I'm infected - What do I do now? 8/15/14

egad1986 · August 15, 2014

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 15-08-2014

Ran by Amy (administrator) on AMY on 15-08-2014 18:18:55

Running from C:\Users\Amy\Downloads

Platform: Windows 8.1 (X64) OS Language: English (United States)

Internet Explorer Version 11

Boot Mode: Normal

The only official download link for FRST:

Download link for 32-Bit version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/

Download link for 64-Bit Version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/

Download link from any site other than Bleeping Computer is unpermitted or outdated.

See tutorial for FRST: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Microsoft Corporation) C:\Windows\System32\dasHost.exe

(Freemake) C:\ProgramData\Freemake\FreemakeUtilsService\FreemakeUtilsService.exe

(Intel® Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\Jhi_service.exe

(Nalpeiron Ltd.) C:\Windows\SysWOW64\NLSSRV32.EXE

(Sendori) C:\Program Files (x86)\PureLeads\plsapp.exe

() C:\Program Files (x86)\Froyo_Android_Driver\Bin\MonServiceUDisk.exe

(PureLeads) C:\Program Files (x86)\PureLeads\PureLeadsSvc.exe

(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe

(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe

(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.24.15\GoogleCrashHandler.exe

(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.24.15\GoogleCrashHandler64.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe

(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrl.exe

(Alcor Micro Corp.) C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe

(Lenovo (Beijing) Limited) C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe

(Lenovo(beijing) Limited) C:\Program Files (x86)\Lenovo\Energy Management\utility.exe

(CyberLink) C:\Program Files (x86)\Lenovo\YouCam\YCMMirage.exe

(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrlHelper.exe

(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDIntelligent.exe

(Intel Corporation) C:\Windows\System32\igfxtray.exe

(Intel Corporation) C:\Windows\System32\hkcmd.exe

(Intel Corporation) C:\Windows\System32\igfxsrvc.exe

(Intel Corporation) C:\Windows\System32\igfxpers.exe

(AWS Convergence Technologies, Inc.) C:\Program Files (x86)\AWS\WeatherBug\Weather.exe

(Google Inc.) C:\Users\Amy\AppData\Local\Google\Update\GoogleUpdate.exe

(Dolby Laboratories Inc.) C:\Program Files (x86)\Dolby Advanced Audio v2\pcee4.exe

() C:\Program Files (x86)\Lenovo EasyCamera\Monitor.exe

(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe

(Adobe Systems Inc.) C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\acrotray.exe

(PureLeads) C:\Program Files (x86)\PureLeads\PureLeadsTray.exe

(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\IPC\AdobeIPCBroker.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\FWService\IntelMeFWService.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

() C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Adobe Creative Cloud\HEX\Adobe CEF Helper.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Adobe Creative Cloud\HEX\Adobe CEF Helper.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe

(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\Creative Cloud Helper.exe

(Microsoft Corporation) C:\Windows\System32\rundll32.exe

(Adobe Systems Inc.) C:\Users\Amy\AppData\Roaming\Adobe\AIR\Updater\Background\updater

(Adobe Systems Inc.) C:\Users\Amy\AppData\Local\Temp\AIR360B.tmp\Adobe AIR Installer.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Microsoft Corporation) C:\Program Files\Windows Defender\MpCmdRun.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12921488 2012-07-02] (Realtek Semiconductor)

HKLM\...\Run: [RtHDVBg_Dolby] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1212560 2012-06-13] (Realtek Semiconductor)

HKLM\...\Run: [ETDCtrl] => C:\Program Files\Elantech\ETDCtrl.exe [2864016 2012-08-09] (ELAN Microelectronics Corp.)

HKLM\...\Run: [AmIcoSinglun64] => C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe [366720 2012-06-26] (Alcor Micro Corp.)

HKLM\...\Run: [Energy Management] => C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe [17079376 2012-10-20] (Lenovo (Beijing) Limited)

HKLM\...\Run: [EnergyUtility] => C:\Program Files (x86)\Lenovo\Energy Management\Utility.exe [191568 2012-10-20] (Lenovo(beijing) Limited)

HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [558496 2014-02-27] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [Dolby Advanced Audio v2] => C:\Program Files (x86)\Dolby Advanced Audio v2\pcee4.exe [508256 2012-04-23] (Dolby Laboratories Inc.)

HKLM-x32\...\Run: [Lenovo EasyCamera_Monitor] => C:\Program Files (x86)\Lenovo EasyCamera\monitor.exe [257224 2010-08-24] ()

HKLM-x32\...\Run: [YouCam Mirage] => C:\Program Files (x86)\Lenovo\YouCam\YCMMirage.exe [136488 2012-07-27] (CyberLink)

HKLM-x32\...\Run: [YouCam Tray] => C:\Program Files (x86)\Lenovo\YouCam\YouCamTray.exe [167024 2012-07-27] (CyberLink Corp.)

HKLM-x32\...\Run: [updateP2GShortCut] => C:\Program Files (x86)\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe [217088 2012-04-18] (CyberLink Corp.)

HKLM-x32\...\Run: [RemoteControl10] => C:\Program Files (x86)\Lenovo\PowerDVD10\PDVD10Serv.exe [91432 2012-03-28] (CyberLink Corp.)

HKLM-x32\...\Run: [intel AppUp(SM) center] => C:\Program Files (x86)\Intel\IntelAppStore\bin\ismagent.exe [155488 2012-07-12] (Intel Corporation)

HKLM-x32\...\Run: [switchBoard] => C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [AdobeCS6ServiceManager] => C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe [1075296 2013-04-25] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)

HKLM-x32\...\Run: [Adobe Creative Cloud] => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe [2694040 2014-07-22] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [] => [X]

HKLM-x32\...\Run: [Acrobat Assistant 8.0] => C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\Acrotray.exe [3499896 2014-05-08] (Adobe Systems Inc.)

HKLM-x32\...\Run: [PureLeads Tray] => C:\Program Files (x86)\PureLeads\PureLeadsTray.exe [83232 2014-01-23] (PureLeads)

HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2014-01-17] (Apple Inc.)

HKLM-x32\...\Run: [sunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [256896 2014-07-25] (Oracle Corporation)

Winlogon\Notify\igfxcui: C:\windows\system32\igfxdev.dll (Intel Corporation)

HKLM\...\Policies\Explorer: [NoControlPanel] 0

HKU\S-1-5-21-3948811954-352045940-1238658349-1001\...\Run: [Weather] => C:\Program Files (x86)\AWS\WeatherBug\Weather.exe [1653760 2013-03-04] (AWS Convergence Technologies, Inc.)

HKU\S-1-5-21-3948811954-352045940-1238658349-1001\...\Run: [skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [18643560 2013-03-01] (Skype Technologies S.A.)

HKU\S-1-5-21-3948811954-352045940-1238658349-1001\...\Run: [AdobeBridge] => [X]

HKU\S-1-5-21-3948811954-352045940-1238658349-1001\...\Run: [speech Recognition] => C:\WINDOWS\Speech\Common\sapisvr.exe [44544 2013-08-22] (Microsoft Corporation)

HKU\S-1-5-21-3948811954-352045940-1238658349-1001\...\Run: [spotify Web Helper] => C:\Users\Amy\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1178168 2014-07-29] (Spotify Ltd)

HKU\S-1-5-21-3948811954-352045940-1238658349-1001\...\Run: [spotify] => C:\Users\Amy\AppData\Roaming\Spotify\Spotify.exe [6162488 2014-07-29] (Spotify Ltd)

HKU\S-1-5-21-3948811954-352045940-1238658349-1001\...\Run: [TWC.Win7] => C:\Program Files (x86)\The Weather Channel\Desktop Weather\TWC.Win7.exe [48640 2014-04-13] ()

HKU\S-1-5-21-3948811954-352045940-1238658349-1001\...\Run: [Google Update] => C:\Users\Amy\AppData\Local\Google\Update\GoogleUpdate.exe [116648 2014-05-08] (Google Inc.)

HKU\S-1-5-21-3948811954-352045940-1238658349-1001\...\MountPoints2: {9279e1ad-eb41-11e2-be96-3c970e3a695e} - "G:\LGAutoRun.exe"

ShellIconOverlayIdentifiers: AccExtIco1 -> {AB9CF9F8-8A96-4F9D-BF21-CE85714C3A47} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync_x64.dll ()

ShellIconOverlayIdentifiers: AccExtIco2 -> {853B7E05-C47D-4985-909A-D0DC5C6D7303} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync_x64.dll ()

ShellIconOverlayIdentifiers: AccExtIco3 -> {42D38F2E-98E9-4382-B546-E24E4D6D04BB} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync_x64.dll ()

ShellIconOverlayIdentifiers: SugarSyncBackedUp -> {0C4A258A-3F3B-4FFF-80A7-9B3BEC139472} => No File

ShellIconOverlayIdentifiers: SugarSyncPending -> {62CCD8E3-9C21-41E1-B55E-1E26DFC68511} => No File

ShellIconOverlayIdentifiers: SugarSyncRoot -> {A759AFF6-5851-457D-A540-F4ECED148351} => No File

ShellIconOverlayIdentifiers: SugarSyncShared -> {1574C9EF-7D58-488F-B358-8B78C1538F51} => No File

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://lenovo13.msn.com

HKCU\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = http://www.lenovo.com/

HKCU\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = http://www.lenovo.com

SearchScopes: HKLM - DefaultScope {3728E3C4-5F83-4573-9054-941BF0267289} URL = http://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MALNJS

SearchScopes: HKLM - {3728E3C4-5F83-4573-9054-941BF0267289} URL = http://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MALNJS

SearchScopes: HKLM-x32 - DefaultScope {9B5E3A3B-557B-4424-975F-B0D077758D0D} URL =

SearchScopes: HKLM-x32 - {3728E3C4-5F83-4573-9054-941BF0267289} URL = http://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MALNJS

SearchScopes: HKCU - {3728E3C4-5F83-4573-9054-941BF0267289} URL =

BHO: Adobe Acrobat Create PDF Helper -> {AE7CD045-E861-484f-8273-0445EE161910} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\x64\AcroIEFavClient.dll (Adobe Systems Incorporated)

BHO: Adobe Acrobat Create PDF from Selection -> {F4971EE7-DAA0-4053-9964-665D8EE6A077} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\x64\AcroIEFavClient.dll (Adobe Systems Incorporated)

BHO-x32: Java Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO-x32: Adobe Acrobat Create PDF Helper -> {AE7CD045-E861-484f-8273-0445EE161910} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)

BHO-x32: Java Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

BHO-x32: Adobe Acrobat Create PDF from Selection -> {F4971EE7-DAA0-4053-9964-665D8EE6A077} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)

Toolbar: HKLM - Adobe Acrobat Create PDF Toolbar - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\x64\AcroIEFavClient.dll (Adobe Systems Incorporated)

Toolbar: HKLM-x32 - Adobe Acrobat Create PDF Toolbar - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)

Toolbar: HKCU - Adobe Acrobat Create PDF Toolbar - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\x64\AcroIEFavClient.dll (Adobe Systems Incorporated)

Toolbar: HKCU - No Name - {E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - No File

DPF: HKLM-x32 {4FF78044-96B4-4312-A5B7-FDA3CB328095}

DPF: HKLM-x32 {6A060448-60F9-11D5-A6CD-0002B31F7455}

Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)

Winsock: Catalog9 01 C:\WINDOWS\SysWOW64\plsapp.dll [354592] (Sendori)

Winsock: Catalog9 02 C:\WINDOWS\SysWOW64\plsapp.dll [354592] (Sendori)

Winsock: Catalog9 03 C:\WINDOWS\SysWOW64\plsapp.dll [354592] (Sendori)

Winsock: Catalog9 04 C:\WINDOWS\SysWOW64\plsapp.dll [354592] (Sendori)

Winsock: Catalog9 15 C:\WINDOWS\SysWOW64\plsapp.dll [354592] (Sendori)

Winsock: Catalog9-x64 01 C:\WINDOWS\system32\plsapp64.dll [439296] (Sendori)

Winsock: Catalog9-x64 02 C:\WINDOWS\system32\plsapp64.dll [439296] (Sendori)

Winsock: Catalog9-x64 03 C:\WINDOWS\system32\plsapp64.dll [439296] (Sendori)

Winsock: Catalog9-x64 04 C:\WINDOWS\system32\plsapp64.dll [439296] (Sendori)

Winsock: Catalog9-x64 15 C:\WINDOWS\system32\plsapp64.dll [439296] (Sendori)

Tcpip\Parameters: [DhcpNameServer] 65.32.5.111 65.32.5.112

FireFox:

========

FF ProfilePath: C:\Users\Amy\AppData\Roaming\Mozilla\Firefox\Profiles\fkjlsnsj.default

FF NewTab: about:newtab

FF DefaultSearchEngine: Conduit Search

FF SelectedSearchEngine: Conduit Search

FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_14_0_0_145.dll ()

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)

FF Plugin: adobe.com/AdobeAAMDetect_x86_64 -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect64.dll (Adobe Systems)

FF Plugin: adobe.com/AdobeExManDetect -> C:\Program Files (x86)\Adobe\Adobe Extension Manager CS6\Win64Plugin\npAdobeExManDetectX64.dll (Adobe Systems)

FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_14_0_0_145.dll ()

FF Plugin-x32: @exent.com/npExentControl,version=7.1.0.1 -> C:\Program Files (x86)\FreeRide Games\npExentControl.dll (Exent Technologies Ltd.)

FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 -> C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)

FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)

FF Plugin-x32: @java.com/DTPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)

FF Plugin-x32: @java.com/JavaPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3508.0205 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin-x32: @nexon.net/NxGame -> C:\ProgramData\NexonUS\NGM\npNxGameUS.dll (Nexon)

FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: Adobe Acrobat -> C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\Air\nppdf32.dll (Adobe Systems Inc.)

FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF Plugin-x32: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect32.dll (Adobe Systems)

FF Plugin-x32: adobe.com/AdobeExManDetect -> C:\Program Files (x86)\Adobe\Adobe Extension Manager CS6\npAdobeExManDetectX86.dll (Adobe Systems)

FF Plugin HKCU: @talk.google.com/GoogleTalkPlugin -> C:\Users\Amy\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll (Google)

FF Plugin HKCU: @talk.google.com/O1DPlugin -> C:\Users\Amy\AppData\Roaming\Mozilla\plugins\npo1d.dll (Google)

FF Plugin HKCU: @tools.google.com/Google Update;version=3 -> C:\Users\Amy\AppData\Local\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)

FF Plugin HKCU: @tools.google.com/Google Update;version=9 -> C:\Users\Amy\AppData\Local\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)

FF user.js: detected! => C:\Users\Amy\AppData\Roaming\Mozilla\Firefox\Profiles\fkjlsnsj.default\user.js

FF Plugin ProgramFiles/Appdata: C:\Users\Amy\AppData\Roaming\mozilla\plugins\npgoogletalk.dll (Google)

FF Plugin ProgramFiles/Appdata: C:\Users\Amy\AppData\Roaming\mozilla\plugins\npo1d.dll (Google)

FF SearchPlugin: C:\Users\Amy\AppData\Roaming\Mozilla\Firefox\Profiles\fkjlsnsj.default\searchplugins\askcom.xml

FF SearchPlugin: C:\Users\Amy\AppData\Roaming\Mozilla\Firefox\Profiles\fkjlsnsj.default\searchplugins\safeguard-secure-search.xml

FF Extension: appmarket- - C:\Users\Amy\AppData\Roaming\Mozilla\Firefox\Profiles\fkjlsnsj.default\Extensions\{64d64833-9296-421b-a362-83cfbd6291b6} [2013-12-12]

FF Extension: xVidly1 - C:\Users\Amy\AppData\Roaming\Mozilla\Firefox\Profiles\fkjlsnsj.default\Extensions\{8c58b088-1159-4ad9-a411-c7d3ae7edb28} [2013-07-12]

FF Extension: Firebug - C:\Users\Amy\AppData\Roaming\Mozilla\Firefox\Profiles\fkjlsnsj.default\Extensions\firebug@software.joehewitt.com.xpi [2013-03-07]

FF Extension: FreeHDSport.TV - C:\Users\Amy\AppData\Roaming\Mozilla\Firefox\Profiles\fkjlsnsj.default\Extensions\freehdsport@freehdsport.tv.xpi [2013-04-08]

FF HKLM-x32\...\Firefox\Extensions: [web2pdfextension@web2pdf.adobedotcom] - C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\Browser\WCFirefoxExtn

FF Extension: Adobe Acrobat - Create PDF - C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\Browser\WCFirefoxExtn [2013-12-29]

FF HKLM-x32\...\Firefox\Extensions: [fmconverter@gmail.com] - C:\Program Files (x86)\Freemake\Freemake Video Converter\BrowserPlugin\Firefox

FF Extension: Freemake Video Converter Plugin - C:\Program Files (x86)\Freemake\Freemake Video Converter\BrowserPlugin\Firefox [2014-01-11]

FF HKLM-x32\...\Thunderbird\Extensions: [msktbird@mcafee.com] - C:\Program Files\McAfee\MSK

Chrome:

=======

CHR HomePage: hxxp://search.conduit.com/?gd=&ctid=CT3326285&octid=EB_ORIGINAL_CTID&ISID=MA45B1311-13E2-448C-A758-89339C9A7B61&SearchSource=55&CUI=&UM=5&UP=SP39284524-52FF-4D6B-A549-EAC984F79BF6&SSPV=

CHR StartupUrls: "hxxp://currently.com/"

CHR NewTab: "chrome-extension://ojhmphdkpgbibohbnpbfiefkgieacjmh/index.html"

CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Amy\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-05-25]

CHR Extension: (xVidly1) - C:\Users\Amy\AppData\Local\Google\Chrome\User Data\Default\Extensions\dachbokeklmhlikpklnkmmealjdfanoh [2013-07-12]

CHR Extension: (Upromise RewardU Toolbar) - C:\Users\Amy\AppData\Local\Google\Chrome\User Data\Default\Extensions\ddpocmpoechljihmgemoaahhmadaenbc [2014-06-05]

CHR Extension: (Adobe Acrobat - Create PDF) - C:\Users\Amy\AppData\Local\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj [2013-12-29]

CHR Extension: (appmarket-) - C:\Users\Amy\AppData\Local\Google\Chrome\User Data\Default\Extensions\iekjmlcgpmcjigljdiagaibfjfaideal [2014-03-05]

CHR Extension: (Freemake Video Converter) - C:\Users\Amy\AppData\Local\Google\Chrome\User Data\Default\Extensions\jbolfgndggfhhpbnkgnpjkfhinclbigj [2014-01-17]

CHR Extension: (Google Wallet) - C:\Users\Amy\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-23]

CHR Extension: (Currently) - C:\Users\Amy\AppData\Local\Google\Chrome\User Data\Default\Extensions\ojhmphdkpgbibohbnpbfiefkgieacjmh [2014-03-09]

