temp\jre-7u17-windows-i586-iftw.exe C:\Users\mike\AppData\Local\Temp\jre-7u21-windows-i586-iftw.exe C:\Users\mike\AppData\Local\Temp\jre-7u25-windows-i586-iftw.exe C:\Users\mike\AppData\Local\Temp\jre-7u45-windows-i586-iftw.exe C:\Users\mike\AppData\Local\Temp\MotoHelper_2.0.51_Driver_5.1.0.exe C:\Users\mike\AppData\Local\Temp\nsb4FCE.exe C:\Users\mike\AppData\Local\Temp\nseC38B.exe C:\Users\mike\AppData\Local\Temp\nsg33C.exe C:\Users\mike\AppData\Local\Temp\nsiAF13.exe C:\Users\mike\AppData\Local\Temp\nsj3F35.exe C:\Users\mike\AppData\Local\Temp\nsmF7C5.exe C:\Users\mike\AppData\Local\Temp\nsuD3C4.exe C:\Users\mike\AppData\Local\Temp\nsv1AD0.exe C:\Users\mike\AppData\Local\Temp\nsv23F7.exe C:\Users\mike\AppData\Local\Temp\nsy18E0.exe C:\Users\mike\AppData\Local\Temp\nsy34E5.exe C:\Users\mike\AppData\Local\Temp\ose00000.exe C:\Users\mike\AppData\Local\Temp\ose00001.exe C:\Users\mike\AppData\Local\Temp\setup.exe C:\Users\mike\AppData\Local\Temp\SetupDataMngr_BearShare.exe C:\Users\mike\AppData\Local\Temp\SPStub.exe C:\Users\mike\AppData\Local\Temp\tbDiv2.dll C:\Users\mike\AppData\Local\Temp\ToolbarHelper.exe C:\Users\mike\AppData\Local\Temp\worker.exe C:\Users\mike\AppData\Local\Temp\xmlUpdater.exe C:\Users\mike\AppData\Local\Temp\_is7290.exe C:\Users\mike\AppData\Local\Temp\_is7FCA.exe C:\Users\Mike w\AppData\Local\Temp\cltmng.exe C:\Users\Mike w\AppData\Local\Temp\msvcp100.dll C:\Users\Mike w\AppData\Local\Temp\msvcr100.dll C:\Users\Mike w\AppData\Local\Temp\nspE55D.tmp.tbProd.dll C:\Users\Mike w\AppData\Local\Temp\SkypeSetup.exe C:\Users\Mike w\AppData\Local\Temp\tbedrs.dll 2009-07-13 20:34 - 2012-04-14 18:41 - 00000946 ____A C:\Windows\system32\Drivers\etc\hosts End ***************** HKU\S-1-5-21-1229362484-4032704617-3898728357-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\S-1-5-21-1229362484-4032704617-3898728357-1001 => Key not found. HKU\S-1-5-21-1229362484-4032704617-3898728357-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{2163a700-14aa-11e1-83b7-002197d95ef5} => Key deleted successfully. HKCR\CLSID\{2163a700-14aa-11e1-83b7-002197d95ef5} => Key not found. HKU\S-1-5-21-1229362484-4032704617-3898728357-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{39b0c568-7625-11e3-9f58-002197d95ef5} => Key deleted successfully. HKCR\CLSID\{39b0c568-7625-11e3-9f58-002197d95ef5} => Key not found. HKU\S-1-5-21-1229362484-4032704617-3898728357-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{9c96663d-7609-11e0-af53-002197d95ef5} => Key deleted successfully. HKCR\CLSID\{9c96663d-7609-11e0-af53-002197d95ef5} => Key not found. HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{b0441a0e-a49a-4e16-afc1-74ecced1921f} => Key deleted successfully. HKCR\Wow6432Node\CLSID\{b0441a0e-a49a-4e16-afc1-74ecced1921f} => Key not found. HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar\\{f84db37a-ae6f-423b-9f51-14b5ec10c879} => Value deleted successfully. HKCR\Wow6432Node\CLSID\{f84db37a-ae6f-423b-9f51-14b5ec10c879} => Key not found. HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{47833539-D0C5-4125-9FA8-0819E2EAAC93} => Value deleted successfully. HKCR\CLSID\{47833539-D0C5-4125-9FA8-0819E2EAAC93} => Key not found. HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{D4027C7F-154A-4066-A1AD-4243D8127440} => Value deleted successfully. HKCR\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440} => Key not found. HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{F84DB37A-AE6F-423B-9F51-14B5EC10C879} => Value deleted successfully. HKCR\CLSID\{F84DB37A-AE6F-423B-9F51-14B5EC10C879} => Key not found. HKCR\PROTOCOLS\Handler\Handler: a5res\CLSID - No CLSID Value - => Key not found. HKCR\PROTOCOLS\Handler\Handler: XBasic\CLSID - No CLSID Value - => Key not found. HKCR\PROTOCOLS\Handler\Handler: XBasic\OLEScript - No CLSID Value - => Key not found. HKCR\PROTOCOLS\Handler\Handler: XBasicV10\CLSID - No CLSID Value - => Key not found. HKCR\PROTOCOLS\Handler\Handler: XBasicV10\OLEScript - No CLSID Value - => Key not found. HKCR\Wow6432Node\PROTOCOLS\Handler\Handler-x32: a5res\CLSID - No CLSID Value - => Key not found. HKCR\Wow6432Node\PROTOCOLS\Handler\Handler-x32: XBasic\CLSID - No CLSID Value - => Key not found. HKCR\Wow6432Node\PROTOCOLS\Handler\Handler-x32: XBasic\OLEScript - No CLSID Value - => Key not found. HKCR\Wow6432Node\PROTOCOLS\Handler\Handler-x32: XBasicV10\CLSID - No CLSID Value - => Key not found. HKCR\Wow6432Node\PROTOCOLS\Handler\Handler-x32: XBasicV10\OLEScript - No CLSID Value - => Key not found. LMIRfsClientNP => Service deleted successfully. av9k0pbr => Service deleted successfully. Could not move "C:\Windows\System32\Drivers\av9k0pbr.sys" => Scheduled to move on reboot. C:\Users\Eve\AppData\Local\Temp\handbrake-setup.exe => Moved successfully. C:\Users\jim\AppData\Local\Temp\jre-6u29-windows-i586-iftw-rv.exe => Moved successfully. C:\Users\mike\AppData\Local\Temp\7-Zip.exe => Moved successfully. C:\Users\mike\AppData\Local\Temp\BearShare_setup.exe => Moved successfully. C:\Users\mike\AppData\Local\Temp\bitool.dll => Moved successfully. C:\Users\mike\AppData\Local\Temp\cbSetupE.exe => Moved successfully. C:\Users\mike\AppData\Local\Temp\Del9479.exe => Moved successfully. C:\Users\mike\AppData\Local\Temp\DivXSetup.exe => Moved successfully. C:\Users\mike\AppData\Local\Temp\dlLogic.exe => Moved successfully. C:\Users\mike\AppData\Local\Temp\DTLite4413-0173.exe => Moved successfully. C:\Users\mike\AppData\Local\Temp\DTLite4453-0297.exe => Moved successfully. C:\Users\mike\AppData\Local\Temp\DTLite4454-0315.exe => Moved successfully. C:\Users\mike\AppData\Local\Temp\DTLite4471-0333.exe => Moved successfully. C:\Users\mike\AppData\Local\Temp\GUR2673.exe => Moved successfully. C:\Users\mike\AppData\Local\Temp\GUR2971.exe => Moved successfully. C:\Users\mike\AppData\Local\Temp\iqu_installer.exe => Moved successfully. C:\Users\mike\AppData\Local\Temp\jre-6u24-windows-i586-iftw-rv.exe => Moved successfully. C:\Users\mike\AppData\Local\Temp\jre-6u26-windows-i586-iftw-rv.exe => Moved successfully. C:\Users\mike\AppData\Local\Temp\jre-6u29-windows-i586-iftw-rv.exe => Moved successfully. C:\Users\mike\AppData\Local\Temp\jre-6u35-windows-i586-iftw.exe => Moved successfully. C:\Users\mike\AppData\Local\Temp\jre-6u37-windows-i586-iftw.exe => Moved successfully. C:\Users\mike\AppData\Local\Temp\jre-7u15-windows-i586-iftw.exe => Moved successfully. C:\Users\mike\AppData\Local\Temp\jre-7u17-windows-i586-iftw.exe => Moved successfully. C:\Users\mike\AppData\Local\Temp\jre-7u21-windows-i586-iftw.exe => Moved successfully. C:\Users\mike\AppData\Local\Temp\jre-7u25-windows-i586-iftw.exe => Moved successfully. C:\Users\mike\AppData\Local\Temp\jre-7u45-windows-i586-iftw.exe => Moved successfully. C:\Users\mike\AppData\Local\Temp\MotoHelper_2.0.51_Driver_5.1.0.exe => Moved successfully. C:\Users\mike\AppData\Local\Temp\nsb4FCE.exe => Moved successfully. C:\Users\mike\AppData\Local\Temp\nseC38B.exe => Moved successfully. C:\Users\mike\AppData\Local\Temp\nsg33C.exe => Moved successfully. C:\Users\mike\AppData\Local\Temp\nsiAF13.exe => Moved successfully. C:\Users\mike\AppData\Local\Temp\nsj3F35.exe => Moved successfully. C:\Users\mike\AppData\Local\Temp\nsmF7C5.exe => Moved successfully. C:\Users\mike\AppData\Local\Temp\nsuD3C4.exe => Moved successfully. C:\Users\mike\AppData\Local\Temp\nsv1AD0.exe => Moved successfully. C:\Users\mike\AppData\Local\Temp\nsv23F7.exe => Moved successfully. C:\Users\mike\AppData\Local\Temp\nsy18E0.exe => Moved successfully. C:\Users\mike\AppData\Local\Temp\nsy34E5.exe => Moved successfully. C:\Users\mike\AppData\Local\Temp\ose00000.exe => Moved successfully. C:\Users\mike\AppData\Local\Temp\ose00001.exe => Moved successfully. C:\Users\mike\AppData\Local\Temp\setup.exe => Moved successfully. C:\Users\mike\AppData\Local\Temp\SetupDataMngr_BearShare.exe => Moved successfully. C:\Users\mike\AppData\Local\Temp\SPStub.exe => Moved successfully. C:\Users\mike\AppData\Local\Temp\tbDiv2.dll => Moved successfully. C:\Users\mike\AppData\Local\Temp\ToolbarHelper.exe => Moved successfully. C:\Users\mike\AppData\Local\Temp\worker.exe => Moved successfully. C:\Users\mike\AppData\Local\Temp\xmlUpdater.exe => Moved successfully. C:\Users\mike\AppData\Local\Temp\_is7290.exe => Moved successfully. C:\Users\mike\AppData\Local\Temp\_is7FCA.exe => Moved successfully. C:\Users\Mike w\AppData\Local\Temp\cltmng.exe => Moved successfully. C:\Users\Mike w\AppData\Local\Temp\msvcp100.dll => Moved successfully. C:\Users\Mike w\AppData\Local\Temp\msvcr100.dll => Moved successfully. C:\Users\Mike w\AppData\Local\Temp\nspE55D.tmp.tbProd.dll => Moved successfully. C:\Users\Mike w\AppData\Local\Temp\SkypeSetup.exe => Moved successfully. C:\Users\Mike w\AppData\Local\Temp\tbedrs.dll => Moved successfully. C:\Windows\system32\Drivers\etc\hosts => Moved successfully. => Result of Scheduled Files to move (Boot Mode: Normal) (Date&Time: 2014-04-27 20:59:35)<= C:\Windows\System32\Drivers\av9k0pbr.sys => Is moved successfully. ==== End of Fixlog ==== ---------------------------------------------------------------- malwarebytes quickscan log: ----------------------------------------------------------------- Malwarebytes Anti-Malware (PRO) 1.75.0.1300 www.malwarebytes.org Database version: v2014.04.27.04 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 11.0.9600.17041 mike :: ECSC2D [administrator] Protection: Enabled 4/27/2014 9:30:24 PM mbam-log-2014-04-27 (21-30-24).txt Scan type: Quick scan Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM | P2P Scan options disabled: Objects scanned: 433842 Time elapsed: 13 minute(s), 28 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 5 HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Installl_Converter_A Toolbar (PUP.Optional.InstalllConverter.A) -> Quarantined and deleted successfully. HKCU\Software\AppDataLow\Software\Crossrider (PUP.Optional.CrossRider.A) -> Quarantined and deleted successfully. HKCU\Software\AppDataLow\Software\PriceGong (PUP.Optional.PriceGong.A) -> Quarantined and deleted successfully. HKCU\Software\Softonic\Universal Downloader (PUP.Optional.Softonic.A) -> Quarantined and deleted successfully. HKLM\SOFTWARE\Installl_Converter_A (PUP.Optional.InstalllConverter.A) -> Quarantined and deleted successfully. Registry Values Detected: 2 HKLM\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\{f84db37a-ae6f-423b-9f51-14b5ec10c879} (PUP.Optional.InstalllConverter.A) -> Data: -> Quarantined and deleted successfully. HKLM\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks|{f84db37a-ae6f-423b-9f51-14b5ec10c879} (PUP.Optional.InstalllConverter.A) -> Data: -> Quarantined and deleted successfully. Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 30 C:\Program Files (x86)\Installl_Converter_A (PUP.Optional.InstalllConverter.A) -> Quarantined and deleted successfully. C:\Users\mike\AppData\Roaming\OpenCandy (PUP.Optional.OpenCandy) -> Quarantined and deleted successfully. C:\Users\mike\AppData\Roaming\OpenCandy\OpenCandy_049603A5E3BC4844A5DBA0CF2ED150E8 (PUP.Optional.OpenCandy) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\Temp\CT3297930 (PUP.Optional.Conduit.A) -> Quarantined and deleted successfully. C:\Users\mike\AppData\Local\Temp\ct3288691 (PUP.Optional.Conduit.A) -> Quarantined and deleted successfully. C:\Users\mike\AppData\Local\Temp\ct3288691\xpi (PUP.Optional.Conduit.A) -> Quarantined and deleted successfully. C:\Users\mike\AppData\Local\Temp\ct3288691\xpi\defaults (PUP.Optional.Conduit.A) -> Quarantined and deleted successfully. C:\Users\mike\AppData\Local\Temp\ct3288691\xpi\defaults\preferences (PUP.Optional.Conduit.A) -> Quarantined and deleted successfully. C:\Users\mike\AppData\Local\Temp\ct3297861 (PUP.Optional.Conduit.A) -> Quarantined and deleted successfully. C:\Users\mike\AppData\Local\TBHostSupport (PUP.Optional.Conduit) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39 (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\91fbdd335935d6fab2f0f46ec3451b3a18a24a23 (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\91fbdd335935d6fab2f0f46ec3451b3a18a24a23\1.2.3 (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\91fbdd335935d6fab2f0f46ec3451b3a18a24a23\1.2.3\css (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\91fbdd335935d6fab2f0f46ec3451b3a18a24a23\1.2.3\images (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\91fbdd335935d6fab2f0f46ec3451b3a18a24a23\1.2.3\images\icons (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\91fbdd335935d6fab2f0f46ec3451b3a18a24a23\1.2.3\js (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\d0e0492c497d8c260a5e799f8212a9e2b288600a (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\d0e0492c497d8c260a5e799f8212a9e2b288600a\1.0.2 (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\d0e0492c497d8c260a5e799f8212a9e2b288600a\1.0.2\css (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\d0e0492c497d8c260a5e799f8212a9e2b288600a\1.0.2\fonts (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\d0e0492c497d8c260a5e799f8212a9e2b288600a\1.0.2\images (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\d0e0492c497d8c260a5e799f8212a9e2b288600a\1.0.2\js (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2 (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\css (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\fonts (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\js (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. Files Detected: 252 C:\Users\mike\AppData\Roaming\OpenCandy\OpenCandy_049603A5E3BC4844A5DBA0CF2ED150E8\LatestDLMgr.exe (PUP.Optional.OpenCandy.A) -> Quarantined and deleted successfully. C:\ministub.exe (PUP.Optional.Conduit.A) -> Quarantined and deleted successfully. C:\Users\mike\AppData\Local\Temp\nstDB35.tmp (PUP.Optional.Somoto.A) -> Quarantined and deleted successfully. C:\Users\mike\AppData\Local\Temp\ct3288691\ctbe.exe (PUP.Optional.Conduit.A) -> Quarantined and deleted successfully. C:\Users\mike\AppData\Local\Temp\ct3288691\spch.exe (PUP.Optional.Conduit.A) -> Quarantined and deleted successfully. C:\Users\mike\AppData\Local\Temp\ct3288691\spff.exe (PUP.Optional.Conduit.A) -> Quarantined and deleted successfully. C:\Users\mike\AppData\Local\Temp\ct3288691\statisticsStub.exe (PUP.Optional.Conduit.A) -> Quarantined and deleted successfully. C:\Users\mike\Downloads\monoSetup.exe (PUP.Bundle.Installer.OI) -> Quarantined and deleted successfully. C:\Users\mike\Downloads\SoftonicDownloader_for_video-download-capture.exe (PUP.Optional.Softonic.A) -> Quarantined and deleted successfully. C:\Users\mike\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_pbkdpahkifcigckmhiafindmaflfifgm_0.localstorage-journal (PUP.Optional.CrossRider.A) -> Quarantined and deleted successfully. C:\Program Files (x86)\Installl_Converter_A\toolbar.cfg (PUP.Optional.InstalllConverter.A) -> Quarantined and deleted successfully. C:\Program Files (x86)\Installl_Converter_A\GottenAppsContextMenu.xml (PUP.Optional.InstalllConverter.A) -> Quarantined and deleted successfully. C:\Program Files (x86)\Installl_Converter_A\hk64tbIns0.dll (PUP.Optional.InstalllConverter.A) -> Quarantined and deleted successfully. C:\Program Files (x86)\Installl_Converter_A\hk64tbInst.dll (PUP.Optional.InstalllConverter.A) -> Quarantined and deleted successfully. C:\Program Files (x86)\Installl_Converter_A\hktbIns0.dll (PUP.Optional.InstalllConverter.A) -> Quarantined and deleted successfully. C:\Program Files (x86)\Installl_Converter_A\hktbInst.dll (PUP.Optional.InstalllConverter.A) -> Quarantined and deleted successfully. C:\Program Files (x86)\Installl_Converter_A\Installl_Converter_AToolbarHelper.exe (PUP.Optional.InstalllConverter.A) -> Quarantined and deleted successfully. C:\Program Files (x86)\Installl_Converter_A\Installl_Converter_AToolbarHelper1.exe (PUP.Optional.InstalllConverter.A) -> Quarantined and deleted successfully. C:\Program Files (x86)\Installl_Converter_A\ldrtbIns0.dll (PUP.Optional.InstalllConverter.A) -> Quarantined and deleted successfully. C:\Program Files (x86)\Installl_Converter_A\ldrtbInst.dll (PUP.Optional.InstalllConverter.A) -> Quarantined and deleted successfully. C:\Program Files (x86)\Installl_Converter_A\OtherAppsContextMenu.xml (PUP.Optional.InstalllConverter.A) -> Quarantined and deleted successfully. C:\Program Files (x86)\Installl_Converter_A\prxtbIns0.dll (PUP.Optional.InstalllConverter.A) -> Quarantined and deleted successfully. C:\Program Files (x86)\Installl_Converter_A\prxtbInst.dll (PUP.Optional.InstalllConverter.A) -> Quarantined and deleted successfully. C:\Program Files (x86)\Installl_Converter_A\SharedAppsContextMenu.xml (PUP.Optional.InstalllConverter.A) -> Quarantined and deleted successfully. C:\Program Files (x86)\Installl_Converter_A\tbIns0.dll (PUP.Optional.InstalllConverter.A) -> Quarantined and deleted successfully. C:\Program Files (x86)\Installl_Converter_A\tbInst.dll (PUP.Optional.InstalllConverter.A) -> Quarantined and deleted successfully. C:\Program Files (x86)\Installl_Converter_A\ToolbarContextMenu.xml (PUP.Optional.InstalllConverter.A) -> Quarantined and deleted successfully. C:\Program Files (x86)\Installl_Converter_A\uninstall.exe (PUP.Optional.InstalllConverter.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\Temp\CT3297930\ddt.csf (PUP.Optional.Conduit.A) -> Quarantined and deleted successfully. C:\Users\mike\AppData\Local\Temp\ct3288691\chromeid.txt (PUP.Optional.Conduit.A) -> Quarantined and deleted successfully. C:\Users\mike\AppData\Local\Temp\ct3288691\conduit.xml (PUP.Optional.Conduit.A) -> Quarantined and deleted successfully. C:\Users\mike\AppData\Local\Temp\ct3288691\CT3288691.txt (PUP.Optional.Conduit.A) -> Quarantined and deleted successfully. C:\Users\mike\AppData\Local\Temp\ct3288691\CT3288691.xpi (PUP.Optional.Conduit.A) -> Quarantined and deleted successfully. C:\Users\mike\AppData\Local\Temp\ct3288691\dtime.csf (PUP.Optional.Conduit.A) -> Quarantined and deleted successfully. C:\Users\mike\AppData\Local\Temp\ct3288691\initData.json (PUP.Optional.Conduit.A) -> Quarantined and deleted successfully. C:\Users\mike\AppData\Local\Temp\ct3288691\manifest.json (PUP.Optional.Conduit.A) -> Quarantined and deleted successfully. C:\Users\mike\AppData\Local\Temp\ct3288691\setup.ini.txt (PUP.Optional.Conduit.A) -> Quarantined and deleted successfully. C:\Users\mike\AppData\Local\Temp\ct3288691\stub.exe (PUP.Optional.Conduit.A) -> Quarantined and deleted successfully. C:\Users\mike\AppData\Local\Temp\ct3288691\xpi\install.rdf (PUP.Optional.Conduit.A) -> Quarantined and deleted successfully. C:\Users\mike\AppData\Local\Temp\ct3288691\xpi\defaults\preferences\defaults.js (PUP.Optional.Conduit.A) -> Quarantined and deleted successfully. C:\Users\mike\AppData\Local\Temp\ct3297861\chromeid.txt (PUP.Optional.Conduit.A) -> Quarantined and deleted successfully. C:\Users\mike\AppData\Local\Temp\ct3297861\setup.ini.txt (PUP.Optional.Conduit.