Jump to content

Need Help with Conduit infestation


Recommended Posts

I've had the purchased version of Malwarebytes on my computer for several years now and have experienced no problems until now..  Some how I wound up with something called "Conduit" on my computer.  There was an uninstall for it in programs and features in the control panel so I did the uninstall but now every time I log in I get a dialog titled RunDLL in the title bar, and this message in the body:

 

"There was a problem starting C:\Users\mike\AppData\Local\Conduit\BackgroundContainer\BackgroundContainer.dll   The specified module could not be found."

 

I have searched the registry and deleted every entry containing "BackgroundContainer.dll" and every entry containing that path.  There was nothing in the startup folder of my profile or the public startup folder.  I also ran MSConfig and see nothing in startup that I don't recognize.  There is no directory named "Conduit" under my AppData\Local\   path or anywhere else in my profile.

 

How do I get rid of this infestation and why didn't Malwarebytes keep it from infecting my computer in the first place ?

 

 

post-53691-0-21930000-1398618633_thumb.j

Link to post
Share on other sites

Hello and post-32477-1261866970.gif

 

P2P/Piracy Warning:

 

   

If you're using Peer 2 Peer software such as uTorrent, BitTorrent or similar you must either fully uninstall them or completely disable them from running while being assisted here.

Failure to remove or disable such software will result in your topic being closed and no further assistance being provided.

If you have illegal/cracked software, cracks, keygens etc. on the system, please remove or uninstall them now and read the policy on Piracy.

 

Conduit may have been bundled with some program that you downloaded intentionally. You have to pay close attention to the dialog boxes when installing software, also be sure and untick the boxes for the optional toolbars and such adware.

Lots of software advertized as "Freeware" often come bundled with unwanted extras. As Conduit is not actually listed as Malicious if you unknowingly accept such downloads your security will not react.

 

Run the following and post the logs...

 

Download Farbar Recovery Scan Tool and save it to your desktop.

 

Note: You need to run the version compatible with your system (32 bit or 64 bit). If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.


Double-click to run it. When the tool opens click Yes to disclaimer.
Press Scan button.
It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.

 

Kevin....

Link to post
Share on other sites

The Addition.txt file is attached.

Here is the FRST File text:

--------------------------------

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 27-04-2014
Ran by mike (administrator) on ECSC2D on 27-04-2014 17:30:48
Running from C:\Users\mike\Downloads\frst64
Windows 7 Home Premium Service Pack 1 (X64) OS Language: English(US)
Internet Explorer Version 11
Boot Mode: Normal

The only official download link for FRST:
Download link for 32-Bit version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/
Download link for 64-Bit Version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2013\avgrsa.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2013\avgcsrva.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2013\avgidsagent.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2013\avgwdsvc.exe
(CobianSoft, Luis Cobian) C:\Program Files (x86)\Cobian Backup 11\cbVSCService11.exe
(Luis Cobian, CobianSoft) C:\Program Files (x86)\Cobian Backup 11\cbService.exe
(Microsoft Corporation) C:\Windows\system32\inetsrv\inetinfo.exe
(LogMeIn, Inc.) C:\Program Files (x86)\LogMeIn\x64\LMIGuardianSvc.exe
(LogMeIn, Inc.) C:\Program Files (x86)\LogMeIn\x64\RaMaint.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2013\avgnsa.exe
() C:\Program Files (x86)\Motorola\MotoHelper\MotoHelperService.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2013\avgemca.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\MSSQL10.SQLSERVER\MSSQL\Binn\sqlservr.exe
(Paramount Software UK Ltd) C:\Program Files\Macrium\Reflect\ReflectService.exe
(SonicWALL Inc.) C:\Program Files (x86)\SonicWALL\SSL-VPN\NetExtender\NEService64.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft SQL Server\90\Shared\sqlbrowser.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2013\avgcsrva.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(LogMeIn, Inc.) C:\Program Files (x86)\LogMeIn\x64\LogMeIn.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Microsoft Corporation) C:\Windows\system32\UI0Detect.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(LogMeIn, Inc.) C:\Program Files (x86)\LogMeIn\x64\LogMeInSystray.exe
() C:\Program Files (x86)\Greenshot\Greenshot.exe
() C:\Users\mike\AppData\Local\Amazon Cloud Player\Amazon Music Helper.exe
(NEC Electronics Corporation) C:\Program Files (x86)\Western Digital\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
(Luis Cobian, CobianSoft) C:\Program Files (x86)\Cobian Backup 11\cbInterface.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2013\avgui.exe
() C:\Program Files (x86)\Motorola\MotoHelper\MotoHelperAgent.exe
(Microsoft Corporation) C:\Windows\SYSTEM32\cmd.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [LogMeIn GUI] => C:\Program Files (x86)\LogMeIn\x64\LogMeInSystray.exe [57928 2010-09-17] (LogMeIn, Inc.)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [NUSB3MON] => C:\Program Files (x86)\Western Digital\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [106496 2009-11-20] (NEC Electronics Corporation)
HKLM-x32\...\Run: [Cobian Backup 11 interface] => C:\Program Files (x86)\Cobian Backup 11\cbInterface.exe [4482048 2012-05-14] (Luis Cobian, CobianSoft)
HKLM-x32\...\Run: [AVG_UI] => C:\Program Files (x86)\AVG\AVG2013\avgui.exe [4411952 2014-01-21] (AVG Technologies CZ, s.r.o.)
HKLM-x32\...\Run: [AsioThk32Reg] => REGSVR32.EXE /S CTASIO.DLL
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\.DEFAULT\...\Run: [DevconDefaultDB] => C:\Windows\system32\READREG /SILENT /FAIL=1
HKU\S-1-5-21-1229362484-4032704617-3898728357-1001\...\Run: [Greenshot] => C:\Program Files (x86)\Greenshot\Greenshot.exe [548864 2010-07-12] ()
HKU\S-1-5-21-1229362484-4032704617-3898728357-1001\...\Run: [DAEMON Tools Lite] => C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [3672640 2013-03-14] (Disc Soft Ltd)
HKU\S-1-5-21-1229362484-4032704617-3898728357-1001\...\Run: [Amazon Cloud Player] => C:\Users\mike\AppData\Local\Amazon Cloud Player\Amazon Music Helper.exe [3168576 2014-03-07] ()
HKU\S-1-5-21-1229362484-4032704617-3898728357-1001\...\MountPoints2: H - H:\setup.exe -a
HKU\S-1-5-21-1229362484-4032704617-3898728357-1001\...\MountPoints2: {2163a700-14aa-11e1-83b7-002197d95ef5} - I:\setup.exe -a
HKU\S-1-5-21-1229362484-4032704617-3898728357-1001\...\MountPoints2: {39b0c568-7625-11e3-9f58-002197d95ef5} - H:\VZW_Software_upgrade_assistant.exe
HKU\S-1-5-21-1229362484-4032704617-3898728357-1001\...\MountPoints2: {9c96663d-7609-11e0-af53-002197d95ef5} - F:\TLBootstrap_WPP.exe
Startup: C:\Users\Mike w\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Greenshot.lnk
ShortcutTarget: Greenshot.lnk -> C:\Program Files (x86)\Greenshot\Greenshot.exe ()
Startup: C:\Users\Robert\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\magicJack - Shortcut.lnk
ShortcutTarget: magicJack - Shortcut.lnk -> C:\mjusbsp\magicJack.exe (magicJack L.P.)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-US
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xE8F0FA663F60CF01
URLSearchHook: HKLM-x32 - (No Name) - {f84db37a-ae6f-423b-9f51-14b5ec10c879} - No File
SearchScopes: HKLM-x32 - DefaultScope {B4E51FC4-C4A4-42E4-945A-889EA5F28B72} URL =
SearchScopes: HKLM-x32 - {b0441a0e-a49a-4e16-afc1-74ecced1921f} URL = http://search.mywebsearch.com/mywebsearch/GGmain.jhtml?p2=^UX^man000^YY^&ptb=CE66B2A7-EFD2-47CE-80FA-4B53FBDEDB98&ind=2013032021&n=77fc6e55&psa=&st=sb&searchfor={searchTerms}
SearchScopes: HKCU - {B4E51FC4-C4A4-42E4-945A-889EA5F28B72} URL =
BHO: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: No Name - {02478D38-C3F9-4efb-9B51-7695ECA05670} -  No File
BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: DivX Plus Web Player HTML5 <video> - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)
BHO-x32: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: SmartSelect Class - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
Toolbar: HKLM-x32 - Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
Toolbar: HKLM-x32 - No Name - {f84db37a-ae6f-423b-9f51-14b5ec10c879} -  No File
Toolbar: HKCU - No Name - {47833539-D0C5-4125-9FA8-0819E2EAAC93} -  No File
Toolbar: HKCU - No Name - {D4027C7F-154A-4066-A1AD-4243D8127440} -  No File
Toolbar: HKCU - No Name - {F84DB37A-AE6F-423B-9F51-14B5EC10C879} -  No File
DPF: HKLM-x32 {6EEFD7B1-B26C-440D-B55A-1EC677189F30} https://75.160.58.125:4433/NELX.cab
DPF: HKLM-x32 {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler: a5res\CLSID - No CLSID Value -
Handler: XBasic\CLSID - No CLSID Value -
Handler: XBasic\OLEScript - No CLSID Value -
Handler: XBasicV10\CLSID - No CLSID Value -
Handler: XBasicV10\OLEScript - No CLSID Value -
Handler-x32: a5res\CLSID - No CLSID Value -
Handler-x32: XBasic\CLSID - No CLSID Value -
Handler-x32: XBasic\OLEScript - No CLSID Value -
Handler-x32: XBasicV10\CLSID - No CLSID Value -
Handler-x32: XBasicV10\OLEScript - No CLSID Value -
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

FireFox:
========
FF ProfilePath: C:\Users\mike\AppData\Roaming\Mozilla\Firefox\Profiles\y428pvf0.default-1396214294990
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_12_0_0_77.dll ()
FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin: @java.com/DTPlugin,version=10.5.0 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.5.0 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_77.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\SysWOW64\Adobe\Director\np32dsw_1166636.dll (Adobe Systems, Inc.)
FF Plugin-x32: @divx.com/DivX Plus Web Player Plug-In,version=1.0.0 - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @java.com/DTPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MIF5BA~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MIF5BA~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @oberon-media.com/ONCAdapter - C:\Program Files (x86)\Common Files\Oberon Media\NCAdapter\1.0.0.8\npapicomadapter.dll (Oberon-Media )
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.0.2 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Acrobat - C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\Air\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: amazon.com/AmazonMP3DownloaderPlugin - C:\Program Files (x86)\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin.dll (Amazon.com, Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF HKLM-x32\...\Firefox\Extensions: [{23fcfd51-4958-4f00-80a3-ae97e717ed8b}] - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5
FF Extension: DivX Plus Web Player HTML5 <video> - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2013-05-23]
FF HKLM-x32\...\Thunderbird\Extensions: [avgthb@avg.com] - C:\Program Files (x86)\AVG\AVG2012\Thunderbird\
FF Extension: AVG E-mail Scanner - C:\Program Files (x86)\AVG\AVG2012\Thunderbird\ []