CHR HKCU\...\Chrome\Extension: [dachbokeklmhlikpklnkmmealjdfanoh] - C:\Users\Amy\AppData\Local\CRE\dachbokeklmhlikpklnkmmealjdfanoh.crx [2013-05-06]

CHR HKCU\...\Chrome\Extension: [iekjmlcgpmcjigljdiagaibfjfaideal] - C:\Users\Amy\AppData\Local\CRE\iekjmlcgpmcjigljdiagaibfjfaideal.crx [2013-10-29]

CHR HKCU\...\Chrome\Extension: [khdbjicdngoonodcjggkioffhjlpicbp] - C:\Users\Amy\AppData\Local\CRE\khdbjicdngoonodcjggkioffhjlpicbp.crx [2013-10-29]

CHR HKLM-x32\...\Chrome\Extension: [dachbokeklmhlikpklnkmmealjdfanoh] - C:\Users\Amy\AppData\Local\CRE\dachbokeklmhlikpklnkmmealjdfanoh.crx [2013-05-06]

CHR HKLM-x32\...\Chrome\Extension: [efaidnbmnnnibpcajpcglclefindmkaj] - C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\Browser\WCChromeExtn\WCChromeExtn.crx [2014-05-08]

CHR HKLM-x32\...\Chrome\Extension: [iekjmlcgpmcjigljdiagaibfjfaideal] - C:\Users\Amy\AppData\Local\CRE\iekjmlcgpmcjigljdiagaibfjfaideal.crx [2013-10-29]

CHR HKLM-x32\...\Chrome\Extension: [jbolfgndggfhhpbnkgnpjkfhinclbigj] - C:\Program Files (x86)\Freemake\Freemake Video Converter\BrowserPlugin\Chrome\Freemake.Plugin.Chrome.crx [2014-01-11]

CHR HKLM-x32\...\Chrome\Extension: [khdbjicdngoonodcjggkioffhjlpicbp] - C:\Users\Amy\AppData\Local\CRE\khdbjicdngoonodcjggkioffhjlpicbp.crx [2014-01-11]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 Freemake Improver; C:\ProgramData\Freemake\FreemakeUtilsService\FreemakeUtilsService.exe [101888 2013-12-09] (Freemake) [File not signed]

R2 Intel® ME Service; C:\Program Files (x86)\Intel\Intel® Management Engine Components\FWService\IntelMeFWService.exe [128896 2012-07-17] (Intel Corporation)

R2 jhi_service; C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe [165760 2012-07-17] (Intel Corporation)

S3 LSCWinService; C:\Program Files\Lenovo\Lenovo Solution Center\App\LSCWinService.exe [1663880 2014-05-06] ()

R2 plsapp; C:\Program Files (x86)\PureLeads\plsapp.exe [3690784 2014-01-23] (Sendori)

R2 PlsvcV1; C:\Program Files (x86)\PureLeads\PureLeadsSvc.exe [91936 2014-01-23] (PureLeads)

S2 PlsvcV2; C:\Program Files (x86)\PureLeads\PureLeads.Service.exe [24352 2014-01-23] (sendori)

S3 SwitchBoard; C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated) [File not signed]

R2 UDisk Monitor; C:\Program Files (x86)\Froyo_Android_Driver\Bin\MonServiceUDisk.exe [512000 2011-05-12] () [File not signed]

R3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [347880 2014-03-23] (Microsoft Corporation)

R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23824 2014-03-23] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R3 BCM43XX; C:\Windows\system32\DRIVERS\bcmwl63a.sys [8536752 2013-07-01] (Broadcom Corporation)

R0 PxHlpa64; C:\Windows\System32\Drivers\PxHlpa64.sys [56336 2012-06-22] (Corel Corporation)

R3 SPUVCbv; C:\Windows\System32\Drivers\SPUVCbv_x64.sys [1059064 2012-08-24] (Sunplus)

R3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [123224 2014-03-23] (Microsoft Corporation)

S3 wsvd; C:\Windows\system32\DRIVERS\wsvd.sys [102376 2012-06-13] ("CyberLink)

R2 X5XSEx_Pr148; C:\Program Files (x86)\FreeRide Games\X5XSEx_Pr148.Sys [56136 2012-08-02] (Exent Technologies Ltd.)

S3 AndNetDiag; \SystemRoot\system32\DRIVERS\lgandnetdiag64.sys [X]

S3 ANDNetModem; \SystemRoot\system32\DRIVERS\lgandnetmodem64.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)

==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-08-15 18:18 - 2014-08-15 18:20 - 00025722 ____C () C:\Users\Amy\Downloads\FRST.txt

2014-08-15 18:17 - 2014-08-15 18:19 - 00000000 ___DC () C:\FRST

2014-08-15 18:17 - 2014-08-15 18:17 - 02100224 ____C (Farbar) C:\Users\Amy\Downloads\FRST64.exe

2014-08-15 18:11 - 2014-08-15 18:12 - 00688992 ____C (Swearware) C:\Users\Amy\Downloads\dds.scr

2014-08-13 22:38 - 2014-08-13 22:40 - 00018397 ____C () C:\WINDOWS\DirectX.log

2014-08-13 22:38 - 2014-08-13 22:38 - 00001293 ____C () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Edge Animate CC 2014.lnk

2014-08-13 22:37 - 2014-08-13 22:37 - 00050012 ____C () C:\Users\Amy\Downloads\test (1).tif

2014-08-13 22:28 - 2014-08-13 22:28 - 00000000 ___DC () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java

2014-08-13 22:28 - 2014-07-25 12:55 - 00098216 ____C (Oracle Corporation) C:\WINDOWS\SysWOW64\WindowsAccessBridge-32.dll

2014-08-13 22:28 - 2014-07-25 12:49 - 00272808 ____C (Oracle Corporation) C:\WINDOWS\SysWOW64\javaws.exe

2014-08-13 22:28 - 2014-07-25 12:49 - 00175528 ____C (Oracle Corporation) C:\WINDOWS\SysWOW64\javaw.exe

2014-08-13 22:28 - 2014-07-25 12:49 - 00175528 ____C (Oracle Corporation) C:\WINDOWS\SysWOW64\java.exe

2014-08-13 22:27 - 2014-08-13 22:28 - 00004162 ____C () C:\WINDOWS\SysWOW64\jupdate-1.7.0_67-b01.log

2014-08-13 22:23 - 2014-08-13 22:23 - 00918440 ____C (Oracle Corporation) C:\Users\Amy\Downloads\chromeinstall-7u67.exe

2014-08-13 22:21 - 2014-08-13 22:21 - 00000000 ___DC () C:\Users\Amy\AppData\Roaming\Oracle

2014-08-13 22:02 - 2014-08-13 22:02 - 00050012 ____C () C:\Users\Amy\Downloads\test.tif

2014-08-11 19:32 - 2014-08-11 19:37 - 17292760 ____C (Malwarebytes Corporation ) C:\Users\Amy\Downloads\mbam-setup-2.0.2.1012.exe

2014-08-07 23:19 - 2014-08-07 23:19 - 00023709 ____C () C:\Users\Amy\Downloads\dhg-Skeleton-7ab6820 (1).tar.gz

2014-08-05 22:32 - 2014-08-05 22:32 - 00023709 ____C () C:\Users\Amy\Downloads\dhg-Skeleton-7ab6820.tar.gz

2014-08-05 22:32 - 2014-08-05 22:32 - 00007916 ____C () C:\Users\Amy\Downloads\CSS_onlyLoading.html

2014-08-05 22:32 - 2014-08-05 22:32 - 00005995 ____C () C:\Users\Amy\Downloads\Skeleton-Grid.psd.zip

2014-08-05 22:32 - 2014-08-05 22:32 - 00003778 ____C () C:\Users\Amy\Downloads\CSS_onlyBounceZoomSlideshow.html

2014-08-03 17:55 - 2014-08-03 17:55 - 00001270 ____C () C:\Users\Amy\Downloads\test1.php

2014-08-03 12:41 - 2014-08-13 22:51 - 00013872 ____C () C:\WINDOWS\PFRO.log

2014-07-29 22:35 - 2014-08-15 17:42 - 00006232 ____C () C:\WINDOWS\setupact.log

2014-07-29 22:35 - 2014-07-29 22:35 - 00000000 ____C () C:\WINDOWS\setuperr.log

2014-07-29 18:26 - 2014-07-29 18:26 - 00000816 ____C () C:\Users\Amy\Downloads\proPlayerForm_data (1).fdf

2014-07-29 18:24 - 2014-07-29 18:24 - 00000816 ____C () C:\Users\Amy\Downloads\proPlayerForm_data.fdf

2014-07-25 17:54 - 2014-07-25 17:54 - 00001340 ____C () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Creative Cloud.lnk

2014-07-25 17:54 - 2014-07-25 17:54 - 00001328 ____C () C:\Users\Public\Desktop\Adobe Creative Cloud.lnk

2014-07-23 12:19 - 2014-07-23 12:19 - 00001868 ____C () C:\Users\Public\Desktop\QuickTime Player.lnk

2014-07-23 12:19 - 2014-07-23 12:19 - 00000000 ___DC () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime

2014-07-23 12:18 - 2014-07-23 12:19 - 00000000 ___DC () C:\Program Files (x86)\QuickTime

2014-07-22 18:34 - 2014-07-22 18:34 - 00025592 ____C () C:\Users\Amy\Downloads\covered_by_your_grace.zip

2014-07-22 18:23 - 2014-07-22 18:23 - 00001124 ____C () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Content Viewer.lnk

2014-07-20 16:00 - 2014-07-20 16:00 - 00000000 ___DC () C:\Users\Amy\Documents\Bible Study

2014-07-19 16:44 - 2014-07-20 19:31 - 00000034 ____C () C:\Users\Amy\AppData\Roaming\AdobeWLCMCache.dat

2014-07-16 21:13 - 2014-07-16 21:13 - 00007626 ____C () C:\Users\Amy\Downloads\RWST.css

2014-07-16 21:12 - 2014-07-16 21:12 - 00005308 ____C () C:\Users\Amy\Downloads\events.php

2014-07-16 20:10 - 2014-07-17 19:32 - 14418017 ____C () C:\Users\Amy\Downloads\rwstFlyer (1).psd

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-08-15 18:20 - 2014-08-15 18:18 - 00025722 ____C () C:\Users\Amy\Downloads\FRST.txt

2014-08-15 18:19 - 2014-08-15 18:17 - 00000000 ___DC () C:\FRST

2014-08-15 18:17 - 2014-08-15 18:17 - 02100224 ____C (Farbar) C:\Users\Amy\Downloads\FRST64.exe

2014-08-15 18:15 - 2014-07-13 17:17 - 01615487 ____C () C:\WINDOWS\WindowsUpdate.log

2014-08-15 18:12 - 2014-08-15 18:11 - 00688992 ____C (Swearware) C:\Users\Amy\Downloads\dds.scr

2014-08-15 18:09 - 2013-08-22 11:36 - 00000000 ___DC () C:\WINDOWS\AppReadiness

2014-08-15 18:09 - 2012-12-16 16:35 - 00000000 ___DC () C:\Users\Amy\AppData\Local\Adobe

2014-08-15 18:08 - 2013-12-09 21:03 - 00003898 _____ () C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{7A6E0A37-13D4-425B-9D12-7D475E75E096}

2014-08-15 18:07 - 2012-12-16 16:56 - 00000900 ____C () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job

2014-08-15 18:02 - 2013-08-22 11:36 - 00000000 ___DC () C:\WINDOWS\system32\sru

2014-08-15 17:42 - 2014-07-29 22:35 - 00006232 ____C () C:\WINDOWS\setupact.log

2014-08-15 00:24 - 2013-03-14 18:42 - 00000830 ____C () C:\WINDOWS\Tasks\Adobe Flash Player Updater.job

2014-08-14 20:00 - 2014-05-20 18:41 - 00000000 ___DC () C:\Users\Amy\AppData\Roaming\LSC

2014-08-13 22:58 - 2012-12-16 16:39 - 00003596 _____ () C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-3948811954-352045940-1238658349-1001

2014-08-13 22:57 - 2014-02-14 21:59 - 00002214 ____C () C:\Users\Public\Desktop\Google Chrome.lnk

2014-08-13 22:56 - 2012-12-16 16:56 - 00000896 ____C () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job

2014-08-13 22:52 - 2013-08-22 10:45 - 00000006 ___HC () C:\WINDOWS\Tasks\SA.DAT

2014-08-13 22:51 - 2014-08-03 12:41 - 00013872 ____C () C:\WINDOWS\PFRO.log

2014-08-13 22:51 - 2013-08-22 09:25 - 00524288 ___SH () C:\WINDOWS\system32\config\BBI

2014-08-13 22:40 - 2014-08-13 22:38 - 00018397 ____C () C:\WINDOWS\DirectX.log

2014-08-13 22:38 - 2014-08-13 22:38 - 00001293 ____C () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Edge Animate CC 2014.lnk

2014-08-13 22:38 - 2012-10-20 21:07 - 00000000 ___DC () C:\Program Files (x86)\Adobe

2014-08-13 22:37 - 2014-08-13 22:37 - 00050012 ____C () C:\Users\Amy\Downloads\test (1).tif

2014-08-13 22:28 - 2014-08-13 22:28 - 00000000 ___DC () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java

2014-08-13 22:28 - 2014-08-13 22:27 - 00004162 ____C () C:\WINDOWS\SysWOW64\jupdate-1.7.0_67-b01.log

2014-08-13 22:28 - 2013-11-08 20:08 - 00000000 ___DC () C:\ProgramData\Oracle

2014-08-13 22:28 - 2013-04-07 19:26 - 00000000 ___DC () C:\Program Files (x86)\Java

2014-08-13 22:23 - 2014-08-13 22:23 - 00918440 ____C (Oracle Corporation) C:\Users\Amy\Downloads\chromeinstall-7u67.exe

2014-08-13 22:21 - 2014-08-13 22:21 - 00000000 ___DC () C:\Users\Amy\AppData\Roaming\Oracle

2014-08-13 22:13 - 2012-10-20 20:49 - 00000000 __HDC () C:\Program Files (x86)\InstallShield Installation Information

2014-08-13 22:02 - 2014-08-13 22:02 - 00050012 ____C () C:\Users\Amy\Downloads\test.tif

2014-08-12 21:35 - 2013-08-22 11:36 - 00000000 ___DC () C:\WINDOWS\PLA

2014-08-12 21:31 - 2012-10-20 21:09 - 00000000 ___DC () C:\Program Files (x86)\Amazon

2014-08-11 21:21 - 2014-05-05 19:14 - 00122584 ____C (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys

2014-08-11 19:46 - 2014-05-05 19:14 - 00001125 ____C () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2014-08-11 19:46 - 2014-05-05 19:14 - 00000000 ___DC () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2014-08-11 19:46 - 2014-05-05 19:14 - 00000000 ___DC () C:\Program Files (x86)\Malwarebytes Anti-Malware

2014-08-11 19:37 - 2014-08-11 19:32 - 17292760 ____C (Malwarebytes Corporation ) C:\Users\Amy\Downloads\mbam-setup-2.0.2.1012.exe

2014-08-10 17:54 - 2012-12-30 18:13 - 00000000 ___DC () C:\Users\Amy\Teaching

2014-08-10 17:23 - 2012-12-21 23:46 - 02176000 __SHC () C:\Users\Amy\Downloads\Thumbs.db

2014-08-10 17:22 - 2013-12-07 21:30 - 00000000 ___DC () C:\Users\Amy

2014-08-09 00:14 - 2013-03-27 08:30 - 00000000 ___DC () C:\Users\Amy\AppData\Local\WeatherBug

2014-08-07 23:19 - 2014-08-07 23:19 - 00023709 ____C () C:\Users\Amy\Downloads\dhg-Skeleton-7ab6820 (1).tar.gz

2014-08-07 22:19 - 2013-01-09 01:03 - 00001456 ____C () C:\Users\Amy\AppData\Local\Adobe Save for Web 13.0 Prefs

2014-08-05 22:32 - 2014-08-05 22:32 - 00023709 ____C () C:\Users\Amy\Downloads\dhg-Skeleton-7ab6820.tar.gz

2014-08-05 22:32 - 2014-08-05 22:32 - 00007916 ____C () C:\Users\Amy\Downloads\CSS_onlyLoading.html

2014-08-05 22:32 - 2014-08-05 22:32 - 00005995 ____C () C:\Users\Amy\Downloads\Skeleton-Grid.psd.zip

2014-08-05 22:32 - 2014-08-05 22:32 - 00003778 ____C () C:\Users\Amy\Downloads\CSS_onlyBounceZoomSlideshow.html

2014-08-03 17:55 - 2014-08-03 17:55 - 00001270 ____C () C:\Users\Amy\Downloads\test1.php

2014-08-03 14:20 - 2013-07-28 15:41 - 00000000 ___DC () C:\Users\Amy\Documents\Adobe

2014-08-03 12:43 - 2013-03-17 10:47 - 00089600 __SHC () C:\Users\Amy\Desktop\Thumbs.db

2014-08-03 12:41 - 2014-02-09 21:14 - 00000000 ___DC () C:\Program Files\Microsoft Silverlight

2014-08-03 12:41 - 2014-02-09 21:14 - 00000000 ___DC () C:\Program Files (x86)\Microsoft Silverlight

2014-08-01 21:29 - 2013-11-30 21:59 - 00007623 ____C () C:\Users\Amy\AppData\Local\resmon.resmoncfg

2014-07-30 19:53 - 2013-12-19 17:36 - 00000000 ___DC () C:\Users\Amy\Documents\eryn

2014-07-29 22:35 - 2014-07-29 22:35 - 00000000 ____C () C:\WINDOWS\setuperr.log

2014-07-29 18:26 - 2014-07-29 18:26 - 00000816 ____C () C:\Users\Amy\Downloads\proPlayerForm_data (1).fdf

2014-07-29 18:24 - 2014-07-29 18:24 - 00000816 ____C () C:\Users\Amy\Downloads\proPlayerForm_data.fdf

2014-07-29 18:24 - 2014-02-27 11:26 - 00000000 ___DC () C:\Users\Amy\AppData\Roaming\Spotify

2014-07-29 12:30 - 2014-02-27 11:26 - 00000000 ___DC () C:\Users\Amy\AppData\Local\Spotify

2014-07-25 22:01 - 2014-02-09 21:15 - 00000000 ___DC () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight

2014-07-25 17:54 - 2014-07-25 17:54 - 00001340 ____C () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Creative Cloud.lnk

2014-07-25 17:54 - 2014-07-25 17:54 - 00001328 ____C () C:\Users\Public\Desktop\Adobe Creative Cloud.lnk

2014-07-25 12:55 - 2014-08-13 22:28 - 00098216 ____C (Oracle Corporation) C:\WINDOWS\SysWOW64\WindowsAccessBridge-32.dll