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\UrlFolderExtension.uf1 (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\UrlFolderExtension.ufm (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\91fbdd335935d6fab2f0f46ec3451b3a18a24a23\1.2.3\anemone-1.2.7.js (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\91fbdd335935d6fab2f0f46ec3451b3a18a24a23\1.2.3\background.html (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\91fbdd335935d6fab2f0f46ec3451b3a18a24a23\1.2.3\Date.getWeek.js (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\91fbdd335935d6fab2f0f46ec3451b3a18a24a23\1.2.3\hidden-window.html (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\91fbdd335935d6fab2f0f46ec3451b3a18a24a23\1.2.3\ie7-fix.html (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\91fbdd335935d6fab2f0f46ec3451b3a18a24a23\1.2.3\jquery-1.7.2.min.js (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\91fbdd335935d6fab2f0f46ec3451b3a18a24a23\1.2.3\jquery-dropdown.js (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\91fbdd335935d6fab2f0f46ec3451b3a18a24a23\1.2.3\jquery-inputfieldrestrict.js (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\91fbdd335935d6fab2f0f46ec3451b3a18a24a23\1.2.3\jquery-modal.js (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\91fbdd335935d6fab2f0f46ec3451b3a18a24a23\1.2.3\jquery-ui.min.js (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\91fbdd335935d6fab2f0f46ec3451b3a18a24a23\1.2.3\json2.min.js (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\91fbdd335935d6fab2f0f46ec3451b3a18a24a23\1.2.3\manifest.json (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\91fbdd335935d6fab2f0f46ec3451b3a18a24a23\1.2.3\SignedExtension.cab (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\91fbdd335935d6fab2f0f46ec3451b3a18a24a23\1.2.3\underscore-1.3.1.min.js (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\91fbdd335935d6fab2f0f46ec3451b3a18a24a23\1.2.3\widget-api-1.2.js (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\91fbdd335935d6fab2f0f46ec3451b3a18a24a23\1.2.3\window.html (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\91fbdd335935d6fab2f0f46ec3451b3a18a24a23\1.2.3\css\dropdown.css (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\91fbdd335935d6fab2f0f46ec3451b3a18a24a23\1.2.3\css\modal.css (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\91fbdd335935d6fab2f0f46ec3451b3a18a24a23\1.2.3\css\widget.css (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\91fbdd335935d6fab2f0f46ec3451b3a18a24a23\1.2.3\images\favicon.ico (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\91fbdd335935d6fab2f0f46ec3451b3a18a24a23\1.2.3\images\FBwidget_sprite.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\91fbdd335935d6fab2f0f46ec3451b3a18a24a23\1.2.3\images\icon.bmp (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\91fbdd335935d6fab2f0f46ec3451b3a18a24a23\1.2.3\images\icon.bmp,hot,flags=none.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\91fbdd335935d6fab2f0f46ec3451b3a18a24a23\1.2.3\images\icon.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\91fbdd335935d6fab2f0f46ec3451b3a18a24a23\1.2.3\images\loading.gif (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\91fbdd335935d6fab2f0f46ec3451b3a18a24a23\1.2.3\images\icons\F0.bmp (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\91fbdd335935d6fab2f0f46ec3451b3a18a24a23\1.2.3\images\icons\F0.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\91fbdd335935d6fab2f0f46ec3451b3a18a24a23\1.2.3\images\icons\F1.bmp (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\91fbdd335935d6fab2f0f46ec3451b3a18a24a23\1.2.3\images\icons\F1.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\91fbdd335935d6fab2f0f46ec3451b3a18a24a23\1.2.3\images\icons\F10.bmp (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\91fbdd335935d6fab2f0f46ec3451b3a18a24a23\1.2.3\images\icons\F10.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\91fbdd335935d6fab2f0f46ec3451b3a18a24a23\1.2.3\images\icons\F2.bmp (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\91fbdd335935d6fab2f0f46ec3451b3a18a24a23\1.2.3\images\icons\F2.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\91fbdd335935d6fab2f0f46ec3451b3a18a24a23\1.2.3\images\icons\F3.bmp (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\91fbdd335935d6fab2f0f46ec3451b3a18a24a23\1.2.3\images\icons\F3.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\91fbdd335935d6fab2f0f46ec3451b3a18a24a23\1.2.3\images\icons\F4.bmp (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\91fbdd335935d6fab2f0f46ec3451b3a18a24a23\1.2.3\images\icons\F4.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\91fbdd335935d6fab2f0f46ec3451b3a18a24a23\1.2.3\images\icons\F5.bmp (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\91fbdd335935d6fab2f0f46ec3451b3a18a24a23\1.2.3\images\icons\F5.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\91fbdd335935d6fab2f0f46ec3451b3a18a24a23\1.2.3\images\icons\F6.bmp (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\91fbdd335935d6fab2f0f46ec3451b3a18a24a23\1.2.3\images\icons\F6.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\91fbdd335935d6fab2f0f46ec3451b3a18a24a23\1.2.3\images\icons\F7.bmp (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\91fbdd335935d6fab2f0f46ec3451b3a18a24a23\1.2.3\images\icons\F7.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\91fbdd335935d6fab2f0f46ec3451b3a18a24a23\1.2.3\images\icons\F8.bmp (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\91fbdd335935d6fab2f0f46ec3451b3a18a24a23\1.2.3\images\icons\F8.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\91fbdd335935d6fab2f0f46ec3451b3a18a24a23\1.2.3\images\icons\F9.bmp (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\91fbdd335935d6fab2f0f46ec3451b3a18a24a23\1.2.3\images\icons\F9.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\91fbdd335935d6fab2f0f46ec3451b3a18a24a23\1.2.3\js\background.js (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\91fbdd335935d6fab2f0f46ec3451b3a18a24a23\1.2.3\js\hiddenwindow.js (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\91fbdd335935d6fab2f0f46ec3451b3a18a24a23\1.2.3\js\settings.js (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\91fbdd335935d6fab2f0f46ec3451b3a18a24a23\1.2.3\js\widgetwindow.js (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\d0e0492c497d8c260a5e799f8212a9e2b288600a\1.0.2\anemone-1.2.7.js (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\d0e0492c497d8c260a5e799f8212a9e2b288600a\1.0.2\App.html (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\d0e0492c497d8c260a5e799f8212a9e2b288600a\1.0.2\Background.html (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\d0e0492c497d8c260a5e799f8212a9e2b288600a\1.0.2\EventManager.js (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\d0e0492c497d8c260a5e799f8212a9e2b288600a\1.0.2\hogan-2.0.0.js (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\d0e0492c497d8c260a5e799f8212a9e2b288600a\1.0.2\jquery-1.7.1.min.js (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\d0e0492c497d8c260a5e799f8212a9e2b288600a\1.0.2\manifest.json (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\d0e0492c497d8c260a5e799f8212a9e2b288600a\1.0.2\reset.css (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\d0e0492c497d8c260a5e799f8212a9e2b288600a\1.0.2\SignedExtension.cab (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\d0e0492c497d8c260a5e799f8212a9e2b288600a\1.0.2\underscore-1.3.1.min.js (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\d0e0492c497d8c260a5e799f8212a9e2b288600a\1.0.2\widget-messaging-1.0.SNAPSHOT.js (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\d0e0492c497d8c260a5e799f8212a9e2b288600a\1.0.2\css\App.css (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\d0e0492c497d8c260a5e799f8212a9e2b288600a\1.0.2\fonts\cabin.eot (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\d0e0492c497d8c260a5e799f8212a9e2b288600a\1.0.2\fonts\cabin.woff (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\d0e0492c497d8c260a5e799f8212a9e2b288600a\1.0.2\images\arrow.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\d0e0492c497d8c260a5e799f8212a9e2b288600a\1.0.2\images\close.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\d0e0492c497d8c260a5e799f8212a9e2b288600a\1.0.2\images\close2.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\d0e0492c497d8c260a5e799f8212a9e2b288600a\1.0.2\images\delete.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\d0e0492c497d8c260a5e799f8212a9e2b288600a\1.0.2\images\delete2.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\d0e0492c497d8c260a5e799f8212a9e2b288600a\1.0.2\images\edit.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\d0e0492c497d8c260a5e799f8212a9e2b288600a\1.0.2\images\find.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\d0e0492c497d8c260a5e799f8212a9e2b288600a\1.0.2\images\go.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\d0e0492c497d8c260a5e799f8212a9e2b288600a\1.0.2\images\logo.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\d0e0492c497d8c260a5e799f8212a9e2b288600a\1.0.2\images\MapsGalaxy.bmp (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\d0e0492c497d8c260a5e799f8212a9e2b288600a\1.0.2\images\MapsGalaxy.bmp,hot,flags=none.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\d0e0492c497d8c260a5e799f8212a9e2b288600a\1.0.2\images\MapsGalaxy.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\d0e0492c497d8c260a5e799f8212a9e2b288600a\1.0.2\images\MapsGalaxy2.bmp (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\d0e0492c497d8c260a5e799f8212a9e2b288600a\1.0.2\images\MapsGalaxy2.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\d0e0492c497d8c260a5e799f8212a9e2b288600a\1.0.2\images\save.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\d0e0492c497d8c260a5e799f8212a9e2b288600a\1.0.2\images\save2.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\d0e0492c497d8c260a5e799f8212a9e2b288600a\1.0.2\images\settings.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\d0e0492c497d8c260a5e799f8212a9e2b288600a\1.0.2\images\stars.