Chrome:
=======


CHR DefaultSearchKeyword:
CHR DefaultSearchProvider: Web
CHR DefaultSearchURL: http://start.msn.iplay.com/searchresultsredirect.aspx?o=chrome&q={searchTerms}
CHR DefaultNewTabURL:
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\34.0.1847.116\gcswf32.dll No File
CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll No File
CHR Plugin: (QuickTime Plug-in 7.6.7) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.7) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin2.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.7) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin3.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.7) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin4.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.7) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin5.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.7) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin6.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.7) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin7.dll (Apple Inc.)
CHR Plugin: (Java Deployment Toolkit 6.0.260.3) - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll No File
CHR Plugin: (Java Platform SE 6 U26) - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll No File
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Silverlight Plug-In) - C:\Program Files (x86)\Microsoft Silverlight\4.0.60531.0\npctrl.dll No File
CHR Plugin: (Shockwave for Director) - C:\Windows\system32\Adobe\Director\np32dsw.dll No File
CHR Plugin: (DivX Web Player) - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MIF5BA~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MIF5BA~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
CHR Plugin: (Remoting Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\34.0.1847.116\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\34.0.1847.116\pdf.dll ()
CHR Plugin: (DivX VOD Helper Plug-in) - C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
CHR Plugin: (Google Earth Plugin) - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.69\npGoogleUpdate3.dll No File
CHR Plugin: (Default Plug-in) - default_plugin No File
CHR Extension: (Google Wallet) - C:\Users\mike\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-11-06]
CHR Extension: (DivX Plus Web Player HTML5 <video>) - C:\Users\mike\AppData\Local\Google\Chrome\User Data\Default\Extensions\nneajnkjbffgblleaoojgaacokifdkhm [2011-07-17]
CHR Extension: (DivX Browser Bar) - C:\Users\mike\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkmpcdbgnfjfeelcpebpkflcmbkclfho [2013-06-16]
CHR HKCU\...\Chrome\Extension: [pkmpcdbgnfjfeelcpebpkflcmbkclfho] - C:\Users\mike\AppData\Local\CRE\pkmpcdbgnfjfeelcpebpkflcmbkclfho.crx [2013-05-13]
CHR HKLM-x32\...\Chrome\Extension: [nneajnkjbffgblleaoojgaacokifdkhm] - C:\Program Files (x86)\DivX\DivX Plus Web Player\chrome\DivXHTML5\DivXHTML5.crx [2013-05-06]
CHR HKLM-x32\...\Chrome\Extension: [pkmpcdbgnfjfeelcpebpkflcmbkclfho] - C:\Users\mike\AppData\Local\CRE\pkmpcdbgnfjfeelcpebpkflcmbkclfho.crx [2013-05-13]

==================== Services (Whitelisted) =================

R2 AVGIDSAgent; C:\Program Files (x86)\AVG\AVG2013\avgidsagent.exe [4939312 2013-07-04] (AVG Technologies CZ, s.r.o.)
R2 avgwd; C:\Program Files (x86)\AVG\AVG2013\avgwdsvc.exe [283136 2013-11-20] (AVG Technologies CZ, s.r.o.)
R2 cbVSCService11; C:\Program Files (x86)\Cobian Backup 11\cbVSCService11.exe [67584 2012-05-13] (CobianSoft, Luis Cobian)
R2 CobianBackup11; C:\Program Files (x86)\Cobian Backup 11\cbService.exe [1131008 2012-05-14] (Luis Cobian, CobianSoft)
R2 IISADMIN; C:\Windows\system32\inetsrv\inetinfo.exe [15872 2010-11-20] (Microsoft Corporation)
R2 LMIGuardianSvc; C:\Program Files (x86)\LogMeIn\x64\LMIGuardianSvc.exe [376144 2014-04-17] (LogMeIn, Inc.)
R2 LMIMaint; C:\Program Files (x86)\LogMeIn\x64\RaMaint.exe [226640 2014-04-17] (LogMeIn, Inc.)
R2 LogMeIn; C:\Program Files (x86)\LogMeIn\x64\LogMeIn.exe [407424 2010-11-08] (LogMeIn, Inc.)
S4 LXiMediaCenter Backend; C:\Program Files (x86)\LXiMediaCenter\lximcbackend.exe [704512 2012-02-29] ()
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
R2 MotoHelper; C:\Program Files (x86)\Motorola\MotoHelper\MotoHelperService.exe [223088 2011-04-26] ()
R2 MSSQL$SQLEXPRESS; C:\Program Files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe [57966424 2010-09-17] (Microsoft Corporation)
R2 MSSQL$SQLSERVER; C:\Program Files\Microsoft SQL Server\MSSQL10.SQLSERVER\MSSQL\Binn\sqlservr.exe [57966424 2010-09-17] (Microsoft Corporation)
S4 msvsmon90; C:\Program Files\Microsoft Visual Studio 9.0\Common7\IDE\Remote Debugger\x64\msvsmon.exe [4737024 2008-07-29] (Microsoft Corporation)
R2 ReflectService.exe; C:\Program Files\Macrium\Reflect\ReflectService.exe [1142768 2013-12-05] (Paramount Software UK Ltd)
R2 SONICWALL_NetExtender; C:\Program Files (x86)\SonicWALL\SSL-VPN\NetExtender\NEService64.exe [498560 2010-04-01] (SonicWALL Inc.)
S2 SQLAgent$SQLEXPRESS; C:\Program Files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE [430424 2010-09-17] (Microsoft Corporation)
S2 SQLAgent$SQLSERVER; C:\Program Files\Microsoft SQL Server\MSSQL10.SQLSERVER\MSSQL\Binn\SQLAGENT.EXE [430424 2010-09-17] (Microsoft Corporation)
R2 W3SVC; C:\Windows\system32\inetsrv\iisw3adm.dll [453120 2010-11-20] (Microsoft Corporation)
S3 WMSVC; C:\Windows\system32\inetsrv\wmsvc.exe [10752 2009-07-13] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

S3 Apowersoft_AudioDevice; C:\Windows\System32\drivers\Apowersoft_AudioDevice.sys [29288 2010-12-24] (Wondershare)
R1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdrivera.sys [246072 2013-11-25] (AVG Technologies CZ, s.r.o.)
R0 AVGIDSHA; C:\Windows\System32\DRIVERS\avgidsha.sys [71480 2013-07-20] (AVG Technologies CZ, s.r.o.)
R1 Avgldx64; C:\Windows\System32\DRIVERS\avgldx64.sys [206648 2013-07-20] (AVG Technologies CZ, s.r.o.)
R0 Avgloga; C:\Windows\System32\DRIVERS\avgloga.sys [311608 2013-07-20] (AVG Technologies CZ, s.r.o.)
R0 Avgmfx64; C:\Windows\System32\DRIVERS\avgmfx64.sys [116536 2013-07-01] (AVG Technologies CZ, s.r.o.)
R0 Avgrkx64; C:\Windows\System32\DRIVERS\avgrkx64.sys [45880 2013-10-23] (AVG Technologies CZ, s.r.o.)
R1 Avgtdia; C:\Windows\System32\DRIVERS\avgtdia.sys [240952 2014-04-15] (AVG Technologies CZ, s.r.o.)
S3 BrSerIf; C:\Windows\System32\DRIVERS\BrSerIf.sys [97280 2006-09-03] (Brother Industries Ltd.)
R3 COMMONFX.DLL; C:\Windows\System32\COMMONFX.DLL [151296 2007-04-12] (Creative Technology Ltd)
S3 CT20XUT.DLL; C:\Windows\System32\CT20XUT.DLL [252712 2007-04-10] (Creative Technology Ltd.)
R3 CTAUDFX.DLL; C:\Windows\System32\CTAUDFX.DLL [700200 2007-04-10] (Creative Technology Ltd)
S3 CTEAPSFX.DLL; C:\Windows\System32\CTEAPSFX.DLL [219432 2007-04-10] (Creative Technology Ltd)
S3 CTEDSPFX.DLL; C:\Windows\System32\CTEDSPFX.DLL [321832 2007-04-10] (Creative Technology Ltd)
S3 CTEDSPIO.DLL; C:\Windows\System32\CTEDSPIO.DLL [190248 2007-04-10] (Creative Technology Ltd)
S3 CTEDSPSY.DLL; C:\Windows\System32\CTEDSPSY.DLL [363304 2007-04-10] (Creative Technology Ltd)
S3 CTERFXFX.DLL; C:\Windows\System32\CTERFXFX.DLL [142120 2007-04-10] (Creative Technology Ltd)
S3 CTEXFIFX.DLL; C:\Windows\System32\CTEXFIFX.DLL [1571112 2007-04-10] (Creative Technology Ltd.)
S3 CTHWIUT.DLL; C:\Windows\System32\CTHWIUT.DLL [123688 2007-04-10] (Creative Technology Ltd.)
R3 CTSBLFX.DLL; C:\Windows\System32\CTSBLFX.DLL [681256 2007-04-10] (Creative Technology Ltd)
R1 Ext2Fsd; C:\Windows\System32\Drivers\Ext2Fsd.sys [769816 2011-07-09] (www.ext2fsd.com)
R2 LMIInfo; C:\Program Files (x86)\LogMeIn\x64\RaInfo.sys [16056 2013-05-23] (LogMeIn, Inc.)
S4 LMIRfsClientNP; No ImagePath
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 NxDrv; C:\Windows\System32\DRIVERS\NxDrv.sys [24264 2009-10-21] (SonicWALL Inc.)
S3 PSMounterEx; C:\Windows\system32\drivers\psmounterex.sys [76408 2013-08-01] (Paramount Software UK Ltd)
R1 Serial; C:\Windows\System32\DRIVERS\serial.sys [94208 2009-07-13] (Brother Industries Ltd.)
R0 sptd; C:\Windows\System32\Drivers\sptd.sys [564824 2013-04-10] (Duplex Secure Ltd.)
U3 av9k0pbr; C:\Windows\System32\Drivers\av9k0pbr.sys [0 ] (Advanced Micro Devices)
S3 VBoxNetFlt; system32\DRIVERS\VBoxNetFlt.sys [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-04-27 17:30 - 2014-04-27 17:30 - 00000000 ____D () C:\FRST
2014-04-27 17:29 - 2014-04-27 17:30 - 00000000 ____D () C:\Users\mike\Downloads\frst64
2014-04-27 17:28 - 2014-04-27 17:29 - 02061824 _____ (Farbar) C:\Users\mike\Downloads\FRST64.exe
2014-04-27 11:51 - 2014-04-27 11:51 - 01722095 _____ () C:\Users\mike\Downloads\iphonesmsexport166.zip
2014-04-27 10:45 - 2014-04-27 10:45 - 00000178 _____ () C:\Users\mike\Desktop\Malwarebytes forum.url
2014-04-25 17:51 - 2014-04-25 17:51 - 00000000 ____D () C:\Users\mike\AppData\Roaming\3697
2014-04-24 22:58 - 2014-04-24 22:58 - 00000062 _____ () C:\Users\mike\Downloads\index.html
2014-04-24 22:42 - 2014-04-24 22:42 - 00441344 _____ () C:\Users\mike\Downloads\ipscan (1).exe
2014-04-24 22:39 - 2014-04-24 22:39 - 00441344 _____ () C:\Users\mike\Downloads\ipscan.exe
2014-04-19 11:28 - 2014-04-19 11:28 - 00000000 __SHD () C:\Users\mike\AppData\Local\EmieUserList
2014-04-19 11:28 - 2014-04-19 11:28 - 00000000 __SHD () C:\Users\mike\AppData\Local\EmieSiteList
2014-04-16 21:34 - 2014-03-06 04:21 - 23549440 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-04-16 21:34 - 2014-03-06 03:32 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-04-16 21:34 - 2014-03-06 03:31 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-04-16 21:34 - 2014-03-06 03:19 - 17387008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-04-16 21:34 - 2014-03-06 02:59 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-04-16 21:34 - 2014-03-06 02:57 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-04-16 21:34 - 2014-03-06 02:57 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-04-16 21:34 - 2014-03-06 02:53 - 02767360 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-04-16 21:34 - 2014-03-06 02:40 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-04-16 21:34 - 2014-03-06 02:39 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-04-16 21:34 - 2014-03-06 02:32 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-04-16 21:34 - 2014-03-06 02:32 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-04-16 21:34 - 2014-03-06 02:29 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-04-16 21:34 - 2014-03-06 02:29 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-04-16 21:34 - 2014-03-06 02:28 - 00752640 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-04-16 21:34 - 2014-03-06 02:15 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-04-16 21:34 - 2014-03-06 02:11 - 05784064 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-04-16 21:34 - 2014-03-06 02:09 - 00453120 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-04-16 21:34 - 2014-03-06 02:03 - 00586240 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-04-16 21:34 - 2014-03-06 02:02 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-04-16 21:34 - 2014-03-06 02:02 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-04-16 21:34 - 2014-03-06 02:01 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-04-16 21:34 - 2014-03-06 01:56 - 00038400 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-04-16 21:34 - 2014-03-06 01:48 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-04-16 21:34 - 2014-03-06 01:47 - 02178048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-04-16 21:34 - 2014-03-06 01:46 - 04254720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-04-16 21:34 - 2014-03-06 01:46 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-04-16 21:34 - 2014-03-06 01:45 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-04-16 21:34 - 2014-03-06 01:42 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-04-16 21:34 - 2014-03-06 01:40 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-04-16 21:34 - 2014-03-06 01:38 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-04-16 21:34 - 2014-03-06 01:36 - 00592896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-04-16 21:34 - 2014-03-06 01:22 - 00367616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-04-16 21:34 - 2014-03-06 01:21 - 00628736 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-04-16 21:34 - 2014-03-06 01:13 - 00032256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-04-16 21:34 - 2014-03-06 01:11 - 02043904 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-04-16 21:34 - 2014-03-06 01:07 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-04-16 21:34 - 2014-03-06 01:01 - 00244224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-04-16 21:34 - 2014-03-06 00:53 - 13551104 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-04-16 21:34 - 2014-03-06 00:46 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-04-16 21:34 - 2014-03-06 00:40 - 01967104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-04-16 21:34 - 2014-03-06 00:36 - 11745792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-04-16 21:34 - 2014-03-06 00:22 - 02260480 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-04-16 21:34 - 2014-03-05 23:58 - 01400832 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-04-16 21:34 - 2014-03-05 23:50 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-04-16 21:34 - 2014-03-05 23:43 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-04-16 21:34 - 2014-03-05 23:41 - 01789440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-04-16 21:34 - 2014-03-05 23:36 - 01143808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-04-15 13:35 - 2014-04-15 13:35 - 00240952 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgtdia.sys
2014-04-12 21:08 - 2014-04-12 21:09 - 00000000 ____D () C:\Users\mike\Documents\pera
2014-04-12 14:56 - 2014-04-12 14:56 - 00000079 _____ () C:\conduit.txt
2014-04-12 14:54 - 2014-04-12 14:54 - 00001292 ____N () C:\Users\mike\Desktop\run conduit.reg
2014-04-12 14:49 - 2014-04-12 14:49 - 00001104 ____N () C:\Users\mike\Desktop\conduit.reg
2014-04-12 14:42 - 2014-04-12 14:42 - 00001247 ____N () C:\Users\mike\Desktop\cmd.exe.lnk
2014-04-12 14:41 - 2014-04-12 14:41 - 00000560 ____N () C:\Users\mike\Desktop\run.reg
2014-04-09 21:45 - 2014-04-09 21:55 - 00000000 ____D () C:\Program Files (x86)\CDex
2014-04-09 21:45 - 2014-04-09 21:45 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CDex
2014-04-09 21:41 - 2014-04-09 21:43 - 08697544 _____ (Georgy Berdyshev) C:\Users\mike\Downloads\CDex-win32-1.70-b4-2009.exe
2014-04-09 10:37 - 2014-03-04 03:44 - 01163264 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2014-04-09 10:37 - 2014-03-04 03:44 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2014-04-09 10:37 - 2014-03-04 03:44 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2014-04-09 10:37 - 2014-03-04 03:44 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2014-04-09 10:37 - 2014-03-04 03:44 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2014-04-09 10:37 - 2014-03-04 03:17 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2014-04-09 10:37 - 2014-03-04 03:16 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2014-04-09 10:37 - 2014-03-04 03:16 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2014-04-09 10:37 - 2014-03-04 03:16 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2014-04-09 10:37 - 2014-03-04 02:09 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2014-04-09 10:37 - 2014-03-04 02:09 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2014-04-05 20:59 - 2014-04-07 11:19 - 00003364 _____ () C:\Windows\System32\Tasks\BackgroundContainer Startup Task
2014-03-30 15:18 - 2014-03-30 15:18 - 00000000 ____D () C:\Users\mike\Desktop\Old Firefox Data
2014-03-29 13:48 - 2014-03-29 13:48 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-03-29 13:41 - 2014-03-31 18:37 - 00000000 ____D () C:\Program Files (x86)\Mozilla Thunderbird