2014-07-25 12:49 - 2014-08-13 22:28 - 00272808 ____C (Oracle Corporation) C:\WINDOWS\SysWOW64\javaws.exe

2014-07-25 12:49 - 2014-08-13 22:28 - 00175528 ____C (Oracle Corporation) C:\WINDOWS\SysWOW64\javaw.exe

2014-07-25 12:49 - 2014-08-13 22:28 - 00175528 ____C (Oracle Corporation) C:\WINDOWS\SysWOW64\java.exe

2014-07-23 23:30 - 2012-12-30 18:13 - 00000000 ___DC () C:\Users\Amy\Resumes

2014-07-23 21:43 - 2013-08-22 10:44 - 05245592 ____C () C:\WINDOWS\system32\FNTCACHE.DAT

2014-07-23 12:19 - 2014-07-23 12:19 - 00001868 ____C () C:\Users\Public\Desktop\QuickTime Player.lnk

2014-07-23 12:19 - 2014-07-23 12:19 - 00000000 ___DC () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime

2014-07-23 12:19 - 2014-07-23 12:18 - 00000000 ___DC () C:\Program Files (x86)\QuickTime

2014-07-22 18:34 - 2014-07-22 18:34 - 00025592 ____C () C:\Users\Amy\Downloads\covered_by_your_grace.zip

2014-07-22 18:23 - 2014-07-22 18:23 - 00001124 ____C () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Content Viewer.lnk

2014-07-21 19:56 - 2013-09-30 00:04 - 00863592 ____C () C:\WINDOWS\system32\PerfStringBackup.INI

2014-07-20 19:31 - 2014-07-19 16:44 - 00000034 ____C () C:\Users\Amy\AppData\Roaming\AdobeWLCMCache.dat

2014-07-20 16:00 - 2014-07-20 16:00 - 00000000 ___DC () C:\Users\Amy\Documents\Bible Study

2014-07-20 13:30 - 2012-12-30 18:03 - 00000000 ___DC () C:\Users\Amy\Finances

2014-07-17 19:32 - 2014-07-16 20:10 - 14418017 ____C () C:\Users\Amy\Downloads\rwstFlyer (1).psd

2014-07-16 21:13 - 2014-07-16 21:13 - 00007626 ____C () C:\Users\Amy\Downloads\RWST.css

2014-07-16 21:12 - 2014-07-16 21:12 - 00005308 ____C () C:\Users\Amy\Downloads\events.php

Some content of TEMP:

====================

C:\Users\Amy\AppData\Local\Temp\jre-7u67-windows-i586-iftw.exe

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed

C:\Windows\System32\wininit.exe => File is digitally signed

C:\Windows\explorer.exe => File is digitally signed

C:\Windows\SysWOW64\explorer.exe => File is digitally signed

C:\Windows\System32\svchost.exe => File is digitally signed

C:\Windows\SysWOW64\svchost.exe => File is digitally signed

C:\Windows\System32\services.exe => File is digitally signed

C:\Windows\System32\User32.dll => File is digitally signed

C:\Windows\SysWOW64\User32.dll => File is digitally signed

C:\Windows\System32\userinit.exe => File is digitally signed

C:\Windows\SysWOW64\userinit.exe => File is digitally signed

C:\Windows\System32\rpcss.dll => File is digitally signed

C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2014-08-07 23:04

==================== End Of Log ============================

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 15-08-2014

Ran by Amy at 2014-08-15 18:21:15

Running from C:\Users\Amy\Downloads

Boot Mode: Normal

==========================================================

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Adobe Acrobat XI Pro (HKLM-x32\...\{AC76BA86-1033-FFFF-7760-000000000006}) (Version: 11.0.07 - Adobe Systems)

Adobe After Effects CC 2014 (HKLM-x32\...\{2B22C750-5C3B-4738-B621-BA786AC7A494}) (Version: 13.0.2 - Adobe Systems Incorporated)

Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 14.0.0.178 - Adobe Systems Incorporated)

Adobe AIR (x32 Version: 14.0.0.178 - Adobe Systems Incorporated) Hidden

Adobe Audition CC 2014 (HKLM-x32\...\{F3388E10-EFA9-4A80-B28E-2E647F8D00C4}) (Version: 7.0.1 - Adobe Systems Incorporated)

Adobe Creative Cloud (HKLM-x32\...\Adobe Creative Cloud) (Version: 2.7.1.418 - Adobe Systems Incorporated)

Adobe Dreamweaver CC 2014 (HKLM-x32\...\{766255CE-D156-11E3-8DBC-A136EB52ACCF}) (Version: 14.0.0 - Adobe Systems Incorporated)

Adobe Edge Animate CC 2014 (HKLM-x32\...\{F1BFBED6-2779-4A4D-B401-5C08F813B0F2}) (Version: 4.0 - Adobe Systems Incorporated)

Adobe Edge Reflow CC Preview (HKLM\...\{AC41E46F-969F-439B-84C9-D5DA8C783E9D}) (Version: 0.32.13658 - Adobe Systems Incorporated)

Adobe Flash Player 14 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 14.0.0.145 - Adobe Systems Incorporated)

Adobe Flash Professional CC 2014 (HKLM-x32\...\{AA704223-E11C-11E3-8A38-C09A633B72AF}) (Version: 14.0.1 - Adobe Systems Incorporated)

Adobe Illustrator CC 2014 (HKLM-x32\...\{2B4B4082-8043-4646-8334-B0A29E641211}) (Version: 18.0 - Adobe Systems Incorporated)

Adobe InDesign CC 2014 (HKLM-x32\...\{CCDCB9C4-72BA-1014-A3F8-D123F2F18BC2}) (Version: 10.0 - Adobe Systems Incorporated)

Adobe Media Encoder CC 2014 (HKLM-x32\...\{663DEEEF-EF34-4DCB-8687-73A7AA146E02}) (Version: 8.0.1 - Adobe Systems Incorporated)

Adobe Photoshop CC 2014 (HKLM-x32\...\{D7A4F897-B20A-42D0-862D-CB5F6DB7391D}) (Version: 15.1 - Adobe Systems Incorporated)

Adobe Photoshop Lightroom 4.1 64-bit (HKLM\...\{F7ADB493-B913-4D61-9A63-DA736C20C3F2}) (Version: 4.1.2 - Adobe)

Adobe Photoshop Lightroom 5.5 64-bit (HKLM\...\{19BBD0F3-7A31-480D-8A23-19AE28035E9C}) (Version: 5.5.0 - Adobe Systems Incorporated)

Adobe Prelude CC 2014 (HKLM-x32\...\{2A054E48-0A75-42BD-8738-EC9AB4E2207A}) (Version: 3.0.1 - Adobe Systems Incorporated)

Adobe Premiere Pro CC 2014 (HKLM-x32\...\{07BE616F-9E42-4C90-AF4F-0F32A5B088E7}) (Version: 8.0.1 - Adobe Systems Incorporated)

Adobe Reader XI (11.0.08) (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AB0000000001}) (Version: 11.0.08 - Adobe Systems Incorporated)

Adobe SpeedGrade CC 2014 (HKLM-x32\...\{8EFF28F0-9DFD-4208-9E04-4D49A4812CF3}) (Version: 8.0.1 - Adobe Systems Incorporated)

Adobe® Content Viewer (HKLM-x32\...\com.adobe.dmp.contentviewer) (Version: 3.4.3 - Adobe Systems, Incorporated)

Adobe® Content Viewer (x32 Version: 3.4.3 - Adobe Systems, Incorporated) Hidden

Apple Application Support (HKLM-x32\...\{46F044A5-CE8B-4196-984E-5BD6525E361D}) (Version: 2.3.6 - Apple Inc.)

bl (x32 Version: 1.0.0 - Your Company Name) Hidden

Broadcom 802.11 Network Adapter (HKLM\...\Broadcom 802.11 Network Adapter) (Version: 6.30.59.20 - Broadcom Corporation)

CCleaner (HKLM\...\CCleaner) (Version: 4.14 - Piriform)

ETDWare PS/2-X64 11.4.4.2_WHQL (HKLM\...\Elantech) (Version: 11.4.4.2 - ELAN Microelectronic Corp.)

GitHub (HKCU\...\5f7eb300e2ea4ebf) (Version: 1.2.3.0 - GitHub, Inc.)

Google Chrome (HKLM-x32\...\Google Chrome) (Version: 36.0.1985.143 - Google Inc.)

Google Talk Plugin (HKLM-x32\...\{C1E3DFE7-4EAD-3E9E-A826-E06055BA5921}) (Version: 5.4.2.18903 - Google)

Google Update Helper (x32 Version: 1.3.24.15 - Google Inc.) Hidden

GoToMeeting 5.5.0.1132 (HKCU\...\GoToMeeting) (Version: 5.5.0.1132 - CitrixOnline)

Intel® Trusted Connect Service Client (Version: 1.24.388.1 - Intel Corporation) Hidden

Java Auto Updater (x32 Version: 2.1.67.1 - Oracle, Inc.) Hidden

Lenovo OneKey Recovery (Version: 8.0.0.0710 - CyberLink Corp.) Hidden

Lenovo Solution Center (HKLM\...\{2F45A217-E9C7-4984-B0AC-5BE31FF4712B}) (Version: 2.4.003.00 - Lenovo Group Limited)

LG PC Suite (HKLM-x32\...\LG PC Suite) (Version: 5.3.16.20140414 - LG Electronics)

LG United Mobile Drivers (HKLM-x32\...\{55031CEF-CE75-4A5C-8DEA-60577820529B}) (Version: 3.10.1.0 - LG Electronics)

Malwarebytes Anti-Malware version 2.0.2.1012 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.2.1012 - Malwarebytes Corporation)

Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden

Microsoft Mouse and Keyboard Center (HKLM\...\Microsoft Mouse and Keyboard Center) (Version: 2.3.188.0 - Microsoft Corporation)

Microsoft Mouse and Keyboard Center (Version: 2.3.188.0 - Microsoft Corporation) Hidden

Microsoft Office File Validation Add-In (HKLM-x32\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)

Microsoft Office Office 64-bit Components 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Professional Plus 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Shared 64-bit MUI (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)

Microsoft SkyDrive (HKCU\...\SkyDriveSetup.exe) (Version: 16.4.6013.0910 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710F4C1C-CC18-4C49-8CBF-51240C89A1A2}) (Version: - )

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052B-02A4-4627-81F2-1818DA5D550D}) (Version: - )

Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: - )

Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)

Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)

Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.61030 (Version: 11.0.61030 - Microsoft Corporation) Hidden

Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.61030 (Version: 11.0.61030 - Microsoft Corporation) Hidden

Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030 (x32 Version: 11.0.61030 - Microsoft Corporation) Hidden

Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030 (x32 Version: 11.0.61030 - Microsoft Corporation) Hidden

Mozilla Firefox 27.0.1 (x86 en-US) (HKLM-x32\...\Mozilla Firefox 27.0.1 (x86 en-US)) (Version: 27.0.1 - Mozilla)

Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 27.0.1 - Mozilla)

MSVCRT110_amd64 (Version: 16.4.1109.0912 - Microsoft) Hidden

ph (x32 Version: 1.0.0 - Your Company Name) Hidden

QuickTime 7 (HKLM-x32\...\{111EE7DF-FC45-40C7-98A7-753AC46B12FB}) (Version: 7.75.80.95 - Apple Inc.)

Shared C Run-time for x64 (HKLM\...\{EF79C448-6946-4D71-8134-03407888C054}) (Version: 10.0.0 - McAfee)

Spotify (HKCU\...\Spotify) (Version: 0.9.11.27.g2b1a638c - Spotify AB)

Upromise RewardU Toolbar (HKCU\...\Upromise RewardU Toolbar) (Version: - Upromise.com)

Windows Driver Package - Lenovo (ACPIVPC) System (06/15/2012 8.1.0.1) (HKLM\...\71BC3FD63F450BA0A957AAECBDB4A000C4F2BE42) (Version: 06/15/2012 8.1.0.1 - Lenovo)

Windows Driver Package - Lenovo (WUDFRd) LenovoVhid (06/19/2012 10.13.29.733) (HKLM\...\8A223E56FB1ED4F697B54E5BF96F1EB63B512684) (Version: 06/19/2012 10.13.29.733 - Lenovo)

Windows Live MIME IFilter (Version: 16.4.3508.0205 - Microsoft Corporation) Hidden

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-3948811954-352045940-1238658349-1001_Classes\CLSID\{84B5A313-CD5D-4904-8BA2-AFDC81C1B309}\InprocServer32 -> C:\Program Files (x86)\Citrix\GoToMeeting\1132\G2MOutlookAddin64.dll (Citrix Online, a division of Citrix Systems, Inc.)

CustomCLSID: HKU\S-1-5-21-3948811954-352045940-1238658349-1001_Classes\CLSID\{90B3DFBF-AF6A-4EA0-8899-F332194690F8}\InprocServer32 -> C:\Users\Amy\AppData\Local\Google\Update\1.3.24.15\psuser_64.dll (Google Inc.)

CustomCLSID: HKU\S-1-5-21-3948811954-352045940-1238658349-1001_Classes\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}\InprocServer32 -> C:\Users\Amy\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64\SkyDriveShell64.dll (Microsoft Corporation)

CustomCLSID: HKU\S-1-5-21-3948811954-352045940-1238658349-1001_Classes\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}\InprocServer32 -> C:\Users\Amy\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64\SkyDriveShell64.dll (Microsoft Corporation)

CustomCLSID: HKU\S-1-5-21-3948811954-352045940-1238658349-1001_Classes\CLSID\{E8CF3E55-F919-49D9-ABC0-948E6CB34B9F}\InprocServer32 -> C:\Users\Amy\AppData\Local\Google\Update\1.3.24.15\psuser_64.dll (Google Inc.)

CustomCLSID: HKU\S-1-5-21-3948811954-352045940-1238658349-1001_Classes\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}\InprocServer32 -> C:\Users\Amy\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64\SkyDriveShell64.dll (Microsoft Corporation)

CustomCLSID: HKU\S-1-5-21-3948811954-352045940-1238658349-1001_Classes\CLSID\{F8071786-1FD0-4A66-81A1-3CBE29274458}\InprocServer32 -> C:\Users\Amy\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64\FileSyncApi64.dll (Microsoft Corporation)

==================== Restore Points =========================

09-08-2014 00:29:22 Scheduled Checkpoint

14-08-2014 02:26:41 Installed Java 7 Update 67

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2013-08-22 09:25 - 2013-08-22 09:25 - 00000824 ___AC C:\WINDOWS\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {05293577-D647-4185-B859-C94839A0B2E3} - System32\Tasks\Microsoft\Windows\SettingSync\NetworkStateChangeTask

Task: {055FF4B1-98F1-4B9F-85B0-D505A957FC3F} - System32\Tasks\Microsoft\Windows\DiskFootprint\Diagnostics

Task: {073EC780-9890-4BF0-977C-51BD02FF3168} - System32\Tasks\Microsoft_Hardware_Launch_itype_exe => c:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe [2014-03-19] (Microsoft Corporation)

Task: {0B545118-B563-42FC-8D07-B78F602FCF34} - System32\Tasks\Microsoft\Windows\WS\WSRefreshBannedAppsListTask => Rundll32.exe WSClient.dll,RefreshBannedAppsList

Task: {1C0C8D7C-318D-43CB-B668-F957A2770E36} - System32\Tasks\AdobeAAMUpdater-1.0-MicrosoftAccount-amyldonohue@hotmail.com => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2014-02-27] (Adobe Systems Incorporated)

Task: {2085BF56-520D-4951-B7C0-DF34AF90CC6A} - System32\Tasks\Microsoft\Windows\Sysmain\WsSwapAssessmentTask => Rundll32.exe sysmain.dll,PfSvWsSwapAssessmentTask

Task: {22B65D29-672D-473C-AA30-C74D2BF0F9D1} - System32\Tasks\Microsoft\Windows\DiskCleanup\SilentCleanup => C:\Windows\system32\cleanmgr.exe [2014-02-22] (Microsoft Corporation)

Task: {2849F956-5B91-4D62-B6F6-16C151F1EA24} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-12-16] (Google Inc.)

Task: {2C9C0C6C-2A74-46F2-858A-4389D253EAD0} - System32\Tasks\Microsoft\Windows\Sysmain\HybridDriveCachePrepopulate

Task: {33CF7934-4DEB-4D7C-A437-6ADA2C690CE0} - System32\Tasks\Microsoft_MKC_Logon_Task_itype.exe => c:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe [2014-03-19] (Microsoft Corporation)

Task: {352E6CA0-7314-4DF4-89C4-682368D80D57} - System32\Tasks\Microsoft\Windows\Workplace Join\Automatic-Workplace-Join => C:\Windows\System32\AutoWorkplace.exe [2013-08-22] (Microsoft Corporation)

Task: {39AD63E1-FD81-435C-B150-DD974096D346} - System32\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start With Network => Sc.exe start wuauserv

Task: {3B6D8A73-F20B-4C93-B8FB-56A154F172D2} - System32\Tasks\Microsoft\Windows\Time Zone\SynchronizeTimeZone => C:\Windows\system32\tzsync.exe [2013-08-22] (Microsoft Corporation)

Task: {49754026-21E1-41FC-94FD-727AFE414FE7} - System32\Tasks\Microsoft\Windows\Sysmain\HybridDriveCacheRebalance

Task: {55687480-89CE-45A3-9A7A-66884B4CFFAA} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\WINDOWS\system32\MRT.exe [2014-07-13] (Microsoft Corporation)

Task: {562928BD-2B5D-4DFE-866F-1C24D61A2FFF} - System32\Tasks\Lenovo\Lenovo Customer Feedback Program => C:\Program Files\Lenovo\Customer Feedback Program\Lenovo.TVT.CustomerFeedback.Agent.exe [2014-05-06] (Lenovo)

Task: {5E9F2D86-E6CC-4B03-9E2D-C35A80919908} - System32\Tasks\Microsoft_MKC_Logon_Task_ipoint.exe => c:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [2014-03-19] (Microsoft Corporation)

Task: {6AA91E8C-DDBD-4979-8464-4062F7681A19} - System32\Tasks\Microsoft\Windows\Plug and Play\Plug and Play Cleanup

Task: {6DFCB649-0769-4F83-BB10-F60F235F6D3D} - System32\Tasks\Microsoft\Windows\SkyDrive\Idle Sync Maintenance Task

Task: {73B1B253-CE67-4501-AE1A-377DD1D68B65} - System32\Tasks\Microsoft\Windows\Application Experience\StartupAppTask => Rundll32.exe Startupscan.dll,SusRunTask

Task: {77F1D869-6E65-4079-A2A0-E2023408EF97} - System32\Tasks\Microsoft\Windows\ApplicationData\CleanupTemporaryState => Rundll32.exe Windows.Storage.ApplicationData.dll,CleanupTemporaryState

Task: {791E77D4-94CF-4384-A004-6E6705A3011E} - System32\Tasks\Microsoft_Hardware_Launch_ipoint_exe => c:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [2014-03-19] (Microsoft Corporation)

Task: {798C48A8-6488-4200-8840-7D8F1CADA80E} - System32\Tasks\Lenovo\LSC\LSCHardwareScanPostpone => C:\Program Files\Lenovo\Lenovo Solution Center\LSC.exe [2014-05-06] ()

Task: {7DD698BC-151A-463E-AAC2-3B0C22FE7C88} - System32\Tasks\Microsoft\Windows\PLA\LSC Memory => Rundll32.exe C:\WINDOWS\system32\pla.dll,PlaHost "LSC Memory" "$(Arg0)"

Task: {872D0E53-FD2E-41E3-B431-698AF82882CE} - System32\Tasks\Microsoft\Windows\SkyDrive\Routine Maintenance Task

Task: {8CC813C9-712A-41EF-9512-B233444FC669} - System32\Tasks\Microsoft\Windows\AppxDeploymentClient\Pre-staged app cleanup => Rundll32.exe %windir%\system32\AppxDeploymentClient.dll,AppxPreStageCleanupRunTask

Task: {975F7E55-614D-4E0B-A720-F76E20BE4CBE} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-12-16] (Google Inc.)