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\d0e0492c497d8c260a5e799f8212a9e2b288600a\1.0.2\js\App.js (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\d0e0492c497d8c260a5e799f8212a9e2b288600a\1.0.2\js\App.Test.js (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\d0e0492c497d8c260a5e799f8212a9e2b288600a\1.0.2\js\Background.js (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\d0e0492c497d8c260a5e799f8212a9e2b288600a\1.0.2\js\Data.js (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\d0e0492c497d8c260a5e799f8212a9e2b288600a\1.0.2\js\FindLocation.js (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\d0e0492c497d8c260a5e799f8212a9e2b288600a\1.0.2\js\GetDirections.js (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\d0e0492c497d8c260a5e799f8212a9e2b288600a\1.0.2\js\MapsGalaxy.js (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\d0e0492c497d8c260a5e799f8212a9e2b288600a\1.0.2\js\MGDropDown.js (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\d0e0492c497d8c260a5e799f8212a9e2b288600a\1.0.2\js\Modals.Delete.js (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\d0e0492c497d8c260a5e799f8212a9e2b288600a\1.0.2\js\Modals.Location.js (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\d0e0492c497d8c260a5e799f8212a9e2b288600a\1.0.2\js\Modals.MaxRecent.js (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\d0e0492c497d8c260a5e799f8212a9e2b288600a\1.0.2\js\Modals.MaxSaved.js (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\d0e0492c497d8c260a5e799f8212a9e2b288600a\1.0.2\js\Reporting.js (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\d0e0492c497d8c260a5e799f8212a9e2b288600a\1.0.2\js\Settings.js (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\anemone-1.2.7.js (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\App.html (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\Background.html (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\hogan-2.0.0.js (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\jquery-1.7.1.min.js (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\json2.min.js (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\manifest.json (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\reset.css (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\SignedExtension.cab (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\underscore-1.4.2.min.js (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\widget-api-1.2.js (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\css\App.css (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\fonts\cabin.eot (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\fonts\cabin.woff (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\close.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\MainIcon.bmp (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\MainIcon.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\minimize.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\rateUISprite.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\rate_WB.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\search.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\WBlogo.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\ChanceOfRain.bmp (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\ChanceOfRain.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\ChanceOfRain_60x60.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\ChanceOfRain_90x90.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\ChanceOfSnow.bmp (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\ChanceOfSnow.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\ChanceOfSnow_60x60.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\ChanceOfSnow_90x90.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\ChanceOfStorm.bmp (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\ChanceOfStorm.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\ChanceOfStorm_60x60.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\ChanceOfStorm_90x90.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\ChanceOfTstorm.bmp (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\ChanceOfTstorm.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\ChanceOfTstorm_60x60.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\ChanceOfTstorm_90x90.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\Cloudy.bmp (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\Cloudy.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\Cloudy_60x60.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\Cloudy_90x90.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\Dust.bmp (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\Dust.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\Dust_60x60.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\Dust_90x90.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\Fog.bmp (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\Fog.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\Fog_60x60.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\Fog_90x90.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\Ice.bmp (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\Ice.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\Ice_60x60.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\Ice_90x90.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\MainIcon.bmp (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\MainIcon.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\Misc.bmp (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\Misc.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\Misc_60x60.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\Misc_90x90.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\Misty.bmp (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\Misty.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\Misty_60x60.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\Misty_90x90.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\MostlyCloudy.bmp (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\MostlyCloudy.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\MostlyCloudy_60x60.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\MostlyCloudy_90x90.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\MostlySunny.bmp (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\MostlySunny.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\MostlySunny_60x60.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\MostlySunny_90x90.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\Rain.bmp (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\Rain.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\Rain_60x60.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\Rain_90x90.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\SevereWeatherAdvisory.bmp (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\SevereWeatherAdvisory.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\SevereWeatherWarning.bmp (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\SevereWeatherWarning.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\SevereWeatherWatch.bmp (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\SevereWeatherWatch.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\Showers.bmp (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\Showers.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\Showers_60x60.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\Showers_90x90.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\Sleet.bmp (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\Sleet.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\Sleet_60x60.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\Sleet_90x90.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\Snow.bmp (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\Snow.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\Snow_60x60.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\Snow_90x90.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\Sunny.bmp (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\Sunny.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\Sunny_60x60.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\Sunny_90x90.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\Thunderstorm.bmp (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\Thunderstorm.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\Thunderstorm_60x60.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\Thunderstorm_90x90.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\Windy.bmp (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\Windy.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\Windy_60x60.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\Windy_90x90.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\js\App.js (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\js\App.Test.js (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\js\Background.js (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\js\Settings.js (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\js\WeatherBlink.js (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully. (end) -----------------------------------------------------------------
  5. Conduit is certainly malicious and should be flagged as such. I cannot believe ANYONE would knowingly allow this crap to be installed on their computer.