==================== One Month Modified Files and Folders =======

2014-04-27 17:30 - 2014-04-27 17:30 - 00000000 ____D () C:\FRST
2014-04-27 17:30 - 2014-04-27 17:29 - 00000000 ____D () C:\Users\mike\Downloads\frst64
2014-04-27 17:29 - 2014-04-27 17:28 - 02061824 _____ (Farbar) C:\Users\mike\Downloads\FRST64.exe
2014-04-27 16:33 - 2012-04-04 12:16 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-04-27 16:24 - 2010-12-30 15:02 - 01787121 _____ () C:\Windows\WindowsUpdate.log
2014-04-27 14:40 - 2010-12-30 17:01 - 00000000 ____D () C:\ProgramData\MFAData
2014-04-27 11:51 - 2014-04-27 11:51 - 01722095 _____ () C:\Users\mike\Downloads\iphonesmsexport166.zip
2014-04-27 10:45 - 2014-04-27 10:45 - 00000178 _____ () C:\Users\mike\Desktop\Malwarebytes forum.url
2014-04-27 09:31 - 2009-07-13 22:45 - 00015152 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-04-27 09:31 - 2009-07-13 22:45 - 00015152 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-04-27 09:25 - 2009-07-13 21:20 - 00000000 ____D () C:\Windows\system32\inetsrv
2014-04-27 09:24 - 2014-01-22 20:30 - 00001009 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LogMeIn Client.lnk
2014-04-27 09:22 - 2009-07-13 23:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-04-27 09:22 - 2009-07-13 22:51 - 00147857 _____ () C:\Windows\setupact.log
2014-04-27 00:18 - 2011-01-04 07:25 - 00000000 ____D () C:\ProgramData\LogMeIn
2014-04-25 18:46 - 2011-11-04 17:21 - 00000000 ____D () C:\Users\mike\Documents\Outlook Files
2014-04-25 17:51 - 2014-04-25 17:51 - 00000000 ____D () C:\Users\mike\AppData\Roaming\3697
2014-04-25 13:20 - 2011-11-01 17:23 - 00000000 ____D () C:\Users\mike\AppData\Roaming\HandBrake
2014-04-24 23:13 - 2012-02-18 19:44 - 00000000 ____D () C:\Users\mike\Downloads\calls
2014-04-24 22:58 - 2014-04-24 22:58 - 00000062 _____ () C:\Users\mike\Downloads\index.html
2014-04-24 22:42 - 2014-04-24 22:42 - 00441344 _____ () C:\Users\mike\Downloads\ipscan (1).exe
2014-04-24 22:39 - 2014-04-24 22:39 - 00441344 _____ () C:\Users\mike\Downloads\ipscan.exe
2014-04-19 16:28 - 2013-07-27 19:21 - 00000000 ____D () C:\Users\mike\Documents\Robert L Allen
2014-04-19 11:28 - 2014-04-19 11:28 - 00000000 __SHD () C:\Users\mike\AppData\Local\EmieUserList
2014-04-19 11:28 - 2014-04-19 11:28 - 00000000 __SHD () C:\Users\mike\AppData\Local\EmieSiteList
2014-04-17 22:11 - 2010-12-30 22:24 - 00158636 _____ () C:\Windows\PFRO.log
2014-04-17 21:04 - 2014-01-22 20:30 - 00001026 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LogMeIn Control Panel.lnk
2014-04-17 21:04 - 2011-01-04 07:25 - 00001024 _____ () C:\.rnd
2014-04-17 21:04 - 2011-01-04 07:25 - 00000000 ____D () C:\Program Files (x86)\LogMeIn
2014-04-17 21:01 - 2011-01-04 07:25 - 00107368 _____ (LogMeIn, Inc.) C:\Windows\system32\LMIRfsClientNP.dll
2014-04-17 21:01 - 2011-01-04 07:25 - 00092488 _____ (LogMeIn, Inc.) C:\Windows\system32\LMIinit.dll
2014-04-17 21:01 - 2011-01-04 07:25 - 00035656 _____ (LogMeIn, Inc.) C:\Windows\system32\LMIport.dll
2014-04-17 14:41 - 2013-08-30 22:24 - 00000000 ____D () C:\Program Files (x86)\Installl_Converter_A
2014-04-17 11:04 - 2009-07-13 21:20 - 00000000 ____D () C:\Windows\rescache
2014-04-16 23:55 - 2009-07-13 21:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
2014-04-15 13:35 - 2014-04-15 13:35 - 00240952 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgtdia.sys
2014-04-14 14:48 - 2012-11-23 11:16 - 00000000 ____D () C:\Users\Mike w\AppData\Local\Microsoft Games
2014-04-12 21:09 - 2014-04-12 21:08 - 00000000 ____D () C:\Users\mike\Documents\pera
2014-04-12 21:09 - 2013-06-18 18:09 - 00005892 _____ () C:\Users\mike\_viminfo
2014-04-12 21:09 - 2010-12-30 15:02 - 00000000 ____D () C:\Users\mike
2014-04-12 14:56 - 2014-04-12 14:56 - 00000079 _____ () C:\conduit.txt
2014-04-12 14:54 - 2014-04-12 14:54 - 00001292 ____N () C:\Users\mike\Desktop\run conduit.reg
2014-04-12 14:49 - 2014-04-12 14:49 - 00001104 ____N () C:\Users\mike\Desktop\conduit.reg
2014-04-12 14:42 - 2014-04-12 14:42 - 00001247 ____N () C:\Users\mike\Desktop\cmd.exe.lnk
2014-04-12 14:41 - 2014-04-12 14:41 - 00000560 ____N () C:\Users\mike\Desktop\run.reg
2014-04-10 21:01 - 2011-01-04 07:25 - 00107368 _____ (LogMeIn, Inc.) C:\Windows\system32\LMIRfsClientNP.dll.000.bak
2014-04-09 23:57 - 2011-04-24 14:35 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-04-09 23:56 - 2013-09-08 02:40 - 00000000 ____D () C:\Windows\system32\MRT
2014-04-09 23:54 - 2010-12-30 15:40 - 90655440 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-04-09 23:13 - 2012-04-25 22:06 - 00000000 ____D () C:\Users\mike\AppData\Roaming\vlc
2014-04-09 22:45 - 2009-07-13 23:13 - 01063120 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-04-09 21:55 - 2014-04-09 21:45 - 00000000 ____D () C:\Program Files (x86)\CDex
2014-04-09 21:45 - 2014-04-09 21:45 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CDex
2014-04-09 21:43 - 2014-04-09 21:41 - 08697544 _____ (Georgy Berdyshev) C:\Users\mike\Downloads\CDex-win32-1.70-b4-2009.exe
2014-04-09 21:40 - 2011-11-20 13:01 - 00000000 ____D () C:\Users\mike\AppData\Roaming\Audacity
2014-04-07 11:54 - 2013-11-06 13:40 - 00000000 ____D () C:\Users\mike\AppData\Local\TBHostSupport
2014-04-07 11:19 - 2014-04-05 20:59 - 00003364 _____ () C:\Windows\System32\Tasks\BackgroundContainer Startup Task
2014-04-01 12:43 - 2012-10-22 20:14 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-03-31 18:37 - 2014-03-29 13:41 - 00000000 ____D () C:\Program Files (x86)\Mozilla Thunderbird
2014-03-30 15:31 - 2010-12-30 22:36 - 00000000 ____D () C:\Users\mike\AppData\Roaming\mjusbsp
2014-03-30 15:29 - 2011-11-11 10:08 - 00000000 ____D () C:\Program Files (x86)\Pidgin
2014-03-30 15:18 - 2014-03-30 15:18 - 00000000 ____D () C:\Users\mike\Desktop\Old Firefox Data
2014-03-29 13:48 - 2014-03-29 13:48 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox

Some content of TEMP:
====================
C:\Users\Eve\AppData\Local\Temp\handbrake-setup.exe
C:\Users\jim\AppData\Local\Temp\jre-6u29-windows-i586-iftw-rv.exe
C:\Users\mike\AppData\Local\Temp\7-Zip.exe
C:\Users\mike\AppData\Local\Temp\BearShare_setup.exe
C:\Users\mike\AppData\Local\Temp\bitool.dll
C:\Users\mike\AppData\Local\Temp\cbSetupE.exe
C:\Users\mike\AppData\Local\Temp\Del9479.exe
C:\Users\mike\AppData\Local\Temp\DivXSetup.exe
C:\Users\mike\AppData\Local\Temp\dlLogic.exe
C:\Users\mike\AppData\Local\Temp\DTLite4413-0173.exe
C:\Users\mike\AppData\Local\Temp\DTLite4453-0297.exe
C:\Users\mike\AppData\Local\Temp\DTLite4454-0315.exe
C:\Users\mike\AppData\Local\Temp\DTLite4471-0333.exe
C:\Users\mike\AppData\Local\Temp\GUR2673.exe
C:\Users\mike\AppData\Local\Temp\GUR2971.exe
C:\Users\mike\AppData\Local\Temp\iqu_installer.exe
C:\Users\mike\AppData\Local\Temp\jre-6u24-windows-i586-iftw-rv.exe
C:\Users\mike\AppData\Local\Temp\jre-6u26-windows-i586-iftw-rv.exe
C:\Users\mike\AppData\Local\Temp\jre-6u29-windows-i586-iftw-rv.exe
C:\Users\mike\AppData\Local\Temp\jre-6u35-windows-i586-iftw.exe
C:\Users\mike\AppData\Local\Temp\jre-6u37-windows-i586-iftw.exe
C:\Users\mike\AppData\Local\Temp\jre-7u15-windows-i586-iftw.exe
C:\Users\mike\AppData\Local\Temp\jre-7u17-windows-i586-iftw.exe
C:\Users\mike\AppData\Local\Temp\jre-7u21-windows-i586-iftw.exe
C:\Users\mike\AppData\Local\Temp\jre-7u25-windows-i586-iftw.exe
C:\Users\mike\AppData\Local\Temp\jre-7u45-windows-i586-iftw.exe
C:\Users\mike\AppData\Local\Temp\MotoHelper_2.0.51_Driver_5.1.0.exe
C:\Users\mike\AppData\Local\Temp\nsb4FCE.exe
C:\Users\mike\AppData\Local\Temp\nseC38B.exe
C:\Users\mike\AppData\Local\Temp\nsg33C.exe
C:\Users\mike\AppData\Local\Temp\nsiAF13.exe
C:\Users\mike\AppData\Local\Temp\nsj3F35.exe
C:\Users\mike\AppData\Local\Temp\nsmF7C5.exe
C:\Users\mike\AppData\Local\Temp\nsuD3C4.exe
C:\Users\mike\AppData\Local\Temp\nsv1AD0.exe
C:\Users\mike\AppData\Local\Temp\nsv23F7.exe
C:\Users\mike\AppData\Local\Temp\nsy18E0.exe
C:\Users\mike\AppData\Local\Temp\nsy34E5.exe
C:\Users\mike\AppData\Local\Temp\ose00000.exe
C:\Users\mike\AppData\Local\Temp\ose00001.exe
C:\Users\mike\AppData\Local\Temp\setup.exe
C:\Users\mike\AppData\Local\Temp\SetupDataMngr_BearShare.exe
C:\Users\mike\AppData\Local\Temp\SPStub.exe
C:\Users\mike\AppData\Local\Temp\tbDiv2.dll
C:\Users\mike\AppData\Local\Temp\ToolbarHelper.exe
C:\Users\mike\AppData\Local\Temp\worker.exe
C:\Users\mike\AppData\Local\Temp\xmlUpdater.exe
C:\Users\mike\AppData\Local\Temp\_is7290.exe
C:\Users\mike\AppData\Local\Temp\_is7FCA.exe
C:\Users\Mike w\AppData\Local\Temp\cltmng.exe
C:\Users\Mike w\AppData\Local\Temp\msvcp100.dll
C:\Users\Mike w\AppData\Local\Temp\msvcr100.dll
C:\Users\Mike w\AppData\Local\Temp\nspE55D.tmp.tbProd.dll
C:\Users\Mike w\AppData\Local\Temp\SkypeSetup.exe
C:\Users\Mike w\AppData\Local\Temp\tbedrs.dll


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-04-19 18:28

==================== End Of Log ============================

 

Addition.txt

Link to post
Share on other sites

Looking at those logs you list i`d suspect you may have possibly picked up conduit with this entry "BearShare_setup.exe" any P2P software will without any doubt be loaded with unwanted extras such as conduit.

 

Download attached fixlist.txt file and save it to the Desktop, or the folder you saved FRST into.

NOTE. It's important that both FRST and fixlist.txt are in the same location or the fix will not work.

 

Run FRST and press the Fix button just once and wait.

The tool will make a log on the Desktop (Fixlog.txt) or the folder it was ran from. Please post it to your reply.

 

Next,

 

Run Malwarebytes,  Open > Settings Tab > Scanner Settings > Under action for PUP > Select: Show in Results List and Check for removal.

Please Update and run a Quick scan

Make sure that everything is checked, and click Remove Selected on any found items.

 

Post the produced log

 

Next,

 

Download AdwCleaner by Xplode onto your Desktop.


Double click on Adwcleaner.exe to run the tool.
Click on Scan
Once the scan is done, click on the Clean button.
You will get a prompt asking to close all programs. Click OK.
Click OK again to reboot your computer.
A text file will open after the restart. Please post the content of that logfile in your reply.
You can also find the logfile at C:\AdwCleaner[sn].txt.

 

Next,

 

thisisujrt.gif Please download Junkware Removal Tool to your desktop.


Shut down your protection software now to avoid potential conflicts.
Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
The tool will open and start scanning your system.
Please be patient as this can take a while to complete depending on your system's specifications.
On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
Post the contents of JRT.txt into your next message.

 

Let me see those logs in your next reply...

 

Kevin

 

 

fixlist.txt

Link to post
Share on other sites

Below are the results of Fixlog.txt first, and the log from the malwarebytes quickscan

Conduit error message still occuring, Ill try the last two suggestions in a minute...

 

Fixlog.txt:

----------------------------------------------------------------

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 27-04-2014
Ran by mike at 2014-04-27 20:55:54 Run:1
Running from C:\Users\mike\Downloads\frst64
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
Start
HKU\S-1-5-21-1229362484-4032704617-3898728357-1001\...\MountPoints2: H - H:\setup.exe -a
HKU\S-1-5-21-1229362484-4032704617-3898728357-1001\...\MountPoints2: {2163a700-14aa-11e1-83b7-002197d95ef5} - I:\setup.exe -a
HKU\S-1-5-21-1229362484-4032704617-3898728357-1001\...\MountPoints2: {39b0c568-7625-11e3-9f58-002197d95ef5} - H:\VZW_Software_upgrade_assistant.exe
HKU\S-1-5-21-1229362484-4032704617-3898728357-1001\...\MountPoints2: {9c96663d-7609-11e0-af53-002197d95ef5} - F:\TLBootstrap_WPP.exe
SearchScopes: HKLM-x32 - {b0441a0e-a49a-4e16-afc1-74ecced1921f} URL = http://search.mywebs...t=sb&searchfor={searchTerms}
Toolbar: HKLM-x32 - No Name - {f84db37a-ae6f-423b-9f51-14b5ec10c879} -  No File
Toolbar: HKCU - No Name - {47833539-D0C5-4125-9FA8-0819E2EAAC93} -  No File
Toolbar: HKCU - No Name - {D4027C7F-154A-4066-A1AD-4243D8127440} -  No File
Toolbar: HKCU - No Name - {F84DB37A-AE6F-423B-9F51-14B5EC10C879} -  No File
Handler: a5res\CLSID - No CLSID Value -
Handler: XBasic\CLSID - No CLSID Value -
Handler: XBasic\OLEScript - No CLSID Value -
Handler: XBasicV10\CLSID - No CLSID Value -
Handler: XBasicV10\OLEScript - No CLSID Value -
Handler-x32: a5res\CLSID - No CLSID Value -
Handler-x32: XBasic\CLSID - No CLSID Value -
Handler-x32: XBasic\OLEScript - No CLSID Value -
Handler-x32: XBasicV10\CLSID - No CLSID Value -
Handler-x32: XBasicV10\OLEScript - No CLSID Value -
S4 LMIRfsClientNP; No ImagePath
U3 av9k0pbr; C:\Windows\System32\Drivers\av9k0pbr.sys [0 ] (Advanced Micro Devices)
C:\Windows\System32\Drivers\av9k0pbr.sys
C:\Users\Eve\AppData\Local\Temp\handbrake-setup.exe
C:\Users\jim\AppData\Local\Temp\jre-6u29-windows-i586-iftw-rv.exe
C:\Users\mike\AppData\Local\Temp\7-Zip.exe
C:\Users\mike\AppData\Local\Temp\BearShare_setup.exe
C:\Users\mike\AppData\Local\Temp\bitool.dll
C:\Users\mike\AppData\Local\Temp\cbSetupE.exe
C:\Users\mike\AppData\Local\Temp\Del9479.exe
C:\Users\mike\AppData\Local\Temp\DivXSetup.exe
C:\Users\mike\AppData\Local\Temp\dlLogic.exe
C:\Users\mike\AppData\Local\Temp\DTLite4413-0173.exe
C:\Users\mike\AppData\Local\Temp\DTLite4453-0297.exe
C:\Users\mike\AppData\Local\Temp\DTLite4454-0315.exe
C:\Users\mike\AppData\Local\Temp\DTLite4471-0333.exe
C:\Users\mike\AppData\Local\Temp\GUR2673.exe
C:\Users\mike\AppData\Local\Temp\GUR2971.exe
C:\Users\mike\AppData\Local\Temp\iqu_installer.exe
C:\Users\mike\AppData\Local\Temp\jre-6u24-windows-i586-iftw-rv.exe
C:\Users\mike\AppData\Local\Temp\jre-6u26-windows-i586-iftw-rv.exe
C:\Users\mike\AppData\Local\Temp\jre-6u29-windows-i586-iftw-rv.exe
C:\Users\mike\AppData\Local\Temp\jre-6u35-windows-i586-iftw.exe
C:\Users\mike\AppData\Local\Temp\jre-6u37-windows-i586-iftw.exe
C:\Users\mike\AppData\Local\Temp\jre-7u15-windows-i586-iftw.exe
C:\Users\mike\AppData\Local\Temp\jre-7u17-windows-i586-iftw.exe
C:\Users\mike\AppData\Local\Temp\jre-7u21-windows-i586-iftw.exe
C:\Users\mike\AppData\Local\Temp\jre-7u25-windows-i586-iftw.exe
C:\Users\mike\AppData\Local\Temp\jre-7u45-windows-i586-iftw.exe
C:\Users\mike\AppData\Local\Temp\MotoHelper_2.0.51_Driver_5.1.0.exe
C:\Users\mike\AppData\Local\Temp\nsb4FCE.exe
C:\Users\mike\AppData\Local\Temp\nseC38B.exe
C:\Users\mike\AppData\Local\Temp\nsg33C.exe
C:\Users\mike\AppData\Local\Temp\nsiAF13.exe
C:\Users\mike\AppData\Local\Temp\nsj3F35.exe
C:\Users\mike\AppData\Local\Temp\nsmF7C5.exe
C:\Users\mike\AppData\Local\Temp\nsuD3C4.exe
C:\Users\mike\AppData\Local\Temp\nsv1AD0.exe
C:\Users\mike\AppData\Local\Temp\nsv23F7.exe
C:\Users\mike\AppData\Local\Temp\nsy18E0.exe
C:\Users\mike\AppData\Local\Temp\nsy34E5.exe
C:\Users\mike\AppData\Local\Temp\ose00000.exe
C:\Users\mike\AppData\Local\Temp\ose00001.exe
C:\Users\mike\AppData\Local\Temp\setup.exe
C:\Users\mike\AppData\Local\Temp\SetupDataMngr_BearShare.exe
C:\Users\mike\AppData\Local\Temp\SPStub.exe
C:\Users\mike\AppData\Local\Temp\tbDiv2.dll
C:\Users\mike\AppData\Local\Temp\ToolbarHelper.exe
C:\Users\mike\AppData\Local\Temp\worker.exe
C:\Users\mike\AppData\Local\Temp\xmlUpdater.exe
C:\Users\mike\AppData\Local\Temp\_is7290.exe
C:\Users\mike\AppData\Local\Temp\_is7FCA.exe
C:\Users\Mike w\AppData\Local\Temp\cltmng.exe
C:\Users\Mike w\AppData\Local\Temp\msvcp100.dll
C:\Users\Mike w\AppData\Local\Temp\msvcr100.dll
C:\Users\Mike w\AppData\Local\Temp\nspE55D.tmp.tbProd.dll
C:\Users\Mike w\AppData\Local\Temp\SkypeSetup.exe
C:\Users\Mike w\AppData\Local\Temp\tbedrs.dll
2009-07-13 20:34 - 2012-04-14 18:41 - 00000946 ____A C:\Windows\system32\Drivers\etc\hosts
End
*****************

HKU\S-1-5-21-1229362484-4032704617-3898728357-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\S-1-5-21-1229362484-4032704617-3898728357-1001 => Key not found.
HKU\S-1-5-21-1229362484-4032704617-3898728357-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{2163a700-14aa-11e1-83b7-002197d95ef5} => Key deleted successfully.
HKCR\CLSID\{2163a700-14aa-11e1-83b7-002197d95ef5} => Key not found.
HKU\S-1-5-21-1229362484-4032704617-3898728357-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{39b0c568-7625-11e3-9f58-002197d95ef5} => Key deleted successfully.
HKCR\CLSID\{39b0c568-7625-11e3-9f58-002197d95ef5} => Key not found.
HKU\S-1-5-21-1229362484-4032704617-3898728357-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{9c96663d-7609-11e0-af53-002197d95ef5} => Key deleted successfully.
HKCR\CLSID\{9c96663d-7609-11e0-af53-002197d95ef5} => Key not found.
HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{b0441a0e-a49a-4e16-afc1-74ecced1921f} => Key deleted successfully.
HKCR\Wow6432Node\CLSID\{b0441a0e-a49a-4e16-afc1-74ecced1921f} => Key not found.
HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar\\{f84db37a-ae6f-423b-9f51-14b5ec10c879} => Value deleted successfully.
HKCR\Wow6432Node\CLSID\{f84db37a-ae6f-423b-9f51-14b5ec10c879} => Key not found.
HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{47833539-D0C5-4125-9FA8-0819E2EAAC93} => Value deleted successfully.
HKCR\CLSID\{47833539-D0C5-4125-9FA8-0819E2EAAC93} => Key not found.
HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{D4027C7F-154A-4066-A1AD-4243D8127440} => Value deleted successfully.
HKCR\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440} => Key not found.
HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{F84DB37A-AE6F-423B-9F51-14B5EC10C879} => Value deleted successfully.
HKCR\CLSID\{F84DB37A-AE6F-423B-9F51-14B5EC10C879} => Key not found.
HKCR\PROTOCOLS\Handler\Handler: a5res\CLSID - No CLSID Value - => Key not found.
HKCR\PROTOCOLS\Handler\Handler: XBasic\CLSID - No CLSID Value - => Key not found.
HKCR\PROTOCOLS\Handler\Handler: XBasic\OLEScript - No CLSID Value - => Key not found.
HKCR\PROTOCOLS\Handler\Handler: XBasicV10\CLSID - No CLSID Value - => Key not found.
HKCR\PROTOCOLS\Handler\Handler: XBasicV10\OLEScript - No CLSID Value - => Key not found.
HKCR\Wow6432Node\PROTOCOLS\Handler\Handler-x32: a5res\CLSID - No CLSID Value - => Key not found.
HKCR\Wow6432Node\PROTOCOLS\Handler\Handler-x32: XBasic\CLSID - No CLSID Value - => Key not found.
HKCR\Wow6432Node\PROTOCOLS\Handler\Handler-x32: XBasic\OLEScript - No CLSID Value - => Key not found.
HKCR\Wow6432Node\PROTOCOLS\Handler\Handler-x32: XBasicV10\CLSID - No CLSID Value - => Key not found.
HKCR\Wow6432Node\PROTOCOLS\Handler\Handler-x32: XBasicV10\OLEScript - No CLSID Value - => Key not found.
LMIRfsClientNP => Service deleted successfully.
av9k0pbr => Service deleted successfully.
Could not move "C:\Windows\System32\Drivers\av9k0pbr.sys" => Scheduled to move on reboot.
C:\Users\Eve\AppData\Local\Temp\handbrake-setup.exe => Moved successfully.
C:\Users\jim\AppData\Local\Temp\jre-6u29-windows-i586-iftw-rv.exe => Moved successfully.
C:\Users\mike\AppData\Local\Temp\7-Zip.exe => Moved successfully.
C:\Users\mike\AppData\Local\Temp\BearShare_setup.exe => Moved successfully.
C:\Users\mike\AppData\Local\Temp\bitool.dll => Moved successfully.
C:\Users\mike\AppData\Local\Temp\cbSetupE.exe => Moved successfully.
C:\Users\mike\AppData\Local\Temp\Del9479.exe => Moved successfully.
C:\Users\mike\AppData\Local\Temp\DivXSetup.exe => Moved successfully.
C:\Users\mike\AppData\Local\Temp\dlLogic.exe => Moved successfully.
C:\Users\mike\AppData\Local\Temp\DTLite4413-0173.exe => Moved successfully.
C:\Users\mike\AppData\Local\Temp\DTLite4453-0297.exe => Moved successfully.
C:\Users\mike\AppData\Local\Temp\DTLite4454-0315.exe => Moved successfully.
C:\Users\mike\AppData\Local\Temp\DTLite4471-0333.exe => Moved successfully.
C:\Users\mike\AppData\Local\Temp\GUR2673.exe => Moved successfully.
C:\Users\mike\AppData\Local\Temp\GUR2971.exe => Moved successfully.
C:\Users\mike\AppData\Local\Temp\iqu_installer.exe => Moved successfully.
C:\Users\mike\AppData\Local\Temp\jre-6u24-windows-i586-iftw-rv.exe => Moved successfully.
C:\Users\mike\AppData\Local\Temp\jre-6u26-windows-i586-iftw-rv.exe => Moved successfully.
C:\Users\mike\AppData\Local\Temp\jre-6u29-windows-i586-iftw-rv.exe => Moved successfully.
C:\Users\mike\AppData\Local\Temp\jre-6u35-windows-i586-iftw.exe => Moved successfully.
C:\Users\mike\AppData\Local\Temp\jre-6u37-windows-i586-iftw.exe => Moved successfully.
C:\Users\mike\AppData\Local\Temp\jre-7u15-windows-i586-iftw.exe => Moved successfully.
C:\Users\mike\AppData\Local\Temp\jre-7u17-windows-i586-iftw.exe => Moved successfully.
C:\Users\mike\AppData\Local\Temp\jre-7u21-windows-i586-iftw.exe => Moved successfully.
C:\Users\mike\AppData\Local\Temp\jre-7u25-windows-i586-iftw.exe => Moved successfully.
C:\Users\mike\AppData\Local\Temp\jre-7u45-windows-i586-iftw.exe => Moved successfully.
C:\Users\mike\AppData\Local\Temp\MotoHelper_2.0.51_Driver_5.1.0.exe => Moved successfully.
C:\Users\mike\AppData\Local\Temp\nsb4FCE.exe => Moved successfully.
C:\Users\mike\AppData\Local\Temp\nseC38B.exe => Moved successfully.
C:\Users\mike\AppData\Local\Temp\nsg33C.exe => Moved successfully.
C:\Users\mike\AppData\Local\Temp\nsiAF13.exe => Moved successfully.
C:\Users\mike\AppData\Local\Temp\nsj3F35.exe => Moved successfully.
C:\Users\mike\AppData\Local\Temp\nsmF7C5.exe => Moved successfully.
C:\Users\mike\AppData\Local\Temp\nsuD3C4.exe => Moved successfully.
C:\Users\mike\AppData\Local\Temp\nsv1AD0.exe => Moved successfully.
C:\Users\mike\AppData\Local\Temp\nsv23F7.exe => Moved successfully.
C:\Users\mike\AppData\Local\Temp\nsy18E0.exe => Moved successfully.
C:\Users\mike\AppData\Local\Temp\nsy34E5.exe => Moved successfully.
C:\Users\mike\AppData\Local\Temp\ose00000.exe => Moved successfully.
C:\Users\mike\AppData\Local\Temp\ose00001.exe => Moved successfully.
C:\Users\mike\AppData\Local\Temp\setup.exe => Moved successfully.
C:\Users\mike\AppData\Local\Temp\SetupDataMngr_BearShare.exe => Moved successfully.
C:\Users\mike\AppData\Local\Temp\SPStub.exe => Moved successfully.
C:\Users\mike\AppData\Local\Temp\tbDiv2.dll => Moved successfully.
C:\Users\mike\AppData\Local\Temp\ToolbarHelper.exe => Moved successfully.
C:\Users\mike\AppData\Local\Temp\worker.exe => Moved successfully.
C:\Users\mike\AppData\Local\Temp\xmlUpdater.exe => Moved successfully.
C:\Users\mike\AppData\Local\Temp\_is7290.exe => Moved successfully.
C:\Users\mike\AppData\Local\Temp\_is7FCA.exe => Moved successfully.
C:\Users\Mike w\AppData\Local\Temp\cltmng.exe => Moved successfully.
C:\Users\Mike w\AppData\Local\Temp\msvcp100.dll => Moved successfully.
C:\Users\Mike w\AppData\Local\Temp\msvcr100.dll => Moved successfully.
C:\Users\Mike w\AppData\Local\Temp\nspE55D.tmp.tbProd.dll => Moved successfully.
C:\Users\Mike w\AppData\Local\Temp\SkypeSetup.exe => Moved successfully.
C:\Users\Mike w\AppData\Local\Temp\tbedrs.dll => Moved successfully.
C:\Windows\system32\Drivers\etc\hosts => Moved successfully.