Task: {9AF203C9-BFCB-4E6C-A61E-3F29BD56B73B} - System32\Tasks\Lenovo\Lenovo Solution Center Launcher => C:\Program Files\lenovo\lenovo solution center\App\LSCService.exe [2014-05-06] (Lenovo)

Task: {9E9F84B2-B7A3-4FD0-BDAB-1BD9D8BBEFD3} - System32\Tasks\OFFICE2010ACT => C:\ProgramData\Microsoft\Windows\OFFICEICON.vbs [2012-03-08] ()

Task: {9EBB9ED1-3265-40B7-8BAE-4FF4966159CB} - System32\Tasks\Lenovo\LSC\LSCHardwareScan => C:\Program Files\Lenovo\Lenovo Solution Center\LSC.exe [2014-05-06] ()

Task: {9FF4C139-5234-410C-B7FA-23EE2FD2AB53} - System32\Tasks\Microsoft\Windows\Work Folders\Work Folders Maintenance Work

Task: {AF66401C-A0AF-4CFB-A141-F93F9431E91A} - System32\Tasks\Microsoft_Hardware_Launch_mousekeyboardcenter_exe => c:\Program Files\Microsoft Mouse and Keyboard Center\mousekeyboardcenter.exe [2014-03-19] (Microsoft)

Task: {B66DF1D3-4EC8-40B2-AAE9-613891ED3EB5} - System32\Tasks\MirageAgent => C:\Program Files (x86)\Lenovo\YouCam\YCMMirage.exe [2012-07-27] (CyberLink)

Task: {C11B36A6-4B24-4D42-A6AB-BFBDF6A902E8} - System32\Tasks\Adobe Flash Player Updater => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-07-09] (Adobe Systems Incorporated)

Task: {CCD183A4-4F08-4F6F-8EF8-0B756A8E0E58} - System32\Tasks\Microsoft\Windows\WOF\WIM-Hash-Management

Task: {CFD7C21A-808B-487B-A6EC-8A10E44E8360} - System32\Tasks\Microsoft\Windows\SettingSync\BackupTask

Task: {D88FEC9E-A82A-46F9-87E2-B6B97B301C1A} - System32\Tasks\Microsoft\Windows\WS\License Validation => Rundll32.exe WSClient.dll,WSpTLR licensing

Task: {DA46820F-FF8A-4B5E-A6B2-B12185DCFFFB} - System32\Tasks\Microsoft\Windows\Work Folders\Work Folders Logon Synchronization

Task: {E20D5181-2879-47DB-BE3F-333F6A2BF3D3} - System32\Tasks\Microsoft\Windows\WOF\WIM-Hash-Validation

Task: {E6D378FA-E068-4BCB-80DE-56D43A249507} - System32\Tasks\Microsoft\Windows\RecoveryEnvironment\VerifyWinRE

Task: {EA872851-6228-4F10-BF9E-DC67F981E912} - \Advanced System Protector_startup No Task File <==== ATTENTION

Task: {EDA2E878-4D3A-4A09-A6C1-F0874DC13909} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)

Task: {F6B5677B-B3EE-419C-918A-F4C2D3CB41C5} - System32\Tasks\Microsoft\Windows\Shell\FamilySafetyUpload

Task: {FC73AB38-4215-4C38-8D31-493F659854BA} - System32\Tasks\Lenovo\LSC\LSCTaskService => C:\Program Files\Lenovo\Lenovo Solution Center\App\LSCTaskService.exe [2014-05-06] ()

Task: C:\WINDOWS\Tasks\Adobe Flash Player Updater.job => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

Task: C:\WINDOWS\Tasks\APSnotifierCA.job => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION

Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

Task: C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-3948811954-352045940-1238658349-1001Core1cf8dd5cba5919f.job => C:\Users\Amy\AppData\Local\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2013-02-01 19:22 - 2011-05-12 15:23 - 00512000 _____ () C:\Program Files (x86)\Froyo_Android_Driver\Bin\MonServiceUDisk.exe

2014-07-16 11:06 - 2014-07-16 11:06 - 00672416 _____ () C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync_x64.dll

2012-08-27 02:13 - 2012-08-23 04:07 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll

2010-08-24 10:44 - 2010-08-24 10:44 - 00257224 _____ () C:\Program Files (x86)\Lenovo EasyCamera\Monitor.exe

2014-07-16 11:05 - 2014-07-16 11:05 - 05558432 _____ () C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync.exe

2014-07-25 17:49 - 2014-07-03 06:45 - 32733056 ____N () C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CEF\libcef.dll

2014-08-13 21:25 - 2014-08-06 23:20 - 00718152 ____C () C:\Program Files (x86)\Google\Chrome\Application\36.0.1985.143\libglesv2.dll

2014-08-13 21:25 - 2014-08-06 23:20 - 00126280 ____C () C:\Program Files (x86)\Google\Chrome\Application\36.0.1985.143\libegl.dll

2014-08-13 21:25 - 2014-08-06 23:20 - 08537928 ____C () C:\Program Files (x86)\Google\Chrome\Application\36.0.1985.143\pdf.dll

2014-08-13 21:25 - 2014-08-06 23:20 - 00353096 ____C () C:\Program Files (x86)\Google\Chrome\Application\36.0.1985.143\ppGoogleNaClPluginChrome.dll

2014-08-13 21:25 - 2014-08-06 23:20 - 01732936 ____C () C:\Program Files (x86)\Google\Chrome\Application\36.0.1985.143\ffmpegsumo.dll

2014-07-25 17:49 - 2014-07-03 06:45 - 00742784 ____N () C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CEF\libglesv2.dll

2014-07-25 17:49 - 2014-07-03 06:45 - 00136576 ____N () C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CEF\libegl.dll

2012-10-20 20:50 - 2012-06-24 22:41 - 01198912 _____ () C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\ACE.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

AlternateDataStreams: C:\Users\Amy\SkyDrive:ms-properties

AlternateDataStreams: C:\Users\Amy_2\OneDrive:ms-properties

==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\plsapp => ""="service"

==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)

==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)

HKLM\...\StartupApproved\Run32: => "YouCam Tray"

HKLM\...\StartupApproved\Run32: => "mcui_exe"

HKLM\...\StartupApproved\Run32: => "RemoteControl10"

HKLM\...\StartupApproved\Run32: => "YouCam Mirage"

HKLM\...\StartupApproved\Run32: => "APSDaemon"

HKCU\...\StartupApproved\StartupFolder: => "OpenOffice.org 3.4.1.lnk"

HKCU\...\StartupApproved\Run: => "ooVoo.exe"

HKCU\...\StartupApproved\Run: => "Spotify"

HKCU\...\StartupApproved\Run: => "Spotify Web Helper"

HKCU\...\StartupApproved\Run: => "BitTorrent"

HKCU\...\StartupApproved\Run: => "Skype"

HKCU\...\StartupApproved\Run: => "Speech Recognition"

HKCU\...\StartupApproved\Run: => "TWC.Win7"

==================== Faulty Device Manager Devices =============

==================== Event log errors: =========================

Application errors:

==================

Error: (08/15/2014 06:06:24 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: Faulting application name: backgroundTaskHost.exe, version: 6.3.9600.16384, time stamp: 0x52157d67

Faulting module name: combase.dll, version: 6.3.9600.17031, time stamp: 0x53086d7c

Exception code: 0xc000027b

Fault offset: 0x000fb1d7

Faulting process id: 0x2e58

Faulting application start time: 0xbackgroundTaskHost.exe0

Faulting application path: backgroundTaskHost.exe1

Faulting module path: backgroundTaskHost.exe2

Report Id: backgroundTaskHost.exe3

Faulting package full name: backgroundTaskHost.exe4

Faulting package-relative application ID: backgroundTaskHost.exe5

Error: (08/15/2014 06:01:40 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: Amy)

Description: Activation of app Microsoft.SkypeApp_kzf8qxf38zg5c!App failed with error: -2144927141 See the Microsoft-Windows-TWinUI/Operational log for additional information.

Error: (08/15/2014 05:39:04 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: Amy)

Description: Activation of app Microsoft.SkypeApp_kzf8qxf38zg5c!App failed with error: -2144927141 See the Microsoft-Windows-TWinUI/Operational log for additional information.

Error: (08/15/2014 05:38:56 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: Amy)

Description: Activation of app Microsoft.SkypeApp_kzf8qxf38zg5c!App failed with error: -2144927141 See the Microsoft-Windows-TWinUI/Operational log for additional information.

Error: (08/14/2014 08:16:10 PM) (Source: Customer Experience Improvement Program) (EventID: 1008) (User: )

Description: 80070005

Error: (08/14/2014 08:06:34 PM) (Source: SideBySide) (EventID: 78) (User: )

Description: Activation context generation failed for "C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest1".Error in manifest or policy file "C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest2" on line C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest3.

A component version required by the application conflicts with another component version already active.

Conflicting components are:.

Component 1: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest.

Component 2: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest.

Error: (08/13/2014 10:54:39 PM) (Source: MsiInstaller) (EventID: 1024) (User: Amy)

Description: Product: Adobe Acrobat XI Pro - Update '{AC76BA86-A440-FFFF-A440-7A8C40011008}' could not be installed. Error code 1625. Windows Installer can create logs to help troubleshoot issues with installing software packages. Use the following link for instructions on turning on logging support: http://go.microsoft.com/fwlink/?LinkId=23127

Error: (08/13/2014 10:24:58 PM) (Source: Microsoft-Windows-LocationProvider) (EventID: 2006) (User: NT AUTHORITY)

Description: There was an error with the Windows Location Provider database

Error: (08/13/2014 08:41:10 PM) (Source: SideBySide) (EventID: 78) (User: )

Description: Activation context generation failed for "C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest1".Error in manifest or policy file "C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest2" on line C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest3.

A component version required by the application conflicts with another component version already active.

Conflicting components are:.

Component 1: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest.

Component 2: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest.

Error: (08/13/2014 08:32:23 PM) (Source: Customer Experience Improvement Program) (EventID: 1008) (User: )

Description: 80070005

System errors:

=============

Error: (08/15/2014 06:01:40 PM) (Source: DCOM) (EventID: 10010) (User: Amy)

Description: App.AppX54xz6wnkhmw763c2y8tb018n7d71dtx7.wwa

Error: (08/15/2014 05:42:04 PM) (Source: Service Control Manager) (EventID: 7000) (User: )

Description: The PlsvcV2 service failed to start due to the following error:

%%1053

Error: (08/15/2014 05:42:04 PM) (Source: Service Control Manager) (EventID: 7009) (User: )

Description: A timeout was reached (30000 milliseconds) while waiting for the PlsvcV2 service to connect.

Error: (08/15/2014 05:40:32 PM) (Source: Service Control Manager) (EventID: 7031) (User: )

Description: The PlsvcV2 service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.

Error: (08/15/2014 05:39:04 PM) (Source: DCOM) (EventID: 10010) (User: Amy)

Description: App.AppX54xz6wnkhmw763c2y8tb018n7d71dtx7.wwa

Error: (08/15/2014 05:38:56 PM) (Source: DCOM) (EventID: 10010) (User: Amy)

Description: App.AppX54xz6wnkhmw763c2y8tb018n7d71dtx7.wwa

Error: (08/14/2014 11:55:12 PM) (Source: Service Control Manager) (EventID: 7031) (User: )

Description: The PlsvcV2 service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.

Error: (08/14/2014 07:54:02 PM) (Source: Service Control Manager) (EventID: 7031) (User: )

Description: The PlsvcV2 service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.

Error: (08/13/2014 10:11:52 PM) (Source: DCOM) (EventID: 10010) (User: Amy)

Description: {1B1F472E-3221-4826-97DB-2C2324D389AE}

Error: (08/13/2014 08:37:39 PM) (Source: Service Control Manager) (EventID: 7031) (User: )

Description: The PlsvcV2 service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.

Microsoft Office Sessions:

=========================

Error: (01/21/2014 10:51:32 AM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )

Description: ID: 1, Application Name: Microsoft Office Excel, Application Version: 12.0.6683.5002, Microsoft Office Version: 12.0.6612.1000. This session lasted 150827 seconds with 60 seconds of active time. This session ended with a crash.

Error: (01/05/2014 08:47:34 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )

Description: ID: 1, Application Name: Microsoft Office Excel, Application Version: 12.0.6683.5002, Microsoft Office Version: 12.0.6612.1000. This session lasted 89694 seconds with 600 seconds of active time. This session ended with a crash.

Error: (07/16/2013 06:47:22 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )

Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6668.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 204 seconds with 0 seconds of active time. This session ended with a crash.

CodeIntegrity Errors:

===================================

Date: 2014-08-03 14:02:25.761

Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

Date: 2014-08-03 14:02:25.614

Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

Date: 2014-08-03 14:02:25.446

Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

Date: 2014-08-03 14:02:25.042

Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

Date: 2014-08-03 14:02:24.870

Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

Date: 2014-08-03 14:02:24.729

Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

Date: 2014-08-03 14:02:18.106

Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

Date: 2014-08-03 14:02:17.783

Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

Date: 2014-08-03 14:02:17.571

Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

Date: 2014-08-03 14:02:17.401

Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

==================== Memory info ===========================

Processor: Intel® Core i3-3110M CPU @ 2.40GHz

Percentage of memory in use: 53%

Total physical RAM: 3943.41 MB

Available physical RAM: 1825.32 MB

Total Pagefile: 11111.41 MB

Available Pagefile: 7770.33 MB

Total Virtual: 131072 MB

Available Virtual: 131071.78 MB

==================== Drives ================================

Drive c: (Windows8_OS) (Fixed) (Total:418.09 GB) (Free:204.87 GB) NTFS ==>[system with boot components (obtained from reading drive)]

Drive d: (LENOVO) (Fixed) (Total:25 GB) (Free:22.93 GB) NTFS

==================== MBR & Partition Table ==================

========================================================

Disk: 0 (Size: 466 GB) (Disk ID: FF669BDE)

Partition: GPT Partition Type.

==================== End Of Log ============================

deeprybka · August 15, 2014

Hi & :welcome:
My name is Jürgen and I will be assisting you with your Malware related problems.

Before we move on, please read the following points carefully. :excl:

My native language isn't English. So please do not use slang or idioms. It could be hard for me to read. Thanks for your understanding.
Please read my instructions completely. If there is anything that you do not understand kindly ask before proceeding.
Perform everything in the correct order. Sometimes one step requires the previous one.
If you have any problems while you are follow my instructions, Stop there and tell me the exact nature of your problem.
Do not run any other scans without instruction or Add/ Remove Software unless I tell you to do so. This would change the output of our tools and could be confusing for me.
Post all Logfiles as a reply rather than as an attachment unless I specifically ask you. If you can not post all logfiles in one reply, feel free to use more posts.
If I don't hear from you within 3 days from this initial or any subsequent post, then this thread will be closed.
Stay with me. I will give you some advice about prevention after the cleanup process. Absence of symptoms does not always mean the computer is clean.

P2P/Piracy Warning:

If you're using Peer 2 Peer software such as uTorrent, BitTorrent or similar you must either fully uninstall them or completely disable them from running while being assisted here.
Failure to remove or disable such software will result in your topic being closed and no further assistance being provided.
If you have illegal/cracked software, cracks, keygens, etc. on the system, please remove or uninstall them now and read the policy on Piracy.

Step 1

Scan with Malwarebytes Antimalware

Please update the database by clicking on the "Update Now" button.
Following the update and click "Settings" and go to "Detection and Protection"
Make sure "Scan for Rootkits" is checked.
Click on Dashboard, then click on Scan Now to start the scan.
(If Malware or Potentially Unwanted Programs [PUPs] are found, you will receive a prompt so that you can decide what you want to do. I suggest "Quarantine". Click the button: Apply All Actions.)
A window with an option to view the detailed log will appear. Click on "View Detailed Log".
After viewing the results, please click on the "Copy to Clipboard" button and then OK.
Return to our forum. Paste your log into your next reply.

egad1986 · August 16, 2014

Malwarebytes Anti-Malware

www.malwarebytes.org

Scan Date: 8/15/2014

Scan Time: 6:48:48 PM

Logfile:

Administrator: No

Version: 2.00.2.1012

Malware Database: v2014.08.15.11

Rootkit Database: v2014.08.04.01

License: Free

Malware Protection: Disabled

Malicious Website Protection: Disabled

Self-protection: Disabled

OS: Windows 8.1

CPU: x64

File System: NTFS

User: Amy

Scan Type: Threat Scan

Result: Completed

Objects Scanned: 354104

Time Elapsed: 35 min, 44 sec

Memory: Enabled

Startup: Enabled

Filesystem: Enabled

Archives: Enabled

Rootkits: Enabled

Heuristics: Enabled

PUP: Warn

PUM: Warn

Processes: 0

(No malicious items detected)

Modules: 0

(No malicious items detected)

Registry Keys: 0

(No malicious items detected)

Registry Values: 0

(No malicious items detected)

Registry Data: 0

(No malicious items detected)

Folders: 0

(No malicious items detected)

Files: 3

PUP.Optional.Superfish.A, C:\Users\Amy\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_www.superfish.com_0.localstorage, Delete-on-Reboot, [d51211b5e893cb6b21865c98a062c33d],

PUP.Optional.Superfish.A, C:\Users\Amy\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_www.superfish.com_0.localstorage-journal, Delete-on-Reboot, [9057b90d64172016c4e330c4ad557987],

PUP.Optional.Conduit.A, C:\Users\Amy\AppData\Local\Google\Chrome\User Data\Default\Preferences, Good: (), Bad: ( "homepage": "http://search.conduit.com/?gd=&ctid=CT3326285&octid=EB_ORIGINAL_CTID&ISID=MA45B1311-13E2-448C-A758-89339C9A7B61&SearchSource=55&CUI=&UM=5&UP=SP39284524-52FF-4D6B-A549-EAC984F79BF6&SSPV=",), Replaced,[03e4814586f5cc6a2abe7093778e31cf]

Physical Sectors: 0

(No malicious items detected)

(end)

deeprybka · August 16, 2014

Hi,

to get rid of this

PUP.Optional.Superfish.A, C:\Users\Amy\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_www.superfish.com_0.localstorage, Delete-on-Reboot, [d51211b5e893cb6b21865c98a062c33d], PUP.Optional.Superfish.A, C:\Users\Amy\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_www.superfish.com_0.localstorage-journal, Delete-on-Reboot, [9057b90d64172016c4e330c4ad557987],

you must normally un- and reinstall chrome. But before we do so...