  6. The Addition.txt file is attached. Here is the FRST File text: -------------------------------- Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 27-04-2014 Ran by mike (administrator) on ECSC2D on 27-04-2014 17:30:48 Running from C:\Users\mike\Downloads\frst64 Windows 7 Home Premium Service Pack 1 (X64) OS Language: English(US) Internet Explorer Version 11 Boot Mode: Normal The only official download link for FRST: Download link for 32-Bit version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/ Download link for 64-Bit Version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/ Download link from any site other than Bleeping Computer is unpermitted or outdated. See tutorial for FRST: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2013\avgrsa.exe (AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2013\avgcsrva.exe (AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2013\avgidsagent.exe (AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2013\avgwdsvc.exe (CobianSoft, Luis Cobian) C:\Program Files (x86)\Cobian Backup 11\cbVSCService11.exe (Luis Cobian, CobianSoft) C:\Program Files (x86)\Cobian Backup 11\cbService.exe (Microsoft Corporation) C:\Windows\system32\inetsrv\inetinfo.exe (LogMeIn, Inc.) C:\Program Files (x86)\LogMeIn\x64\LMIGuardianSvc.exe (LogMeIn, Inc.) C:\Program Files (x86)\LogMeIn\x64\RaMaint.exe (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Microsoft Corporation) C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe (AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2013\avgnsa.exe () C:\Program Files (x86)\Motorola\MotoHelper\MotoHelperService.exe (AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2013\avgemca.exe (Microsoft Corporation) C:\Program Files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe (Microsoft Corporation) C:\Program Files\Microsoft SQL Server\MSSQL10.SQLSERVER\MSSQL\Binn\sqlservr.exe (Paramount Software UK Ltd) C:\Program Files\Macrium\Reflect\ReflectService.exe (SonicWALL Inc.) C:\Program Files (x86)\SonicWALL\SSL-VPN\NetExtender\NEService64.exe (Microsoft Corporation) C:\Program Files (x86)\Microsoft SQL Server\90\Shared\sqlbrowser.exe (Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe (TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe (AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2013\avgcsrva.exe (Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (LogMeIn, Inc.) C:\Program Files (x86)\LogMeIn\x64\LogMeIn.exe (Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe (Microsoft Corporation) C:\Windows\system32\UI0Detect.exe (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Intel Corporation) C:\Windows\System32\hkcmd.exe (LogMeIn, Inc.) C:\Program Files (x86)\LogMeIn\x64\LogMeInSystray.exe () C:\Program Files (x86)\Greenshot\Greenshot.exe () C:\Users\mike\AppData\Local\Amazon Cloud Player\Amazon Music Helper.exe (NEC Electronics Corporation) C:\Program Files (x86)\Western Digital\USB 3.0 Host Controller Driver\Application\nusb3mon.exe (Luis Cobian, CobianSoft) C:\Program Files (x86)\Cobian Backup 11\cbInterface.exe (AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2013\avgui.exe () C:\Program Files (x86)\Motorola\MotoHelper\MotoHelperAgent.exe (Microsoft Corporation) C:\Windows\SYSTEM32\cmd.exe (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe ==================== Registry (Whitelisted) ================== HKLM\...\Run: [LogMeIn GUI] => C:\Program Files (x86)\LogMeIn\x64\LogMeInSystray.exe [57928 2010-09-17] (LogMeIn, Inc.) HKLM-x32\...\Run: [] => [X] HKLM-x32\...\Run: [NUSB3MON] => C:\Program Files (x86)\Western Digital\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [106496 2009-11-20] (NEC Electronics Corporation) HKLM-x32\...\Run: [Cobian Backup 11 interface] => C:\Program Files (x86)\Cobian Backup 11\cbInterface.exe [4482048 2012-05-14] (Luis Cobian, CobianSoft) HKLM-x32\...\Run: [AVG_UI] => C:\Program Files (x86)\AVG\AVG2013\avgui.exe [4411952 2014-01-21] (AVG Technologies CZ, s.r.o.) HKLM-x32\...\Run: [AsioThk32Reg] => REGSVR32.EXE /S CTASIO.DLL Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation) HKU\.DEFAULT\...\Run: [DevconDefaultDB] => C:\Windows\system32\READREG /SILENT /FAIL=1 HKU\S-1-5-21-1229362484-4032704617-3898728357-1001\...\Run: [Greenshot] => C:\Program Files (x86)\Greenshot\Greenshot.exe [548864 2010-07-12] () HKU\S-1-5-21-1229362484-4032704617-3898728357-1001\...\Run: [DAEMON Tools Lite] => C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [3672640 2013-03-14] (Disc Soft Ltd) HKU\S-1-5-21-1229362484-4032704617-3898728357-1001\...\Run: [Amazon Cloud Player] => C:\Users\mike\AppData\Local\Amazon Cloud Player\Amazon Music Helper.exe [3168576 2014-03-07] () HKU\S-1-5-21-1229362484-4032704617-3898728357-1001\...\MountPoints2: H - H:\setup.exe -a HKU\S-1-5-21-1229362484-4032704617-3898728357-1001\...\MountPoints2: {2163a700-14aa-11e1-83b7-002197d95ef5} - I:\setup.exe -a HKU\S-1-5-21-1229362484-4032704617-3898728357-1001\...\MountPoints2: {39b0c568-7625-11e3-9f58-002197d95ef5} - H:\VZW_Software_upgrade_assistant.exe HKU\S-1-5-21-1229362484-4032704617-3898728357-1001\...\MountPoints2: {9c96663d-7609-11e0-af53-002197d95ef5} - F:\TLBootstrap_WPP.exe Startup: C:\Users\Mike w\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Greenshot.lnk ShortcutTarget: Greenshot.lnk -> C:\Program Files (x86)\Greenshot\Greenshot.exe () Startup: C:\Users\Robert\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\magicJack - Shortcut.lnk ShortcutTarget: magicJack - Shortcut.lnk -> C:\mjusbsp\magicJack.exe (magicJack L.P.) ==================== Internet (Whitelisted) ==================== HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/ HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-US HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xE8F0FA663F60CF01 URLSearchHook: HKLM-x32 - (No Name) - {f84db37a-ae6f-423b-9f51-14b5ec10c879} - No File SearchScopes: HKLM-x32 - DefaultScope {B4E51FC4-C4A4-42E4-945A-889EA5F28B72} URL = SearchScopes: HKLM-x32 - {b0441a0e-a49a-4e16-afc1-74ecced1921f} URL = http://search.mywebsearch.com/mywebsearch/GGmain.jhtml?p2=^UX^man000^YY^&ptb=CE66B2A7-EFD2-47CE-80FA-4B53FBDEDB98&ind=2013032021&n=77fc6e55&psa=&st=sb&searchfor={searchTerms} SearchScopes: HKCU - {B4E51FC4-C4A4-42E4-945A-889EA5F28B72} URL = BHO: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation) BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation) BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) BHO-x32: No Name - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated) BHO-x32: DivX Plus Web Player HTML5 <video> - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC) BHO-x32: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation) BHO-x32: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated) BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation) BHO-x32: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) BHO-x32: SmartSelect Class - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated) Toolbar: HKLM-x32 - Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated) Toolbar: HKLM-x32 - No Name - {f84db37a-ae6f-423b-9f51-14b5ec10c879} - No File Toolbar: HKCU - No Name - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - No File Toolbar: HKCU - No Name - {D4027C7F-154A-4066-A1AD-4243D8127440} - No File Toolbar: HKCU - No Name - {F84DB37A-AE6F-423B-9F51-14B5EC10C879} - No File DPF: HKLM-x32 {6EEFD7B1-B26C-440D-B55A-1EC677189F30} https://75.160.58.125:4433/NELX.cab DPF: HKLM-x32 {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab Handler: a5res\CLSID - No CLSID Value - Handler: XBasic\CLSID - No CLSID Value - Handler: XBasic\OLEScript - No CLSID Value - Handler: XBasicV10\CLSID - No CLSID Value - Handler: XBasicV10\OLEScript - No CLSID Value - Handler-x32: a5res\CLSID - No CLSID Value - Handler-x32: XBasic\CLSID - No CLSID Value - Handler-x32: XBasic\OLEScript - No CLSID Value - Handler-x32: XBasicV10\CLSID - No CLSID Value - Handler-x32: XBasicV10\OLEScript - No CLSID Value - Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 FireFox: ======== FF ProfilePath: C:\Users\mike\AppData\Roaming\Mozilla\Firefox\Profiles\y428pvf0.default-1396214294990 FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_12_0_0_77.dll () FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.) FF Plugin: @java.com/DTPlugin,version=10.5.0 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation) FF Plugin: @java.com/JavaPlugin,version=10.5.0 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin: @microsoft.com/GENUINE - disabled No File FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation) FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_77.dll () FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\SysWOW64\Adobe\Director\np32dsw_1166636.dll (Adobe Systems, Inc.) FF Plugin-x32: @divx.com/DivX Plus Web Player Plug-In,version=1.0.0 - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC) FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.) FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google) FF Plugin-x32: @java.com/DTPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin-x32: @microsoft.com/GENUINE - disabled No File FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MIF5BA~1\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MIF5BA~1\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF Plugin-x32: @oberon-media.com/ONCAdapter - C:\Program Files (x86)\Common Files\Oberon Media\NCAdapter\1.0.0.8\npapicomadapter.dll (Oberon-Media ) FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @videolan.org/vlc,version=2.0.2 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN) FF Plugin-x32: Adobe Acrobat - C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\Air\nppdf32.dll (Adobe Systems Inc.) FF Plugin HKCU: amazon.com/AmazonMP3DownloaderPlugin - C:\Program Files (x86)\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin.dll (Amazon.com, Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.) FF HKLM-x32\...