=> Result of Scheduled Files to move (Boot Mode: Normal) (Date&Time: 2014-04-27 20:59:35)<=

C:\Windows\System32\Drivers\av9k0pbr.sys => Is moved successfully.

==== End of Fixlog ====

----------------------------------------------------------------

 

 

malwarebytes quickscan log:

-----------------------------------------------------------------

Malwarebytes Anti-Malware (PRO) 1.75.0.1300
www.malwarebytes.org

Database version: v2014.04.27.04

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 11.0.9600.17041
mike :: ECSC2D [administrator]

Protection: Enabled

4/27/2014 9:30:24 PM
mbam-log-2014-04-27 (21-30-24).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM | P2P
Scan options disabled:
Objects scanned: 433842
Time elapsed: 13 minute(s), 28 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 5
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Installl_Converter_A Toolbar (PUP.Optional.InstalllConverter.A) -> Quarantined and deleted successfully.
HKCU\Software\AppDataLow\Software\Crossrider (PUP.Optional.CrossRider.A) -> Quarantined and deleted successfully.
HKCU\Software\AppDataLow\Software\PriceGong (PUP.Optional.PriceGong.A) -> Quarantined and deleted successfully.
HKCU\Software\Softonic\Universal Downloader (PUP.Optional.Softonic.A) -> Quarantined and deleted successfully.
HKLM\SOFTWARE\Installl_Converter_A (PUP.Optional.InstalllConverter.A) -> Quarantined and deleted successfully.

Registry Values Detected: 2
HKLM\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\{f84db37a-ae6f-423b-9f51-14b5ec10c879} (PUP.Optional.InstalllConverter.A) -> Data:  -> Quarantined and deleted successfully.
HKLM\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks|{f84db37a-ae6f-423b-9f51-14b5ec10c879} (PUP.Optional.InstalllConverter.A) -> Data:  -> Quarantined and deleted successfully.

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 30
C:\Program Files (x86)\Installl_Converter_A (PUP.Optional.InstalllConverter.A) -> Quarantined and deleted successfully.
C:\Users\mike\AppData\Roaming\OpenCandy (PUP.Optional.OpenCandy) -> Quarantined and deleted successfully.
C:\Users\mike\AppData\Roaming\OpenCandy\OpenCandy_049603A5E3BC4844A5DBA0CF2ED150E8 (PUP.Optional.OpenCandy) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\Temp\CT3297930 (PUP.Optional.Conduit.A) -> Quarantined and deleted successfully.
C:\Users\mike\AppData\Local\Temp\ct3288691 (PUP.Optional.Conduit.A) -> Quarantined and deleted successfully.
C:\Users\mike\AppData\Local\Temp\ct3288691\xpi (PUP.Optional.Conduit.A) -> Quarantined and deleted successfully.
C:\Users\mike\AppData\Local\Temp\ct3288691\xpi\defaults (PUP.Optional.Conduit.A) -> Quarantined and deleted successfully.
C:\Users\mike\AppData\Local\Temp\ct3288691\xpi\defaults\preferences (PUP.Optional.Conduit.A) -> Quarantined and deleted successfully.
C:\Users\mike\AppData\Local\Temp\ct3297861 (PUP.Optional.Conduit.A) -> Quarantined and deleted successfully.
C:\Users\mike\AppData\Local\TBHostSupport (PUP.Optional.Conduit) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39 (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\91fbdd335935d6fab2f0f46ec3451b3a18a24a23 (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\91fbdd335935d6fab2f0f46ec3451b3a18a24a23\1.2.3 (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\91fbdd335935d6fab2f0f46ec3451b3a18a24a23\1.2.3\css (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\91fbdd335935d6fab2f0f46ec3451b3a18a24a23\1.2.3\images (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\91fbdd335935d6fab2f0f46ec3451b3a18a24a23\1.2.3\images\icons (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\91fbdd335935d6fab2f0f46ec3451b3a18a24a23\1.2.3\js (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\d0e0492c497d8c260a5e799f8212a9e2b288600a (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\d0e0492c497d8c260a5e799f8212a9e2b288600a\1.0.2 (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\d0e0492c497d8c260a5e799f8212a9e2b288600a\1.0.2\css (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\d0e0492c497d8c260a5e799f8212a9e2b288600a\1.0.2\fonts (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\d0e0492c497d8c260a5e799f8212a9e2b288600a\1.0.2\images (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\d0e0492c497d8c260a5e799f8212a9e2b288600a\1.0.2\js (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2 (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\css (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\fonts (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\js (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.