Let's do a final check up:

Step 1

Please download AdwCleaner (by Xplode) and save it to your Desktop.

Double click on AdwCleaner.exe to run the tool.
Vista/Windows 7/8 users right-click and select "Run As Administrator"
Click on the Scan button.
After the scan has finished, click on the Clean button.
Press OK when asked to close all programs and follow the onscreen prompts.
After rebooting, a log file (that is saved in C:\AdwCleaner[s#].txt) will open automatically.
Copy and paste the contents of that logfile in your next reply.

Step 2

Please download the ESET Online Scanner and save it to your Desktop.

Disable the realtime-protection of your antivirus and anti-malware programs because they might interfere with the scan.
Start esetsmartinstaller_enu.exe with administartor privileges.
Select the option Yes, I accept the Terms of Use and click on Start.
Make sure that the option Remove found threats is NOT checked, and the option Scan archives is checked.
Now click on Advanced Settings and select the following:
- Scan for potentially unwanted applications
- Scan for potentially unsafe applications
- Enable Anti-Stealth Technology
Click on Start. The virus signature database will begin to download. This may take some time.
When completed the Online Scan will begin automatically.
Note: This scan might take a long time! Please be patient.
When completed select Uninstall application on close if you so wish, but make sure you copy the logfile first!
Now click on Finish
A log file is created at C:\Program Files\ESET\EsetOnlineScanner\log.txt.
Copy and paste the content of this log file in your next reply.

Note: Do not forget to re-enable your antivirus application after running the above scan!

Step 3

Start FRST with administator privileges.

Press the Scan button.
When finished, FRST will produce a log (FRST.txt) in the same directory the tool was run from.
Please copy and paste the log in your next reply.

egad1986 · August 19, 2014

Hello,

Still working on step 2.

It seemed to be stuck so I stopped and restarted it. This time it has made it to 34% and scanned almost 225K files so far and it looks like it is still moving. Last night it said 13 hours total scan time now it says only 9, but the file number continues to increase.

egad1986 · August 20, 2014

Ok, now my computer decided it needed to restart so I have launched Step 2 for a third time. This time it has reached 33% and almost 45K files scanned in just under 1 hour total scan time. Hopefully it will finish tonight and I will be able to finish the other steps and move on.

egad1986 · August 20, 2014

Still at 34% after 3.5 hours total scan time but almost 300K files scanned.

deeprybka · August 20, 2014

Hi,

yes the scan take a long time, indeed. It depends on the amount of files.

egad1986 · August 21, 2014

# AdwCleaner v3.306 - Report created 15/08/2014 at 22:32:07

# Updated 15/08/2014 by Xplode

# Operating System : Windows 8.1 (64 bits)

# Username : Amy - AMY

# Running from : C:\Users\Amy\Downloads\AdwCleaner.exe

# Option : Clean

***** [ Services ] *****

***** [ Files / Folders ] *****

Folder Deleted : C:\SearchProtect

Folder Deleted : C:\ProgramData\apn

Folder Deleted : C:\ProgramData\Ask

Folder Deleted : C:\ProgramData\Babylon

Folder Deleted : C:\ProgramData\Conduit

Folder Deleted : C:\ProgramData\Systweak

Folder Deleted : C:\ProgramData\Tarma Installer

Folder Deleted : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FlvPlayer

Folder Deleted : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Uniblue

Folder Deleted : C:\Program Files (x86)\AnyProtectEx

Folder Deleted : C:\Program Files (x86)\Bench

Folder Deleted : C:\Program Files (x86)\Conduit

Folder Deleted : C:\Program Files (x86)\RegClean Pro

Folder Deleted : C:\Program Files (x86)\Surf Canyon

Folder Deleted : C:\WINDOWS\SysWOW64\SearchProtect

Folder Deleted : C:\Program Files\Conduit

Folder Deleted : C:\Users\Amy\AppData\Local\apn

Folder Deleted : C:\Users\Amy\AppData\Local\Conduit

Folder Deleted : C:\Users\Amy\AppData\Local\NativeMessaging

Folder Deleted : C:\Users\Amy\AppData\LocalLow\Conduit

Folder Deleted : C:\Users\Amy\AppData\LocalLow\Delta

Folder Deleted : C:\Users\Amy\AppData\Roaming\Babylon

Folder Deleted : C:\Users\Amy\AppData\Roaming\Systweak

Folder Deleted : C:\Users\Amy\AppData\Roaming\ValueApps

Folder Deleted : C:\Users\Amy\AppData\Roaming\xVidly

Folder Deleted : C:\Users\Amy\AppData\Roaming\Mozilla\Firefox\Profiles\fkjlsnsj.default\Smartbar

Folder Deleted : C:\Users\Amy\AppData\Roaming\Mozilla\Firefox\Profiles\fkjlsnsj.default\CT3307181

Folder Deleted : C:\Users\Amy\AppData\Roaming\Mozilla\Firefox\Profiles\fkjlsnsj.default\CT3300237

Folder Deleted : C:\Users\Amy\AppData\Roaming\Mozilla\Firefox\Profiles\fkjlsnsj.default\Extensions\{64d64833-9296-421b-a362-83cfbd6291b6}

Folder Deleted : C:\Users\Amy\AppData\Roaming\Mozilla\Firefox\Profiles\fkjlsnsj.default\Extensions\{8c58b088-1159-4ad9-a411-c7d3ae7edb28}

Folder Deleted : C:\Users\Amy\AppData\Local\Google\Chrome\User Data\Default\Extensions\jbolfgndggfhhpbnkgnpjkfhinclbigj

Folder Deleted : C:\Users\Amy\AppData\Local\Google\Chrome\User Data\Default\Extensions\dachbokeklmhlikpklnkmmealjdfanoh

Folder Deleted : C:\Users\Amy\AppData\Local\Google\Chrome\User Data\Default\Extensions\iekjmlcgpmcjigljdiagaibfjfaideal

File Deleted : C:\Users\Amy\AppData\Roaming\Mozilla\Firefox\Profiles\fkjlsnsj.default\Extensions\freehdsport@freehdsport.tv.xpi

File Deleted : C:\Users\Amy\AppData\Local\CRE\dachbokeklmhlikpklnkmmealjdfanoh.crx

File Deleted : C:\Users\Amy\AppData\Local\CRE\iekjmlcgpmcjigljdiagaibfjfaideal.crx

File Deleted : C:\END

File Deleted : C:\Users\Amy\AppData\Roaming\aps.scan.quick.results

File Deleted : C:\Users\Amy\Desktop\AnyProtect.lnk

File Deleted : C:\Users\Amy\Desktop\Continue VuuPC Installation.lnk

File Deleted : C:\Program Files (x86)\Mozilla Firefox\nsprotector.js

File Deleted : C:\Users\Amy\AppData\Roaming\Mozilla\Firefox\Profiles\fkjlsnsj.default\searchplugins\Askcom.xml

File Deleted : C:\Users\Amy\AppData\Roaming\Mozilla\Firefox\Profiles\fkjlsnsj.default\searchplugins\safeguard-secure-search.xml

File Deleted : C:\Users\Amy\AppData\Roaming\Mozilla\Firefox\Profiles\fkjlsnsj.default\user.js

File Deleted : C:\Users\Amy\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.superfish.com_0.localstorage

File Deleted : C:\Users\Amy\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.superfish.com_0.localstorage-journal

***** [ Scheduled Tasks ] *****

Task Deleted : Advanced System Protector_startup

***** [ Shortcuts ] *****

***** [ Registry ] *****

Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\jbolfgndggfhhpbnkgnpjkfhinclbigj

Key Deleted : HKCU\Software\Google\Chrome\Extensions\dachbokeklmhlikpklnkmmealjdfanoh

Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\dachbokeklmhlikpklnkmmealjdfanoh

Key Deleted : HKCU\Software\Google\Chrome\Extensions\iekjmlcgpmcjigljdiagaibfjfaideal

Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\iekjmlcgpmcjigljdiagaibfjfaideal

Key Deleted : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\superfish.com

Key Deleted : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\www.superfish.com

Key Deleted : HKLM\SOFTWARE\Classes\driverscanner

Key Deleted : HKLM\SOFTWARE\Classes\PCProxy.DataContainer

Key Deleted : HKLM\SOFTWARE\Classes\Prod.cap

Key Deleted : HKLM\SOFTWARE\Classes\speedupmypc

Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{74F475FA-6C75-43BD-AAB9-ECDA6184F600}

Key Deleted : HKCU\Software\fedcd9b638e817

Key Deleted : HKLM\SOFTWARE\Classes\AppID\{608D3067-77E8-463D-9084-908966806826}

Key Deleted : HKLM\SOFTWARE\Classes\AppID\{9DC8FA51-B596-4F77-802C-5B295919C205}

Key Deleted : HKLM\SOFTWARE\Classes\AppID\{C007DADD-132A-624C-088E-59EE6CF0711F}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{3E28F712-0D6C-4EE3-AC8C-8F060F5D7C33}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{533403E2-6E21-4615-9E28-43F4E97E977B}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{6CE321DA-DC11-45C6-A0FC-4E8A7D978ABC}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{6EEBC7FF-67DA-4B90-9251-C2C5696E4B48}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{74137531-80F7-406F-9543-7D11385FA8C8}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{80922EE0-8A76-46AE-95D5-BD3C3FE0708D}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{832599B2-55BF-4437-8F3E-030CF5AEB262}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{9B7B034B-944A-4261-B487-862F642F7615}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{B1A429DB-FB06-4645-B7C0-0CC405EAD3CD}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{DD67706E-819E-4EBD-BF8D-6D6147CC7A49}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{DE9028D0-5FFA-4E69-94E3-89EE8741F468}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{F62A4AF9-58B4-4FEC-89CC-D717A547D8E8}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{0FCE4F01-64EC-42F1-83E1-1E08D38605D2}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{1A2A195A-A0F9-4006-AF02-3F05EEFDE792}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{22511E2E-7970-414E-BC7C-28D16C4AF54D}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{23C5311E-016D-4999-BCB1-499898429D6C}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{2C4B6DB8-6413-403B-A038-16A352CFE8B9}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{2D9DB233-DC4B-4677-946C-5FA5ABCF506B}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{3AE76A17-C344-4A83-81CE-65EFEE41E42D}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{46803190-228D-470E-90FE-F5E0CEA9C4F2}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{4C0A69B0-CE97-42B7-86FC-08280C99C74D}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{4E9EB4D5-C929-4005-AC62-1856B1DA5A24}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{5180FE16-2E09-497B-9C8B-5A6F029ECECB}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{8FAF962C-3EDE-405E-B1D0-62B8235C6044}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{A4F6E1B3-469E-46EF-A936-FBA9D5EFD2B9}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{C1F5E799-B218-4C32-B189-3C389BA140BB}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{C97AF157-6A27-4F57-9D47-E2D3E4761B77}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{ED0D2C81-7DB5-4599-B7C0-1033418B5672}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{F60C9408-3110-4C98-A139-ABE1EE1111DD}

Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8}

Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{ED721A76-8160-4DA0-A18E-7FD7C4574774}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F25AF245-4A81-40DC-92F9-E9021F207706}

Value Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}]

Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}

Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{0FCE4F01-64EC-42F1-83E1-1E08D38605D2}

Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{1A2A195A-A0F9-4006-AF02-3F05EEFDE792}

Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{22511E2E-7970-414E-BC7C-28D16C4AF54D}

Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{23C5311E-016D-4999-BCB1-499898429D6C}

Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{2C4B6DB8-6413-403B-A038-16A352CFE8B9}

Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{2D9DB233-DC4B-4677-946C-5FA5ABCF506B}

Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{3AE76A17-C344-4A83-81CE-65EFEE41E42D}

Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{46803190-228D-470E-90FE-F5E0CEA9C4F2}

Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{4C0A69B0-CE97-42B7-86FC-08280C99C74D}

Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{4E9EB4D5-C929-4005-AC62-1856B1DA5A24}

Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{5180FE16-2E09-497B-9C8B-5A6F029ECECB}

Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{8FAF962C-3EDE-405E-B1D0-62B8235C6044}

Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}

Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{A4F6E1B3-469E-46EF-A936-FBA9D5EFD2B9}

Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{C1F5E799-B218-4C32-B189-3C389BA140BB}

Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{C97AF157-6A27-4F57-9D47-E2D3E4761B77}

Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{ED0D2C81-7DB5-4599-B7C0-1033418B5672}

Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{F60C9408-3110-4C98-A139-ABE1EE1111DD}

Key Deleted : HKCU\Software\AnyProtect

Key Deleted : HKCU\Software\APN PIP

Key Deleted : HKCU\Software\Conduit

Key Deleted : HKCU\Software\SmartBar

Key Deleted : HKCU\Software\AppDataLow\Software\BackgroundContainer

Key Deleted : HKCU\Software\AppDataLow\Software\ConduitSearchScopes

Key Deleted : HKCU\Software\AppDataLow\Software\SmartBar

Key Deleted : HKLM\SOFTWARE\Babylon

Key Deleted : HKLM\SOFTWARE\Bench

Key Deleted : HKLM\SOFTWARE\Conduit

Key Deleted : HKLM\SOFTWARE\FlvPlayer

Key Deleted : HKLM\SOFTWARE\PIP

Key Deleted : HKLM\SOFTWARE\systweak

Key Deleted : HKLM\SOFTWARE\Uniblue

Key Deleted : [x64] HKLM\SOFTWARE\Tarma Installer

***** [ Browsers ] *****

-\\ Internet Explorer v11.0.9600.17126

-\\ Mozilla Firefox v27.0.1 (en-US)

[ File : C:\Users\Amy\AppData\Roaming\Mozilla\Firefox\Profiles\fkjlsnsj.default\prefs.js ]

Line Deleted : user_pref("CT3300236.FF19Solved", "true");

Line Deleted : user_pref("CT3300236.UserID", "UN65307577720504304");

Line Deleted : user_pref("CT3300236.addressUrlXPETakeover", "true");

Line Deleted : user_pref("CT3300236.autoDisableScopes", 14);

Line Deleted : user_pref("CT3300236.browser.search.defaultthis.engineName", "true");

Line Deleted : user_pref("CT3300236.defaultSearchXPETakeover", "true");

Line Deleted : user_pref("CT3300236.installDate", "12/7/2013 0:36:28");

Line Deleted : user_pref("CT3300236.installSessionId", "{EE23A489-23DA-4147-A2D2-56DC40C6EA24}");

Line Deleted : user_pref("CT3300236.installSp", "TRUE");

Line Deleted : user_pref("CT3300236.installerVersion", "1.4.2.3");

Line Deleted : user_pref("CT3300236.keyword", "true");

Line Deleted : user_pref("CT3300236.originalHomepage", "about:home");

Line Deleted : user_pref("CT3300236.originalSearchAddressUrl", "");

Line Deleted : user_pref("CT3300236.originalSearchEngine", "Ask.com");

Line Deleted : user_pref("CT3300236.searchRevert", "false");

Line Deleted : user_pref("CT3300236.searchUserMode", "2");

Line Deleted : user_pref("CT3300236.smartbar.homepage", "true");

Line Deleted : user_pref("CT3300236.startPageXPETakeover", "true");

Line Deleted : user_pref("CT3300236.versionFromInstaller", "10.15.2.23");

Line Deleted : user_pref("CT3300237.FF19Solved", "true");

Line Deleted : user_pref("CT3300237.UserID", "UN62980654114896584");

Line Deleted : user_pref("CT3300237.addressUrlXPETakeover", "true");

Line Deleted : user_pref("CT3300237.autoDisableScopes", 10);

Line Deleted : user_pref("CT3300237.browser.search.defaultthis.engineName", "true");

Line Deleted : user_pref("CT3300237.defaultSearchXPETakeover", "true");

Line Deleted : user_pref("CT3300237.installDate", "12/7/2013 8:49:27");

Line Deleted : user_pref("CT3300237.installSessionId", "{C037EAAE-95BB-48E3-BE75-93141DAB933E}");

Line Deleted : user_pref("CT3300237.installSp", "TRUE");

Line Deleted : user_pref("CT3300237.installUsage", "12/7/2013 8:49:18");

Line Deleted : user_pref("CT3300237.installUsageEarly", "12/7/2013 8:49:18");

Line Deleted : user_pref("CT3300237.installerVersion", "1.4.2.3");

Line Deleted : user_pref("CT3300237.keyword", "true");

Line Deleted : user_pref("CT3300237.originalHomepage", "hxxp://search.conduit.com/?ctid=CT3300236&octid=CT3300236&SearchSource=61&CUI=UN65307577720504304&UM=2&UP=SPF0665CC8-7838-4D77-9588-F498A8A0DAE9");

Line Deleted : user_pref("CT3300237.originalSearchAddressUrl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3300236&SearchSource=2&CUI=UN65307577720504304&UM=2&q=");

Line Deleted : user_pref("CT3300237.originalSearchEngine", "xVidly1 Customized Web Search");

Line Deleted : user_pref("CT3300237.searchRevert", "false");

Line Deleted : user_pref("CT3300237.searchUserMode", "2");

Line Deleted : user_pref("CT3300237.smartbar.homepage", "true");

Line Deleted : user_pref("CT3300237.startPageXPETakeover", "true");

Line Deleted : user_pref("CT3300237.versionFromInstaller", "10.15.2.23");

Line Deleted : user_pref("CT3307181.1000082.isPlayDisplay", "true");

Line Deleted : user_pref("CT3307181.1000082.state", "{\"state\":\"stopped\",\"text\":\"Californi...\",\"description\":\"California Rock - Rock\",\"url\":\"hxxp://www.feedlive.net/california.asx\"}");

Line Deleted : user_pref("CT3307181.ENABALE_HISTORY", "{\"dataType\":\"string\",\"data\":\"true\"}");

Line Deleted : user_pref("CT3307181.ENABLE_RETURN_WEB_SEARCH_ON_THE_PAGE", "{\"dataType\":\"string\",\"data\":\"true\"}");

Line Deleted : user_pref("CT3307181.FF19Solved", "true");

Line Deleted : user_pref("CT3307181.FirstTime", "true");

Line Deleted : user_pref("CT3307181.FirstTimeFF3", "true");

Line Deleted : user_pref("CT3307181.TopHitsConfig.enc", "ew0KICAgICJzcHJpdGVVcmwiOiAiaHR0cDovL3N0b3JhZ2UuY29uZHVpdC5jb20vcHMvVG9wSGl0c0dlbmVyaWNBcHAvY29uZmlncy9VUy1VSy1EYW5jZS1Sb2NrLVJhcC9zcHJpdGUucG5nIiwNCiAgICAiaX[...]