\Firefox\Extensions: [{23fcfd51-4958-4f00-80a3-ae97e717ed8b}] - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5 FF Extension: DivX Plus Web Player HTML5 <video> - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2013-05-23] FF HKLM-x32\...\Thunderbird\Extensions: [avgthb@avg.com] - C:\Program Files (x86)\AVG\AVG2012\Thunderbird\ FF Extension: AVG E-mail Scanner - C:\Program Files (x86)\AVG\AVG2012\Thunderbird\ [] Chrome: ======= CHR DefaultSearchKeyword: CHR DefaultSearchProvider: Web CHR DefaultSearchURL: http://start.msn.iplay.com/searchresultsredirect.aspx?o=chrome&q={searchTerms} CHR DefaultNewTabURL: CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\34.0.1847.116\gcswf32.dll No File CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll No File CHR Plugin: (QuickTime Plug-in 7.6.7) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin.dll (Apple Inc.) CHR Plugin: (QuickTime Plug-in 7.6.7) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin2.dll (Apple Inc.) CHR Plugin: (QuickTime Plug-in 7.6.7) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin3.dll (Apple Inc.) CHR Plugin: (QuickTime Plug-in 7.6.7) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin4.dll (Apple Inc.) CHR Plugin: (QuickTime Plug-in 7.6.7) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin5.dll (Apple Inc.) CHR Plugin: (QuickTime Plug-in 7.6.7) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin6.dll (Apple Inc.) CHR Plugin: (QuickTime Plug-in 7.6.7) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin7.dll (Apple Inc.) CHR Plugin: (Java Deployment Toolkit 6.0.260.3) - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll No File CHR Plugin: (Java Platform SE 6 U26) - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll No File CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\Browser\nppdf32.dll (Adobe Systems Inc.) CHR Plugin: (Silverlight Plug-In) - C:\Program Files (x86)\Microsoft Silverlight\4.0.60531.0\npctrl.dll No File CHR Plugin: (Shockwave for Director) - C:\Windows\system32\Adobe\Director\np32dsw.dll No File CHR Plugin: (DivX Web Player) - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC) CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MIF5BA~1\Office14\NPAUTHZ.DLL (Microsoft Corporation) CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MIF5BA~1\Office14\NPSPWRAP.DLL (Microsoft Corporation) CHR Plugin: (Remoting Viewer) - internal-remoting-viewer CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\34.0.1847.116\ppGoogleNaClPluginChrome.dll () CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\34.0.1847.116\pdf.dll () CHR Plugin: (DivX VOD Helper Plug-in) - C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.) CHR Plugin: (Google Earth Plugin) - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google) CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.69\npGoogleUpdate3.dll No File CHR Plugin: (Default Plug-in) - default_plugin No File CHR Extension: (Google Wallet) - C:\Users\mike\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-11-06] CHR Extension: (DivX Plus Web Player HTML5 <video>) - C:\Users\mike\AppData\Local\Google\Chrome\User Data\Default\Extensions\nneajnkjbffgblleaoojgaacokifdkhm [2011-07-17] CHR Extension: (DivX Browser Bar) - C:\Users\mike\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkmpcdbgnfjfeelcpebpkflcmbkclfho [2013-06-16] CHR HKCU\...\Chrome\Extension: [pkmpcdbgnfjfeelcpebpkflcmbkclfho] - C:\Users\mike\AppData\Local\CRE\pkmpcdbgnfjfeelcpebpkflcmbkclfho.crx [2013-05-13] CHR HKLM-x32\...\Chrome\Extension: [nneajnkjbffgblleaoojgaacokifdkhm] - C:\Program Files (x86)\DivX\DivX Plus Web Player\chrome\DivXHTML5\DivXHTML5.crx [2013-05-06] CHR HKLM-x32\...\Chrome\Extension: [pkmpcdbgnfjfeelcpebpkflcmbkclfho] - C:\Users\mike\AppData\Local\CRE\pkmpcdbgnfjfeelcpebpkflcmbkclfho.crx [2013-05-13] ==================== Services (Whitelisted) ================= R2 AVGIDSAgent; C:\Program Files (x86)\AVG\AVG2013\avgidsagent.exe [4939312 2013-07-04] (AVG Technologies CZ, s.r.o.) R2 avgwd; C:\Program Files (x86)\AVG\AVG2013\avgwdsvc.exe [283136 2013-11-20] (AVG Technologies CZ, s.r.o.) R2 cbVSCService11; C:\Program Files (x86)\Cobian Backup 11\cbVSCService11.exe [67584 2012-05-13] (CobianSoft, Luis Cobian) R2 CobianBackup11; C:\Program Files (x86)\Cobian Backup 11\cbService.exe [1131008 2012-05-14] (Luis Cobian, CobianSoft) R2 IISADMIN; C:\Windows\system32\inetsrv\inetinfo.exe [15872 2010-11-20] (Microsoft Corporation) R2 LMIGuardianSvc; C:\Program Files (x86)\LogMeIn\x64\LMIGuardianSvc.exe [376144 2014-04-17] (LogMeIn, Inc.) R2 LMIMaint; C:\Program Files (x86)\LogMeIn\x64\RaMaint.exe [226640 2014-04-17] (LogMeIn, Inc.) R2 LogMeIn; C:\Program Files (x86)\LogMeIn\x64\LogMeIn.exe [407424 2010-11-08] (LogMeIn, Inc.) S4 LXiMediaCenter Backend; C:\Program Files (x86)\LXiMediaCenter\lximcbackend.exe [704512 2012-02-29] () R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation) R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation) R2 MotoHelper; C:\Program Files (x86)\Motorola\MotoHelper\MotoHelperService.exe [223088 2011-04-26] () R2 MSSQL$SQLEXPRESS; C:\Program Files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe [57966424 2010-09-17] (Microsoft Corporation) R2 MSSQL$SQLSERVER; C:\Program Files\Microsoft SQL Server\MSSQL10.SQLSERVER\MSSQL\Binn\sqlservr.exe [57966424 2010-09-17] (Microsoft Corporation) S4 msvsmon90; C:\Program Files\Microsoft Visual Studio 9.0\Common7\IDE\Remote Debugger\x64\msvsmon.exe [4737024 2008-07-29] (Microsoft Corporation) R2 ReflectService.exe; C:\Program Files\Macrium\Reflect\ReflectService.exe [1142768 2013-12-05] (Paramount Software UK Ltd) R2 SONICWALL_NetExtender; C:\Program Files (x86)\SonicWALL\SSL-VPN\NetExtender\NEService64.exe [498560 2010-04-01] (SonicWALL Inc.) S2 SQLAgent$SQLEXPRESS; C:\Program Files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE [430424 2010-09-17] (Microsoft Corporation) S2 SQLAgent$SQLSERVER; C:\Program Files\Microsoft SQL Server\MSSQL10.SQLSERVER\MSSQL\Binn\SQLAGENT.EXE [430424 2010-09-17] (Microsoft Corporation) R2 W3SVC; C:\Windows\system32\inetsrv\iisw3adm.dll [453120 2010-11-20] (Microsoft Corporation) S3 WMSVC; C:\Windows\system32\inetsrv\wmsvc.exe [10752 2009-07-13] (Microsoft Corporation) ==================== Drivers (Whitelisted) ==================== S3 Apowersoft_AudioDevice; C:\Windows\System32\drivers\Apowersoft_AudioDevice.sys [29288 2010-12-24] (Wondershare) R1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdrivera.sys [246072 2013-11-25] (AVG Technologies CZ, s.r.o.) R0 AVGIDSHA; C:\Windows\System32\DRIVERS\avgidsha.sys [71480 2013-07-20] (AVG Technologies CZ, s.r.o.) R1 Avgldx64; C:\Windows\System32\DRIVERS\avgldx64.sys [206648 2013-07-20] (AVG Technologies CZ, s.r.o.) R0 Avgloga; C:\Windows\System32\DRIVERS\avgloga.sys [311608 2013-07-20] (AVG Technologies CZ, s.r.o.) R0 Avgmfx64; C:\Windows\System32\DRIVERS\avgmfx64.sys [116536 2013-07-01] (AVG Technologies CZ, s.r.o.) R0 Avgrkx64; C:\Windows\System32\DRIVERS\avgrkx64.sys [45880 2013-10-23] (AVG Technologies CZ, s.r.o.) R1 Avgtdia; C:\Windows\System32\DRIVERS\avgtdia.sys [240952 2014-04-15] (AVG Technologies CZ, s.r.o.) S3 BrSerIf; C:\Windows\System32\DRIVERS\BrSerIf.sys [97280 2006-09-03] (Brother Industries Ltd.) R3 COMMONFX.DLL; C:\Windows\System32\COMMONFX.DLL [151296 2007-04-12] (Creative Technology Ltd) S3 CT20XUT.DLL; C:\Windows\System32\CT20XUT.DLL [252712 2007-04-10] (Creative Technology Ltd.) R3 CTAUDFX.DLL; C:\Windows\System32\CTAUDFX.DLL [700200 2007-04-10] (Creative Technology Ltd) S3 CTEAPSFX.DLL; C:\Windows\System32\CTEAPSFX.DLL [219432 2007-04-10] (Creative Technology Ltd) S3 CTEDSPFX.DLL; C:\Windows\System32\CTEDSPFX.DLL [321832 2007-04-10] (Creative Technology Ltd) S3 CTEDSPIO.DLL; C:\Windows\System32\CTEDSPIO.DLL [190248 2007-04-10] (Creative Technology Ltd) S3 CTEDSPSY.DLL; C:\Windows\System32\CTEDSPSY.DLL [363304 2007-04-10] (Creative Technology Ltd) S3 CTERFXFX.DLL; C:\Windows\System32\CTERFXFX.DLL [142120 2007-04-10] (Creative Technology Ltd) S3 CTEXFIFX.DLL; C:\Windows\System32\CTEXFIFX.DLL [1571112 2007-04-10] (Creative Technology Ltd.) S3 CTHWIUT.DLL; C:\Windows\System32\CTHWIUT.DLL [123688 2007-04-10] (Creative Technology Ltd.) R3 CTSBLFX.DLL; C:\Windows\System32\CTSBLFX.DLL [681256 2007-04-10] (Creative Technology Ltd) R1 Ext2Fsd; C:\Windows\System32\Drivers\Ext2Fsd.sys [769816 2011-07-09] (www.ext2fsd.com) R2 LMIInfo; C:\Program Files (x86)\LogMeIn\x64\RaInfo.sys [16056 2013-05-23] (LogMeIn, Inc.) S4 LMIRfsClientNP; No ImagePath R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation) R3 NxDrv; C:\Windows\System32\DRIVERS\NxDrv.sys [24264 2009-10-21] (SonicWALL Inc.) S3 PSMounterEx; C:\Windows\system32\drivers\psmounterex.sys [76408 2013-08-01] (Paramount Software UK Ltd) R1 Serial; C:\Windows\System32\DRIVERS\serial.sys [94208 2009-07-13] (Brother Industries Ltd.) R0 sptd; C:\Windows\System32\Drivers\sptd.sys [564824 2013-04-10] (Duplex Secure Ltd.) U3 av9k0pbr; C:\Windows\System32\Drivers\av9k0pbr.sys [0 ] (Advanced Micro Devices) S3 VBoxNetFlt; system32\DRIVERS\VBoxNetFlt.sys [X] ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2014-04-27 17:30 - 2014-04-27 17:30 - 00000000 ____D () C:\FRST 2014-04-27 17:29 - 2014-04-27 17:30 - 00000000 ____D () C:\Users\mike\Downloads\frst64 2014-04-27 17:28 - 2014-04-27 17:29 - 02061824 _____ (Farbar) C:\Users\mike\Downloads\FRST64.exe 2014-04-27 11:51 - 2014-04-27 11:51 - 01722095 _____ () C:\Users\mike\Downloads\iphonesmsexport166.zip 2014-04-27 10:45 - 2014-04-27 10:45 - 00000178 _____ () C:\Users\mike\Desktop\Malwarebytes forum.url 2014-04-25 17:51 - 2014-04-25 17:51 - 00000000 ____D () C:\Users\mike\AppData\Roaming\3697 2014-04-24 22:58 - 2014-04-24 22:58 - 00000062 _____ () C:\Users\mike\Downloads\index.html 2014-04-24 22:42 - 2014-04-24 22:42 - 00441344 _____ () C:\Users\mike\Downloads\ipscan (1).exe 2014-04-24 22:39 - 2014-04-24 22:39 - 00441344 _____ () C:\Users\mike\Downloads\ipscan.exe 2014-04-19 11:28 - 2014-04-19 11:28 - 00000000 __SHD () C:\Users\mike\AppData\Local\EmieUserList 2014-04-19 11:28 - 2014-04-19 11:28 - 00000000 __SHD () C:\Users\mike\AppData\Local\EmieSiteList 2014-04-16 21:34 - 2014-03-06 04:21 - 23549440 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2014-04-16 21:34 - 2014-03-06 03:32 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2014-04-16 21:34 - 2014-03-06 03:31 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll 2014-04-16 21:34 - 2014-03-06 03:19 - 17387008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2014-04-16 21:34 - 2014-03-06 02:59 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll 2014-04-16 21:34 - 2014-03-06 02:57 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll 2014-04-16 21:34 - 2014-03-06 02:57 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll 2014-04-16 21:34 - 2014-03-06 02:53 - 02767360 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2014-04-16 21:34 - 2014-03-06 02:40 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2014-04-16 21:34 - 2014-03-06 02:39 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll 2014-04-16 21:34 - 2014-03-06 02:32 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2014-04-16 21:34 - 2014-03-06 02:32 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2014-04-16 21:34 - 2014-03-06 02:29 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe 2014-04-16 21:34 - 2014-03-06 02:29 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe 2014-04-16 21:34 - 2014-03-06 02:28 - 00752640 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll 2014-04-16 21:34 - 2014-03-06 02:15 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe 2014-04-16 21:34 - 2014-03-06 02:11 - 05784064 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2014-04-16 21:34 - 2014-03-06 02:09 - 00453120 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll 2014-04-16 21:34 - 2014-03-06 02:03 - 00586240 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2014-04-16 21:34 - 2014-03-06 02:02 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll 2014-04-16 21:34 - 2014-03-06 02:02 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll 2014-04-16 21:34 - 2014-03-06 02:01 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll 2014-04-16 21:34 - 2014-03-06 01:56 - 00038400 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll 2014-04-16 21:34 - 2014-03-06 01:48 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll 2014-04-16 21:34 - 2014-03-06 01:47 - 02178048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2014-04-16 21:34 - 2014-03-06 01:46 - 04254720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2014-04-16 21:34 - 2014-03-06 01:46 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll 2014-04-16 21:34 - 2014-03-06 01:45 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll 2014-04-16 21:34 - 2014-03-06 01:42 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll 2014-04-16 21:34 - 2014-03-06 01:40 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll 2014-04-16 21:34 - 2014-03-06 01:38 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe 2014-04-16 21:34 - 2014-03-06 01:36 - 00592896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll 2014-04-16 21:34 - 2014-03-06 01:22 - 00367616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll 2014-04-16 21:34 - 2014-03-06 01:21 - 00628736 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2014-04-16 21:34 - 2014-03-06 01:13 - 00032256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll 2014-04-16 21:34 - 2014-03-06 01:11 - 02043904 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl 2014-04-16 21:34 - 2014-03-06 01:07 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll 2014-04-16 21:34 - 2014-03-06 01:01 - 00244224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll 2014-04-16 21:34 - 2014-03-06 00:53 - 13551104 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2014-04-16 21:34 - 2014-03-06 00:46 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2014-04-16 21:34 - 2014-03-06 00:40 - 01967104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl 2014-04-16 21:34 - 2014-03-06 00:36 - 11745792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2014-04-16 21:34 - 2014-03-06 00:22 - 02260480 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2014-04-16 21:34 - 2014-03-05 23:58 - 01400832 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2014-04-16 21:34 - 2014-03-05 23:50 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll 2014-04-16 21:34 - 2014-03-05 23:43 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll 2014-04-16 21:34 - 2014-03-05 23:41 - 01789440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2014-04-16 21:34 - 2014-03-05 23:36 - 01143808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2014-04-15 13:35 - 2014-04-15 13:35 - 00240952 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgtdia.sys 2014-04-12 21:08 - 2014-04-12 21:09 - 00000000 ____D () C:\Users\mike\Documents\pera 2014-04-12 14:56 - 2014-04-12 14:56 - 00000079 _____ () C:\conduit.txt 2014-04-12 14:54 - 2014-04-12 14:54 - 00001292 ____N () C:\Users\mike\Desktop\run conduit.reg 2014-04-12 14:49 - 2014-04-12 14:49 - 00001104 ____N () C:\Users\mike\Desktop\conduit.reg 2014-04-12 14:42 - 2014-04-12 14:42 - 00001247 ____N () C:\Users\mike\Desktop\cmd.exe.lnk 2014-04-12 14:41 - 2014-04-12 14:41 - 00000560 ____N () C:\Users\mike\Desktop\run.reg 2014-04-09 21:45 - 2014-04-09 21:55 - 00000000 ____D () C:\Program Files (x86)\CDex 2014-04-09 21:45 - 2014-04-09 21:45 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CDex 2014-04-09 21:41 - 2014-04-09 21:43 - 08697544 _____ (Georgy Berdyshev) C:\Users\mike\Downloads\CDex-win32-1.70-b4-2009.exe 2014-04-09 10:37 - 2014-03-04 03:44 - 01163264 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll 2014-04-09 10:37 - 2014-03-04 03:44 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll 2014-04-09 10:37 - 2014-03-04 03:44 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll 2014-04-09 10:37 - 2014-03-04 03:44 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll 2014-04-09 10:37 - 2014-03-04 03:44 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll 2014-04-09 10:37 - 2014-03-04 03:17 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll 2014-04-09 10:37 - 2014-03-04 03:16 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll 2014-04-09 10:37 - 2014-03-04 03:16 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe 2014-04-09 10:37 - 2014-03-04 03:16 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll 2014-04-09 10:37 - 2014-03-04 02:09 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe 2014-04-09 10:37 - 2014-03-04 02:09 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe 2014-04-05 20:59 - 2014-04-07 11:19 - 00003364 _____ () C:\Windows\System32\Tasks\BackgroundContainer Startup Task 2014-03-30 15:18 - 2014-03-30 15:18 - 00000000 ____D () C:\Users\mike\Desktop\Old Firefox Data 2014-03-29 13:48 - 2014-03-29 13:48 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox 2014-03-29 13:41 - 2014-03-31 18:37 - 00000000 ____D () C:\Program Files (x86)\Mozilla Thunderbird ==================== One Month Modified Files and Folders ======= 2014-04-27 17:30 - 2014-04-27 17:30 - 00000000 ____D () C:\FRST 2014-04-27 17:30 - 2014-04-27 17:29 - 00000000 ____D () C:\Users\mike\Downloads\frst64 2014-04-27 17:29 - 2014-04-27 17:28 - 02061824 _____ (Farbar) C:\Users\mike\Downloads\FRST64.exe 2014-04-27 16:33 - 2012-04-04 12:16 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job 2014-04-27 16:24 - 2010-12-30 15:02 - 01787121 _____ () C:\Windows\WindowsUpdate.log 2014-04-27 14:40 - 2010-12-30 17:01 - 00000000 ____D () C:\ProgramData\MFAData 2014-04-27 11:51 - 2014-04-27 11:51 - 01722095 _____ () C:\Users\mike\Downloads\iphonesmsexport166.zip 2014-04-27 10:45 - 2014-04-27 10:45 - 00000178 _____ () C:\Users\mike\Desktop\Malwarebytes forum.url 2014-04-27 09:31 - 2009-07-13 22:45 - 00015152 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2014-04-27 09:31 - 2009-07-13 22:45 - 00015152 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2014-04-27 09:25 - 2009-07-13 21:20 - 00000000 ____D () C:\Windows\system32\inetsrv 2014-04-27 09:24 - 2014-01-22 20:30 - 00001009 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LogMeIn Client.lnk 2014-04-27 09:22 - 2009-07-13 23:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2014-04-27 09:22 - 2009-07-13 22:51 - 00147857 _____ () C:\Windows\setupact.log 2014-04-27 00:18 - 2011-01-04 07:25 - 00000000 ____D () C:\ProgramData\LogMeIn 2014-04-25 18:46 - 2011-11-04 17:21 - 00000000 ____D () C:\Users\mike\Documents\Outlook Files 2014-04-25 17:51 - 2014-04-25 17:51 - 00000000 ____D () C:\Users\mike\AppData\Roaming\3697 2014-04-25 13:20 - 2011-11-01 17:23 - 00000000 ____D () C:\Users\mike\AppData\Roaming\HandBrake 2014-04-24 23:13 - 2012-02-18 19:44 - 00000000 ____D () C:\Users\mike\Downloads\calls 2014-04-24 22:58 - 2014-04-24 22:58 - 00000062 _____ () C:\Users\mike\Downloads\index.html 2014-04-24 22:42 - 2014-04-24 22:42 - 00441344 _____ () C:\Users\mike\Downloads\ipscan (1).exe 2014-04-24 22:39 - 