Files Detected: 252
C:\Users\mike\AppData\Roaming\OpenCandy\OpenCandy_049603A5E3BC4844A5DBA0CF2ED150E8\LatestDLMgr.exe (PUP.Optional.OpenCandy.A) -> Quarantined and deleted successfully.
C:\ministub.exe (PUP.Optional.Conduit.A) -> Quarantined and deleted successfully.
C:\Users\mike\AppData\Local\Temp\nstDB35.tmp (PUP.Optional.Somoto.A) -> Quarantined and deleted successfully.
C:\Users\mike\AppData\Local\Temp\ct3288691\ctbe.exe (PUP.Optional.Conduit.A) -> Quarantined and deleted successfully.
C:\Users\mike\AppData\Local\Temp\ct3288691\spch.exe (PUP.Optional.Conduit.A) -> Quarantined and deleted successfully.
C:\Users\mike\AppData\Local\Temp\ct3288691\spff.exe (PUP.Optional.Conduit.A) -> Quarantined and deleted successfully.
C:\Users\mike\AppData\Local\Temp\ct3288691\statisticsStub.exe (PUP.Optional.Conduit.A) -> Quarantined and deleted successfully.
C:\Users\mike\Downloads\monoSetup.exe (PUP.Bundle.Installer.OI) -> Quarantined and deleted successfully.
C:\Users\mike\Downloads\SoftonicDownloader_for_video-download-capture.exe (PUP.Optional.Softonic.A) -> Quarantined and deleted successfully.
C:\Users\mike\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_pbkdpahkifcigckmhiafindmaflfifgm_0.localstorage-journal (PUP.Optional.CrossRider.A) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Installl_Converter_A\toolbar.cfg (PUP.Optional.InstalllConverter.A) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Installl_Converter_A\GottenAppsContextMenu.xml (PUP.Optional.InstalllConverter.A) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Installl_Converter_A\hk64tbIns0.dll (PUP.Optional.InstalllConverter.A) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Installl_Converter_A\hk64tbInst.dll (PUP.Optional.InstalllConverter.A) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Installl_Converter_A\hktbIns0.dll (PUP.Optional.InstalllConverter.A) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Installl_Converter_A\hktbInst.dll (PUP.Optional.InstalllConverter.A) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Installl_Converter_A\Installl_Converter_AToolbarHelper.exe (PUP.Optional.InstalllConverter.A) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Installl_Converter_A\Installl_Converter_AToolbarHelper1.exe (PUP.Optional.InstalllConverter.A) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Installl_Converter_A\ldrtbIns0.dll (PUP.Optional.InstalllConverter.A) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Installl_Converter_A\ldrtbInst.dll (PUP.Optional.InstalllConverter.A) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Installl_Converter_A\OtherAppsContextMenu.xml (PUP.Optional.InstalllConverter.A) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Installl_Converter_A\prxtbIns0.dll (PUP.Optional.InstalllConverter.A) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Installl_Converter_A\prxtbInst.dll (PUP.Optional.InstalllConverter.A) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Installl_Converter_A\SharedAppsContextMenu.xml (PUP.Optional.InstalllConverter.A) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Installl_Converter_A\tbIns0.dll (PUP.Optional.InstalllConverter.A) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Installl_Converter_A\tbInst.dll (PUP.Optional.InstalllConverter.A) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Installl_Converter_A\ToolbarContextMenu.xml (PUP.Optional.InstalllConverter.A) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Installl_Converter_A\uninstall.exe (PUP.Optional.InstalllConverter.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\Temp\CT3297930\ddt.csf (PUP.Optional.Conduit.A) -> Quarantined and deleted successfully.
C:\Users\mike\AppData\Local\Temp\ct3288691\chromeid.txt (PUP.Optional.Conduit.A) -> Quarantined and deleted successfully.
C:\Users\mike\AppData\Local\Temp\ct3288691\conduit.xml (PUP.Optional.Conduit.A) -> Quarantined and deleted successfully.
C:\Users\mike\AppData\Local\Temp\ct3288691\CT3288691.txt (PUP.Optional.Conduit.A) -> Quarantined and deleted successfully.
C:\Users\mike\AppData\Local\Temp\ct3288691\CT3288691.xpi (PUP.Optional.Conduit.A) -> Quarantined and deleted successfully.
C:\Users\mike\AppData\Local\Temp\ct3288691\dtime.csf (PUP.Optional.Conduit.A) -> Quarantined and deleted successfully.
C:\Users\mike\AppData\Local\Temp\ct3288691\initData.json (PUP.Optional.Conduit.A) -> Quarantined and deleted successfully.
C:\Users\mike\AppData\Local\Temp\ct3288691\manifest.json (PUP.Optional.Conduit.A) -> Quarantined and deleted successfully.
C:\Users\mike\AppData\Local\Temp\ct3288691\setup.ini.txt (PUP.Optional.Conduit.A) -> Quarantined and deleted successfully.
C:\Users\mike\AppData\Local\Temp\ct3288691\stub.exe (PUP.Optional.Conduit.A) -> Quarantined and deleted successfully.
C:\Users\mike\AppData\Local\Temp\ct3288691\xpi\install.rdf (PUP.Optional.Conduit.A) -> Quarantined and deleted successfully.
C:\Users\mike\AppData\Local\Temp\ct3288691\xpi\defaults\preferences\defaults.js (PUP.Optional.Conduit.A) -> Quarantined and deleted successfully.
C:\Users\mike\AppData\Local\Temp\ct3297861\chromeid.txt (PUP.Optional.Conduit.A) -> Quarantined and deleted successfully.
C:\Users\mike\AppData\Local\Temp\ct3297861\setup.ini.txt (PUP.Optional.Conduit.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\UrlFolderExtension.uf1 (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\UrlFolderExtension.ufm (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\91fbdd335935d6fab2f0f46ec3451b3a18a24a23\1.2.3\anemone-1.2.7.js (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\91fbdd335935d6fab2f0f46ec3451b3a18a24a23\1.2.3\background.html (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\91fbdd335935d6fab2f0f46ec3451b3a18a24a23\1.2.3\Date.getWeek.js (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\91fbdd335935d6fab2f0f46ec3451b3a18a24a23\1.2.3\hidden-window.html (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\91fbdd335935d6fab2f0f46ec3451b3a18a24a23\1.2.3\ie7-fix.html (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\91fbdd335935d6fab2f0f46ec3451b3a18a24a23\1.2.3\jquery-1.7.2.min.js (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\91fbdd335935d6fab2f0f46ec3451b3a18a24a23\1.2.3\jquery-dropdown.js (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\91fbdd335935d6fab2f0f46ec3451b3a18a24a23\1.2.3\jquery-inputfieldrestrict.js (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\91fbdd335935d6fab2f0f46ec3451b3a18a24a23\1.2.3\jquery-modal.js (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\91fbdd335935d6fab2f0f46ec3451b3a18a24a23\1.2.3\jquery-ui.min.js (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\91fbdd335935d6fab2f0f46ec3451b3a18a24a23\1.2.3\json2.min.js (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\91fbdd335935d6fab2f0f46ec3451b3a18a24a23\1.2.3\manifest.json (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\91fbdd335935d6fab2f0f46ec3451b3a18a24a23\1.2.3\SignedExtension.cab (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\91fbdd335935d6fab2f0f46ec3451b3a18a24a23\1.2.3\underscore-1.3.1.min.js (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\91fbdd335935d6fab2f0f46ec3451b3a18a24a23\1.2.3\widget-api-1.2.js (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\91fbdd335935d6fab2f0f46ec3451b3a18a24a23\1.2.3\window.html (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\91fbdd335935d6fab2f0f46ec3451b3a18a24a23\1.2.3\css\dropdown.css (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\91fbdd335935d6fab2f0f46ec3451b3a18a24a23\1.2.3\css\modal.css (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\91fbdd335935d6fab2f0f46ec3451b3a18a24a23\1.2.3\css\widget.css (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\91fbdd335935d6fab2f0f46ec3451b3a18a24a23\1.2.3\images\favicon.ico (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\91fbdd335935d6fab2f0f46ec3451b3a18a24a23\1.2.3\images\FBwidget_sprite.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\91fbdd335935d6fab2f0f46ec3451b3a18a24a23\1.2.3\images\icon.bmp (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\91fbdd335935d6fab2f0f46ec3451b3a18a24a23\1.2.3\images\icon.bmp,hot,flags=none.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\91fbdd335935d6fab2f0f46ec3451b3a18a24a23\1.2.3\images\icon.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\91fbdd335935d6fab2f0f46ec3451b3a18a24a23\1.2.3\images\loading.gif (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\91fbdd335935d6fab2f0f46ec3451b3a18a24a23\1.2.3\images\icons\F0.bmp (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\91fbdd335935d6fab2f0f46ec3451b3a18a24a23\1.2.3\images\icons\F0.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\91fbdd335935d6fab2f0f46ec3451b3a18a24a23\1.2.3\images\icons\F1.bmp (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\91fbdd335935d6fab2f0f46ec3451b3a18a24a23\1.2.3\images\icons\F1.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\91fbdd335935d6fab2f0f46ec3451b3a18a24a23\1.2.3\images\icons\F10.bmp (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\91fbdd335935d6fab2f0f46ec3451b3a18a24a23\1.2.3\images\icons\F10.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\91fbdd335935d6fab2f0f46ec3451b3a18a24a23\1.2.3\images\icons\F2.bmp (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\91fbdd335935d6fab2f0f46ec3451b3a18a24a23\1.2.3\images\icons\F2.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\91fbdd335935d6fab2f0f46ec3451b3a18a24a23\1.2.3\images\icons\F3.bmp (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\91fbdd335935d6fab2f0f46ec3451b3a18a24a23\1.2.3\images\icons\F3.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\91fbdd335935d6fab2f0f46ec3451b3a18a24a23\1.2.3\images\icons\F4.bmp (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\91fbdd335935d6fab2f0f46ec3451b3a18a24a23\1.2.3\images\icons\F4.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\91fbdd335935d6fab2f0f46ec3451b3a18a24a23\1.2.3\images\icons\F5.bmp (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\91fbdd335935d6fab2f0f46ec3451b3a18a24a23\1.2.3\images\icons\F5.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\91fbdd335935d6fab2f0f46ec3451b3a18a24a23\1.2.3\images\icons\F6.bmp (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\91fbdd335935d6fab2f0f46ec3451b3a18a24a23\1.2.3\images\icons\F6.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\91fbdd335935d6fab2f0f46ec3451b3a18a24a23\1.2.3\images\icons\F7.bmp (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\91fbdd335935d6fab2f0f46ec3451b3a18a24a23\1.2.3\images\icons\F7.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\91fbdd335935d6fab2f0f46ec3451b3a18a24a23\1.2.3\images\icons\F8.bmp (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\91fbdd335935d6fab2f0f46ec3451b3a18a24a23\1.2.3\images\icons\F8.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\91fbdd335935d6fab2f0f46ec3451b3a18a24a23\1.2.3\images\icons\F9.bmp (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\91fbdd335935d6fab2f0f46ec3451b3a18a24a23\1.2.3\images\icons\F9.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\91fbdd335935d6fab2f0f46ec3451b3a18a24a23\1.2.3\js\background.js (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\91fbdd335935d6fab2f0f46ec3451b3a18a24a23\1.2.3\js\hiddenwindow.js (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\91fbdd335935d6fab2f0f46ec3451b3a18a24a23\1.2.3\js\settings.js (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\91fbdd335935d6fab2f0f46ec3451b3a18a24a23\1.2.3\js\widgetwindow.js (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\d0e0492c497d8c260a5e799f8212a9e2b288600a\1.0.2\anemone-1.2.7.js (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\d0e0492c497d8c260a5e799f8212a9e2b288600a\1.0.2\App.html (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\d0e0492c497d8c260a5e799f8212a9e2b288600a\1.0.2\Background.html (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\d0e0492c497d8c260a5e799f8212a9e2b288600a\1.0.2\EventManager.js (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\d0e0492c497d8c260a5e799f8212a9e2b288600a\1.0.2\hogan-2.0.0.js (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\d0e0492c497d8c260a5e799f8212a9e2b288600a\1.0.2\jquery-1.7.1.min.js (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\d0e0492c497d8c260a5e799f8212a9e2b288600a\1.0.2\manifest.json (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\d0e0492c497d8c260a5e799f8212a9e2b288600a\1.0.2\reset.css (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\d0e0492c497d8c260a5e799f8212a9e2b288600a\1.0.2\SignedExtension.cab (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\d0e0492c497d8c260a5e799f8212a9e2b288600a\1.0.2\underscore-1.3.1.min.js (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\d0e0492c497d8c260a5e799f8212a9e2b288600a\1.0.2\widget-messaging-1.0.SNAPSHOT.js (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\d0e0492c497d8c260a5e799f8212a9e2b288600a\1.0.2\css\App.css (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\d0e0492c497d8c260a5e799f8212a9e2b288600a\1.0.2\fonts\cabin.eot (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\d0e0492c497d8c260a5e799f8212a9e2b288600a\1.0.2\fonts\cabin.woff (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\d0e0492c497d8c260a5e799f8212a9e2b288600a\1.0.2\images\arrow.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\d0e0492c497d8c260a5e799f8212a9e2b288600a\1.0.2\images\close.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\d0e0492c497d8c260a5e799f8212a9e2b288600a\1.0.2\images\close2.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\d0e0492c497d8c260a5e799f8212a9e2b288600a\1.0.2\images\delete.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\d0e0492c497d8c260a5e799f8212a9e2b288600a\1.0.2\images\delete2.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\d0e0492c497d8c260a5e799f8212a9e2b288600a\1.0.2\images\edit.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\d0e0492c497d8c260a5e799f8212a9e2b288600a\1.0.2\images\find.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\d0e0492c497d8c260a5e799f8212a9e2b288600a\1.0.2\images\go.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\d0e0492c497d8c260a5e799f8212a9e2b288600a\1.0.2\images\logo.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\d0e0492c497d8c260a5e799f8212a9e2b288600a\1.0.2\images\MapsGalaxy.bmp (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\d0e0492c497d8c260a5e799f8212a9e2b288600a\1.0.2\images\MapsGalaxy.bmp,hot,flags=none.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\d0e0492c497d8c260a5e799f8212a9e2b288600a\1.0.2\images\MapsGalaxy.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\d0e0492c497d8c260a5e799f8212a9e2b288600a\1.0.2\images\MapsGalaxy2.bmp (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\d0e0492c497d8c260a5e799f8212a9e2b288600a\1.0.2\images\MapsGalaxy2.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\d0e0492c497d8c260a5e799f8212a9e2b288600a\1.0.2\images\save.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\d0e0492c497d8c260a5e799f8212a9e2b288600a\1.0.2\images\save2.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\d0e0492c497d8c260a5e799f8212a9e2b288600a\1.0.2\images\settings.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\d0e0492c497d8c260a5e799f8212a9e2b288600a\1.0.2\images\stars.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\d0e0492c497d8c260a5e799f8212a9e2b288600a\1.0.2\js\App.js (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\d0e0492c497d8c260a5e799f8212a9e2b288600a\1.0.2\js\App.Test.js (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\d0e0492c497d8c260a5e799f8212a9e2b288600a\1.0.2\js\Background.js (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\d0e0492c497d8c260a5e799f8212a9e2b288600a\1.0.2\js\Data.js (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\d0e0492c497d8c260a5e799f8212a9e2b288600a\1.0.2\js\FindLocation.js (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\d0e0492c497d8c260a5e799f8212a9e2b288600a\1.0.2\js\GetDirections.js (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\d0e0492c497d8c260a5e799f8212a9e2b288600a\1.0.2\js\MapsGalaxy.js (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\d0e0492c497d8c260a5e799f8212a9e2b288600a\1.0.2\js\MGDropDown.js (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\d0e0492c497d8c260a5e799f8212a9e2b288600a\1.0.2\js\Modals.Delete.js (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\d0e0492c497d8c260a5e799f8212a9e2b288600a\1.0.2\js\Modals.Location.js (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\d0e0492c497d8c260a5e799f8212a9e2b288600a\1.0.2\js\Modals.MaxRecent.js (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\d0e0492c497d8c260a5e799f8212a9e2b288600a\1.0.2\js\Modals.MaxSaved.js (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\d0e0492c497d8c260a5e799f8212a9e2b288600a\1.0.2\js\Reporting.js (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\d0e0492c497d8c260a5e799f8212a9e2b288600a\1.0.2\js\Settings.js (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\anemone-1.2.7.js (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\App.html (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\Background.html (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\hogan-2.0.0.js (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\jquery-1.7.1.min.js (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\json2.min.js (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\manifest.json (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\reset.css (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\SignedExtension.cab (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\underscore-1.4.2.min.js (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\widget-api-1.2.js (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\css\App.css (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\fonts\cabin.eot (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\fonts\cabin.woff (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\close.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\MainIcon.bmp (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\MainIcon.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\minimize.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\rateUISprite.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\rate_WB.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\search.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\WBlogo.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\ChanceOfRain.bmp (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\ChanceOfRain.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\ChanceOfRain_60x60.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\ChanceOfRain_90x90.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\ChanceOfSnow.bmp (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\ChanceOfSnow.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\ChanceOfSnow_60x60.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\ChanceOfSnow_90x90.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\ChanceOfStorm.bmp (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\ChanceOfStorm.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\ChanceOfStorm_60x60.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\ChanceOfStorm_90x90.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\ChanceOfTstorm.bmp (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\ChanceOfTstorm.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\ChanceOfTstorm_60x60.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\ChanceOfTstorm_90x90.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\Cloudy.bmp (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\Cloudy.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\Cloudy_60x60.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\Cloudy_90x90.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\Dust.bmp (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\Dust.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\Dust_60x60.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\Dust_90x90.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\Fog.bmp (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\Fog.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\Fog_60x60.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\Fog_90x90.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\Ice.bmp (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\Ice.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\Ice_60x60.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\Ice_90x90.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\MainIcon.bmp (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\MainIcon.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\Misc.bmp (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\Misc.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\Misc_60x60.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\Misc_90x90.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\Misty.bmp (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\Misty.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\Misty_60x60.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\Misty_90x90.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\MostlyCloudy.bmp (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\MostlyCloudy.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\MostlyCloudy_60x60.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\MostlyCloudy_90x90.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\MostlySunny.bmp (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\MostlySunny.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\MostlySunny_60x60.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\MostlySunny_90x90.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\Rain.bmp (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\Rain.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\Rain_60x60.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\Rain_90x90.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\SevereWeatherAdvisory.bmp (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\SevereWeatherAdvisory.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\SevereWeatherWarning.bmp (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\SevereWeatherWarning.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\SevereWeatherWatch.bmp (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\SevereWeatherWatch.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\Showers.bmp (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\Showers.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\Showers_60x60.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\Showers_90x90.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\Sleet.bmp (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\Sleet.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\Sleet_60x60.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\Sleet_90x90.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\Snow.bmp (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\Snow.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\Snow_60x60.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\Snow_90x90.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\Sunny.bmp (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\Sunny.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\Sunny_60x60.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\Sunny_90x90.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\Thunderstorm.bmp (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\Thunderstorm.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\Thunderstorm_60x60.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\Thunderstorm_90x90.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\Windy.bmp (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\Windy.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\Windy_60x60.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather\Windy_90x90.png (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\js\App.js (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\js\App.Test.js (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\js\Background.js (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\js\Settings.js (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.
C:\Users\Mike w\AppData\Local\MapsGalaxy_39\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\js\WeatherBlink.js (PUP.Optional.MindSpark.A) -> Quarantined and deleted successfully.