Line Deleted : user_pref("CT3307181.UserID", "UN57077000328576231");

Line Deleted : user_pref("CT3307181.addressBarTakeOverEnabledInHidden", "true");

Line Deleted : user_pref("CT3307181.browser.search.defaultthis.engineName", "true");

Line Deleted : user_pref("CT3307181.countryCode", "US");

Line Deleted : user_pref("CT3307181.defaultSearch", "true");

Line Deleted : user_pref("CT3307181.embeddedsData", "[{\"appId\":\"130166768271741233\",\"apiPermissions\":{\"crossDomainAjax\":true,\"getMainFrameTitle\":true,\"getMainFrameUrl\":true,\"getSearchTerm\":true,\"insta[...]

Line Deleted : user_pref("CT3307181.enableAlerts", "true");

Line Deleted : user_pref("CT3307181.enableSearchFromAddressBar", "true");

Line Deleted : user_pref("CT3307181.firstTimeDialogOpened", "true");

Line Deleted : user_pref("CT3307181.fixPageNotFoundError", "true");

Line Deleted : user_pref("CT3307181.fixPageNotFoundErrorByUser", "true");

Line Deleted : user_pref("CT3307181.fixPageNotFoundErrorInHidden", "true");

Line Deleted : user_pref("CT3307181.fullUserID", "UN57077000328576231.IN.20131030164526");

Line Deleted : user_pref("CT3307181.installDate", "30/10/2013 16:45:31");

Line Deleted : user_pref("CT3307181.installId", "cideoo");

Line Deleted : user_pref("CT3307181.installSessionId", "{A76DDAF8-4D35-4DFD-AB99-59DE833010A0}");

Line Deleted : user_pref("CT3307181.installSp", "TRUE");

Line Deleted : user_pref("CT3307181.installType", "conduitnsisintegration");

Line Deleted : user_pref("CT3307181.installUsage", "30/10/2013 16:59:17");

Line Deleted : user_pref("CT3307181.installUsageEarly", "30/10/2013 16:59:17");

Line Deleted : user_pref("CT3307181.installerVersion", "1.8.0.14");

Line Deleted : user_pref("CT3307181.isCheckedStartAsHidden", true);

Line Deleted : user_pref("CT3307181.isEnableAllDialogs", "{\"dataType\":\"string\",\"data\":\"true\"}");

Line Deleted : user_pref("CT3307181.isFirstTimeToolbarLoading", "false");

Line Deleted : user_pref("CT3307181.isToolbarShrinked", "{\"dataType\":\"string\",\"data\":\"false\"}");

Line Deleted : user_pref("CT3307181.keyword", "true");

Line Deleted : user_pref("CT3307181.lastVersion", "10.23.0.822");

Line Deleted : user_pref("CT3307181.mam_gk_installer_preapproved.enc", "ZmFsc2U=");

Line Deleted : user_pref("CT3307181.navigationAliasesJson", "{\"EB_MAIN_FRAME_URL\":\"\",\"EB_MAIN_FRAME_TITLE\":\"\",\"EB_SEARCH_TERM\":\"\",\"EB_TOOLBAR_SUB_DOMAIN\":\"hxxp://appmarketToolbar.OurToolbar.com/\",\"E[...]

Line Deleted : user_pref("CT3307181.openThankYouPage", "false");

Line Deleted : user_pref("CT3307181.openUninstallPage", "true");

Line Deleted : user_pref("CT3307181.originalHomepage", "hxxp://search.conduit.com/?ctid=CT3300237&octid=CT3300237&SearchSource=61&CUI=UN62980654114896584&UM=2&UP=SPF0665CC8-7838-4D77-9588-F498A8A0DAE9");

Line Deleted : user_pref("CT3307181.originalSearchAddressUrl", "");

Line Deleted : user_pref("CT3307181.originalSearchEngine", "AVG Secure Search");

Line Deleted : user_pref("CT3307181.originalSearchEngineName", "AVG Secure Search");

Line Deleted : user_pref("CT3307181.revertSettingsEnabled", "false");

Line Deleted : user_pref("CT3307181.search.searchAppId", "130166768271741233");

Line Deleted : user_pref("CT3307181.search.searchCount", "0");

Line Deleted : user_pref("CT3307181.searchFromAddressBarEnabledByUser", "true");

Line Deleted : user_pref("CT3307181.searchInNewTabEnabledByUser", "true");

Line Deleted : user_pref("CT3307181.searchInNewTabEnabledInHidden", "true");

Line Deleted : user_pref("CT3307181.searchRevert", "false");

Line Deleted : user_pref("CT3307181.searchSuggestEnabledByUser", "true");

Line Deleted : user_pref("CT3307181.searchUserMode", "2");

Line Deleted : user_pref("CT3307181.selectToSearchBoxEnabled", "{\"dataType\":\"string\",\"data\":\"true\"}");

Line Deleted : user_pref("CT3307181.serviceLayer_service_login_isFirstLoginInvoked", "{\"dataType\":\"boolean\",\"data\":\"true\"}");

Line Deleted : user_pref("CT3307181.serviceLayer_service_login_loginCount", "{\"dataType\":\"number\",\"data\":\"4\"}");

Line Deleted : user_pref("CT3307181.serviceLayer_service_toolbarGrouping_activeCTID", "{\"dataType\":\"string\",\"data\":\"CT3307181\"}");

Line Deleted : user_pref("CT3307181.serviceLayer_service_toolbarGrouping_activeDownloadUrl", "{\"dataType\":\"string\",\"data\":\"hxxp://appmarketToolbar.OurToolbar.com//xpi\"}");

Line Deleted : user_pref("CT3307181.serviceLayer_service_toolbarGrouping_activeToolbarName", "{\"dataType\":\"string\",\"data\":\"appmarket- \"}");

Line Deleted : user_pref("CT3307181.serviceLayer_service_toolbarGrouping_invoked", "{\"dataType\":\"string\",\"data\":\"true\"}");

Line Deleted : user_pref("CT3307181.serviceLayer_service_usage_toolbarUsageCount", "{\"dataType\":\"number\",\"data\":\"2\"}");

Line Deleted : user_pref("CT3307181.serviceLayer_services_Configuration_lastUpdate", "1396162337112");

Line Deleted : user_pref("CT3307181.serviceLayer_services_appTrackingFirstTime_lastUpdate", "1396162336711");

Line Deleted : user_pref("CT3307181.serviceLayer_services_appsMetadata_lastUpdate", "1396162336775");

Line Deleted : user_pref("CT3307181.serviceLayer_services_gottenAppsContextMenu_lastUpdate", "1396162336655");

Line Deleted : user_pref("CT3307181.serviceLayer_services_login_10.21.1.7_lastUpdate", "1385341270851");

Line Deleted : user_pref("CT3307181.serviceLayer_services_login_10.22.5.510_lastUpdate", "1386732953855");

Line Deleted : user_pref("CT3307181.serviceLayer_services_login_10.23.0.822_lastUpdate", "1396162336799");

Line Deleted : user_pref("CT3307181.serviceLayer_services_otherAppsContextMenu_lastUpdate", "1396162336744");

Line Deleted : user_pref("CT3307181.serviceLayer_services_searchAPI_lastUpdate", "1396162336912");

Line Deleted : user_pref("CT3307181.serviceLayer_services_serviceMap_lastUpdate", "1396162336645");

Line Deleted : user_pref("CT3307181.serviceLayer_services_toolbarContextMenu_lastUpdate", "1396162336584");

Line Deleted : user_pref("CT3307181.serviceLayer_services_toolbarSettings_lastUpdate", "1396162336717");

Line Deleted : user_pref("CT3307181.serviceLayer_services_translation_lastUpdate", "1396162336699");

Line Deleted : user_pref("CT3307181.settingsINI", true);

Line Deleted : user_pref("CT3307181.shouldFirstTimeDialog", "false");

Line Deleted : user_pref("CT3307181.showToolbarPermission", "false");

Line Deleted : user_pref("CT3307181.smartbar.CTID", "CT3307181");

Line Deleted : user_pref("CT3307181.smartbar.Uninstall", "0");

Line Deleted : user_pref("CT3307181.smartbar.homepage", "true");

Line Deleted : user_pref("CT3307181.smartbar.toolbarName", "appmarket- ");

Line Deleted : user_pref("CT3307181.startPage", "true");

Line Deleted : user_pref("CT3307181.toolbarBornServerTime", "25-11-2013");

Line Deleted : user_pref("CT3307181.toolbarCurrentServerTime", "30-3-2014");

Line Deleted : user_pref("CT3307181.toolbarInstallDate", "30-10-2013 16:45:26");

Line Deleted : user_pref("CT3307181.toolbarLoginClientTime", "Sun Nov 24 2013 20:01:10 GMT-0500 (Eastern Standard Time)");

Line Deleted : user_pref("CT3307181.versionFromInstaller", "10.21.1.7");

Line Deleted : user_pref("CT3307181.xpeMode", "0");

Line Deleted : user_pref("CT3307181_Firefox.csv", "[{\"from\":\"Abs Layer\",\"action\":\"loading toolbar\",\"time\":1396162379275,\"isWithState\":\"\",\"timeFromStart\":0,\"timeFromPrev\":0}]");

Line Deleted : user_pref("CT3309350.searchProtector.notifyChanges", "{\"dataType\":\"string\",\"data\":\"false\"}");

Line Deleted : user_pref("Smartbar.ConduitHomepagesList", "");

Line Deleted : user_pref("Smartbar.ConduitSearchEngineList", "Conduit Search");

Line Deleted : user_pref("Smartbar.ConduitSearchUrlList", "hxxp://search.conduit.com&CUI=UN57077000328576231");

Line Deleted : user_pref("Smartbar.SearchFromAddressBarSavedUrl", "");

Line Deleted : user_pref("Smartbar.keywordURLSelectedCTID", "CT3307181");

Line Deleted : user_pref("browser.search.defaultenginename", "Conduit Search");

Line Deleted : user_pref("browser.search.defaultthis.engineName", "appmarket- Customized Web Search");

Line Deleted : user_pref("browser.search.selectedEngine", "Conduit Search");

Line Deleted : user_pref("iminent.enabledAds", "false");

Line Deleted : user_pref("plugin.state.npconduitfirefoxplugin", 2);

Line Deleted : user_pref("smartbar.addressBarOwnerCTID", "CT3307181");

Line Deleted : user_pref("smartbar.conduitHomepageList", "hxxp://search.conduit.com/?ctid=CT3300236&CUI=UN65307577720504304&UM=2&SearchSource=13,hxxp://search.conduit.com/?ctid=CT3300236&octid=CT3300236&SearchSource[...]

Line Deleted : user_pref("smartbar.conduitSearchAddressUrlList", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3300236&SearchSource=2&CUI=UN65307577720504304&UM=2&q=,hxxp://search.conduit.com/ResultsExt.aspx?cti[...]

Line Deleted : user_pref("smartbar.defaultSearchOwnerCTID", "CT3307181");

Line Deleted : user_pref("smartbar.homePageOwnerCTID", "CT3307181");

Line Deleted : user_pref("smartbar.machineId", "YZXY1JAKW3IGJ81ZDXHWGHPKGHRVCBNNWIHSPZPIRQAPCGTXQ5UPDX/CE3R6YGS5JPPAW41WZESAVA3IUE2K+A");

Line Deleted : user_pref("smartbar.originalHomepage", "hxxp://search.conduit.com/?ctid=CT3300236&CUI=UN65307577720504304&UM=2&SearchSource=13");

Line Deleted : user_pref("valueApps.CT3307181./9B+7E+x305.storedInFile", true);

Line Deleted : user_pref("valueApps.CT3307181./9B+7E,x305.storedInFile", true);

Line Deleted : user_pref("valueApps.CT3307181./9B+7E-x305.storedInFile", true);

Line Deleted : user_pref("valueApps.CT3307181./9B+7E.:2z527", "247E4035422A363879453A7C36412C742E20213128335449563E4A4C2E58583D263F2E324247");

Line Deleted : user_pref("valueApps.CT3307181./9B+7E.:2z527.storedInFile", true);

Line Deleted : user_pref("valueApps.CT3307181./9B+7E.x305.storedInFile", true);

Line Deleted : user_pref("valueApps.CT3307181./9B+7E/x305.storedInFile", true);

Line Deleted : user_pref("valueApps.CT3307181./9B+7E06CG5EL8:", "6E6D686C726E73737177");

Line Deleted : user_pref("valueApps.CT3307181./9B+7E06CG5EL8:.storedInFile", false);

Line Deleted : user_pref("valueApps.CT3307181./9B+7E06CG5EL;8I:K", "247E2D2F226A74736E7278747979777D242F4B49474F42357D5D5C3D");

Line Deleted : user_pref("valueApps.CT3307181./9B+7E06CG5EL;8I:K.storedInFile", false);

Line Deleted : user_pref("valueApps.CT3307181./9B+7E0x305.storedInFile", true);

Line Deleted : user_pref("valueApps.CT3307181./9B+7E1x305.storedInFile", true);

Line Deleted : user_pref("valueApps.CT3307181./9B+7E2x305.storedInFile", true);

Line Deleted : user_pref("valueApps.CT3307181./9B+7E31;CJ7FK;KG#8QKEF)TIL.storedInFile", true);

Line Deleted : user_pref("valueApps.CT3307181./9B+7E31;CJ7FK;KG#NCEP@MC+VKN.storedInFile", true);

Line Deleted : user_pref("valueApps.CT3307181./9B+7E31;CJ8FED;;K?%PEH.storedInFile", true);

Line Deleted : user_pref("valueApps.CT3307181./9B+7E31;CJ=2:HGF==MAOQCNDT-XMP", "247E61393F236B2574767771792B222D6F4250454E337B354A3F475554534A4A5A4E5C5E505B51613A655A5D4A414C595D64503958536371705740596071786568716F[...]

Line Deleted : user_pref("valueApps.CT3307181./9B+7E31;CJ=2:HGF==MAOQCNDT-XMP.storedInFile", false);

Line Deleted : user_pref("valueApps.CT3307181./9B+7E31;CJC<=FBJ#NCF.storedInFile", true);

Line Deleted : user_pref("valueApps.CT3307181./9B+7E3x305.storedInFile", true);

Line Deleted : user_pref("valueApps.CT3307181./9B+7E4x305.storedInFile", true);

Line Deleted : user_pref("valueApps.CT3307181./9B+7E5x305.storedInFile", true);

Line Deleted : user_pref("valueApps.CT3307181./9B+7E6x305.storedInFile", true);

Line Deleted : user_pref("valueApps.CT3307181./9B+7E7x305.storedInFile", true);

Line Deleted : user_pref("valueApps.CT3307181./9B+7E8x305.storedInFile", true);

Line Deleted : user_pref("valueApps.CT3307181./9B+7E9x305.storedInFile", true);

Line Deleted : user_pref("valueApps.CT3307181./9B+7E:x305.storedInFile", true);

Line Deleted : user_pref("valueApps.CT3307181./9B+7E;x305.storedInFile", true);

Line Deleted : user_pref("valueApps.CT3307181./9B+7E<x305.storedInFile", true);

Line Deleted : user_pref("valueApps.CT3307181./9B+7E=x305.storedInFile", true);

Line Deleted : user_pref("valueApps.CT3307181./9B+7E>x305.storedInFile", true);

Line Deleted : user_pref("valueApps.CT3307181./9B+7E?x305.storedInFile", true);

Line Deleted : user_pref("valueApps.CT3307181./9B+7E@x305.storedInFile", true);

Line Deleted : user_pref("valueApps.CT3307181./9B+7EAx305.storedInFile", true);

Line Deleted : user_pref("valueApps.CT3307181./9B+7EBE3G=;D9N9=D", "372C2D326975762E3A3C7B3A39434A494841434B265146492965504656496571734D334B57");

Line Deleted : user_pref("valueApps.CT3307181./9B+7EBE3G=;D9N9=D.storedInFile", false);

Line Deleted : user_pref("valueApps.CT3307181./9B+7EBx305.storedInFile", true);

Line Deleted : user_pref("valueApps.CT3307181./9B+7ECx305.storedInFile", true);

Line Deleted : user_pref("valueApps.CT3307181./9B+7EDx305.storedInFile", true);

Line Deleted : user_pref("valueApps.CT3307181./9B+7Etx305.storedInFile", true);

Line Deleted : user_pref("valueApps.CT3307181./9B-0?3G>D", "663E696C6D7144427A76447973207C7B4A7A2522247D7D2A565558225726262C2B5F2D31");

Line Deleted : user_pref("valueApps.CT3307181./9B-0?3G>D.storedInFile", false);

Line Deleted : user_pref("valueApps.CT3307181./9B-0?3G@6:5;", "");

Line Deleted : user_pref("valueApps.CT3307181./9B-0?3G@6:5;.storedInFile", false);

Line Deleted : user_pref("valueApps.CT3307181./9B-0?3GFA7EF", "2B2E2C3D");

Line Deleted : user_pref("valueApps.CT3307181./9B-0?3GFA7EF.storedInFile", false);

Line Deleted : user_pref("valueApps.CT3307181./9B-3=3ECCJA=F>", "247E333D2C452F4135276F292A212C393D44307832332A354448584C3A23282E2E3132333435363B466068576C5E6857705A6C60606B6668563F73796F697861");

Line Deleted : user_pref("valueApps.CT3307181./9B-3=3ECCJA=F>.storedInFile", false);

Line Deleted : user_pref("valueApps.CT3307181./9B/>01=9A6K6<IM;KRIE@PDAWM", "6A696B7273747576");

Line Deleted : user_pref("valueApps.CT3307181./9B/>01=9A6K6<IM;KRIE@PDAWM.storedInFile", false);

Line Deleted : user_pref("valueApps.CT3307181./9B3=>@44I48?", "372C2D3269757633423633414847203E3D474E4D4C45474F2A554A4D2D5858585E4B554E366352564F");

Line Deleted : user_pref("valueApps.CT3307181./9B3=>@44I48?.storedInFile", false);

Line Deleted : user_pref("valueApps.CT3307181./9B5BA==9CJAG", "693E6A706C4275727A4646464A767C494B21204C23");

Line Deleted : user_pref("valueApps.CT3307181./9B5BA==9CJAG.storedInFile", false);

Line Deleted : user_pref("valueApps.CT3307181./9B6B11G4C56B>F;P;ANR@P", "6E6D686C726E73737074707A7B");

Line Deleted : user_pref("valueApps.CT3307181./9B6B11G4C56B>F;P;ANR@P.storedInFile", false);

Line Deleted : user_pref("valueApps.CT3307181./9B90E@.3C;7B=?OFB>>RHIQS", "393F352F3E");