2014-04-24 22:39 - 00441344 _____ () C:\Users\mike\Downloads\ipscan.exe 2014-04-19 16:28 - 2013-07-27 19:21 - 00000000 ____D () C:\Users\mike\Documents\Robert L Allen 2014-04-19 11:28 - 2014-04-19 11:28 - 00000000 __SHD () C:\Users\mike\AppData\Local\EmieUserList 2014-04-19 11:28 - 2014-04-19 11:28 - 00000000 __SHD () C:\Users\mike\AppData\Local\EmieSiteList 2014-04-17 22:11 - 2010-12-30 22:24 - 00158636 _____ () C:\Windows\PFRO.log 2014-04-17 21:04 - 2014-01-22 20:30 - 00001026 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LogMeIn Control Panel.lnk 2014-04-17 21:04 - 2011-01-04 07:25 - 00001024 _____ () C:\.rnd 2014-04-17 21:04 - 2011-01-04 07:25 - 00000000 ____D () C:\Program Files (x86)\LogMeIn 2014-04-17 21:01 - 2011-01-04 07:25 - 00107368 _____ (LogMeIn, Inc.) C:\Windows\system32\LMIRfsClientNP.dll 2014-04-17 21:01 - 2011-01-04 07:25 - 00092488 _____ (LogMeIn, Inc.) C:\Windows\system32\LMIinit.dll 2014-04-17 21:01 - 2011-01-04 07:25 - 00035656 _____ (LogMeIn, Inc.) C:\Windows\system32\LMIport.dll 2014-04-17 14:41 - 2013-08-30 22:24 - 00000000 ____D () C:\Program Files (x86)\Installl_Converter_A 2014-04-17 11:04 - 2009-07-13 21:20 - 00000000 ____D () C:\Windows\rescache 2014-04-16 23:55 - 2009-07-13 21:20 - 00000000 ____D () C:\Windows\PolicyDefinitions 2014-04-15 13:35 - 2014-04-15 13:35 - 00240952 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgtdia.sys 2014-04-14 14:48 - 2012-11-23 11:16 - 00000000 ____D () C:\Users\Mike w\AppData\Local\Microsoft Games 2014-04-12 21:09 - 2014-04-12 21:08 - 00000000 ____D () C:\Users\mike\Documents\pera 2014-04-12 21:09 - 2013-06-18 18:09 - 00005892 _____ () C:\Users\mike\_viminfo 2014-04-12 21:09 - 2010-12-30 15:02 - 00000000 ____D () C:\Users\mike 2014-04-12 14:56 - 2014-04-12 14:56 - 00000079 _____ () C:\conduit.txt 2014-04-12 14:54 - 2014-04-12 14:54 - 00001292 ____N () C:\Users\mike\Desktop\run conduit.reg 2014-04-12 14:49 - 2014-04-12 14:49 - 00001104 ____N () C:\Users\mike\Desktop\conduit.reg 2014-04-12 14:42 - 2014-04-12 14:42 - 00001247 ____N () C:\Users\mike\Desktop\cmd.exe.lnk 2014-04-12 14:41 - 2014-04-12 14:41 - 00000560 ____N () C:\Users\mike\Desktop\run.reg 2014-04-10 21:01 - 2011-01-04 07:25 - 00107368 _____ (LogMeIn, Inc.) C:\Windows\system32\LMIRfsClientNP.dll.000.bak 2014-04-09 23:57 - 2011-04-24 14:35 - 00000000 ____D () C:\ProgramData\Microsoft Help 2014-04-09 23:56 - 2013-09-08 02:40 - 00000000 ____D () C:\Windows\system32\MRT 2014-04-09 23:54 - 2010-12-30 15:40 - 90655440 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe 2014-04-09 23:13 - 2012-04-25 22:06 - 00000000 ____D () C:\Users\mike\AppData\Roaming\vlc 2014-04-09 22:45 - 2009-07-13 23:13 - 01063120 _____ () C:\Windows\system32\PerfStringBackup.INI 2014-04-09 21:55 - 2014-04-09 21:45 - 00000000 ____D () C:\Program Files (x86)\CDex 2014-04-09 21:45 - 2014-04-09 21:45 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CDex 2014-04-09 21:43 - 2014-04-09 21:41 - 08697544 _____ (Georgy Berdyshev) C:\Users\mike\Downloads\CDex-win32-1.70-b4-2009.exe 2014-04-09 21:40 - 2011-11-20 13:01 - 00000000 ____D () C:\Users\mike\AppData\Roaming\Audacity 2014-04-07 11:54 - 2013-11-06 13:40 - 00000000 ____D () C:\Users\mike\AppData\Local\TBHostSupport 2014-04-07 11:19 - 2014-04-05 20:59 - 00003364 _____ () C:\Windows\System32\Tasks\BackgroundContainer Startup Task 2014-04-01 12:43 - 2012-10-22 20:14 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service 2014-03-31 18:37 - 2014-03-29 13:41 - 00000000 ____D () C:\Program Files (x86)\Mozilla Thunderbird 2014-03-30 15:31 - 2010-12-30 22:36 - 00000000 ____D () C:\Users\mike\AppData\Roaming\mjusbsp 2014-03-30 15:29 - 2011-11-11 10:08 - 00000000 ____D () C:\Program Files (x86)\Pidgin 2014-03-30 15:18 - 2014-03-30 15:18 - 00000000 ____D () C:\Users\mike\Desktop\Old Firefox Data 2014-03-29 13:48 - 2014-03-29 13:48 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox Some content of TEMP: ==================== C:\Users\Eve\AppData\Local\Temp\handbrake-setup.exe C:\Users\jim\AppData\Local\Temp\jre-6u29-windows-i586-iftw-rv.exe C:\Users\mike\AppData\Local\Temp\7-Zip.exe C:\Users\mike\AppData\Local\Temp\BearShare_setup.exe C:\Users\mike\AppData\Local\Temp\bitool.dll C:\Users\mike\AppData\Local\Temp\cbSetupE.exe C:\Users\mike\AppData\Local\Temp\Del9479.exe C:\Users\mike\AppData\Local\Temp\DivXSetup.exe C:\Users\mike\AppData\Local\Temp\dlLogic.exe C:\Users\mike\AppData\Local\Temp\DTLite4413-0173.exe C:\Users\mike\AppData\Local\Temp\DTLite4453-0297.exe C:\Users\mike\AppData\Local\Temp\DTLite4454-0315.exe C:\Users\mike\AppData\Local\Temp\DTLite4471-0333.exe C:\Users\mike\AppData\Local\Temp\GUR2673.exe C:\Users\mike\AppData\Local\Temp\GUR2971.exe C:\Users\mike\AppData\Local\Temp\iqu_installer.exe C:\Users\mike\AppData\Local\Temp\jre-6u24-windows-i586-iftw-rv.exe C:\Users\mike\AppData\Local\Temp\jre-6u26-windows-i586-iftw-rv.exe C:\Users\mike\AppData\Local\Temp\jre-6u29-windows-i586-iftw-rv.exe C:\Users\mike\AppData\Local\Temp\jre-6u35-windows-i586-iftw.exe C:\Users\mike\AppData\Local\Temp\jre-6u37-windows-i586-iftw.exe C:\Users\mike\AppData\Local\Temp\jre-7u15-windows-i586-iftw.exe C:\Users\mike\AppData\Local\Temp\jre-7u17-windows-i586-iftw.exe C:\Users\mike\AppData\Local\Temp\jre-7u21-windows-i586-iftw.exe C:\Users\mike\AppData\Local\Temp\jre-7u25-windows-i586-iftw.exe C:\Users\mike\AppData\Local\Temp\jre-7u45-windows-i586-iftw.exe C:\Users\mike\AppData\Local\Temp\MotoHelper_2.0.51_Driver_5.1.0.exe C:\Users\mike\AppData\Local\Temp\nsb4FCE.exe C:\Users\mike\AppData\Local\Temp\nseC38B.exe C:\Users\mike\AppData\Local\Temp\nsg33C.exe C:\Users\mike\AppData\Local\Temp\nsiAF13.exe C:\Users\mike\AppData\Local\Temp\nsj3F35.exe C:\Users\mike\AppData\Local\Temp\nsmF7C5.exe C:\Users\mike\AppData\Local\Temp\nsuD3C4.exe C:\Users\mike\AppData\Local\Temp\nsv1AD0.exe C:\Users\mike\AppData\Local\Temp\nsv23F7.exe C:\Users\mike\AppData\Local\Temp\nsy18E0.exe C:\Users\mike\AppData\Local\Temp\nsy34E5.exe C:\Users\mike\AppData\Local\Temp\ose00000.exe C:\Users\mike\AppData\Local\Temp\ose00001.exe C:\Users\mike\AppData\Local\Temp\setup.exe C:\Users\mike\AppData\Local\Temp\SetupDataMngr_BearShare.exe C:\Users\mike\AppData\Local\Temp\SPStub.exe C:\Users\mike\AppData\Local\Temp\tbDiv2.dll C:\Users\mike\AppData\Local\Temp\ToolbarHelper.exe C:\Users\mike\AppData\Local\Temp\worker.exe C:\Users\mike\AppData\Local\Temp\xmlUpdater.exe C:\Users\mike\AppData\Local\Temp\_is7290.exe C:\Users\mike\AppData\Local\Temp\_is7FCA.exe C:\Users\Mike w\AppData\Local\Temp\cltmng.exe C:\Users\Mike w\AppData\Local\Temp\msvcp100.dll C:\Users\Mike w\AppData\Local\Temp\msvcr100.dll C:\Users\Mike w\AppData\Local\Temp\nspE55D.tmp.tbProd.dll C:\Users\Mike w\AppData\Local\Temp\SkypeSetup.exe C:\Users\Mike w\AppData\Local\Temp\tbedrs.dll ==================== Bamital & volsnap Check ================= C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\SysWOW64\wininit.exe => MD5 is legit C:\Windows\explorer.exe => MD5 is legit C:\Windows\SysWOW64\explorer.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\SysWOW64\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\SysWOW64\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\SysWOW64\userinit.exe => MD5 is legit C:\Windows\System32\rpcss.dll => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit LastRegBack: 2014-04-19 18:28 ==================== End Of Log ============================ Addition.txt
  7. I've had the purchased version of Malwarebytes on my computer for several years now and have experienced no problems until now.. Some how I wound up with something called "Conduit" on my computer. There was an uninstall for it in programs and features in the control panel so I did the uninstall but now every time I log in I get a dialog titled RunDLL in the title bar, and this message in the body: "There was a problem starting C:\Users\mike\AppData\Local\Conduit\BackgroundContainer\BackgroundContainer.dll The specified module could not be found." I have searched the registry and deleted every entry containing "BackgroundContainer.dll" and every entry containing that path. There was nothing in the startup folder of my profile or the public startup folder. I also ran MSConfig and see nothing in startup that I don't recognize. There is no directory named "Conduit" under my AppData\Local\ path or anywhere else in my profile. How do I get rid of this infestation and why didn't Malwarebytes keep it from infecting my computer in the first place ?
  8. I've been putting up with a browser redirect infection for about a month now. My problem affected both firefox and IE, and any links I clicked on in any search engine result, whether google, yahoo, would be redirected. I've tried a number of different things trying to get rid of it with only limited success but never able to get completely rid of it. My anti-virus software (AVG2011), malwarebytes, and other malware removal tools and online anti-virus scanneers including ESET, Housecall and others would usually find and remove something but never fix the problem. I ran across a discussion about Hitman Pro this morning, one I had never heard of before today, so I gave it a try. It found and removed a number of infections and I have not had a single page redirect since. It would be hard for me to recommend it as a fix-all for browser re-directs since this is my one and only experience with it but it did take care of my immediate problem after countless other utilities failed and at the moment I am pretty happy with it.
  9. Getting ready to purchase Malwarebytes. Are upgrades to future versions included ? Thanks !
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.