(end)
 

-----------------------------------------------------------------

Link to post
Share on other sites

Ran the adwCleaner, scan then clean.  Below is the contents of the text file that was created:

-----------------------------------------

# AdwCleaner v3.204 - Report created 27/04/2014 at 22:19:25
# Updated 26/04/2014 by Xplode
# Operating System : Windows 7 Home Premium Service Pack 1 (64 bits)
# Username : mike - ECSC2D
# Running from : C:\Users\mike\Downloads\AdwCleaner.exe
# Option : Clean

***** [ Services ] *****


***** [ Files / Folders ] *****

Folder Deleted : C:\Program Files (x86)\w3i
Folder Deleted : C:\Windows\SysWOW64\AI_RecycleBin
Folder Deleted : C:\Users\mike\AppData\Local\iac
Folder Deleted : C:\Users\mike\AppData\Local\NativeMessaging
Folder Deleted : C:\Users\mike\AppData\Local\PackageAware
Folder Deleted : C:\Users\mike\AppData\LocalLow\Conduit
Folder Deleted : C:\Users\mike\AppData\LocalLow\PriceGong
Folder Deleted : C:\Users\Mike w\AppData\Local\iac
Folder Deleted : C:\Users\Mike w\AppData\LocalLow\mapsgalaxy_39
Folder Deleted : C:\Users\Mike w\AppData\Roaming\Uniblue
Folder Deleted : C:\Users\Robert\AppData\LocalLow\AskToolbar
Folder Deleted : C:\Users\mike\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkmpcdbgnfjfeelcpebpkflcmbkclfho
File Deleted : C:\END
File Deleted : C:\Program Files (x86)\Mozilla Firefox\nsprotector.js
File Deleted : C:\Users\mike\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_app.mam.conduit.com_0.localstorage
File Deleted : C:\Users\mike\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_app.mam.conduit.com_0.localstorage-journal
File Deleted : C:\Windows\System32\Tasks\BackgroundContainer Startup Task

***** [ Shortcuts ] *****


***** [ Registry ] *****

Key Deleted : HKCU\Software\Google\Chrome\Extensions\pkmpcdbgnfjfeelcpebpkflcmbkclfho
Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\pkmpcdbgnfjfeelcpebpkflcmbkclfho
Key Deleted : HKLM\SOFTWARE\Classes\driverscanner
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\AskInstallChecker-1_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\AskInstallChecker-1_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\askpartnercobrandingtool_rasapi32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\askpartnercobrandingtool_rasmancs
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\au__rasapi32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\au__rasmancs
Key Deleted : HKLM\SOFTWARE\Classes\Toolbar.CT3288691
Key Deleted : HKLM\SOFTWARE\Classes\Toolbar.CT3311834
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_for_quicktime_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_for_quicktime_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_for_supertux_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_for_supertux_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_for_video-download-capture_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_for_video-download-capture_RASMANCS
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{EF99BD32-C1FB-11D2-892F-0090271D4F88}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{FD79F359-E577-46DB-AA74-D6E6B8B45BA8}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{23119123-0854-469D-807A-171568457991}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{3B181CF2-878B-4758-8FBD-59D8AC5AB12D}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{490A5A0F-1471-47FF-8BB5-719F1F5238AD}
Key Deleted : HKCU\Software\Cr_Installer
Key Deleted : HKCU\Software\ilivid
Key Deleted : HKCU\Software\Softonic
Key Deleted : HKCU\Software\YahooPartnerToolbar
Key Deleted : HKCU\Software\Zugo
Key Deleted : HKCU\Software\AppDataLow\Toolbar
Key Deleted : HKCU\Software\AppDataLow\Software\BackgroundContainer
Key Deleted : HKCU\Software\AppDataLow\Software\SmartBar
Key Deleted : HKLM\Software\AVG Secure Search
Key Deleted : HKLM\Software\Freeze.com
Key Deleted : HKLM\Software\Uniblue
Key Deleted : [x64] HKLM\SOFTWARE\Description

***** [ Browsers ] *****

-\\ Internet Explorer v11.0.9600.17041


-\\ Mozilla Firefox v28.0 (en-US)

[ File : C:\Users\mike\AppData\Roaming\Mozilla\Firefox\Profiles\y428pvf0.default-1396214294990\prefs.js ]


-\\ Google Chrome v34.0.1847.116

[ File : C:\Users\Eve\AppData\Local\Google\Chrome\User Data\Default\preferences ]

Deleted [Extension] : kdcnnmifdmlmjffdgeieikcokcogpbej
Deleted [Extension] : kincjchfokkeneeofpeefomkikfkiedl

[ File : C:\Users\mike\AppData\Local\Google\Chrome\User Data\Default\preferences ]



Deleted [Extension] : pkmpcdbgnfjfeelcpebpkflcmbkclfho

[ File : C:\Users\Mike w\AppData\Local\Google\Chrome\User Data\Default\preferences ]




[ File : C:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default\preferences ]


*************************

AdwCleaner[R0].txt - [5827 octets] - [27/04/2014 22:17:56]
AdwCleaner[s0].txt - [5569 octets] - [27/04/2014 22:19:25]

########## EOF - C:\AdwCleaner\AdwCleaner[s0].txt - [5629 octets] ##########
 

-----------------------------------------

Link to post
Share on other sites

I ran JRT and rebooted.  Below is the contents of the text file that it created.....

Upon reboot, the Conduit error message is finally gone.  In addition to that,

hard drive activity is now greatly reduced when system is idle.

 

In my case, it seems that the Junkware Removal Tool was what was needed.

 

------------------------------------------------------------------------------

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.4 (04.06.2014:1)
OS: Windows 7 Home Premium x64
Ran by mike on Sun 04/27/2014 at 22:39:52.83
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values

Successfully repaired: [Registry Value] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\\Start Page
Successfully repaired: [Registry Value] HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Main\\Start Page
Successfully repaired: [Registry Value] HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\Main\\Start Page
Successfully repaired: [Registry Value] HKEY_USERS\S-1-5-19\Software\Microsoft\Internet Explorer\Main\\Start Page
Successfully repaired: [Registry Value] HKEY_USERS\S-1-5-20\Software\Microsoft\Internet Explorer\Main\\Start Page
Successfully repaired: [Registry Value] HKEY_USERS\S-1-5-21-1229362484-4032704617-3898728357-1001\Software\Microsoft\Internet Explorer\Main\\Start Page



~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{11111111-1111-1111-1111-110011441193}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{11111111-1111-1111-1111-110011441193}



~~~ Files



~~~ Folders

Successfully deleted: [Folder] "C:\ProgramData\boost_interprocess"
Successfully deleted: [Folder] "C:\ProgramData\w3i"



~~~ FireFox

Emptied folder: C:\Users\mike\AppData\Roaming\mozilla\firefox\profiles\y428pvf0.default-1396214294990\minidumps [2 files]



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on Sun 04/27/2014 at 22:48:37.32
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 

------------------------------------------------------------------------------

Link to post
Share on other sites

Conduit and other such nuisances are always difficult to weed out, it is always the best option to use multiple tools together as we did with Malwarebytes, AdwCleaner and JRT. The logs do show a multitude of unwanted dross was cleared for us...

 

We need to run an online AV scan to ensure there are no remnants of any infection left on your system that may have been missed. This scan is very thorough and well worth running, it can take several hours please be patient and let it complete:

 

Run Eset Online Scanner

 

**Note** You will need to use Internet explorer for this scan - Vista and Windows 7/8 right click on IE shortcut and run as admin

 

Go to Eset web page http://www.eset.com/us/online-scanner/ to run an online scan from ESET.

 


Turn off the real time scanner of any existing antivirus program while performing the online scan
click on the Run ESET Online Scanner button
Tick the box next to YES, I accept the Terms of Use.
Click Start
When asked, allow the add/on to be installed
Click Start
Make sure that the option "Remove found threats"  is UNticked
Click on Advanced Settings, ensure the options
Scan for potentially unwanted applications, Scan for potentially unsafe applications, and Enable Anti-Stealth Technology are ticked.
Click Scan
wait for the virus definitions to be downloaded
Wait for the scan to finish

 

When the scan is complete

 


If no threats were found
put a checkmark in "Uninstall application on close"
close program
report to me that nothing was found

 

If threats were found

 


click on "list of threats found"
click on "export to text file" and save it as ESET SCAN and save to the desktop
Click on back
put a checkmark in "Uninstall application on close"
click on finish

 

close program

 

Copy and paste the report in next reply.

 

Kevin..

Link to post
Share on other sites

  • Root Admin

Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!

Link to post
Share on other sites

Guest
This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.