Line Deleted : user_pref("valueApps.CT3307181./9B90E@.3C;7B=?OFB>>RHIQS.storedInFile", false);

Line Deleted : user_pref("valueApps.CT3307181./9B9643G3/9E", "6A");

Line Deleted : user_pref("valueApps.CT3307181./9B9643G3/9E.storedInFile", false);

Line Deleted : user_pref("valueApps.CT3307181./9B;45>:BI9I7IE", "2B2E2C3D");

Line Deleted : user_pref("valueApps.CT3307181./9B;45>:BI9I7IE.storedInFile", false);

Line Deleted : user_pref("valueApps.CT3307181./9B<:222H64<", "393F352F3E");

Line Deleted : user_pref("valueApps.CT3307181./9B<:222H64<.storedInFile", false);

Line Deleted : user_pref("valueApps.CT3307181./9B<:222H64<L8DAJ", "6D70706F7673737977752A7A7A72787A757D7C");

Line Deleted : user_pref("valueApps.CT3307181./9B<:222H64<L8DAJ.storedInFile", false);

Line Deleted : user_pref("valueApps.CT3307181./9B=+03EH8H8J?:", "4443");

Line Deleted : user_pref("valueApps.CT3307181./9B=+03EH8H8J?:.storedInFile", false);

Line Deleted : user_pref("valueApps.CT3307181./9B?+E2A52D8", "372C2D326975762E3A3C7B3A39434A494841434B2651464929655046566470727951555E5E52");

Line Deleted : user_pref("valueApps.CT3307181./9B?+E2A52D8.storedInFile", false);

Line Deleted : user_pref("valueApps.CT3307181./9B?B0D:8AJ62<H", "6D");

Line Deleted : user_pref("valueApps.CT3307181./9B?B0D:8AJ62<H.storedInFile", false);

Line Deleted : user_pref("valueApps.CT3307181./9BA@0<0BI6A7GN:6@L?", "6C");

Line Deleted : user_pref("valueApps.CT3307181./9BA@0<0BI6A7GN:6@L?.storedInFile", false);

Line Deleted : user_pref("valueApps.CT3307181.PG_ENABLE", "74727565");

Line Deleted : user_pref("valueApps.CT3307181.PG_ENABLE.storedInFile", false);

Line Deleted : user_pref("valueApps.CT3307181.SF_JUST_INSTALLED", "46414C5345");

Line Deleted : user_pref("valueApps.CT3307181.SF_JUST_INSTALLED.storedInFile", false);

Line Deleted : user_pref("valueApps.CT3307181.SF_STATUS", "454E41424C4544");

Line Deleted : user_pref("valueApps.CT3307181.SF_STATUS.storedInFile", false);

Line Deleted : user_pref("valueApps.CT3307181.SF_USER_ID", "6369645F3231323230313332303534333836333438333931");

Line Deleted : user_pref("valueApps.CT3307181.SF_USER_ID.storedInFile", false);

Line Deleted : user_pref("valueApps.CT3307181._key_cl_active", "33343034316135332D646136382D346361312D393165652D376261306563353463303636");

Line Deleted : user_pref("valueApps.CT3307181._key_cl_active.storedInFile", false);

Line Deleted : user_pref("valueApps.CT3307181._key_edilia__uID", "64306266386532372D323830622D343338342D383230372D656538616463323338326361");

Line Deleted : user_pref("valueApps.CT3307181._key_edilia__uID.storedInFile", false);

Line Deleted : user_pref("valueApps.CT3307181.cb_experience_000", "34");

Line Deleted : user_pref("valueApps.CT3307181.cb_experience_000.storedInFile", false);

Line Deleted : user_pref("valueApps.CT3307181.cb_firstuse0100", "31");

Line Deleted : user_pref("valueApps.CT3307181.cb_firstuse0100.storedInFile", false);

Line Deleted : user_pref("valueApps.CT3307181.cb_user_id_000", "43423938353032303433333434365F313338363832343631333539345F46697265666F78");

Line Deleted : user_pref("valueApps.CT3307181.cb_user_id_000.storedInFile", false);

Line Deleted : user_pref("valueApps.CT3307181.cbfirsttime", "4D6F6E2044656320303220323031332032303A35343A353120474D542D3035303020284561737465726E205374616E646172642054696D6529");

Line Deleted : user_pref("valueApps.CT3307181.cbfirsttime.storedInFile", false);

Line Deleted : user_pref("valueApps.CT3307181.impression_session_counter", "33");

Line Deleted : user_pref("valueApps.CT3307181.impression_session_counter.storedInFile", false);

Line Deleted : user_pref("valueApps.CT3307181.impression_session_id", "2266343735643865652D646231642D343633642D613562652D64636330323365616465326122");

Line Deleted : user_pref("valueApps.CT3307181.impression_session_id.storedInFile", false);

Line Deleted : user_pref("valueApps.CT3307181.impression_session_last_active", "31333932343238363231353636");

Line Deleted : user_pref("valueApps.CT3307181.impression_session_last_active.storedInFile", false);

Line Deleted : user_pref("valueApps.CT3307181.mam_gk_appStateReportTime", "34363336363636333235393336");

Line Deleted : user_pref("valueApps.CT3307181.mam_gk_appStateReportTime.storedInFile", false);

Line Deleted : user_pref("valueApps.CT3307181.mam_gk_appState_Clarity_Active", "6F6E");

Line Deleted : user_pref("valueApps.CT3307181.mam_gk_appState_Clarity_Active.storedInFile", false);

Line Deleted : user_pref("valueApps.CT3307181.mam_gk_appState_CouponBuddy", "6F6E");

Line Deleted : user_pref("valueApps.CT3307181.mam_gk_appState_CouponBuddy.storedInFile", false);

Line Deleted : user_pref("valueApps.CT3307181.mam_gk_appState_Discover", "6F6E");

Line Deleted : user_pref("valueApps.CT3307181.mam_gk_appState_Discover.storedInFile", false);

Line Deleted : user_pref("valueApps.CT3307181.mam_gk_appState_Easytobook", "6F6E");

Line Deleted : user_pref("valueApps.CT3307181.mam_gk_appState_Easytobook.storedInFile", false);

Line Deleted : user_pref("valueApps.CT3307181.mam_gk_appState_Easytobook_targeted", "6F6E");

Line Deleted : user_pref("valueApps.CT3307181.mam_gk_appState_Easytobook_targeted.storedInFile", false);

Line Deleted : user_pref("valueApps.CT3307181.mam_gk_appState_Find-a-Pro", "6F6E");

Line Deleted : user_pref("valueApps.CT3307181.mam_gk_appState_Find-a-Pro.storedInFile", false);

Line Deleted : user_pref("valueApps.CT3307181.mam_gk_appState_JobsMiner", "6F6E");

Line Deleted : user_pref("valueApps.CT3307181.mam_gk_appState_JobsMiner.storedInFile", false);

Line Deleted : user_pref("valueApps.CT3307181.mam_gk_appState_PriceGong", "6F6E");

Line Deleted : user_pref("valueApps.CT3307181.mam_gk_appState_PriceGong.storedInFile", false);

Line Deleted : user_pref("valueApps.CT3307181.mam_gk_appState_WindowShopper", "6F6E");

Line Deleted : user_pref("valueApps.CT3307181.mam_gk_appState_WindowShopper.storedInFile", false);

Line Deleted : user_pref("valueApps.CT3307181.mam_gk_appsConfig.storedInFile", true);

Line Deleted : user_pref("valueApps.CT3307181.mam_gk_appsDefaultEnabled", "6E756C6C");

Line Deleted : user_pref("valueApps.CT3307181.mam_gk_appsDefaultEnabled.storedInFile", false);

Line Deleted : user_pref("valueApps.CT3307181.mam_gk_calledSetupService", "31");

Line Deleted : user_pref("valueApps.CT3307181.mam_gk_calledSetupService.storedInFile", false);

Line Deleted : user_pref("valueApps.CT3307181.mam_gk_currentBadgeValue", "31");

Line Deleted : user_pref("valueApps.CT3307181.mam_gk_currentBadgeValue.storedInFile", false);

Line Deleted : user_pref("valueApps.CT3307181.mam_gk_currentVersion", "312E31332E302E3137");

Line Deleted : user_pref("valueApps.CT3307181.mam_gk_currentVersion.storedInFile", false);

Line Deleted : user_pref("valueApps.CT3307181.mam_gk_existingUsersRecoveryDone", "31");

Line Deleted : user_pref("valueApps.CT3307181.mam_gk_existingUsersRecoveryDone.storedInFile", false);

Line Deleted : user_pref("valueApps.CT3307181.mam_gk_first_time", "31");

Line Deleted : user_pref("valueApps.CT3307181.mam_gk_first_time.storedInFile", false);

Line Deleted : user_pref("valueApps.CT3307181.mam_gk_globalKeysMigratedToLocalStorage", "31");

Line Deleted : user_pref("valueApps.CT3307181.mam_gk_globalKeysMigratedToLocalStorage.storedInFile", false);

Line Deleted : user_pref("valueApps.CT3307181.mam_gk_lastLoginTime", "34363336363636333330393931");

Line Deleted : user_pref("valueApps.CT3307181.mam_gk_lastLoginTime.storedInFile", false);

Line Deleted : user_pref("valueApps.CT3307181.mam_gk_localization.storedInFile", true);

Line Deleted : user_pref("valueApps.CT3307181.mam_gk_mamEnabled", "74727565");

Line Deleted : user_pref("valueApps.CT3307181.mam_gk_mamEnabled.storedInFile", false);

Line Deleted : user_pref("valueApps.CT3307181.mam_gk_migrated_from_ls", "31");

Line Deleted : user_pref("valueApps.CT3307181.mam_gk_migrated_from_ls.storedInFile", false);

Line Deleted : user_pref("valueApps.CT3307181.mam_gk_newApps", "5B5D");

Line Deleted : user_pref("valueApps.CT3307181.mam_gk_newApps.storedInFile", false);

Line Deleted : user_pref("valueApps.CT3307181.mam_gk_new_welcome_experience", "31");

Line Deleted : user_pref("valueApps.CT3307181.mam_gk_new_welcome_experience.storedInFile", false);

Line Deleted : user_pref("valueApps.CT3307181.mam_gk_settings1.11.5.1.storedInFile", true);

Line Deleted : user_pref("valueApps.CT3307181.mam_gk_settings1.12.0.5.storedInFile", true);

Line Deleted : user_pref("valueApps.CT3307181.mam_gk_settings1.13.0.17.storedInFile", true);

Line Deleted : user_pref("valueApps.CT3307181.mam_gk_showWelcomeGadget", "66616C7365");

Line Deleted : user_pref("valueApps.CT3307181.mam_gk_showWelcomeGadget.storedInFile", false);

Line Deleted : user_pref("valueApps.CT3307181.mam_gk_stamp", "313034335F30");

Line Deleted : user_pref("valueApps.CT3307181.mam_gk_stamp.storedInFile", false);

Line Deleted : user_pref("valueApps.CT3307181.mam_gk_userBornDate", "4E2F41");

Line Deleted : user_pref("valueApps.CT3307181.mam_gk_userBornDate.storedInFile", false);

Line Deleted : user_pref("valueApps.CT3307181.mam_gk_userId", "37656363396532352D646239382D346263392D396538622D313935356338616337346539");

Line Deleted : user_pref("valueApps.CT3307181.mam_gk_userId.storedInFile", false);

Line Deleted : user_pref("valueApps.CT3307181.mam_gk_user_approval_interacted", "31");

Line Deleted : user_pref("valueApps.CT3307181.mam_gk_user_approval_interacted.storedInFile", false);

Line Deleted : user_pref("valueApps.CT3307181.mam_gk_welcomeDialogMode", "31");

Line Deleted : user_pref("valueApps.CT3307181.mam_gk_welcomeDialogMode.storedInFile", false);

Line Deleted : user_pref("valueApps.CT3307181.rematchGround-country-code", "22555322");

Line Deleted : user_pref("valueApps.CT3307181.rematchGround-country-code.storedInFile", false);

Line Deleted : user_pref("valueApps.CT3307181.rematchGround.upstairs", "7B22687474703A2F2F66617374636F6E74656E742E636F6E647569742E636F6D2F646F776E6C6F61645F6F66666572732E68746D6C3F637469643D4354333330373138317E62313[...]

Line Deleted : user_pref("valueApps.CT3307181.rematchGround.upstairs.storedInFile", false);

Line Deleted : user_pref("valueApps.CT3307181.rematchagent-is-test-user", "66616C7365");

Line Deleted : user_pref("valueApps.CT3307181.rematchagent-is-test-user.storedInFile", false);

Line Deleted : user_pref("valueApps.CT3307181.rematchagent-matkot-user-id", "22313338393936353136373436303634323334353622");

Line Deleted : user_pref("valueApps.CT3307181.rematchagent-matkot-user-id.storedInFile", false);

Line Deleted : user_pref("valueApps.CT3307181.rematchagent-periodic-reports", "7B2270696E675F30223A5B313339363136323337303930362C31343430303030305D7D");

Line Deleted : user_pref("valueApps.CT3307181.rematchagent-periodic-reports.storedInFile", false);

Line Deleted : user_pref("valueApps.CT3307181.rematchagent-user-id", "2237636365653735612D333539382D343764632D383033312D34633161353933373030333922");

Line Deleted : user_pref("valueApps.CT3307181.rematchagent-user-id.storedInFile", false);

Line Deleted : user_pref("valueApps.CT3307181.url_history0001", "73746172743A3A3A636C69636B68616E646C65723A3A3A313338363832343631333831382C2C2C73746172743A3A3A636C69636B68616E646C65723A3A3A31333836383234363135393537[...]

Line Deleted : user_pref("valueApps.CT3307181.url_history0001.storedInFile", true);

Line Deleted : user_pref("valueApps.ct3323245./9B+7E+x305.storedInFile", true);

Line Deleted : user_pref("valueApps.ct3323245./9B+7E,x305.storedInFile", true);

Line Deleted : user_pref("valueApps.ct3323245./9B+7E-x305.storedInFile", true);

Line Deleted : user_pref("valueApps.ct3323245./9B+7E.:2z527.storedInFile", true);

Line Deleted : user_pref("valueApps.ct3323245./9B+7E.x305.storedInFile", true);

Line Deleted : user_pref("valueApps.ct3323245./9B+7E/x305.storedInFile", true);

Line Deleted : user_pref("valueApps.ct3323245./9B+7E06CG5EL8:", "6E6D686C726E73737176");

Line Deleted : user_pref("valueApps.ct3323245./9B+7E06CG5EL8:.storedInFile", false);

Line Deleted : user_pref("valueApps.ct3323245./9B+7E06CG5EL;8I:K", "247E2D2F226A74736E7278747979777C242F4B49474F42357D5D5C3D");

Line Deleted : user_pref("valueApps.ct3323245./9B+7E06CG5EL;8I:K.storedInFile", false);

Line Deleted : user_pref("valueApps.ct3323245./9B+7E0x305.storedInFile", true);

Line Deleted : user_pref("valueApps.ct3323245./9B+7E1x305.storedInFile", true);

Line Deleted : user_pref("valueApps.ct3323245./9B+7E2x305.storedInFile", true);

Line Deleted : user_pref("valueApps.ct3323245./9B+7E3x305.storedInFile", true);

Line Deleted : user_pref("valueApps.ct3323245./9B+7E4x305.storedInFile", true);

Line Deleted : user_pref("valueApps.ct3323245./9B+7E5x305.storedInFile", true);

Line Deleted : user_pref("valueApps.ct3323245./9B+7E6x305.storedInFile", true);

Line Deleted : user_pref("valueApps.ct3323245./9B+7E7x305.storedInFile", true);

Line Deleted : user_pref("valueApps.ct3323245./9B+7E8x305.storedInFile", true);

Line Deleted : user_pref("valueApps.ct3323245./9B+7E9x305.storedInFile", true);

Line Deleted : user_pref("valueApps.ct3323245./9B+7E:x305.storedInFile", true);

Line Deleted : user_pref("valueApps.ct3323245./9B+7E;x305.storedInFile", true);

Line Deleted : user_pref("valueApps.ct3323245./9B+7E<x305.storedInFile", true);

Line Deleted : user_pref("valueApps.ct3323245./9B+7E=x305.storedInFile", true);

Line Deleted : user_pref("valueApps.ct3323245./9B+7E>x305.storedInFile", true);

Line Deleted : user_pref("valueApps.ct3323245./9B+7E?x305.storedInFile", true);

Line Deleted : user_pref("valueApps.ct3323245./9B+7E@x305.storedInFile", true);

Line Deleted : user_pref("valueApps.ct3323245./9B+7EAx305.storedInFile", true);

Line Deleted : user_pref("valueApps.ct3323245./9B+7EBE3G=;D9N9=D", "372C2D326975762E3A3C7B3A39434A494841434B265146492965504656496571734D334B57");

Line Deleted : user_pref("valueApps.ct3323245./9B+7EBE3G=;D9N9=D.storedInFile", false);

Line Deleted : user_pref("valueApps.ct3323245./9B+7EBx305.storedInFile", true);

Line Deleted : user_pref("valueApps.ct3323245./9B+7ECx305.storedInFile", true);

Line Deleted : user_pref("valueApps.ct3323245./9B+7EDx305.storedInFile", true);

Line Deleted : user_pref("valueApps.ct3323245./9B+7Etx305.storedInFile", true);

Line Deleted : user_pref("valueApps.ct3323245./9B-0?3G>D", "6D686E3F404170717A7678764920764D767C25217D7C522A2355552B26562C585D5F2B2D");

Line Deleted : user_pref("valueApps.ct3323245./9B-0?3G>D.storedInFile", false);

Line Deleted : user_pref("valueApps.ct3323245./9B-0?3G@6:5;", "");

Line Deleted : user_pref("valueApps.ct3323245./9B-0?3G@6:5;.storedInFile", false);

Line Deleted : user_pref("valueApps.ct3323245./9B-0?3GFA7EF", "2B2E2C3D");

Line Deleted : user_pref("valueApps.ct3323245./9B-0?3GFA7EF.storedInFile", false);

Line Deleted : user_pref("valueApps.ct3323245./9B-3=3ECCJA=F>", "247E333D2C452F4135276F297B7E7D21202F26313E4249357D37382F3A494D5D513F283338435D6554695B65546D57695D5D686365533C70766C66755E");

Line Deleted : user_pref("valueApps.ct3323245./9B-3=3ECCJA=F>.storedInFile", false);

Line Deleted : user_pref("valueApps.ct3323245./9B/>01=9A6K6<IM;KRIE@PDAWM", "6A696B7273747576");

Line Deleted : user_pref("valueApps.ct3323245./9B/>01=9A6K6<IM;KRIE@PDAWM.storedInFile", false);

Line Deleted : user_pref("valueApps.ct3323245./9B3=>@44I48?", "372C2D3269757633423633414847203E3D474E4D4C45474F2A554A4D2D5858585E4B554E366352564F");

Line Deleted : user_pref("valueApps.ct3323245./9B3=>@44I48?.storedInFile", false);

Line Deleted : user_pref("valueApps.ct3323245./9B5BA==9CJAG", "3B673D6F3F70406D7A457049787A77757D2079207C");

Line Deleted : user_pref("valueApps.ct3323245./9B5BA==9CJAG.storedInFile", false);

Line Deleted : user_pref("valueApps.ct3323245./9B6B11G4C56B>F;P;ANR@P", "6E6D686C726E73737072757275");

Line Deleted : user_pref("valueApps.ct3323245./9B6B11G4C56B>F;P;ANR@P.storedInFile", false);

Line Deleted : user_pref("valueApps.ct3323245./9B90E@.3C;7B=?OFB>>RHIQS", "393F352F3E");

Line Deleted : user_pref("valueApps.ct3323245./9B90E@.3C;7B=?OFB>>RHIQS.storedInFile", false);

Line Deleted : user_pref("valueApps.ct3323245./9B9643G3/9E", "6A");

Line Deleted : user_pref("valueApps.ct3323245./9B9643G3/9E.storedInFile", false);

Line Deleted : user_pref("valueApps.ct3323245./9B;45>:BI9I7IE", "2B2E2C3D");

Line Deleted : user_pref("valueApps.ct3323245./9B;45>:BI9I7IE.storedInFile", false);

Line Deleted : user_pref("valueApps.ct3323245./9B<:222H64<", "393F352F3E");

Line Deleted : user_pref("valueApps.ct3323245./9B<:222H64<.storedInFile", false);

Line Deleted : user_pref("valueApps.ct3323245./9B<:222H64<L8DAJ", "6D70706E7674727974782A7A7572787C757C20");

Line Deleted : user_pref("valueApps.ct3323245./9B<:222H64<L8DAJ.storedInFile", false);

Line Deleted : user_pref("valueApps.ct3323245./9B=+03EH8H8J?:", "4443");

Line Deleted : user_pref("valueApps.ct3323245./9B=+03EH8H8J?:.storedInFile", false);

Line Deleted : user_pref("valueApps.ct3323245./9B?+E2A52D8", "372C2D326975762E3A3C7B3A39434A494841434B2651464929655046566470727951555E5E52");

Line Deleted : user_pref("valueApps.ct3323245./9B?+E2A52D8.storedInFile", false);

Line Deleted : user_pref("valueApps.ct3323245./9B?B0D:8AJ62<H", "6D");

Line Deleted : user_pref("valueApps.ct3323245./9B?B0D:8AJ62<H.storedInFile", false);

Line Deleted : user_pref("valueApps.ct3323245./9BA@0<0BI6A7GN:6@L?", "6C");

Line Deleted : user_pref("valueApps.ct3323245./9BA@0<0BI6A7GN:6@L?.storedInFile", false);

Line Deleted : user_pref("valueApps.ct3323245.PG_ENABLE", "74727565");

Line Deleted : user_pref("valueApps.ct3323245.PG_ENABLE.storedInFile", false);

Line Deleted : user_pref("valueApps.ct3323245.SF_JUST_INSTALLED", "46414C5345");

Line Deleted : user_pref("valueApps.ct3323245.SF_JUST_INSTALLED.storedInFile", false);

Line Deleted : user_pref("valueApps.ct3323245.SF_STATUS", "454E41424C4544");

Line Deleted : user_pref("valueApps.ct3323245.SF_STATUS.storedInFile", false);

Line Deleted : user_pref("valueApps.ct3323245.SF_USER_ID", "6369645F33303332303134323532353433373933373833");

Line Deleted : user_pref("valueApps.ct3323245.SF_USER_ID.storedInFile", false);

Line Deleted : user_pref("valueApps.ct3323245._key_cl_active", "37643964633530332D343665372D343830372D626636312D653565353336323732376262");

Line Deleted : user_pref("valueApps.ct3323245._key_cl_active.storedInFile", false);

Line Deleted : user_pref("valueApps.ct3323245.cbfirsttime", "53756E204D617220333020323031342030323A35323A353320474D542D3034303020284561737465726E205374616E646172642054696D6529");

Line Deleted : user_pref("valueApps.ct3323245.cbfirsttime.storedInFile", false);

Line Deleted : user_pref("valueApps.ct3323245.mam_gk_appStateReportTime", "31333936313632333431323438");

Line Deleted : user_pref("valueApps.ct3323245.mam_gk_appStateReportTime.storedInFile", false);

Line Deleted : user_pref("valueApps.ct3323245.mam_gk_appState_Clarity_Active", "6F6E");

Line Deleted : user_pref("valueApps.ct3323245.mam_gk_appState_Clarity_Active.storedInFile", false);

Line Deleted : user_pref("valueApps.ct3323245.mam_gk_appsConfig.storedInFile", true);

Line Deleted : user_pref("valueApps.ct3323245.mam_gk_appsDefaultEnabled", "74727565");

Line Deleted : user_pref("valueApps.ct3323245.mam_gk_appsDefaultEnabled.storedInFile", false);

Line Deleted : user_pref("valueApps.ct3323245.mam_gk_calledSetupService", "31");

Line Deleted : user_pref("valueApps.ct3323245.mam_gk_calledSetupService.storedInFile", false);

Line Deleted : user_pref("valueApps.ct3323245.mam_gk_currentVersion", "312E31332E302E3137");

Line Deleted : user_pref("valueApps.ct3323245.mam_gk_currentVersion.storedInFile", false);

Line Deleted : user_pref("valueApps.ct3323245.mam_gk_first_time", "31");

Line Deleted : user_pref("valueApps.ct3323245.mam_gk_first_time.storedInFile", false);

Line Deleted : user_pref("valueApps.ct3323245.mam_gk_lastInstallationSessionGuid", "7B65656466666537352D313762652D343735632D383263652D3461353038616535623534377D");

Line Deleted : user_pref("valueApps.ct3323245.mam_gk_lastInstallationSessionGuid.storedInFile", false);

Line Deleted : user_pref("valueApps.ct3323245.mam_gk_lastLoginTime", "31333936313632333432393231");

Line Deleted : user_pref("valueApps.ct3323245.mam_gk_lastLoginTime.storedInFile", false);

Line Deleted : user_pref("valueApps.ct3323245.mam_gk_localization.storedInFile", true);

Line Deleted : user_pref("valueApps.ct3323245.mam_gk_mamEnabled", "74727565");

Line Deleted : user_pref("valueApps.ct3323245.mam_gk_mamEnabled.storedInFile", false);

Line Deleted : user_pref("valueApps.ct3323245.mam_gk_settings1.13.0.17.storedInFile", true);

Line Deleted : user_pref("valueApps.ct3323245.mam_gk_showWelcomeGadget", "66616C7365");

Line Deleted : user_pref("valueApps.ct3323245.mam_gk_showWelcomeGadget.storedInFile", false);

Line Deleted : user_pref("valueApps.ct3323245.mam_gk_stamp", "313034335F30");

Line Deleted : user_pref("valueApps.ct3323245.mam_gk_stamp.storedInFile", false);

Line Deleted : user_pref("valueApps.ct3323245.mam_gk_userBornDate", "3230313430333330");

Line Deleted : user_pref("valueApps.ct3323245.mam_gk_userBornDate.storedInFile", false);

Line Deleted : user_pref("valueApps.ct3323245.mam_gk_userId", "37656363396532352D646239382D346263392D396538622D313935356338616337346539");

Line Deleted : user_pref("valueApps.ct3323245.mam_gk_userId.storedInFile", false);

Line Deleted : user_pref("valueApps.ct3323245.mam_gk_user_approval_interacted", "");

Line Deleted : user_pref("valueApps.ct3323245.mam_gk_user_approval_interacted.storedInFile", false);

Line Deleted : user_pref("valueApps.ct3323245.rematchGround.upstairs", "7B22687474703A2F2F66617374636F6E74656E742E636F6E647569742E636F6D2F646F776E6C6F61645F6F66666572732E68746D6C3F637469643D6374333332333234357E62313[...]

Line Deleted : user_pref("valueApps.ct3323245.rematchGround.upstairs.storedInFile", false);

Line Deleted : user_pref("valueApps.ct3323245.rematchagent-is-test-user", "66616C7365");

Line Deleted : user_pref("valueApps.ct3323245.rematchagent-is-test-user.storedInFile", false);

Line Deleted : user_pref("valueApps.ct3323245.rematchagent-matkot-user-id", "22313338393936353136373436303634323334353622");

Line Deleted : user_pref("valueApps.ct3323245.rematchagent-matkot-user-id.storedInFile", false);

Line Deleted : user_pref("valueApps.ct3323245.rematchagent-periodic-reports", "7B2270696E675F30223A5B313339363136323337303930362C31343430303030305D7D");

Line Deleted : user_pref("valueApps.ct3323245.rematchagent-periodic-reports.storedInFile", false);

-\\ Google Chrome v36.0.1985.143

[ File : C:\Users\Amy\AppData\Local\Google\Chrome\User Data\Default\preferences ]

Deleted [Homepage] : hxxp://search.conduit.com/?gd=&ctid=CT3326285&octid=EB_ORIGINAL_CTID&ISID=MA45B1311-13E2-448C-A758-89339C9A7B61&SearchSource=55&CUI=&UM=5&UP=SP39284524-52FF-4D6B-A549-EAC984F79BF6&SSPV=

Deleted [Extension] : bcjagnifjocnddgeknajocbkkhlgibem

Deleted [Extension] : booedmolknjekdopkepjjeckmjkdpfgl

Deleted [Extension] : dachbokeklmhlikpklnkmmealjdfanoh

Deleted [Extension] : flpcjncodpafbgdpnkljologafpionhb

Deleted [Extension] : iekjmlcgpmcjigljdiagaibfjfaideal

Deleted [Extension] : jbolfgndggfhhpbnkgnpjkfhinclbigj

*************************

AdwCleaner[R0].txt - [52056 octets] - [15/08/2014 22:25:54]

AdwCleaner[s0].txt - [52866 octets] - [15/08/2014 22:32:07]

########## EOF - C:\AdwCleaner\AdwCleaner[s0].txt - [52927 octets] ##########

egad1986 · August 21, 2014

ESETSmartInstaller@High as downloader log:

all ok

# product=EOS

# version=8

# OnlineScannerApp.exe=1.0.0.1

# OnlineScanner.ocx=1.0.0.7623

# api_version=3.0.2

# EOSSerial=b2f7a3061d2dc54b86024d445d9fdaf1

# engine=19700

# end=stopped

# remove_checked=false

# archives_checked=true

# unwanted_checked=true

# unsafe_checked=true

# antistealth_checked=true

# utc_time=2014-08-18 12:36:21

# local_time=2014-08-18 08:36:21 (-0500, Eastern Daylight Time)

# country="United States"

# lang=1033

# osver=6.2.9200 NT

# compatibility_mode_1=''

# compatibility_mode=5893 16776574 100 94 0 11823702 0 0

# scanned=61405

# found=20

# cleaned=0

# scan_time=75703

sh=97BCCD25561F44E9B13F05F6EEF083C9CE9BA529 ft=1 fh=641f1fb3d2e699c4 vn="Win32/Toolbar.Conduit.Y potentially unwanted application" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Conduit\Community Alerts\Alert.dll.vir"

sh=93510E07EBD463BE51052EC8114EC16C5423103E ft=0 fh=0000000000000000 vn="Win32/Conduit.SearchProtect.A potentially unwanted application" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Mozilla Firefox\nsprotector.js.vir"

sh=9896DAB927F232F334AAC794EE39E4741E8560AD ft=1 fh=20cdc242a13dadda vn="MSIL/AdvancedSystemProtector.D potentially unwanted application" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\RegClean Pro\systweakasp.exe.vir"

sh=1E3FF58866D59D4658FE8ED7DCA3E9B73F86BD83 ft=0 fh=0000000000000000 vn="a variant of Win32/Bundled.Toolbar.Ask.F potentially unsafe application" ac=I fn="C:\AdwCleaner\Quarantine\C\ProgramData\apn\APN-Stub\W3IV6-G\APNIC.7z.vir"

sh=D6356361CB5D33E62695230274A8C219D18884A5 ft=1 fh=758f4dd0748812c4 vn="a variant of Win32/Bundled.Toolbar.Ask.F potentially unsafe application" ac=I fn="C:\AdwCleaner\Quarantine\C\ProgramData\apn\APN-Stub\W3IV6-G\APNIC.dll.vir"

sh=3AEF532A0211CE7869F0EB51E940D9E0C7CAE321 ft=1 fh=c7560653d3ee2314 vn="a variant of Win32/Adware.Yontoo.B application" ac=I fn="C:\AdwCleaner\Quarantine\C\ProgramData\Tarma Installer\{361E80BE-388B-4270-BF54-A10C2B756504}\_Setupx.dll.vir"

sh=D86451022DDD8348105C1D52FBFD2ADB1E2DCC30 ft=1 fh=d3e706a6307522ba vn="Win32/Toolbar.Conduit.Y potentially unwanted application" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Amy\AppData\Local\Conduit\BackgroundContainer\BackgroundContainer.dll.vir"

sh=314F703F0F190BF70F0386509C10998D4E2BD10B ft=1 fh=2f9f46df1834d950 vn="Win32/Toolbar.Conduit.Y potentially unwanted application" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Amy\AppData\Local\Conduit\BackgroundContainer\TBUpdaterLogic_1.0.0.1.dll.vir"

sh=D3CBDD7C6ED2C9D81DA4FCF9AF57CDD5D3711ED3 ft=1 fh=86dbe26399c3d0fa vn="Win32/Toolbar.Conduit.Y potentially unwanted application" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Amy\AppData\Local\Conduit\BackgroundContainer\TBUpdaterLogic_1.0.0.2.dll.vir"

sh=D77E1AE2D98312618E6F295448444F5B569A055A ft=0 fh=0000000000000000 vn="a variant of Win32/Toolbar.Conduit.AH potentially unwanted application" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Amy\AppData\Local\CRE\dachbokeklmhlikpklnkmmealjdfanoh.crx.vir"

sh=76893D55C6CBF70A2FD0115B641BE01F72E86EAE ft=0 fh=0000000000000000 vn="a variant of Win32/Toolbar.Conduit.AH potentially unwanted application" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Amy\AppData\Local\CRE\iekjmlcgpmcjigljdiagaibfjfaideal.crx.vir"

sh=2B9A1340BEC2FE2694C333ACD77F0E12EF9550D1 ft=1 fh=fcbeb3ad261a92d1 vn="a variant of Win32/Conduit.SearchProtect.P potentially unwanted application" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Amy\AppData\Local\Google\Chrome\User Data\Default\Extensions\dachbokeklmhlikpklnkmmealjdfanoh\10.31.4.510_0\APISupport\APISupport.dll.vir"

sh=675526C1B3CB27C6635233B62EDB8ECEEBFE1556 ft=1 fh=8382eeac10eb278f vn="a variant of Win32/Toolbar.Conduit.AH potentially unwanted application" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Amy\AppData\Local\Google\Chrome\User Data\Default\Extensions\dachbokeklmhlikpklnkmmealjdfanoh\10.31.4.510_0\nativeMessaging\TBMessagingHost.exe.vir"

sh=C0114483C9E2C1271B0D594AB6A6BF1E4F383D63 ft=1 fh=e2607344a0894545 vn="a variant of Win32/Conduit.SearchProtect.N potentially unwanted application" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Amy\AppData\Local\Google\Chrome\User Data\Default\Extensions\dachbokeklmhlikpklnkmmealjdfanoh\10.31.4.510_0\plugins\ChromeApiPlugin.dll.vir"

sh=2B9A1340BEC2FE2694C333ACD77F0E12EF9550D1 ft=1 fh=fcbeb3ad261a92d1 vn="a variant of Win32/Conduit.SearchProtect.P potentially unwanted application" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Amy\AppData\Local\Google\Chrome\User Data\Default\Extensions\iekjmlcgpmcjigljdiagaibfjfaideal\10.31.4.510_0\APISupport\APISupport.dll.vir"

sh=675526C1B3CB27C6635233B62EDB8ECEEBFE1556 ft=1 fh=8382eeac10eb278f vn="a variant of Win32/Toolbar.Conduit.AH potentially unwanted application" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Amy\AppData\Local\Google\Chrome\User Data\Default\Extensions\iekjmlcgpmcjigljdiagaibfjfaideal\10.31.4.510_0\nativeMessaging\TBMessagingHost.exe.vir"

sh=C0114483C9E2C1271B0D594AB6A6BF1E4F383D63 ft=1 fh=e2607344a0894545 vn="a variant of Win32/Conduit.SearchProtect.N potentially unwanted application" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Amy\AppData\Local\Google\Chrome\User Data\Default\Extensions\iekjmlcgpmcjigljdiagaibfjfaideal\10.31.4.510_0\plugins\ChromeApiPlugin.dll.vir"

sh=E60FD5CB7D2CB265078625E7A72BDB71A5552E8A ft=1 fh=8483eb2d3942bac6 vn="a variant of Win32/Toolbar.Conduit.AH potentially unwanted application" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Amy\AppData\Local\NativeMessaging\CT3307181\1_0_0_2\TBMessagingHost.exe.vir"

sh=A011DFD8D93BBA7B75833C0F85FF6E1D25594B84 ft=1 fh=049679d5506e563e vn="a variant of Win32/Conduit.SearchProtect.N potentially unwanted application" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Amy\AppData\Roaming\Mozilla\Firefox\Profiles\fkjlsnsj.default\Extensions\{64d64833-9296-421b-a362-83cfbd6291b6}\Plugins\npConduitFirefoxPlugin.dll.vir"

sh=64AC7AAD1FF357D84BA287892B7E95099CC43F40 ft=1 fh=710ded7bacb8d5d1 vn="a variant of Win32/Conduit.SearchProtect.N potentially unwanted application" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Amy\AppData\Roaming\Mozilla\Firefox\Profiles\fkjlsnsj.default\Extensions\{8c58b088-1159-4ad9-a411-c7d3ae7edb28}\Plugins\npConduitFirefoxPlugin.dll.vir"

ESETSmartInstaller@High as downloader log:

all ok

# product=EOS

# version=8

# OnlineScannerApp.exe=1.0.0.1

# OnlineScanner.ocx=1.0.0.7623

# api_version=3.0.2

# EOSSerial=b2f7a3061d2dc54b86024d445d9fdaf1

# engine=19739

# end=finished

# remove_checked=false

# archives_checked=true

# unwanted_checked=true

# unsafe_checked=true

# antistealth_checked=true

# utc_time=2014-08-20 09:15:34

# local_time=2014-08-20 05:15:34 (-0500, Eastern Daylight Time)

# country="United States"

# lang=1033

# osver=6.2.9200 NT

# compatibility_mode_1=''

# compatibility_mode=5893 16776574 100 94 0 11984454 0 0

# scanned=561530

# found=170

# cleaned=0

# scan_time=31949